RBAC refactored (pkg renamed, init improved)

app/boot_levels.go

@@ -17,7 +17,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/logger"
 	"github.com/cortezaproject/corteza-server/pkg/mail"
 	"github.com/cortezaproject/corteza-server/pkg/monitor"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/scheduler"
 	"github.com/cortezaproject/corteza-server/pkg/sentry"
 	"github.com/cortezaproject/corteza-server/provision/compose"
@@ -165,12 +165,12 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 	{
 		// Initialize RBAC subsystem
 		// and (re)load rules from the storage backend
-		err = permissions.Initialize(app.Log, app.Store)
+		err = rbac.Initialize(app.Log, app.Store)
 		if err != nil {
 			return
 		}
 
-		permissions.Global().Reload(ctx)
+		rbac.Global().Reload(ctx)
 	}
 
 	// Initializes system services
@@ -285,6 +285,8 @@ func (app *CortezaApp) Activate(ctx context.Context) (err error) {
 	cmpService.Watchers(ctx)
 	msgService.Watchers(ctx)
 
+	rbac.Global().Watch(ctx)
+
 	if err = sysService.Activate(ctx); err != nil {
 		return err
 	}

compose/commands/exporter.go

@@ -11,7 +11,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/cli"
 	"github.com/cortezaproject/corteza-server/pkg/deinterfacer"
 	"github.com/cortezaproject/corteza-server/pkg/handle"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/store"
 	sysExporter "github.com/cortezaproject/corteza-server/system/exporter"
@@ -97,8 +97,8 @@ func nsExporter(ctx context.Context, out *Compose, nsFlag string, args []string)
 	//
 	// Roles are use for resolving access control
 	roles = sysTypes.RoleSet{
-		&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-		&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+		&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+		&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 	}
 
 	modules, _, err := service.DefaultModule.Find(types.ModuleFilter{NamespaceID: ns.ID})
@@ -115,8 +115,8 @@ func nsExporter(ctx context.Context, out *Compose, nsFlag string, args []string)
 	// nsOut.Always = ns.Always
 	// nsOut.Meta = ns.Meta
 	//
-	// nsOut.Allow = sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, ns.PermissionResource())
-	// nsOut.Deny = sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, ns.PermissionResource())
+	// nsOut.Allow = sysExporter.ExportableResourcePermissions(roles, service.DefaultRBAC, permissions.Allow, ns.RBACResource())
+	// nsOut.Deny = sysExporter.ExportableResourcePermissions(roles, service.DefaultRBAC, permissions.Deny, ns.RBACResource())
 
 	for _, arg := range args {
 		switch arg {
@@ -146,12 +146,12 @@ func settingExporter(ctx context.Context, out *Compose) {
 
 func permissionExporter(ctx context.Context, out *Compose) {
 	roles := sysTypes.RoleSet{
-		&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-		&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+		&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+		&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 	}
 
-	out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow)
-	out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny)
+	out.Allow = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Allow)
+	out.Deny = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Deny)
 }
 
 // This is PoC for exporting compose resources
@@ -287,8 +287,8 @@ func expModules(mm types.ModuleSet) (o map[string]Module) {
 			Name:   m.Name,
 			Fields: expModuleFields(m.Fields, mm),
 
-			Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ModulePermissionResource),
-			Deny:  sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ModulePermissionResource),
+			Allow: sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Allow, types.ModuleRBACResource),
+			Deny:  sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Deny, types.ModuleRBACResource),
 		}
 
 		if meta := expModuleMetaCleanup(m.Meta); len(meta) > 0 {
@@ -336,8 +336,8 @@ func expModuleFields(ff types.ModuleFieldSet, modules types.ModuleSet) (o yaml.M
 				Visible:  f.Visible,
 				Multi:    f.Multi,
 
-				Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ModuleFieldPermissionResource),
-				Deny:  sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ModuleFieldPermissionResource),
+				Allow: sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Allow, types.ModuleFieldRBACResource),
+				Deny:  sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Deny, types.ModuleFieldRBACResource),
 			},
 		}
 	}
@@ -416,8 +416,8 @@ func expPages(parentID uint64, pages types.PageSet, modules types.ModuleSet, cha
 			Pages:       expPages(child.ID, pages, modules, charts),
 			Visible:     child.Visible,
 
