fix(rebac): require canonical IMS group ids (^[1-9][0-9]{0,18}$)

Align with the mysticat-data-service CHECK tightened in adobe/mysticat-data-service#1125
review: zero-padded spellings of one IMS group must not be accepted as distinct
subjects, and ids stay within 19 digits.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Ravi Verma

packages/spacecat-shared-http-utils/src/auth/auth-info.js

@@ -119,7 +119,7 @@ export default class AuthInfo {
       } else if (Number.isInteger(group) && Number.isFinite(group) && group >= 0) {
         groupId = String(group);
       }
-      if (groupId && /^[0-9]{1,20}$/.test(groupId) && !seen.has(groupId)) {
+      if (groupId && /^[1-9][0-9]{0,18}$/.test(groupId) && !seen.has(groupId)) {
         seen.add(groupId);
         out.push(groupId);
         if (out.length >= 100) {

packages/spacecat-shared-http-utils/src/auth/readme.md

@@ -158,6 +158,6 @@ The FACS wrapper evaluates route capabilities from the union of:
 `facs_grps` is a string array of IMS group idents that have mappings for the
 current org/product. `AuthInfo#getFacsGroups()` sanitizes that claim by accepting
 strings or finite non-negative integers, coercing integers to strings, keeping
-only decimal idents matching `^[0-9]{1,20}$`, deduplicating, and capping the
+only decimal idents matching `^[1-9][0-9]{0,18}$`, deduplicating, and capping the
 result at 100 entries. Group subjects are grant-only and additive; there are no
 deny records.

packages/spacecat-shared-http-utils/test/auth/auth-info.test.js

@@ -252,12 +252,13 @@ describe('AuthInfo', () => {
           -1,
           1.2,
           Infinity,
-          '123456789012345678901',
+          '12345678901234567890',
+          '0',
           '',
           null,
         ],
       });
-      expect(authInfo.getFacsGroups()).to.deep.equal(['945801205', '123', '00123']);
+      expect(authInfo.getFacsGroups()).to.deep.equal(['945801205', '123']);
     });
 
     it('caps sanitized groups at 100', () => {