From 61e93b64c87e0a0e6178759699fd403c34c23b20 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Mon, 12 Oct 2026 04:07:41 +0400
Subject: [PATCH] Give the bingo photos their own bucket

The datacenter bingo photos sat under bingo/ in asxpio-invoices, next to
the invoice PDFs, guarded only by a prefix policy. Move them to a
datacenterbingo-photos bucket: asxpio's user gets read-write for the
admin's uploads, the bingo user read-only on the whole bucket.

Existing objects are mirrored over with their keys unchanged, so the
database rows stay valid. Both users keep their old access until the
apps are switched and the old prefix is removed.

Assisted-by: Claude:opus-5
---
 SECRETS.md              |  4 +++-
 init/minio-bootstrap.sh | 24 +++++++++++++++++++-----
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/SECRETS.md b/SECRETS.md
index ea2728f..4bb5f81 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -64,7 +64,9 @@ can connect.
 These are read-only:
 - Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
   the `asxpio` DB, and `default_transaction_read_only`.
-- The MinIO user may only `GetObject` under `asxpio-invoices/bingo/`.
+- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
+  (and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
+  asxpio's user has read-write on that bucket for the admin's uploads.
 
 The same values go on the **datacenterbingo repo**.
 
diff --git a/init/minio-bootstrap.sh b/init/minio-bootstrap.sh
index 58dd605..2715b32 100644
--- a/init/minio-bootstrap.sh
+++ b/init/minio-bootstrap.sh
@@ -58,26 +58,40 @@ EOF
     || mc admin policy update local "${name}" "/tmp/${name}.json"
 }
 
+# $3: one or more policy names, space-separated.
 ensure_user() {
   access="$1"
   secret="$2"
-  policy="$3"
+  policies="$3"
   if mc admin user info local "${access}" >/dev/null 2>&1; then
     # Rotate secret to match desired state.
     mc admin user remove local "${access}" >/dev/null
   fi
   mc admin user add local "${access}" "${secret}"
-  mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
+  # shellcheck disable=SC2086 # word-split the policy list on purpose
+  mc admin policy attach local ${policies} --user "${access}" 2>/dev/null || true
 }
 
 ensure_bucket "asxpio-invoices"
 write_policy  "asxpio-invoices-rw" "asxpio-invoices"
-ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
 
-# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
+# Datacenter bingo photos: uploaded and resized by asxpio's admin, served by
+# datacenterbingo. Keys keep their bingo/ prefix, so DB rows stay valid.
+ensure_bucket "datacenterbingo-photos"
+write_policy  "datacenterbingo-photos-rw" "datacenterbingo-photos"
+write_ro_prefix_policy "datacenterbingo-photos-ro" "datacenterbingo-photos" ""
+
+# Migration from asxpio-invoices/bingo/: copy whatever is missing. Remove
+# this (and the old bingo-ro policy below) once the old prefix is deleted.
+if mc ls "local/asxpio-invoices/bingo/" 2>/dev/null | grep -q .; then
+  mc mirror --quiet "local/asxpio-invoices/bingo" "local/datacenterbingo-photos/bingo"
+fi
+
+ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw datacenterbingo-photos-rw"
+
 if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
   write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
-  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
+  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro asxpio-invoices-bingo-ro"
 else
   echo "minio-init: BINGO_S3_* unset, skipping bingo user"
 fi