-			Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.PagePermissionResource),
-			Deny:  sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.PagePermissionResource),
+			Allow: sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Allow, types.PageRBACResource),
+			Deny:  sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Deny, types.PageRBACResource),
 		}
 
 		if child.ModuleID > 0 {
@@ -638,8 +638,8 @@ func expCharts(charts types.ChartSet, modules types.ModuleSet) (o map[string]Cha
 				ColorScheme: c.Config.ColorScheme,
 			},
 
-			Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ChartPermissionResource),
-			Deny:  sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ChartPermissionResource),
+			Allow: sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Allow, types.ChartRBACResource),
+			Deny:  sysExporter.ExportableResourcePermissions(roles, rbac.Global(), rbac.Deny, types.ChartRBACResource),
 		}
 
 		for i, r := range c.Config.Reports {

compose/importer/chart.go

@@ -111,7 +111,7 @@ func (cImp *Chart) Cast(handle string, def interface{}) (err error) {
 			chart.Config, err = cImp.castConfig(chart, val)
 
 		case "allow", "deny":
-			return cImp.imp.permissions.CastSet(types.ChartPermissionResource.String()+handle, key, val)
+			return cImp.imp.permissions.CastSet(types.ChartRBACResource.String()+handle, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for chart %q", key, handle)
@@ -215,7 +215,7 @@ func (cImp *Chart) Store(ctx context.Context, k chartKeeper) (err error) {
 		}
 
 		cImp.dirty[chart.ID] = false
-		cImp.imp.permissions.UpdateResources(types.ChartPermissionResource.String(), handle, chart.ID)
+		cImp.imp.permissions.UpdateResources(types.ChartRBACResource.String(), handle, chart.ID)
 
 		return
 	})

compose/importer/default.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"github.com/cortezaproject/corteza-server/compose/service"
 	"github.com/cortezaproject/corteza-server/compose/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	sysTypes "github.com/cortezaproject/corteza-server/system/types"
 	"gopkg.in/yaml.v2"
@@ -22,7 +22,7 @@ func Import(ctx context.Context, ns *types.Namespace, ff ...io.Reader) (err erro
 			service.DefaultChart.With(ctx),
 			service.DefaultPage.With(ctx),
 
-			permissions.NewImporter(service.DefaultAccessControl.Whitelist()),
+			rbac.NewImporter(service.DefaultAccessControl.Whitelist()),
 			settings.NewImporter(),
 		)
 
@@ -31,8 +31,8 @@ func Import(ctx context.Context, ns *types.Namespace, ff ...io.Reader) (err erro
 		//
 		// Roles are use for resolving access control
 		roles = sysTypes.RoleSet{
-			&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-			&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+			&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+			&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 		}
 	)
 

compose/importer/importer.go

@@ -6,7 +6,7 @@ import (
 	"github.com/cortezaproject/corteza-server/compose/types"
 	"github.com/cortezaproject/corteza-server/pkg/deinterfacer"
 	"github.com/cortezaproject/corteza-server/pkg/importer"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	sysTypes "github.com/cortezaproject/corteza-server/system/types"
 )
 
@@ -132,7 +132,7 @@ func (imp *Importer) Store(
 	cStore chartKeeper,
 	pStore pageKeeper,
 	rStore recordKeeper,
-	pk permissions.ImportKeeper,
+	pk rbac.ImportKeeper,
 	roles sysTypes.RoleSet,
 ) (err error) {
 	if imp.namespaces != nil {

compose/importer/main_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/cortezaproject/corteza-server/compose/service"
 	"github.com/cortezaproject/corteza-server/compose/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 )
 
@@ -23,7 +23,7 @@ var (
 	}
 
 	// Add namespace to the stack, make sure importer can find it
-	pi *permissions.Importer
+	pi *rbac.Importer
 	st *settings.Importer
 
 	imp *Importer
@@ -36,7 +36,7 @@ func TestMain(m *testing.M) {
 
 func resetMocks() {
 	// whitelist = nil, anything can be added
-	pi = permissions.NewImporter(service.AccessControl(nil).Whitelist())
+	pi = rbac.NewImporter(service.AccessControl(nil).Whitelist())
 	st = settings.NewImporter()
 
 	imp = NewImporter(nil, nil, nil, nil, pi, st)

compose/importer/module.go

@@ -134,7 +134,7 @@ func (mImp *Module) Cast(handle string, def interface{}) (err error) {
 		// 	return c.resolveRecords(val)
 
