Migrate codegen for fed&automation, remove old def dir

app/app.cue

@@ -4,6 +4,8 @@ import (
 	"github.com/cortezaproject/corteza-server/codegen/schema"
 	"github.com/cortezaproject/corteza-server/system"
 	"github.com/cortezaproject/corteza-server/compose"
+	"github.com/cortezaproject/corteza-server/automation"
+	"github.com/cortezaproject/corteza-server/federation"
 )
 
 corteza: schema.#platform & {
@@ -12,5 +14,7 @@ corteza: schema.#platform & {
 	components: [
 		system.component,
 		compose.component,
+		automation.component,
+		federation.component,
 	]
 }

automation/component.cue

@@ -0,0 +1,22 @@
+package automation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+component: schema.#component & {
+	handle: "automation"
+
+	resources: {
+		"workflow": workflow
+	}
+
+	rbac: operations: {
+    "grant": description: "Manage automation permissions"
+    "workflow.create": description: "Create workflows"
+    "triggers.search": description: "List, search or filter triggers"
+    "sessions.search": description: "List, search or filter sessions"
+    "workflows.search": description: "List, search or filter workflows"
+    "resource-translations.manage": description: "List, search, create, or update resource translations"
+	}
+}

automation/service/access_control.gen.go

@@ -6,10 +6,6 @@ package service
 // the code is regenerated.
 //
 
-// Definitions file that controls how this file is generated:
-// - automation.workflow.yaml
-// - automation.yaml
-
 import (
 	"context"
 	"fmt"
@@ -249,42 +245,48 @@ func (svc accessControl) CanManageSessionsOnWorkflow(ctx context.Context, r *typ
 //
 // This function is auto-generated
 func (svc accessControl) CanGrant(ctx context.Context) bool {
-	return svc.can(ctx, "grant", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "grant", r)
 }
 
 // CanCreateWorkflow checks if current user can create workflows
 //
 // This function is auto-generated
 func (svc accessControl) CanCreateWorkflow(ctx context.Context) bool {
-	return svc.can(ctx, "workflow.create", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "workflow.create", r)
 }
 
 // CanSearchTriggers checks if current user can list, search or filter triggers
 //
 // This function is auto-generated
 func (svc accessControl) CanSearchTriggers(ctx context.Context) bool {
-	return svc.can(ctx, "triggers.search", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "triggers.search", r)
 }
 
 // CanSearchSessions checks if current user can list, search or filter sessions
 //
 // This function is auto-generated
 func (svc accessControl) CanSearchSessions(ctx context.Context) bool {
-	return svc.can(ctx, "sessions.search", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "sessions.search", r)
 }
 
 // CanSearchWorkflows checks if current user can list, search or filter workflows
 //
 // This function is auto-generated
 func (svc accessControl) CanSearchWorkflows(ctx context.Context) bool {
-	return svc.can(ctx, "workflows.search", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "workflows.search", r)
 }
 
 // CanManageResourceTranslations checks if current user can list, search, create, or update resource translations
 //
 // This function is auto-generated
 func (svc accessControl) CanManageResourceTranslations(ctx context.Context) bool {
-	return svc.can(ctx, "resource-translations.manage", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "resource-translations.manage", r)
 }
 
 // rbacResourceValidator validates known component's resource by routing it to the appropriate validator
@@ -330,24 +332,24 @@ func rbacResourceOperations(r string) map[string]bool {
 	return nil
 }
 
-// rbacWorkflowResourceValidator checks validity of rbac resource and operations
+// rbacWorkflowResourceValidator checks validity of RBAC resource and operations
 //
 // Can be called without operations to check for validity of resource string only
 //
 // This function is auto-generated
 func rbacWorkflowResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for automation Workflow resource", o)
-		}
-	}
-
 	if !strings.HasPrefix(r, types.WorkflowResourceType) {
 		// expecting resource to always include path
 		return fmt.Errorf("invalid resource type")
 	}
 
