feat: route rules in one routes.rego table; Bearer per RFC 7235 in JWTAuth and the policy

[aradng]

Two policy changes, version 0.5.7.

Route rules in one table

routes.rego ended in two statements per route. It now ends in three tables, one route per line:

prefix_rules := {
	"/api/notify/admin": [["ADMIN"]],
}

route_rules := {
	["GET", "/api/notify/healthcheck"]: "public",
	["PUT", "/api/iam/admin/organizations/{org_id}"]: [["ADMIN"]],
}

route_patterns := {
	["GET", "/api/notify/healthcheck"]: `^/api/notify/healthcheck$`,
	["PUT", "/api/iam/admin/organizations/{org_id}"]: `^/api/iam/admin/organizations/(?P<org_id>[^/]+)$`,
}

• route_rules and prefix_rules are the service's; the hook reads each entry back and keeps it as written, multi-line rules included. One loop splits old statements and table entries by bracket depth, ignoring brackets inside strings.
• Every mistake fails without writing, naming the line or text: other rego (x := 1, x := {}), a comment, text between a key and its colon, a key with extra elements or not a list, an unclosed table. Trailing spaces on a table's opener or closer are fine.
• route_patterns is regenerated every run and never edited: Starlette's own compile_path regex, so OPA matches what FastAPI routes.
• Empty tables are left out: an empty object fails opa check --strict. The preamble reads them through data.policy.*, which compiles either way.
• A file in the old one-statement-per-route format is rewritten and keeps its rules.
• OPA silently keeps the last of two equal keys in a table; the hook still fails the commit on a route or prefix listed twice.

Bearer per RFC 7235, in the app and the policy

The scheme is case-insensitive and any spaces before the token are ignored (RFC 7235), now in both places:

• JWTAuth._transform_bearer used a case-sensitive "Bearer " prefix; it now uses FastAPI's get_authorization_scheme_param, as monitoring.py already does.
• the policy's bearer matches the scheme in any case and trims spaces before the token.

One table of headers (Bearer, bearer, BEARER, extra spaces before or after, Bearerx…, a tab, Basic) is tested against both.

Verification

• pytest: 281 passed, OPA decision tests included. The new parser, bearer and migration tests each fail against a mutant of the code they cover (string-blind bracket counting, escapes, comments, trailing spaces, x := {}, junk before the colon, extra key elements, case-sensitive or untrimmed bearer, old-format migration).
• prek run --all-files clean; the rendered file is opa fmt-stable and passes opa check --strict and --v0-compatible with all tables, without prefix rules, and with no routes.
• Migrated the filled routes.rego of notify, assistant, iam, persona, ai and twitter: first run rewrites, second run is a no-op, every rule kept (23/168/49/29/42/21), opa check --strict passes, notify's decisions unchanged.

Services pick it up by bumping fastloom and the hook rev together.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QA7Vjn4bbjxRsvyz8DNHPQ