 		case "allow", "deny":
-			return mImp.imp.permissions.CastSet(types.ModulePermissionResource.String()+handle, key, val)
+			return mImp.imp.permissions.CastSet(types.ModuleRBACResource.String()+handle, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for module %q", key, handle)
@@ -197,7 +197,7 @@ func (mImp *Module) castFields(module *types.Module, def interface{}) (err error
 				})
 
 			case "allow", "deny":
-				return mImp.imp.permissions.CastSet(types.ModuleFieldPermissionResource.String()+fieldName, key, val)
+				return mImp.imp.permissions.CastSet(types.ModuleFieldRBACResource.String()+fieldName, key, val)
 
 			default:
 				return fmt.Errorf("unexpected key %q for field %q on module %q", key, fieldName, module.Name)
@@ -247,10 +247,10 @@ func (mImp *Module) Store(ctx context.Context, k moduleKeeper) (err error) {
 		}
 
 		mImp.dirty[module.ID] = false
-		mImp.imp.permissions.UpdateResources(types.ModulePermissionResource.String(), handle, module.ID)
+		mImp.imp.permissions.UpdateResources(types.ModuleRBACResource.String(), handle, module.ID)
 
 		err = module.Fields.Walk(func(f *types.ModuleField) error {
-			mImp.imp.permissions.UpdateResources(types.ModuleFieldPermissionResource.String(), f.Name, f.ID)
+			mImp.imp.permissions.UpdateResources(types.ModuleFieldRBACResource.String(), f.Name, f.ID)
 			return nil
 		})
 	}

compose/importer/namespace.go

@@ -137,7 +137,7 @@ func (nsImp *Namespace) Cast(handle string, def interface{}) (err error) {
 			return nsImp.castRecords(handle, val)
 
 		case "allow", "deny":
-			return nsImp.imp.permissions.CastSet(types.NamespacePermissionResource.String()+namespace.Slug, key, val)
+			return nsImp.imp.permissions.CastSet(types.NamespaceRBACResource.String()+namespace.Slug, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for namespace %q", key, namespace.Slug)
@@ -247,7 +247,7 @@ func (nsImp *Namespace) Store(ctx context.Context, nsk namespaceKeeper, mk modul
 		spew.Dump(nsImp.dirty, namespace)
 
 		nsImp.dirty[namespace.ID] = false
-		nsImp.imp.permissions.UpdateResources(types.NamespacePermissionResource.String(), handle, namespace.ID)
+		nsImp.imp.permissions.UpdateResources(types.NamespaceRBACResource.String(), handle, namespace.ID)
 
 		if _, ok := nsImp.modules[handle]; ok {
 			nsImp.modules[handle].namespace = namespace

compose/importer/page.go

@@ -158,7 +158,7 @@ func (pImp *Page) cast(parent, handle string, def interface{}) (err error) {
 			return pImp.castSet(handle, val)
 
 		case "allow", "deny":
-			return pImp.imp.permissions.CastSet(types.PagePermissionResource.String()+handle, key, val)
+			return pImp.imp.permissions.CastSet(types.PageRBACResource.String()+handle, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for page %q", key, handle)
@@ -358,7 +358,7 @@ func (pImp *Page) storeChildren(ctx context.Context, parent string, k pageKeeper
 			continue
 		}
 
-		pImp.imp.permissions.UpdateResources(types.PagePermissionResource.String(), page.Handle, page.ID)
+		pImp.imp.permissions.UpdateResources(types.PageRBACResource.String(), page.Handle, page.ID)
 
 		if err = pImp.storeChildren(ctx, page.Handle, k); err != nil {
 			return err

compose/rest.yaml

@@ -972,7 +972,7 @@ endpoints:
   - Client ID
   - Session ID
   imports:
-    - github.com/cortezaproject/corteza-server/pkg/permissions
+    - github.com/cortezaproject/corteza-server/pkg/rbac
   apis:
   - name: list
     path: "/"
@@ -1021,7 +1021,7 @@ endpoints:
         title: Role ID
       post:
       - name: rules
-        type: permissions.RuleSet
+        type: rbac.RuleSet
         required: true
         title: List of permission rules to set
 - title: Compose automation scripts

compose/rest/permissions.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/cortezaproject/corteza-server/compose/rest/request"
 	"github.com/cortezaproject/corteza-server/compose/service"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -16,10 +16,10 @@ type (
 	}
 
 	permissionsAccessController interface {
-		Effective(context.Context) permissions.EffectiveSet
-		Whitelist() permissions.Whitelist
-		FindRulesByRoleID(context.Context, uint64) (permissions.RuleSet, error)
-		Grant(ctx context.Context, rr ...*permissions.Rule) error
+		Effective(context.Context) rbac.EffectiveSet
+		Whitelist() rbac.Whitelist
+		FindRulesByRoleID(context.Context, uint64) (rbac.RuleSet, error)
+		Grant(ctx context.Context, rr ...*rbac.Rule) error
 	}
 )
 
