refactor(controlplane): remove regex support in authz middleware

Replace the regex fallback in the authz policy lookup with exact endpoint
matching. The only rule relying on it ("/controlplane.v1.OrgMetricsService/.*")
is replaced by explicit entries for the Totals, TopWorkflowsByRunsCount and
DailyRunsCount endpoints.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: af6e1c77-67e9-454c-8a56-5220930f328c

Author: jiparis

app/controlplane/pkg/authz/authz.go

@@ -385,7 +385,9 @@ var ServerOperationsMap = map[string]*OperationPolicy{
 	"/controlplane.v1.IntegrationsService/Attach":          {Policies: []*Policy{PolicyAttachedIntegrationAttach}},
 	"/controlplane.v1.IntegrationsService/Detach":          {Policies: []*Policy{PolicyAttachedIntegrationDetach}},
 	// Metrics
-	"/controlplane.v1.OrgMetricsService/.*": {Policies: []*Policy{PolicyOrgMetricsRead}},
+	"/controlplane.v1.OrgMetricsService/Totals":                  {Policies: []*Policy{PolicyOrgMetricsRead}},
+	"/controlplane.v1.OrgMetricsService/TopWorkflowsByRunsCount": {Policies: []*Policy{PolicyOrgMetricsRead}},
+	"/controlplane.v1.OrgMetricsService/DailyRunsCount":          {Policies: []*Policy{PolicyOrgMetricsRead}},
 	// Robot Account
 	"/controlplane.v1.RobotAccountService/List":   {Policies: []*Policy{PolicyRobotAccountList}},
 	"/controlplane.v1.RobotAccountService/Create": {Policies: []*Policy{PolicyRobotAccountCreate}},

app/controlplane/pkg/authz/middleware/middleware.go

@@ -18,7 +18,6 @@ package middleware
 import (
 	"context"
 	"errors"
-	"regexp"
 
 	errorsAPI "github.com/go-kratos/kratos/v2/errors"
 
@@ -103,25 +102,13 @@ func checkPolicies(ctx context.Context, subject, apiOperation string, enforcer E
 	return nil
 }
 
-// policiesLookup returns the policies required for a given API operation
-// it performs a two run lookup
-// 1 - It checks if there is an entry in the map
-// 2 - if there is not, it runs a regex match in each key in case one of those keys contains a regex
+// policiesLookup returns the policies required for a given API operation.
+// It looks up the operation directly in the ServerOperationsMap.
 func policiesLookup(apiOperation string) ([]*authz.Policy, error) {
-	// Direct match
 	entry, found := authz.ServerOperationsMap[apiOperation]
 	if found {
 		return entry.Policies, nil
 	}
 
-	// second pass trying to match a regex
-	// i.e "/controlplane.v1.OrgMetricsService/.*" -> "/controlplane.v1.OrgMetricsService/Totals"
-	for k, entry := range authz.ServerOperationsMap {
-		found, _ := regexp.MatchString(k, apiOperation)
-		if found {
-			return entry.Policies, nil
-		}
-	}
-
 	return nil, errors.New("operation not allowed")
 }

app/controlplane/pkg/authz/middleware/middleware_test.go

@@ -193,20 +193,25 @@ func TestPoliciesLookup(t *testing.T) {
 			operation: "/controlplane.v1.WorkflowContractService/List",
 		},
 		{
-			name:      "operation found with regexp",
-			operation: "/controlplane.v1.OrgMetricsService/List",
+			name:      "org metrics operation found",
+			operation: "/controlplane.v1.OrgMetricsService/Totals",
 		},
 		{
-			name:      "operation found with regexp 2",
+			name:      "org metrics operation found 2",
+			operation: "/controlplane.v1.OrgMetricsService/DailyRunsCount",
+		},
+		{
+			name:      "non-existing org metrics operation, error not found",
 			operation: "/controlplane.v1.OrgMetricsService/boom",
+			wantErr:   true,
 		},
 		{
-			name:      "operation found with regexp, error wrong prefix",
+			name:      "operation error wrong prefix",
 			operation: "/boom/controlplane.v1.OrgMetricsService",
 			wantErr:   true,
 		},
 		{
-			name:      "operation found with regexp, error not found",
+			name:      "operation error not found",
 			operation: "/controlplane.v1.OrgMetricsService",
 			wantErr:   true,
 		},