fix: validate explicit migrations and preserve large business ids

internal/utils/routepath/routepath.go

@@ -5,10 +5,13 @@ import "strings"
 // Normalize removes only a complete configured router prefix. Paths
 // such as /administrator must not be shortened when the prefix is /admin.
 func Normalize(path, routerPrefix string) string {
-	prefix := strings.TrimSuffix(strings.TrimSpace(routerPrefix), "/")
-	if prefix == "" || prefix == "/" {
+	prefix := strings.Trim(strings.TrimSpace(routerPrefix), "/")
+	if prefix == "" {
 		return path
 	}
+	// Gin also accepts a relative group name such as "api". Normalize it
+	// the same way before comparing a request path with Casbin policies.
+	prefix = "/" + prefix
 	if path == prefix {
 		return "/"
 	}

internal/utils/routepath/routepath_test.go

@@ -11,6 +11,8 @@ func TestNormalize(t *testing.T) {
 	}{
 		{name: "empty prefix", path: "/api/login", prefix: "", want: "/api/login"},
 		{name: "configured prefix", path: "/admin/api/login", prefix: "/admin", want: "/api/login"},
+		{name: "relative prefix accepted by Gin", path: "/api/sw/promote/list", prefix: "api", want: "/sw/promote/list"},
+		{name: "relative prefix boundary", path: "/apiary/list", prefix: "api", want: "/apiary/list"},
 		{name: "trailing slash prefix", path: "/admin/api/login", prefix: "/admin/", want: "/api/login"},
 		{name: "prefix root", path: "/admin", prefix: "/admin", want: "/"},
 		{name: "prefix boundary", path: "/administrator/api/login", prefix: "/admin", want: "/administrator/api/login"},