feat: allow access from production sparkle

1 files changed, 18 insertions, 13 deletions

diff --git a/etc/authzd/policy0.cedar b/etc/authzd/policy0.cedar
index a7a0ccb5..18a48476 100644
--- a/etc/authzd/policy0.cedar
+++ b/etc/authzd/policy0.cedar
@@ -22,19 +22,24 @@ when {
 permit(principal, action, resource)
 when {
   context has host && context has method && context has path && (
-    context.host == "sparkle.staging.runway.gitlab.net" && (
-      context.method == "GET" && (
-        context.path == "/" ||
-        context.path == "/callback" ||
-        context.path == "/dashboard/nav" ||
-        context.path == "/health" ||
-        context.path == "/signout" ||
-        context.path == "/sparkles" ||
-        context.path == "/callback"
-      )
-    ) || (
-      context.method == "POST" && (
-        context.path == "/sparkles/restore"
+    (
+      context.host == "sparkle.staging.runway.gitlab.net" ||
+      context.host == "sparkle.runway.gitlab.net"
+    ) && (
+      (
+        context.method == "GET" && (
+          context.path == "/" ||
+          context.path == "/callback" ||
+          context.path == "/dashboard/nav" ||
+          context.path == "/health" ||
+          context.path == "/signout" ||
+          context.path == "/sparkles" ||
+          context.path == "/callback"
+        )
+      ) || (
+        context.method == "POST" && (
+          context.path == "/sparkles/restore"
+        )
       )
     )
   )