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for workflow resource", o)
+		}
+	}
+
 	const sep = "/"
 	var (
 		pp  = strings.Split(strings.Trim(r[len(types.WorkflowResourceType):], sep), sep)
@@ -363,7 +365,7 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error {
 	for i := 0; i < len(pp); i++ {
 		if pp[i] != "*" {
 			if i > 0 && pp[i-1] == "*" {
-				return fmt.Errorf("invalid resource path wildcard level (%d) for Workflow", i)
+				return fmt.Errorf("invalid path wildcard level (%d) for workflow resource", i)
 			}
 
 			if _, err := cast.ToUint64E(pp[i]); err != nil {
@@ -374,23 +376,23 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error {
 	return nil
 }
 
-// rbacComponentResourceValidator checks validity of rbac resource and operations
+// rbacComponentResourceValidator checks validity of RBAC resource and operations
 //
 // Can be called without operations to check for validity of resource string only
 //
 // This function is auto-generated
 func rbacComponentResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for automation resource", o)
-		}
-	}
-
 	if !strings.HasPrefix(r, types.ComponentResourceType) {
 		// expecting resource to always include path
 		return fmt.Errorf("invalid resource type")
 	}
 
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for automation component resource", o)
+		}
+	}
+
 	return nil
 }

automation/types/rbac.gen.go

@@ -6,10 +6,6 @@ package types
 // the code is regenerated.
 //
 
-// Definitions file that controls how this file is generated:
-// - automation.workflow.yaml
-// - automation.yaml
-
 import (
 	"fmt"
 	"strconv"
@@ -22,6 +18,11 @@ type (
 	Component struct{}
 )
 
+var (
+	_ = fmt.Printf
+	_ = strconv.FormatUint
+)
+
 const (
 	WorkflowResourceType  = "corteza::automation:workflow"
 	ComponentResourceType = "corteza::automation"
@@ -53,7 +54,6 @@ func WorkflowRbacResource(id uint64) string {
 
 }
 
-// @todo template
 func WorkflowRbacResourceTpl() string {
 	return "%s/%s"
 }
@@ -77,7 +77,6 @@ func ComponentRbacResource() string {
 
 }
 
-// @todo template
 func ComponentRbacResourceTpl() string {
 	return "%s"
 }

automation/workflow.cue

@@ -0,0 +1,19 @@
+package automation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+workflow: schema.#resource & {
+	rbac: {
+		operations: {
+		  "read": description: "Read workflow"
+		  "update": description: "Update workflow"
+		  "delete": description: "Delete workflow"
+  		"undelete": description: "Undelete workflow"
+		  "execute": description: "Execute workflow"
+	  	"triggers.manage": description: "Manage workflow triggers"
+  		"sessions.manage": description: "Manage workflow sessions"
+		}
+	}
+}

def/README.md

@@ -1,4 +0,0 @@
-Obsolete and pending removal.
-
-All automation.* & federation.* yamls need to be converted
-to cue and moved to automation/ 

def/automation.workflow.yaml

@@ -1,23 +0,0 @@
-rbac:
-  operations:
-    read:
-      description: Read workflow
-    update:
-      description: Update workflow
-    delete:
-      description: Delete workflow
-    undelete:
-      description: Undelete workflow
-    execute:
-      description: Execute workflow
-    triggers.manage:
-      description: Manage workflow triggers
-    sessions.manage:
-      description: Manage workflow sessions
-
-# locale:
-#   resource:
-#     references: [ ID ]
-#   keys:
-#     - { path: name,    field: "Meta.Name" }
-#     - { path: description, field: "Meta.Description" }

def/automation.yaml

@@ -1,21 +0,0 @@
-rbac:
-  resource: { references: [] }
-
-  operations:
-    grant:
-      description: Manage automation permissions
-
-    workflow.create:
-      description: Create workflows
-
-    triggers.search:
-      description: List, search or filter triggers
-
-    sessions.search:
-      description: List, search or filter sessions
-
-    workflows.search:
-      description: List, search or filter workflows
-
-    resource-translations.manage:
-      description: List, search, create, or update resource translations

