feat: allow access from production sparkle

2 files changed, 19 insertions, 14 deletions

diff --git a/etc/authzd/policy0.cedar b/etc/authzd/policy0.cedar
index a7a0ccb5..18a48476 100644
--- a/etc/authzd/policy0.cedar
+++ b/etc/authzd/policy0.cedar
@@ -22,19 +22,24 @@ when {
 permit(principal, action, resource)
 when {
   context has host && context has method && context has path && (
-    context.host == "sparkle.staging.runway.gitlab.net" && (
-      context.method == "GET" && (
-        context.path == "/" ||
-        context.path == "/callback" ||
-        context.path == "/dashboard/nav" ||
-        context.path == "/health" ||
-        context.path == "/signout" ||
-        context.path == "/sparkles" ||
-        context.path == "/callback"
-      )
-    ) || (
-      context.method == "POST" && (
-        context.path == "/sparkles/restore"
+    (
+      context.host == "sparkle.staging.runway.gitlab.net" ||
+      context.host == "sparkle.runway.gitlab.net"
+    ) && (
+      (
+        context.method == "GET" && (
+          context.path == "/" ||
+          context.path == "/callback" ||
+          context.path == "/dashboard/nav" ||
+          context.path == "/health" ||
+          context.path == "/signout" ||
+          context.path == "/sparkles" ||
+          context.path == "/callback"
+        )
+      ) || (
+        context.method == "POST" && (
+          context.path == "/sparkles/restore"
+        )
       )
     )
   )
diff --git a/tests/authorization/check_service_test.rs b/tests/authorization/check_service_test.rs
index f6546802..fc1ab75a 100644
--- a/tests/authorization/check_service_test.rs
+++ b/tests/authorization/check_service_test.rs
@@ -131,7 +131,7 @@ mod tests {
 
         let hosts = vec![
             "sparkle.staging.runway.gitlab.net",
-            // "sparkle.runway.gitlab.net",
+            "sparkle.runway.gitlab.net",
         ];
 
         let routes = vec![