@@ -47,9 +47,9 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 		return nil, err
 	}
 
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Setting access to "inherit" will make Grant remove the rule
-		rule.Access = permissions.Inherit
+		rule.Access = rbac.Inherit
 		return nil
 	})
 
@@ -58,7 +58,7 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 
 func (ctrl Permissions) Update(ctx context.Context, r *request.PermissionsUpdate) (interface{}, error) {
 	rr := r.Rules
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Make sure everything is properly set
 		rule.RoleID = r.RoleID
 		return nil

compose/rest/request/permissions.go

@@ -12,7 +12,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/payload"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/go-chi/chi"
 	"io"
 	"mime/multipart"
@@ -63,7 +63,7 @@ type (
 		// Rules POST parameter
 		//
 		// List of permission rules to set
-		Rules permissions.RuleSet
+		Rules rbac.RuleSet
 	}
 )
 
@@ -247,7 +247,7 @@ func (r PermissionsUpdate) GetRoleID() uint64 {
 }
 
 // Auditable returns all auditable/loggable parameters
-func (r PermissionsUpdate) GetRules() permissions.RuleSet {
+func (r PermissionsUpdate) GetRules() rbac.RuleSet {
 	return r.Rules
 }
 
@@ -272,7 +272,7 @@ func (r *PermissionsUpdate) Fill(req *http.Request) (err error) {
 		// POST params
 
 		//if val, ok := req.Form["rules[]"]; ok && len(val) > 0  {
-		//    r.Rules, err = permissions.RuleSet(val), nil
+		//    r.Rules, err = rbac.RuleSet(val), nil
 		//    if err != nil {
 		//        return err
 		//    }

compose/service/access_control.go

@@ -5,28 +5,28 @@ import (
 	"github.com/cortezaproject/corteza-server/compose/types"
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	accessControl struct {
-		permissions accessControlPermissionServicer
+		permissions accessControlRBACServicer
 		actionlog   actionlog.Recorder
 	}
 
-	accessControlPermissionServicer interface {
-		Can([]uint64, permissions.Resource, permissions.Operation, ...permissions.CheckAccessFunc) bool
-		Grant(context.Context, permissions.Whitelist, ...*permissions.Rule) error
-		FindRulesByRoleID(roleID uint64) (rr permissions.RuleSet)
+	accessControlRBACServicer interface {
+		Can([]uint64, rbac.Resource, rbac.Operation, ...rbac.CheckAccessFunc) bool
+		Grant(context.Context, rbac.Whitelist, ...*rbac.Rule) error
+		FindRulesByRoleID(roleID uint64) (rr rbac.RuleSet)
 	}
 
 	secureResource interface {
-		PermissionResource() permissions.Resource
+		RBACResource() rbac.Resource
 		DynamicRoles(uint64) []uint64
 	}
 )
 
-func AccessControl(perm accessControlPermissionServicer) *accessControl {
+func AccessControl(perm accessControlRBACServicer) *accessControl {
 	return &accessControl{
 		permissions: perm,
 		actionlog:   DefaultActionlog,
@@ -34,40 +34,40 @@ func AccessControl(perm accessControlPermissionServicer) *accessControl {
 }
 
 // Effective returns a list of effective service-level permissions
-func (svc accessControl) Effective(ctx context.Context) (ee permissions.EffectiveSet) {
-	ee = permissions.EffectiveSet{}
+func (svc accessControl) Effective(ctx context.Context) (ee rbac.EffectiveSet) {
+	ee = rbac.EffectiveSet{}
 