def/federation.exposed-module.yaml

@@ -1,9 +0,0 @@
-rbac:
-  resource:
-    references: [ node, ID ]
-
-  operations:
-    manage:
-      description: Manage shared module
-
-envoy: false

def/federation.node.yaml

@@ -1,8 +0,0 @@
-rbac:
-  operations:
-    manage:
-      description: Manage federation node
-    module.create:
-      description: Create shared module
-
-envoy: false

def/federation.shared-module.yaml

@@ -1,9 +0,0 @@
-rbac:
-  resource:
-    references: [ node, ID ]
-
-  operations:
-    map:
-      description: Map shared module
-
-envoy: false

def/federation.yaml

@@ -1,19 +0,0 @@
-rbac:
-  resource: { references: [] }
-  operations:
-    grant:
-      description: Manage federation permissions
-    pair:
-      description: Pair federation nodes
-
-    settings.read:
-      description: Read settings
-    settings.manage:
-      description: Manage settings
-
-    node.create:
-      description: Create new federation node
-    nodes.search:
-      description: List, search or filter federation nodes
-
-envoy: false

federation/component.cue

@@ -0,0 +1,24 @@
+package federation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+component: schema.#component & {
+	handle: "federation"
+
+	resources: {
+		"node":           node
+		"exposed-module": exposedModule
+		"shared-module":  sharedModule
+	}
+
+	rbac: operations: {
+    "grant":            description: "Manage federation permissions"
+    "pair":             description: "Pair federation nodes"
+    "settings.read":    description: "Read settings"
+    "settings.manage":  description: "Manage settings"
+    "node.create":      description: "Create new federation node"
+    "nodes.search":     description: "List, search or filter federation nodes"
+	}
+}

federation/exposed-module.cue

@@ -0,0 +1,17 @@
+package federation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+exposedModule: schema.#resource & {
+	parents: [
+		{handle: "node"},
+	]
+
+	rbac: {
+		operations: {
+				"manage": description: "Manage exposed module module"
+		}
+	}
+}

federation/node.cue

@@ -0,0 +1,14 @@
+package federation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+node: schema.#resource & {
+	rbac: {
+		operations: {
+				"manage": description: "Manage federation node"
+				"module.create": description: "Create shared module"
+		}
+	}
+}

federation/service/access_control.gen.go

@@ -6,12 +6,6 @@ package service
 // the code is regenerated.
 //
 
-// Definitions file that controls how this file is generated:
-// - federation.exposed-module.yaml
-// - federation.node.yaml
-// - federation.shared-module.yaml
-// - federation.yaml
-
 import (
 	"context"
 	"fmt"
@@ -60,11 +54,6 @@ func (svc accessControl) Effective(ctx context.Context, rr ...rbac.Resource) (ee
 
 func (svc accessControl) List() (out []map[string]string) {
 	def := []map[string]string{
-		{
-			"type": types.ExposedModuleResourceType,
-			"any":  types.ExposedModuleRbacResource(0, 0),
-			"op":   "manage",
-		},
 		{
 			"type": types.NodeResourceType,
 			"any":  types.NodeRbacResource(0),
@@ -75,6 +64,11 @@ func (svc accessControl) List() (out []map[string]string) {
 			"any":  types.NodeRbacResource(0),
 			"op":   "module.create",
 		},
+		{
+			"type": types.ExposedModuleResourceType,
+			"any":  types.ExposedModuleRbacResource(0, 0),
+			"op":   "manage",
+		},
 		{
 			"type": types.SharedModuleResourceType,
 			"any":  types.SharedModuleRbacResource(0, 0),
@@ -183,13 +177,6 @@ func (svc accessControl) CloneRulesByRoleID(ctx context.Context, fromRoleID uint
 	return svc.rbac.CloneRulesByRoleID(ctx, fromRoleID, toRoleID...)
 }
 
