[taran-p]

1. A policy with Resource: "*" when parsed and then turned back into a string would come back as "**" because both the prefix and resource were labelled "*" and were appended to each other
2. A Resource prefixed with * was valid, even if it had text after it i.e. Resource: "*-testbucket" is invalid (no prefix) but is treated as valid. ValidateStrict now rejects it (still works on existing policies for backward compatability.

Summary by CodeRabbit

• Behavior Changes
  • Resource patterns containing only * now serialize consistently as *, including policies that use the legacy form **.
  • Strict resource validation now accepts only ARNs or exactly *; prefixed wildcard patterns are rejected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9bb44456-55b3-449b-aec6-70e724dbab16

📥 Commits

Reviewing files that changed from the base of the PR and between 6679633 and 0fc1705.

📒 Files selected for processing: 4

• policy/resource.go
• policy/resource_corpus_test.go
• policy/resource_test.go
• policy/resourceset.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Resource string output now uses "*" for the all-types resource with pattern "*". Strict validation rejects other star-prefixed resources. Tests cover parsing, serialization, validation, and matching of wildcard forms.

Changes: Wildcard Resource Handling

Layer / File(s)	Summary
Canonicalize and validate wildcard resources policy/resource.go, policy/resourceset.go, policy/resource_test.go, policy/resource_corpus_test.go	Resource.String() emits "*" for an all-types resource with pattern "*". Strict validation rejects other star-prefixed resources. Tests cover wildcard parsing, serialization, validation, and matching. Corpus comments describe "**" as a form retained from older releases that now serializes to "*".

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: harshavardhana

Merge Risk: ⚪ Minimal · up to 0fc17

The change fixes the "**" serialization of a wildcard resource and rejects prefix-less star resources only under strict validation. Existing policies still parse and match as before. No actionable merge risk remains.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary changes to wildcard resource parsing and validation.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the stars at night,
"*" shines clear and small,
"**" returns to "*",
Wild forms meet their tests,
The rabbit hops along.}

_{Comment @coderabbitai help to get the list of available commands.}