-	ee.Push(types.ComposePermissionResource, "access", svc.CanAccess(ctx))
-	ee.Push(types.ComposePermissionResource, "grant", svc.CanGrant(ctx))
-	ee.Push(types.ComposePermissionResource, "namespace.create", svc.CanCreateNamespace(ctx))
-	ee.Push(types.ComposePermissionResource, "settings.read", svc.CanReadSettings(ctx))
-	ee.Push(types.ComposePermissionResource, "settings.manage", svc.CanManageSettings(ctx))
+	ee.Push(types.ComposeRBACResource, "access", svc.CanAccess(ctx))
+	ee.Push(types.ComposeRBACResource, "grant", svc.CanGrant(ctx))
+	ee.Push(types.ComposeRBACResource, "namespace.create", svc.CanCreateNamespace(ctx))
+	ee.Push(types.ComposeRBACResource, "settings.read", svc.CanReadSettings(ctx))
+	ee.Push(types.ComposeRBACResource, "settings.manage", svc.CanManageSettings(ctx))
 
 	return
 }
 
 func (svc accessControl) CanAccess(ctx context.Context) bool {
-	return svc.can(ctx, types.ComposePermissionResource, "access")
+	return svc.can(ctx, types.ComposeRBACResource, "access")
 }
 
 func (svc accessControl) CanGrant(ctx context.Context) bool {
-	return svc.can(ctx, types.ComposePermissionResource, "grant")
+	return svc.can(ctx, types.ComposeRBACResource, "grant")
 }
 
 func (svc accessControl) CanReadSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.ComposePermissionResource, "settings.read")
+	return svc.can(ctx, types.ComposeRBACResource, "settings.read")
 }
 
 func (svc accessControl) CanManageSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.ComposePermissionResource, "settings.manage")
+	return svc.can(ctx, types.ComposeRBACResource, "settings.manage")
 }
 
 func (svc accessControl) CanCreateNamespace(ctx context.Context) bool {
-	return svc.can(ctx, types.ComposePermissionResource, "namespace.create")
+	return svc.can(ctx, types.ComposeRBACResource, "namespace.create")
 }
 
 func (svc accessControl) CanReadNamespace(ctx context.Context, r *types.Namespace) bool {
-	return svc.can(ctx, r, "read", permissions.Allowed)
+	return svc.can(ctx, r, "read", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateNamespace(ctx context.Context, r *types.Namespace) bool {
@@ -99,11 +99,11 @@ func (svc accessControl) CanDeleteModule(ctx context.Context, r *types.Module) b
 }
 
 func (svc accessControl) CanReadRecordValue(ctx context.Context, r *types.ModuleField) bool {
-	return svc.can(ctx, r, "record.value.read", permissions.Allowed)
+	return svc.can(ctx, r, "record.value.read", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateRecordValue(ctx context.Context, r *types.ModuleField) bool {
-	return svc.can(ctx, r, "record.value.update", permissions.Allowed)
+	return svc.can(ctx, r, "record.value.update", rbac.Allowed)
 }
 
 func (svc accessControl) CanCreateRecord(ctx context.Context, r *types.Module) bool {
@@ -158,7 +158,7 @@ func (svc accessControl) CanDeletePage(ctx context.Context, r *types.Page) bool
 	return svc.can(ctx, r, "delete")
 }
 
-func (svc accessControl) can(ctx context.Context, res secureResource, op permissions.Operation, ff ...permissions.CheckAccessFunc) bool {
+func (svc accessControl) can(ctx context.Context, res secureResource, op rbac.Operation, ff ...rbac.CheckAccessFunc) bool {
 	var u = auth.GetIdentityFromContext(ctx)
 
 	if auth.IsSuperUser(u) {
@@ -170,13 +170,13 @@ func (svc accessControl) can(ctx context.Context, res secureResource, op permiss
 
 	return svc.permissions.Can(
 		append(u.Roles(), res.DynamicRoles(u.Identity())...),
-		res.PermissionResource(),
+		res.RBACResource(),
 		op,
 		ff...,
 	)
 }
 
-func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) error {
+func (svc accessControl) Grant(ctx context.Context, rr ...*rbac.Rule) error {
 	if !svc.CanGrant(ctx) {
 		return AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -190,7 +190,7 @@ func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) err
 	return nil
 }
 
-func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule) {
+func (svc accessControl) logGrants(ctx context.Context, rr []*rbac.Rule) {
 	if svc.actionlog == nil {
 		return
 	}
@@ -204,7 +204,7 @@ func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule)
 	}
 }
 
-func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (permissions.RuleSet, error) {
+func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (rbac.RuleSet, error) {
 	if !svc.CanGrant(ctx) {
 		return nil, AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -212,11 +212,11 @@ func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (
 	return svc.permissions.FindRulesByRoleID(roleID), nil
 }
 