-// CanManageExposedModule checks if current user can manage shared module
-//
-// This function is auto-generated
-func (svc accessControl) CanManageExposedModule(ctx context.Context, r *types.ExposedModule) bool {
-	return svc.can(ctx, "manage", r)
-}
-
 // CanManageNode checks if current user can manage federation node
 //
 // This function is auto-generated
@@ -204,6 +191,13 @@ func (svc accessControl) CanCreateModuleOnNode(ctx context.Context, r *types.Nod
 	return svc.can(ctx, "module.create", r)
 }
 
+// CanManageExposedModule checks if current user can manage exposed module module
+//
+// This function is auto-generated
+func (svc accessControl) CanManageExposedModule(ctx context.Context, r *types.ExposedModule) bool {
+	return svc.can(ctx, "manage", r)
+}
+
 // CanMapSharedModule checks if current user can map shared module
 //
 // This function is auto-generated
@@ -215,42 +209,48 @@ func (svc accessControl) CanMapSharedModule(ctx context.Context, r *types.Shared
 //
 // This function is auto-generated
 func (svc accessControl) CanGrant(ctx context.Context) bool {
-	return svc.can(ctx, "grant", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "grant", r)
 }
 
 // CanPair checks if current user can pair federation nodes
 //
 // This function is auto-generated
 func (svc accessControl) CanPair(ctx context.Context) bool {
-	return svc.can(ctx, "pair", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "pair", r)
 }
 
 // CanReadSettings checks if current user can read settings
 //
 // This function is auto-generated
 func (svc accessControl) CanReadSettings(ctx context.Context) bool {
-	return svc.can(ctx, "settings.read", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "settings.read", r)
 }
 
 // CanManageSettings checks if current user can manage settings
 //
 // This function is auto-generated
 func (svc accessControl) CanManageSettings(ctx context.Context) bool {
-	return svc.can(ctx, "settings.manage", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "settings.manage", r)
 }
 
 // CanCreateNode checks if current user can create new federation node
 //
 // This function is auto-generated
 func (svc accessControl) CanCreateNode(ctx context.Context) bool {
-	return svc.can(ctx, "node.create", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "node.create", r)
 }
 
 // CanSearchNodes checks if current user can list, search or filter federation nodes
 //
 // This function is auto-generated
 func (svc accessControl) CanSearchNodes(ctx context.Context) bool {
-	return svc.can(ctx, "nodes.search", &types.Component{})
+	r := &types.Component{}
+	return svc.can(ctx, "nodes.search", r)
 }
 
 // rbacResourceValidator validates known component's resource by routing it to the appropriate validator
@@ -258,10 +258,10 @@ func (svc accessControl) CanSearchNodes(ctx context.Context) bool {
 // This function is auto-generated
 func rbacResourceValidator(r string, oo ...string) error {
 	switch rbac.ResourceType(r) {
-	case types.ExposedModuleResourceType:
-		return rbacExposedModuleResourceValidator(r, oo...)
 	case types.NodeResourceType:
 		return rbacNodeResourceValidator(r, oo...)
+	case types.ExposedModuleResourceType:
+		return rbacExposedModuleResourceValidator(r, oo...)
 	case types.SharedModuleResourceType:
 		return rbacSharedModuleResourceValidator(r, oo...)
 	case types.ComponentResourceType:
@@ -276,15 +276,15 @@ func rbacResourceValidator(r string, oo ...string) error {
 // This function is auto-generated
 func rbacResourceOperations(r string) map[string]bool {
 	switch rbac.ResourceType(r) {
-	case types.ExposedModuleResourceType:
-		return map[string]bool{
-			"manage": true,
-		}
 	case types.NodeResourceType:
 		return map[string]bool{
 			"manage":        true,
 			"module.create": true,
 		}
+	case types.ExposedModuleResourceType:
+		return map[string]bool{
+			"manage": true,
+		}
 	case types.SharedModuleResourceType:
 		return map[string]bool{
 			"map": true,
@@ -303,69 +303,24 @@ func rbacResourceOperations(r string) map[string]bool {
 	return nil
 }
 
