should be non-breaking now ;)

internal/service/access_controls_rules.go

@@ -182,32 +182,23 @@ type AuthEnabledRule struct {
 }
 
 func matchPathRule(paths, path string) (bool, error) {
+	paths = strings.TrimSpace(paths)
+
+	if paths == "/" {
+		return true, nil
+	}
+
+	if strings.HasPrefix(paths, "/") && strings.HasSuffix(paths, "/") {
+		regex, err := regexp.Compile(paths[1 : len(paths)-1])
+		if err != nil {
+			return false, fmt.Errorf("invalid path regex %q: %w", paths, err)
+		}
+
+		return regex.MatchString(path), nil
+	}
+
 	for _, configuredPath := range strings.Split(paths, ",") {
-		configuredPath = strings.TrimSpace(configuredPath)
-
-		if configuredPath == "/" {
-			return true, nil
-		}
-
-		if configuredPath == "" {
-			continue
-		}
-
-		// only apply regex if the path starts and ends with a slash, e.g. /regex/
-		if strings.HasPrefix(configuredPath, "/") && strings.HasSuffix(configuredPath, "/") {
-			regex, err := regexp.Compile(configuredPath[1 : len(configuredPath)-1])
-			if err != nil {
-				return false, fmt.Errorf("invalid path regex %q: %w", configuredPath, err)
-			}
-
-			if regex.MatchString(path) {
-				return true, nil
-			}
-
-			continue
-		}
-
-		if strings.HasPrefix(path, configuredPath) {
+		if strings.HasPrefix(path, strings.TrimSpace(configuredPath)) {
 			return true, nil
 		}
 	}

internal/service/access_controls_rules_test.go

@@ -536,6 +536,16 @@ func TestAuthEnabledRule(t *testing.T) {
 			},
 			expected: EffectAllow,
 		},
+		{
+			name: "allows when path matches a comma-separated allow path",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Path: model.AppPath{Allow: "/bar,/foo/bar,/hello"},
+				},
+				Path: "/foo/bar/baz",
+			},
+			expected: EffectAllow,
+		},
 		{
 			name: "allows when path matches allow regex",
 			ctx: &ACLContext{
@@ -546,6 +556,16 @@ func TestAuthEnabledRule(t *testing.T) {
 			},
 			expected: EffectAllow,
 		},
+		{
+			name: "denies when comma-separated allow paths do not match",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Path: model.AppPath{Allow: "/bar,/foo/bar,/hello"},
+				},
+				Path: "/private",
+			},
+			expected: EffectDeny,
+		},
 		{
 			name: "denies when path does not match allow path",
 			ctx: &ACLContext{