-func (svc accessControl) Whitelist() permissions.Whitelist {
-	var wl = permissions.Whitelist{}
+func (svc accessControl) Whitelist() rbac.Whitelist {
+	var wl = rbac.Whitelist{}
 
 	wl.Set(
-		types.ComposePermissionResource,
+		types.ComposeRBACResource,
 		"access",
 		"grant",
 		"namespace.create",
@@ -225,7 +225,7 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.NamespacePermissionResource,
+		types.NamespaceRBACResource,
 		"read",
 		"update",
 		"delete",
@@ -236,7 +236,7 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.ModulePermissionResource,
+		types.ModuleRBACResource,
 		"read",
 		"update",
 		"delete",
@@ -247,20 +247,20 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.ModuleFieldPermissionResource,
+		types.ModuleFieldRBACResource,
 		"record.value.read",
 		"record.value.update",
 	)
 
 	wl.Set(
-		types.ChartPermissionResource,
+		types.ChartRBACResource,
 		"read",
 		"update",
 		"delete",
 	)
 
 	wl.Set(
-		types.PagePermissionResource,
+		types.PageRBACResource,
 		"read",
 		"update",
 		"delete",

compose/service/access_control_actions.gen.go

@@ -16,12 +16,12 @@ import (
 	"time"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	accessControlActionProps struct {
-		rule *permissions.Rule
+		rule *rbac.Rule
 	}
 
 	accessControlAction struct {
@@ -66,7 +66,7 @@ var (
 //
 // This function is auto-generated.
 //
-func (p *accessControlActionProps) setRule(rule *permissions.Rule) *accessControlActionProps {
+func (p *accessControlActionProps) setRule(rule *rbac.Rule) *accessControlActionProps {
 	p.rule = rule
 	return p
 }

compose/service/access_control_actions.yaml

@@ -10,11 +10,11 @@ defaultActionSeverity: notice
 defaultErrorSeverity: alert
 
 import:
-  - github.com/cortezaproject/corteza-server/pkg/permissions
+  - github.com/cortezaproject/corteza-server/pkg/rbac
 
 props:
   - name: rule
-    type: "*permissions.Rule"
+    type: "*rbac.Rule"
     fields: [ operation, roleID, access, resource ]
 
 actions:

compose/service/chart_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"errors"
 	"github.com/cortezaproject/corteza-server/compose/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/store/sqlite3"
 	"github.com/stretchr/testify/require"
@@ -52,7 +52,7 @@ func TestCharts(t *testing.T) {
 		svc := chart{
 			store: s,
 			ctx:   context.Background(),
-			ac:    AccessControl(&permissions.ServiceAllowAll{}),
+			ac:    AccessControl(&rbac.ServiceAllowAll{}),
 		}
 		res, err := svc.Create(&types.Chart{Name: "My first chart", NamespaceID: namespaceID})
 		req.NoError(unwrapChartInternal(err))

compose/service/namespace.go

@@ -8,7 +8,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
 	"github.com/cortezaproject/corteza-server/pkg/handle"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"strconv"
 )
@@ -28,7 +28,7 @@ type (
 		CanUpdateNamespace(context.Context, *types.Namespace) bool
 		CanDeleteNamespace(context.Context, *types.Namespace) bool
 
-		Grant(ctx context.Context, rr ...*permissions.Rule) error
+		Grant(ctx context.Context, rr ...*rbac.Rule) error
 	}
 
 	NamespaceService interface {

compose/service/record_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"github.com/cortezaproject/corteza-server/compose/service/values"
 	"github.com/cortezaproject/corteza-server/compose/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -17,7 +17,7 @@ func TestGeneralValueSetValidation(t *testing.T) {
 
 		svc = record{
 			ctx: context.Background(),
-			ac:  AccessControl(&permissions.ServiceAllowAll{}),
+			ac:  AccessControl(&rbac.ServiceAllowAll{}),
 		}
 		module = &types.Module{
 			Fields: types.ModuleFieldSet{
@@ -71,7 +71,7 @@ func TestDefaultValueSetting(t *testing.T) {
 		a = assert.New(t)
 
 		svc = record{
-			ac: AccessControl(&permissions.ServiceAllowAll{}),
+			ac: AccessControl(&rbac.ServiceAllowAll{}),
 		}
 		mod = &types.Module{
 			Fields: types.ModuleFieldSet{

compose/service/service.go

@@ -14,7 +14,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/objstore/minio"
 	"github.com/cortezaproject/corteza-server/pkg/objstore/plain"
 	"github.com/cortezaproject/corteza-server/pkg/options"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"go.uber.org/zap"
 	"strconv"
@@ -22,8 +22,8 @@ import (
 )
 
 type (
-	permissionServicer interface {
-		accessControlPermissionServicer
+	RBACServicer interface {
+		accessControlRBACServicer
 		Watch(ctx context.Context)
 	}
 
