fix(controller): honor ReferenceGrantTo.Name in cross-namespace validation

Per Gateway API spec, `ReferenceGrantTo.Name` is optional. When set, the grant
must apply only to that named target; when unset, it acts as a wildcard for
the group/kind. The controller was ignoring the field entirely, so a
name-scoped grant like

    to:
      - group: aigateway.envoyproxy.io
        kind: AIServiceBackend
        name: safe-backend

silently allowed AIGatewayRoutes to reference *any* AIServiceBackend of that
group/kind in the target namespace — not what the grant author meant. In
practice this widens cross-namespace permission surface beyond what the
policy declared.

Thread `targetName` through validateReference → isReferenceGrantValid →
matchesTo so the name comparison happens at the leaf. Wildcard behaviour
(name unset) is preserved.

Regression test added covering all three cases: name-unset wildcard,
name-matches (allowed), name-mismatch (denied).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: pokabookinflab

internal/controller/referencegrant.go

@@ -95,7 +95,7 @@ func (v *referenceGrantValidator) validateReference(
 	// Check if any ReferenceGrant allows this cross-namespace reference.
 	for i := range referenceGrants.Items {
 		grant := &referenceGrants.Items[i]
-		if v.isReferenceGrantValid(grant, routeNamespace, targetGroup, targetKind) {
+		if v.isReferenceGrantValid(grant, routeNamespace, targetGroup, targetKind, gwapiv1b1.ObjectName(targetName)) {
 			return nil
 		}
 	}
@@ -109,12 +109,13 @@ func (v *referenceGrantValidator) validateReference(
 }
 
 // isReferenceGrantValid checks if a ReferenceGrant allows an AIGatewayRoute to reference the
-// target resource identified by targetGroup/targetKind.
+// target resource identified by targetGroup/targetKind/targetName.
 func (v *referenceGrantValidator) isReferenceGrantValid(
 	grant *gwapiv1b1.ReferenceGrant,
 	fromNamespace string,
 	targetGroup gwapiv1b1.Group,
 	targetKind gwapiv1b1.Kind,
+	targetName gwapiv1b1.ObjectName,
 ) bool {
 	// Check if the grant allows references from the route's namespace.
 	fromAllowed := false
@@ -131,7 +132,7 @@ func (v *referenceGrantValidator) isReferenceGrantValid(
 
 	// Check if the grant allows references to the target resource.
 	for _, to := range grant.Spec.To {
-		if v.matchesTo(&to, targetGroup, targetKind) {
+		if v.matchesTo(&to, targetGroup, targetKind, targetName) {
 			return true
 		}
 	}
@@ -159,22 +160,31 @@ func (v *referenceGrantValidator) matchesFrom(from *gwapiv1b1.ReferenceGrantFrom
 	return true
 }
 
-// matchesTo checks if a ReferenceGrantTo matches the target resource identified by targetGroup/targetKind.
-func (v *referenceGrantValidator) matchesTo(to *gwapiv1b1.ReferenceGrantTo, targetGroup gwapiv1b1.Group, targetKind gwapiv1b1.Kind) bool {
-	// Check group
+// matchesTo checks if a ReferenceGrantTo matches the target resource identified by
+// targetGroup/targetKind/targetName.
+//
+// Per the Gateway API spec, ReferenceGrantTo.Name is optional. When set, the grant is scoped
+// to exactly that named resource; when unset, it acts as a wildcard covering every resource of
+// the group/kind. Previously we ignored the name field entirely, which quietly promoted any
+// name-scoped grant into a wildcard and let an AIGatewayRoute reference *any* backend of the
+// same kind in the target namespace — not what the grant author meant.
+//
+// https://gateway-api.sigs.k8s.io/api-types/referencegrant/
+func (v *referenceGrantValidator) matchesTo(
+	to *gwapiv1b1.ReferenceGrantTo,
+	targetGroup gwapiv1b1.Group,
+	targetKind gwapiv1b1.Kind,
+	targetName gwapiv1b1.ObjectName,
+) bool {
 	if to.Group != targetGroup {
 		return false
 	}
-
-	// Check kind
 	if to.Kind != targetKind {
 		return false
 	}
-
-	// If a specific name is specified, we would need to check it here,
-	// but ReferenceGrant typically doesn't specify individual resource names
-	// (that's handled by the Name field which is optional in the spec)
-	// For now, we only check group and kind as per Gateway API spec
-
+	// Name is optional in ReferenceGrantTo. Unset == wildcard; set == exact match required.
+	if to.Name != nil && *to.Name != targetName {
+		return false
+	}
 	return true
 }

internal/controller/referencegrant_test.go

@@ -442,6 +442,36 @@ func TestReferenceGrantValidator_MatchesFrom_WrongNamespace(t *testing.T) {
 	require.False(t, result, "should return false for wrong namespace")
 }
 
+// TestReferenceGrantValidator_MatchesTo_Name locks in the name-filter behaviour: when
+// ReferenceGrantTo.Name is set, the grant must apply only to the named resource; when unset,
+// it acts as a wildcard for the group/kind.
+func TestReferenceGrantValidator_MatchesTo_Name(t *testing.T) {
+	scheme := runtime.NewScheme()
+	_ = gwapiv1b1.Install(scheme)
+	_ = aigv1a1.AddToScheme(scheme)
+
+	fakeClient := fake.NewClientBuilder().WithScheme(scheme).Build()
+	validator := newReferenceGrantValidator(fakeClient)
+
+	t.Run("name unset → wildcard, matches any name", func(t *testing.T) {
+		to := &gwapiv1b1.ReferenceGrantTo{Group: aiServiceBackendGroup, Kind: aiServiceBackendKind}
+		require.True(t, validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind, "any-backend"))
+	})
+
+	t.Run("name set and matches → allowed", func(t *testing.T) {
+		named := gwapiv1b1.ObjectName("target-backend")
+		to := &gwapiv1b1.ReferenceGrantTo{Group: aiServiceBackendGroup, Kind: aiServiceBackendKind, Name: &named}
+		require.True(t, validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind, "target-backend"))
+	})
+
+	t.Run("name set but differs → denied", func(t *testing.T) {
+		named := gwapiv1b1.ObjectName("target-backend")
+		to := &gwapiv1b1.ReferenceGrantTo{Group: aiServiceBackendGroup, Kind: aiServiceBackendKind, Name: &named}
+		require.False(t, validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind, "other-backend"),
+			"name-scoped grant must not promote to a wildcard")
+	})
+}
+
 // TestReferenceGrantValidator_MatchesTo_WrongGroup tests matchesTo with wrong group
 func TestReferenceGrantValidator_MatchesTo_WrongGroup(t *testing.T) {
 	scheme := runtime.NewScheme()
@@ -456,7 +486,7 @@ func TestReferenceGrantValidator_MatchesTo_WrongGroup(t *testing.T) {
 		Kind:  aiServiceBackendKind,
 	}
 
-	result := validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind)
+	result := validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind, "target-backend")
 	require.False(t, result, "should return false for wrong group")
 }
 
@@ -474,7 +504,7 @@ func TestReferenceGrantValidator_MatchesTo_WrongKind(t *testing.T) {
 		Kind:  "WrongKind",
 	}
 
-	result := validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind)
+	result := validator.matchesTo(to, aiServiceBackendGroup, aiServiceBackendKind, "target-backend")
 	require.False(t, result, "should return false for wrong kind")
 }