From adb938628224761e6574900917ca3ee31cba798b Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Mon, 1 Dec 2025 17:10:10 -0800
Subject: [PATCH] policy: remove http perm/uid/gid

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 policy/types.go      |  4 ----
 policy/utils_test.go | 36 ++++++++++++++++++++++++++++++++++++
 policy/validate.go   | 21 ---------------------
 3 files changed, 36 insertions(+), 25 deletions(-)
 create mode 100644 policy/utils_test.go

diff --git a/policy/types.go b/policy/types.go
index 019860648..55cb60b7f 100644
--- a/policy/types.go
+++ b/policy/types.go
@@ -23,13 +23,9 @@ type HTTP struct {
 	Host    string              `json:"host,omitempty"`
 	Path    string              `json:"path,omitempty"`
 	Query   map[string][]string `json:"query,omitempty"`
-	Perm    int                 `json:"perm,omitempty"`
-	UID     int                 `json:"uid,omitempty"`
-	GID     int                 `json:"gid,omitempty"`
 	HasAuth bool                `json:"hasAuth,omitempty"`
 
 	Checksum string `json:"checksum,omitempty"`
-	// Filename string `json:"filename,omitempty"`
 
 	Signature         *PGPSignature      `json:"signature,omitempty"`
 	AttestationBundle *AttestationBundle `json:"attestationBundle,omitempty"`
diff --git a/policy/utils_test.go b/policy/utils_test.go
new file mode 100644
index 000000000..a0e706e8e
--- /dev/null
+++ b/policy/utils_test.go
@@ -0,0 +1,36 @@
+package policy
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTrimKey(t *testing.T) {
+	tests := []struct {
+		in  string
+		out string
+	}{
+		// no separators
+		{"git", "git"},
+		{"foo", "foo"},
+
+		// one separator → stays as-is
+		{"git.tag", "git.tag"},
+		{"git[tag", "git[tag"},
+
+		// multiple separators → cut before second one
+		{"git.tag.author", "git.tag"},
+		{"git.tag.author.email", "git.tag"},
+		{"git.tag[0][1]", "git.tag"},
+		{"git.tag[0]", "git.tag"},
+
+		{"a.b.c", "a.b"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.in, func(t *testing.T) {
+			require.Equal(t, tt.out, trimKey(tt.in))
+		})
+	}
+}
diff --git a/policy/validate.go b/policy/validate.go
index 137501deb..feecbf5ad 100644
--- a/policy/validate.go
+++ b/policy/validate.go
@@ -88,27 +88,6 @@ func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicy
 			Path:   u.Path,
 			Query:  u.Query(),
 		}
-		if v, ok := src.Source.Attrs[pb.AttrHTTPPerm]; ok {
-			p, err := strconv.ParseInt(v, 10, 32)
-			if err != nil {
-				return nil, nil, errors.Wrapf(err, "failed to parse http source permission")
-			}
-			inp.HTTP.Perm = int(p)
-		}
-		if v, ok := src.Source.Attrs[pb.AttrHTTPUID]; ok {
-			uid, err := strconv.ParseInt(v, 10, 32)
-			if err != nil {
-				return nil, nil, errors.Wrapf(err, "failed to parse http source uid")
-			}
-			inp.HTTP.UID = int(uid)
-		}
-		if v, ok := src.Source.Attrs[pb.AttrHTTPGID]; ok {
-			gid, err := strconv.ParseInt(v, 10, 32)
-			if err != nil {
-				return nil, nil, errors.Wrapf(err, "failed to parse http source gid")
-			}
-			inp.HTTP.GID = int(gid)
-		}
 		if _, ok := src.Source.Attrs[pb.AttrHTTPAuthHeaderSecret]; ok {
 			inp.HTTP.HasAuth = true
 		}