From c849e253f9e6df0ba1dd369dddd9a08fba783cb6 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Mon, 12 Oct 2026 04:25:20 +0400
Subject: [PATCH] Drop the bingo photo migration from minio-init

All photos are in datacenterbingo-photos and both apps use it, so stop
mirroring from asxpio-invoices/bingo/ and take away the bingo user's
read access there.

Assisted-by: Claude:opus-5
---
 SECRETS.md              |  3 +--
 init/minio-bootstrap.sh | 13 ++++---------
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/SECRETS.md b/SECRETS.md
index 4bb5f81..cc885f0 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -64,8 +64,7 @@ can connect.
 These are read-only:
 - Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
   the `asxpio` DB, and `default_transaction_read_only`.
-- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
-  (and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
+- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket.
   asxpio's user has read-write on that bucket for the admin's uploads.
 
 The same values go on the **datacenterbingo repo**.
diff --git a/init/minio-bootstrap.sh b/init/minio-bootstrap.sh
index c4bc738..7062542 100644
--- a/init/minio-bootstrap.sh
+++ b/init/minio-bootstrap.sh
@@ -81,20 +81,15 @@ ensure_bucket "datacenterbingo-photos"
 write_policy  "datacenterbingo-photos-rw" "datacenterbingo-photos"
 write_ro_prefix_policy "datacenterbingo-photos-ro" "datacenterbingo-photos" ""
 
-# Migration from asxpio-invoices/bingo/: copy whatever is missing. Remove
-# this (and the old bingo-ro policy below) once the old prefix is deleted.
-# (The mc image has no grep; test the listing with plain sh.)
-if [ -n "$(mc ls "local/asxpio-invoices/bingo/" 2>/dev/null)" ]; then
-  mc mirror --quiet "local/asxpio-invoices/bingo" "local/datacenterbingo-photos/bingo"
-fi
-
 ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw datacenterbingo-photos-rw"
 
 if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
-  write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
-  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro asxpio-invoices-bingo-ro"
+  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro"
 else
   echo "minio-init: BINGO_S3_* unset, skipping bingo user"
 fi
 
+# Leftover from before the photos had their own bucket.
+mc admin policy remove local "asxpio-invoices-bingo-ro" >/dev/null 2>&1 || true
+
 echo "minio-init: done"