-// rbacExposedModuleResourceValidator checks validity of rbac resource and operations
-//
-// Can be called without operations to check for validity of resource string only
-//
-// This function is auto-generated
-func rbacExposedModuleResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for federation ExposedModule resource", o)
-		}
-	}
-
-	if !strings.HasPrefix(r, types.ExposedModuleResourceType) {
-		// expecting resource to always include path
-		return fmt.Errorf("invalid resource type")
-	}
-
-	const sep = "/"
-	var (
-		pp  = strings.Split(strings.Trim(r[len(types.ExposedModuleResourceType):], sep), sep)
-		prc = []string{
-			"nodeID",
-			"ID",
-		}
-	)
-
-	if len(pp) != len(prc) {
-		return fmt.Errorf("invalid resource path structure")
-	}
-
-	for i := 0; i < len(pp); i++ {
-		if pp[i] != "*" {
-			if i > 0 && pp[i-1] == "*" {
-				return fmt.Errorf("invalid resource path wildcard level (%d) for ExposedModule", i)
-			}
-
-			if _, err := cast.ToUint64E(pp[i]); err != nil {
-				return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
-			}
-		}
-	}
-	return nil
-}
-
-// rbacNodeResourceValidator checks validity of rbac resource and operations
+// rbacNodeResourceValidator checks validity of RBAC resource and operations
 //
 // Can be called without operations to check for validity of resource string only
 //
 // This function is auto-generated
 func rbacNodeResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for federation Node resource", o)
-		}
-	}
-
 	if !strings.HasPrefix(r, types.NodeResourceType) {
 		// expecting resource to always include path
 		return fmt.Errorf("invalid resource type")
 	}
 
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for node resource", o)
+		}
+	}
+
 	const sep = "/"
 	var (
 		pp  = strings.Split(strings.Trim(r[len(types.NodeResourceType):], sep), sep)
@@ -381,7 +336,7 @@ func rbacNodeResourceValidator(r string, oo ...string) error {
 	for i := 0; i < len(pp); i++ {
 		if pp[i] != "*" {
 			if i > 0 && pp[i-1] == "*" {
-				return fmt.Errorf("invalid resource path wildcard level (%d) for Node", i)
+				return fmt.Errorf("invalid path wildcard level (%d) for node resource", i)
 			}
 
 			if _, err := cast.ToUint64E(pp[i]); err != nil {
@@ -392,29 +347,29 @@ func rbacNodeResourceValidator(r string, oo ...string) error {
 	return nil
 }
 
-// rbacSharedModuleResourceValidator checks validity of rbac resource and operations
+// rbacExposedModuleResourceValidator checks validity of RBAC resource and operations
 //
 // Can be called without operations to check for validity of resource string only
 //
 // This function is auto-generated
-func rbacSharedModuleResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for federation SharedModule resource", o)
-		}
-	}
-
-	if !strings.HasPrefix(r, types.SharedModuleResourceType) {
+func rbacExposedModuleResourceValidator(r string, oo ...string) error {
+	if !strings.HasPrefix(r, types.ExposedModuleResourceType) {
 		// expecting resource to always include path
 		return fmt.Errorf("invalid resource type")
 	}
 
