From 46eb0f17494114df6478bead18ef4e7e2cdc0ea8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toma=C5=BE=20Jerman?= <tomaz.jerman121@gmail.com>
Date: Wed, 23 Mar 2022 11:05:27 +0100
Subject: [PATCH] Fix missing role references for namespace export

---
 compose/rest/namespace.go | 49 +++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/compose/rest/namespace.go b/compose/rest/namespace.go
index b1dd332c4..f750b6fdc 100644
--- a/compose/rest/namespace.go
+++ b/compose/rest/namespace.go
@@ -252,8 +252,14 @@ func (ctrl Namespace) Export(ctx context.Context, r *request.NamespaceExport) (o
 	// Tweak exported resources
 	resources = ctrl.tweakExport(ctx, resources, nsII)
 
+	var roleIndex map[uint64]*systemTypes.Role
+	resources, roleIndex, err = ctrl.preparePlaceholders(ctx, resources)
+	if err != nil {
+		return
+	}
+
 	// RBAC
-	auxRBAC, err := ctrl.exportRBAC(ctx, resources)
+	auxRBAC, err := ctrl.exportRBAC(ctx, roleIndex, resources)
 	if err != nil {
 		return
 	}
@@ -452,22 +458,11 @@ func (ctrl Namespace) exportCompose(ctx context.Context, namespaceID uint64) (re
 	return
 }
 
-func (ctrl Namespace) exportRBAC(ctx context.Context, base resource.InterfaceSet) (resources resource.InterfaceSet, err error) {
-	// get all roles; we'll filter as needed later
-	roleIndex := make(map[uint64]*systemTypes.Role)
-	rr, _, err := ctrl.role.Find(ctx, systemTypes.RoleFilter{})
-	if err != nil {
-		return
-	}
-	for _, r := range rr {
-		roleIndex[r.ID] = r
-	}
-
+func (ctrl Namespace) exportRBAC(ctx context.Context, roleIndex map[uint64]*systemTypes.Role, base resource.InterfaceSet) (resources resource.InterfaceSet, err error) {
 	// get all rbac rules
 	rules := rbac.Global().Rules()
 
 	// Match up
-	dupRoleIndex := make(map[uint64]bool)
 	dupRuleIndex := make(map[string]bool)
 	for _, res := range base {
 		// Skip if we can't handle
@@ -493,13 +488,6 @@ func (ctrl Namespace) exportRBAC(ctx context.Context, base resource.InterfaceSet
 			if !ok {
 				continue
 			}
-			if !dupRoleIndex[role.ID] {
-				// Add a placeholder role so Envoy can resolve dependencies
-				r := resource.NewRole(role)
-				r.MarkPlaceholder()
-				resources = append(resources, r)
-				dupRoleIndex[role.ID] = true
-			}
 
 			roleRef := role.Handle
 			if roleRef == "" {
@@ -587,3 +575,24 @@ func (ctrl Namespace) tweakExport(ctx context.Context, resources resource.Interf
 
 	return resources
 }
+
+func (ctrl Namespace) preparePlaceholders(ctx context.Context, base resource.InterfaceSet) (resources resource.InterfaceSet, roleIndex map[uint64]*systemTypes.Role, err error) {
+	resources = base
+
+	// Get roles as we'll need them later for some resources
+	roleIndex = make(map[uint64]*systemTypes.Role)
+	rr, _, err := ctrl.role.Find(ctx, systemTypes.RoleFilter{})
+	if err != nil {
+		return
+	}
+	for _, role := range rr {
+		roleIndex[role.ID] = role
+
+		// Add them as placeholders since we don't want to export them
+		r := resource.NewRole(role)
+		r.MarkPlaceholder()
+		resources = append(resources, r)
+	}
+
+	return
+}