fix(util): use filepath matching for allowlist

util/util.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"html"
 	"net/url"
+	"path/filepath"
 	"strings"
 
 	"github.com/gin-gonic/gin"
@@ -101,15 +102,7 @@ func CheckAllowlist(r *api.Repo, allowlist []string) bool {
 	}
 
 	for _, repo := range allowlist {
-		// allow all repos in org
-		if strings.Contains(repo, "/*") {
-			if strings.HasPrefix(repo, r.GetOrg()) {
-				return true
-			}
-		}
-
-		// allow specific repo within org
-		if repo == r.GetFullName() {
+		if match, err := filepath.Match(repo, r.GetFullName()); err == nil && match {
 			return true
 		}
 	}

util/util_test.go

@@ -4,6 +4,8 @@ package util
 
 import (
 	"testing"
+
+	api "github.com/go-vela/server/api/types"
 )
 
 func TestUtil_Sanitize(t *testing.T) {
@@ -81,3 +83,51 @@ func TestUtil_Sanitize(t *testing.T) {
 		})
 	}
 }
+
+func TestUtil_CheckAllowlist(t *testing.T) {
+	tests := []struct {
+		allowlist []string
+		repoName  string
+		want      bool
+	}{
+		{
+			allowlist: []string{"*"},
+			repoName:  "octocat/hello-world",
+			want:      true,
+		},
+		{
+			allowlist: []string{"octocat/*"},
+			repoName:  "octocat/hello-world",
+			want:      true,
+		},
+		{
+			allowlist: []string{"octocat/hello-world"},
+			repoName:  "octocat/hello-world",
+			want:      true,
+		},
+		{
+			allowlist: []string{"octocat/*"},
+			repoName:  "octocat-test/hello-world",
+			want:      false,
+		},
+		{
+			allowlist: []string{"octocat/hello-world"},
+			repoName:  "octocat/other-repo",
+			want:      false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.repoName, func(t *testing.T) {
+			repo := new(api.Repo)
+
+			repo.SetFullName(test.repoName)
+
+			got := CheckAllowlist(repo, test.allowlist)
+
+			if got != test.want {
+				t.Errorf("CheckAllowlist is %v, want %v", got, test.want)
+			}
+		})
+	}
+}