@@ -50,9 +50,6 @@ var (
 
 	DefaultActionlog actionlog.Recorder
 
-	// DefaultPermissions Retrieves & stores permissions
-	DefaultPermissions permissionServicer
-
 	// DefaultAccessControl Access control checking
 	DefaultAccessControl *accessControl
 
@@ -101,13 +98,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 		DefaultActionlog = actionlog.NewService(DefaultStore, log, tee, policy)
 	}
 
-	if DefaultPermissions == nil {
-		// Do not override permissions service stored under DefaultPermissions
-		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Global()
-	}
-
-	DefaultAccessControl = AccessControl(DefaultPermissions)
+	DefaultAccessControl = AccessControl(rbac.Global())
 
 	if DefaultObjectStore == nil {
 		const svcPath = "compose"
@@ -167,8 +158,7 @@ func Activate(ctx context.Context) (err error) {
 }
 
 func Watchers(ctx context.Context) {
-	// Reloading permissions on change
-	DefaultPermissions.Watch(ctx)
+	//
 }
 
 func RegisterIteratorProviders() {

compose/types/chart.go

@@ -4,7 +4,7 @@ import (
 	"database/sql/driver"
 	"encoding/json"
 	"github.com/cortezaproject/corteza-server/pkg/filter"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/pkg/errors"
 	"time"
 )
@@ -59,8 +59,8 @@ type (
 )
 
 // Resource returns a system resource ID for this type
-func (c Chart) PermissionResource() permissions.Resource {
-	return ChartPermissionResource.AppendID(c.ID)
+func (c Chart) RBACResource() rbac.Resource {
+	return ChartRBACResource.AppendID(c.ID)
 }
 
 func (c Chart) DynamicRoles(userID uint64) []uint64 {

compose/types/module.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/jmoiron/sqlx/types"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -45,8 +45,8 @@ type (
 )
 
 // Resource returns a system resource ID for this type
-func (m Module) PermissionResource() permissions.Resource {
-	return ModulePermissionResource.AppendID(m.ID)
+func (m Module) RBACResource() rbac.Resource {
+	return ModuleRBACResource.AppendID(m.ID)
 }
 
 func (m Module) DynamicRoles(userID uint64) []uint64 {

compose/types/module_field.go

@@ -4,7 +4,7 @@ import (
 	"database/sql/driver"
 	"encoding/json"
 	"github.com/cortezaproject/corteza-server/pkg/filter"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"sort"
 	"time"
 )
@@ -44,8 +44,8 @@ var (
 )
 
 // Resource returns a system resource ID for this type
-func (m ModuleField) PermissionResource() permissions.Resource {
-	return ModuleFieldPermissionResource.AppendID(m.ID)
+func (m ModuleField) RBACResource() rbac.Resource {
+	return ModuleFieldRBACResource.AppendID(m.ID)
 }
 
 func (m ModuleField) DynamicRoles(userID uint64) []uint64 {

compose/types/namespace.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -49,8 +49,8 @@ type (
 )
 
 // Resource returns a system resource ID for this type
-func (n Namespace) PermissionResource() permissions.Resource {
-	return NamespacePermissionResource.AppendID(n.ID)
+func (n Namespace) RBACResource() rbac.Resource {
+	return NamespaceRBACResource.AppendID(n.ID)
 }
 
 func (n Namespace) DynamicRoles(userID uint64) []uint64 {

compose/types/page.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -74,8 +74,8 @@ type (
 )
 
