From 47c6b2fcfd7b1ba21f899edec78517a38808cd06 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Fri, 2 Oct 2026 10:07:21 +1000 Subject: [PATCH] refactor: move aws body scope parsing to ingress --- spinifex/domains/acm/awsapi/authz.go | 2 +- spinifex/domains/ecr/awsapi/authz.go | 2 +- spinifex/gateway/bedrock/authz.go | 2 +- spinifex/gateway/ecs/authz.go | 4 ++-- spinifex/gateway/eks/authz.go | 2 +- spinifex/{gateway => ingress/aws}/bodyscope/bodyscope.go | 4 ++-- spinifex/{gateway => ingress/aws}/bodyscope/bodyscope_test.go | 2 +- .../aws}/bodyscope/differential_fuzz_test.go | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) rename spinifex/{gateway => ingress/aws}/bodyscope/bodyscope.go (97%) rename spinifex/{gateway => ingress/aws}/bodyscope/bodyscope_test.go (98%) rename spinifex/{gateway => ingress/aws}/bodyscope/differential_fuzz_test.go (98%) diff --git a/spinifex/domains/acm/awsapi/authz.go b/spinifex/domains/acm/awsapi/authz.go index d30e96c46..2e37e37b4 100644 --- a/spinifex/domains/acm/awsapi/authz.go +++ b/spinifex/domains/acm/awsapi/authz.go @@ -8,7 +8,7 @@ import ( "github.com/mulgadc/spinifex/spinifex/foundation/aws/arn" "github.com/mulgadc/spinifex/spinifex/foundation/aws/errors" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" ) // The resource a policy check evaluates against when the request names nothing diff --git a/spinifex/domains/ecr/awsapi/authz.go b/spinifex/domains/ecr/awsapi/authz.go index 6402fe6c2..66edfbbd7 100644 --- a/spinifex/domains/ecr/awsapi/authz.go +++ b/spinifex/domains/ecr/awsapi/authz.go @@ -10,7 +10,7 @@ import ( "github.com/mulgadc/spinifex/spinifex/foundation/aws/arn" "github.com/mulgadc/spinifex/spinifex/foundation/aws/errors" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" "github.com/mulgadc/spinifex/spinifex/ingress/aws/query" ) diff --git a/spinifex/gateway/bedrock/authz.go b/spinifex/gateway/bedrock/authz.go index 167d36e51..aa2114b02 100644 --- a/spinifex/gateway/bedrock/authz.go +++ b/spinifex/gateway/bedrock/authz.go @@ -8,7 +8,7 @@ import ( "slices" "github.com/mulgadc/spinifex/spinifex/foundation/aws/errors" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" ) // The resource a policy check evaluates against when the request names nothing diff --git a/spinifex/gateway/ecs/authz.go b/spinifex/gateway/ecs/authz.go index f509704aa..99e9b4072 100644 --- a/spinifex/gateway/ecs/authz.go +++ b/spinifex/gateway/ecs/authz.go @@ -6,10 +6,10 @@ import ( "maps" "slices" - "github.com/mulgadc/spinifex/spinifex/ingress/aws/query" "github.com/mulgadc/spinifex/spinifex/foundation/aws/errors" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" handlers_ecs "github.com/mulgadc/spinifex/spinifex/handlers/ecs" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/query" ) // The resource a policy check evaluates against when the request names nothing diff --git a/spinifex/gateway/eks/authz.go b/spinifex/gateway/eks/authz.go index daafd5bfc..00103ed59 100644 --- a/spinifex/gateway/eks/authz.go +++ b/spinifex/gateway/eks/authz.go @@ -12,8 +12,8 @@ import ( "github.com/aws/aws-sdk-go/service/eks" "github.com/mulgadc/spinifex/spinifex/foundation/aws/arn" "github.com/mulgadc/spinifex/spinifex/foundation/aws/errors" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" handlers_eks "github.com/mulgadc/spinifex/spinifex/handlers/eks" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" ) // The resource a policy check evaluates against when the request names nothing diff --git a/spinifex/gateway/bodyscope/bodyscope.go b/spinifex/ingress/aws/bodyscope/bodyscope.go similarity index 97% rename from spinifex/gateway/bodyscope/bodyscope.go rename to spinifex/ingress/aws/bodyscope/bodyscope.go index 1f52a1c1d..40b611fab 100644 --- a/spinifex/gateway/bodyscope/bodyscope.go +++ b/spinifex/ingress/aws/bodyscope/bodyscope.go @@ -1,6 +1,6 @@ -// Package bodyscope reads the handful of identifier fields a policy scope +// Package bodyscope reads the identifier fields an AWS ingress policy-scope // resolver needs out of a JSON request body, without deserialising the typed -// input the handler will build from the same bytes. +// input an action adapter will build from the same bytes. // // Two properties matter here. A type mismatch on an unrelated field cannot // poison the parse and silently widen the request to "*", because every field diff --git a/spinifex/gateway/bodyscope/bodyscope_test.go b/spinifex/ingress/aws/bodyscope/bodyscope_test.go similarity index 98% rename from spinifex/gateway/bodyscope/bodyscope_test.go rename to spinifex/ingress/aws/bodyscope/bodyscope_test.go index 75fd43c60..037f6aef2 100644 --- a/spinifex/gateway/bodyscope/bodyscope_test.go +++ b/spinifex/ingress/aws/bodyscope/bodyscope_test.go @@ -3,7 +3,7 @@ package bodyscope_test import ( "testing" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) diff --git a/spinifex/gateway/bodyscope/differential_fuzz_test.go b/spinifex/ingress/aws/bodyscope/differential_fuzz_test.go similarity index 98% rename from spinifex/gateway/bodyscope/differential_fuzz_test.go rename to spinifex/ingress/aws/bodyscope/differential_fuzz_test.go index b5a3f0f96..54a95901b 100644 --- a/spinifex/gateway/bodyscope/differential_fuzz_test.go +++ b/spinifex/ingress/aws/bodyscope/differential_fuzz_test.go @@ -7,7 +7,7 @@ import ( "strings" "testing" - "github.com/mulgadc/spinifex/spinifex/gateway/bodyscope" + "github.com/mulgadc/spinifex/spinifex/ingress/aws/bodyscope" ) // A lookup is one identifier an authz resolver reads through bodyscope, paired