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for exposedModule resource", o)
+		}
+	}
+
 	const sep = "/"
 	var (
-		pp  = strings.Split(strings.Trim(r[len(types.SharedModuleResourceType):], sep), sep)
+		pp  = strings.Split(strings.Trim(r[len(types.ExposedModuleResourceType):], sep), sep)
 		prc = []string{
-			"nodeID",
+			"NodeID",
 			"ID",
 		}
 	)
@@ -426,7 +381,7 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error {
 	for i := 0; i < len(pp); i++ {
 		if pp[i] != "*" {
 			if i > 0 && pp[i-1] == "*" {
-				return fmt.Errorf("invalid resource path wildcard level (%d) for SharedModule", i)
+				return fmt.Errorf("invalid path wildcard level (%d) for exposedModule resource", i)
 			}
 
 			if _, err := cast.ToUint64E(pp[i]); err != nil {
@@ -437,23 +392,68 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error {
 	return nil
 }
 
-// rbacComponentResourceValidator checks validity of rbac resource and operations
+// rbacSharedModuleResourceValidator checks validity of RBAC resource and operations
+//
+// Can be called without operations to check for validity of resource string only
+//
+// This function is auto-generated
+func rbacSharedModuleResourceValidator(r string, oo ...string) error {
+	if !strings.HasPrefix(r, types.SharedModuleResourceType) {
+		// expecting resource to always include path
+		return fmt.Errorf("invalid resource type")
+	}
+
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for sharedModule resource", o)
+		}
+	}
+
+	const sep = "/"
+	var (
+		pp  = strings.Split(strings.Trim(r[len(types.SharedModuleResourceType):], sep), sep)
+		prc = []string{
+			"NodeID",
+			"ID",
+		}
+	)
+
+	if len(pp) != len(prc) {
+		return fmt.Errorf("invalid resource path structure")
+	}
+
+	for i := 0; i < len(pp); i++ {
+		if pp[i] != "*" {
+			if i > 0 && pp[i-1] == "*" {
+				return fmt.Errorf("invalid path wildcard level (%d) for sharedModule resource", i)
+			}
+
+			if _, err := cast.ToUint64E(pp[i]); err != nil {
+				return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
+			}
+		}
+	}
+	return nil
+}
+
+// rbacComponentResourceValidator checks validity of RBAC resource and operations
 //
 // Can be called without operations to check for validity of resource string only
 //
 // This function is auto-generated
 func rbacComponentResourceValidator(r string, oo ...string) error {
-	defOps := rbacResourceOperations(r)
-	for _, o := range oo {
-		if !defOps[o] {
-			return fmt.Errorf("invalid operation '%s' for federation resource", o)
-		}
-	}
-
 	if !strings.HasPrefix(r, types.ComponentResourceType) {
 		// expecting resource to always include path
 		return fmt.Errorf("invalid resource type")
 	}
 
+	defOps := rbacResourceOperations(r)
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for federation component resource", o)
+		}
+	}
+
 	return nil
 }

federation/shared-module.cue

@@ -0,0 +1,17 @@
+package federation
+
+import (
+	"github.com/cortezaproject/corteza-server/codegen/schema"
+)
+
+sharedModule: schema.#resource & {
+	parents: [
+		{handle: "node"},
+	]
+
+	rbac: {
+		operations: {
+				"map": description: "Map shared module"
+		}
+	}
+}

federation/types/rbac.gen.go

@@ -6,12 +6,6 @@ package types
 // the code is regenerated.
 //
 
-// Definitions file that controls how this file is generated:
-// - federation.exposed-module.yaml
-// - federation.node.yaml
-// - federation.shared-module.yaml
-// - federation.yaml
-
 import (
 	"fmt"
 	"strconv"
@@ -24,13 +18,48 @@ type (
 	Component struct{}
 )
 
+var (
+	_ = fmt.Printf
+	_ = strconv.FormatUint
+)
+
 const (
-	ExposedModuleResourceType = "corteza::federation:exposed-module"
 	NodeResourceType          = "corteza::federation:node"
+	ExposedModuleResourceType = "corteza::federation:exposed-module"
 	SharedModuleResourceType  = "corteza::federation:shared-module"
 	ComponentResourceType     = "corteza::federation"
 )
 
