authorize,proxy: remove support for paths within the from parameter

authorize/evaluator/opa/policy/authz.rego

@@ -74,7 +74,6 @@ allowed_route_source(input_url_obj, policy) {
 	object.get(policy, "source", "") != ""
 	source_url_obj := parse_url(policy.source)
 	input_url_obj.host == source_url_obj.host
-	startswith(input_url_obj.path, source_url_obj.path)
 }
 
 allowed_route_prefix(input_url_obj, policy) {

authorize/evaluator/opa/policy/authz_test.rego

@@ -54,9 +54,6 @@ test_allowed_route_source {
 	allowed_route("http://example.com", {"source": "http://example.com"})
 	allowed_route("http://example.com", {"source": "https://example.com"})
 	not allowed_route("http://example.org", {"source": "example.com"})
-	allowed_route("http://example.com/some/path", {"source": "https://example.com/some/path"})
-	allowed_route("http://example.com/some/path", {"source": "https://example.com/some/path?qs"})
-	not allowed_route("http://example.com/some/other/path", {"source": "https://example.com/some/path"})
 }
 
 test_allowed_route_prefix {

proxy/proxy.go

@@ -330,10 +330,13 @@ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 //
 // Routes can be filtered by the `source`, `prefix`, `path` and `regex` fields in the policy config.
 func routeMatcherFuncFromPolicy(policy config.Policy) mux.MatcherFunc {
+	if !(policy.Source.Path == "" || policy.Source.Path == "/") {
+		log.Warn().Str("source", policy.Source.String()).Msg("proxy: dropping path from %v, should be set using path key")
+	}
+
 	// match by source
 	sourceMatches := func(r *http.Request) bool {
-		return r.Host == policy.Source.Host &&
-			strings.HasPrefix(r.URL.Path, policy.Source.Path)
+		return r.Host == policy.Source.Host
 	}
 
 	// match by prefix

proxy/proxy_test.go

@@ -292,14 +292,6 @@ func TestRouteMatcherFuncFromPolicy(t *testing.T) {
 			"https://www.google.com", false,
 			"should not match when host is different from source host"},
 
-		// path prefix in source
-		{"https://www.example.com/admin", "", "", "",
-			"https://www.example.com/admin/someaction", true,
-			"should match when path begins with source path"},
-		{"https://www.example.com/admin", "", "", "",
-			"https://www.example.com/notadmin", false,
-			"should not match when path does not begin with source path"},
-
 		// path prefix
 		{"https://www.example.com", "/admin", "", "",
 			"https://www.example.com/admin/someaction", true,