+// RbacResource returns string representation of RBAC resource for Node by calling NodeRbacResource fn
+//
+// RBAC resource is in the corteza::federation:node/... format
+//
+// This function is auto-generated
+func (r Node) RbacResource() string {
+	return NodeRbacResource(r.ID)
+}
+
+// NodeRbacResource returns string representation of RBAC resource for Node
+//
+// RBAC resource is in the corteza::federation:node/... format
+//
+// This function is auto-generated
+func NodeRbacResource(id uint64) string {
+	cpts := []interface{}{NodeResourceType}
+	if id != 0 {
+		cpts = append(cpts, strconv.FormatUint(id, 10))
+	} else {
+		cpts = append(cpts, "*")
+	}
+
+	return fmt.Sprintf(NodeRbacResourceTpl(), cpts...)
+
+}
+
+func NodeRbacResourceTpl() string {
+	return "%s/%s"
+}
+
 // RbacResource returns string representation of RBAC resource for ExposedModule by calling ExposedModuleRbacResource fn
 //
 // RBAC resource is in the corteza::federation:exposed-module/... format
@@ -63,42 +92,10 @@ func ExposedModuleRbacResource(nodeID uint64, id uint64) string {
 
 }
 
-// @todo template
 func ExposedModuleRbacResourceTpl() string {
 	return "%s/%s/%s"
 }
 
-// RbacResource returns string representation of RBAC resource for Node by calling NodeRbacResource fn
-//
-// RBAC resource is in the corteza::federation:node/... format
-//
-// This function is auto-generated
-func (r Node) RbacResource() string {
-	return NodeRbacResource(r.ID)
-}
-
-// NodeRbacResource returns string representation of RBAC resource for Node
-//
-// RBAC resource is in the corteza::federation:node/... format
-//
-// This function is auto-generated
-func NodeRbacResource(id uint64) string {
-	cpts := []interface{}{NodeResourceType}
-	if id != 0 {
-		cpts = append(cpts, strconv.FormatUint(id, 10))
-	} else {
-		cpts = append(cpts, "*")
-	}
-
-	return fmt.Sprintf(NodeRbacResourceTpl(), cpts...)
-
-}
-
-// @todo template
-func NodeRbacResourceTpl() string {
-	return "%s/%s"
-}
-
 // RbacResource returns string representation of RBAC resource for SharedModule by calling SharedModuleRbacResource fn
 //
 // RBAC resource is in the corteza::federation:shared-module/... format
@@ -131,7 +128,6 @@ func SharedModuleRbacResource(nodeID uint64, id uint64) string {
 
 }
 
-// @todo template
 func SharedModuleRbacResourceTpl() string {
 	return "%s/%s/%s"
 }
@@ -155,7 +151,6 @@ func ComponentRbacResource() string {
 
 }
 
-// @todo template
 func ComponentRbacResourceTpl() string {
 	return "%s"
 }

pkg/envoy/resource/rbac_references_automation.gen.go

@@ -6,10 +6,6 @@ package resource
 // the code is regenerated.
 //
 
-// Definitions file that controls how this file is generated:
-// - automation.workflow.yaml
-// - automation.yaml
-
 import (
 	"github.com/cortezaproject/corteza-server/automation/types"
 )

pkg/envoy/resource/rbac_references_federation.gen.go

@@ -0,0 +1,56 @@
+package resource
+
+// This file is auto-generated.
+//
+// Changes to this file may cause incorrect behavior and will be lost if
+// the code is regenerated.
+//
+
+import (
+	"github.com/cortezaproject/corteza-server/federation/types"
+)
+
+// FederationNodeRbacReferences generates RBAC references
+//
+// Resources with "envoy: false" are skipped
+//
+// This function is auto-generated
+func FederationNodeRbacReferences(node string) (res *Ref, pp []*Ref, err error) {
+	if node != "*" {
+		res = &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(node)}
+	}
+
+	return
+}
+
+// FederationExposedModuleRbacReferences generates RBAC references
+//
+// Resources with "envoy: false" are skipped
+//
+// This function is auto-generated
+func FederationExposedModuleRbacReferences(nodeID string, exposedModule string) (res *Ref, pp []*Ref, err error) {
+	if nodeID != "*" {
+		pp = append(pp, &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(nodeID)})
+	}
+	if exposedModule != "*" {
+		res = &Ref{ResourceType: types.ExposedModuleResourceType, Identifiers: MakeIdentifiers(exposedModule)}
+	}
+
+	return
+}
+
+// FederationSharedModuleRbacReferences generates RBAC references
+//
+// Resources with "envoy: false" are skipped
+//
+// This function is auto-generated
+func FederationSharedModuleRbacReferences(nodeID string, sharedModule string) (res *Ref, pp []*Ref, err error) {
+	if nodeID != "*" {
+		pp = append(pp, &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(nodeID)})
+	}
+	if sharedModule != "*" {
+		res = &Ref{ResourceType: types.SharedModuleResourceType, Identifiers: MakeIdentifiers(sharedModule)}
+	}
+
+	return
+}

pkg/envoy/resource/rbac_rules_parse.gen.go

@@ -8,7 +8,9 @@ package resource
 
 import (
 	"fmt"
+	automationTypes "github.com/cortezaproject/corteza-server/automation/types"
 	composeTypes "github.com/cortezaproject/corteza-server/compose/types"
+	federationTypes "github.com/cortezaproject/corteza-server/federation/types"
 	systemTypes "github.com/cortezaproject/corteza-server/system/types"
 	"strings"
 )
@@ -178,6 +180,44 @@ func ParseRule(res string) (string, *Ref, []*Ref, error) {
 		)
 		return resourceType, ref, pp, err
 
+	case automationTypes.WorkflowResourceType:
+		if len(path) != 1 {
+			return "", nil, nil, fmt.Errorf("expecting 1 reference components in path, got %d", len(path))
+		}
+		ref, pp, err := AutomationWorkflowRbacReferences(
+			path[0],
+		)
+		return resourceType, ref, pp, err
+
+	case federationTypes.NodeResourceType:
+		if len(path) != 1 {
+			return "", nil, nil, fmt.Errorf("expecting 1 reference components in path, got %d", len(path))
+		}
+		ref, pp, err := FederationNodeRbacReferences(
+			path[0],
+		)
+		return resourceType, ref, pp, err
+
+	case federationTypes.ExposedModuleResourceType:
+		if len(path) != 2 {
+			return "", nil, nil, fmt.Errorf("expecting 2 reference components in path, got %d", len(path))
+		}
+		ref, pp, err := FederationExposedModuleRbacReferences(
+			path[0],
+			path[1],
+		)
+		return resourceType, ref, pp, err
+
+	case federationTypes.SharedModuleResourceType:
+		if len(path) != 2 {
+			return "", nil, nil, fmt.Errorf("expecting 2 reference components in path, got %d", len(path))
+		}
+		ref, pp, err := FederationSharedModuleRbacReferences(
+			path[0],
+			path[1],
+		)
+		return resourceType, ref, pp, err
+
 	case systemTypes.ComponentResourceType:
 		if len(path) != 0 {
 			return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path))
@@ -190,6 +230,20 @@ func ParseRule(res string) (string, *Ref, []*Ref, error) {
 			return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path))
 		}
 
+		// Component resource, no path
+		return resourceType, nil, nil, nil
+	case automationTypes.ComponentResourceType:
+		if len(path) != 0 {
+			return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path))
+		}
+
+		// Component resource, no path
+		return resourceType, nil, nil, nil
+	case federationTypes.ComponentResourceType:
+		if len(path) != 0 {
+			return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path))
+		}
+
 		// Component resource, no path
 		return resourceType, nil, nil, nil
 	}