 // Resource returns a system resource ID for this type
-func (p Page) PermissionResource() permissions.Resource {
-	return PagePermissionResource.AppendID(p.ID)
+func (p Page) RBACResource() rbac.Resource {
+	return PageRBACResource.AppendID(p.ID)
 }
 
 func (p Page) DynamicRoles(userID uint64) []uint64 {

compose/types/permission_resources.go

@@ -1,12 +1,12 @@
 package types
 
 import (
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
-const ComposePermissionResource = permissions.Resource("compose")
-const NamespacePermissionResource = permissions.Resource("compose:namespace:")
-const ChartPermissionResource = permissions.Resource("compose:chart:")
-const ModulePermissionResource = permissions.Resource("compose:module:")
-const ModuleFieldPermissionResource = permissions.Resource("compose:module-field:")
-const PagePermissionResource = permissions.Resource("compose:page:")
+const ComposeRBACResource = rbac.Resource("compose")
+const NamespaceRBACResource = rbac.Resource("compose:namespace:")
+const ChartRBACResource = rbac.Resource("compose:chart:")
+const ModuleRBACResource = rbac.Resource("compose:module:")
+const ModuleFieldRBACResource = rbac.Resource("compose:module-field:")
+const PageRBACResource = rbac.Resource("compose:page:")

compose/types/record.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -101,17 +101,17 @@ func (r Record) Clone() *Record {
 }
 
 // Resource returns a system resource ID for this type
-func (r Record) PermissionResource() permissions.Resource {
-	return ModulePermissionResource.AppendID(r.ModuleID)
+func (r Record) RBACResource() rbac.Resource {
+	return ModuleRBACResource.AppendID(r.ModuleID)
 }
 
 func (r Record) DynamicRoles(userID uint64) []uint64 {
-	return permissions.DynamicRoles(
+	return rbac.DynamicRoles(
 		userID,
-		r.OwnedBy, permissions.OwnersDynamicRoleID,
-		r.CreatedBy, permissions.CreatorsDynamicRoleID,
-		r.UpdatedBy, permissions.UpdatersDynamicRoleID,
-		r.DeletedBy, permissions.DeletersDynamicRoleID,
+		r.OwnedBy, rbac.OwnersDynamicRoleID,
+		r.CreatedBy, rbac.CreatorsDynamicRoleID,
+		r.UpdatedBy, rbac.UpdatersDynamicRoleID,
+		r.DeletedBy, rbac.DeletersDynamicRoleID,
 	)
 }
 

messaging/commands/exporter.go

@@ -3,10 +3,9 @@ package commands
 import (
 	"context"
 	"errors"
-	"github.com/cortezaproject/corteza-server/messaging/service"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/cli"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	sysExporter "github.com/cortezaproject/corteza-server/system/exporter"
 	sysService "github.com/cortezaproject/corteza-server/system/service"
@@ -57,12 +56,12 @@ func Exporter() *cobra.Command {
 
 func permissionExporter(ctx context.Context, out *Messaging) {
 	roles := sysTypes.RoleSet{
-		&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-		&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+		&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+		&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 	}
 
-	out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow)
-	out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny)
+	out.Allow = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Allow)
+	out.Deny = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Deny)
 }
 
 func settingExporter(ctx context.Context, out *Messaging) {

messaging/importer/channel.go

@@ -90,7 +90,7 @@ func (cImp *Channel) Cast(name string, def interface{}) (err error) {
 			channel.Topic = deinterfacer.ToString(val)
 
 		case "allow", "deny":
-			return cImp.permissions.CastSet(types.ChannelPermissionResource.String()+channel.Name, key, val)
+			return cImp.permissions.CastSet(types.ChannelRBACResource.String()+channel.Name, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for channel %q", key, channel.Name)
@@ -128,7 +128,7 @@ func (cImp *Channel) Store(ctx context.Context, k channelKeeper) error {
 			return
 		}
 
-		cImp.permissions.UpdateResources(types.ChannelPermissionResource.String(), handle, channel.ID)
+		cImp.permissions.UpdateResources(types.ChannelRBACResource.String(), handle, channel.ID)
 		cImp.permissions.UpdateRoles(channel.Name, channel.ID)
 
 		return

messaging/importer/default.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"github.com/cortezaproject/corteza-server/messaging/service"
 	"github.com/cortezaproject/corteza-server/messaging/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	sysService "github.com/cortezaproject/corteza-server/system/service"
 	sysTypes "github.com/cortezaproject/corteza-server/system/types"
@@ -25,7 +25,7 @@ func Import(ctx context.Context, ff ...io.Reader) (err error) {
 	}
 
 	var (
-		p   = permissions.NewImporter(service.DefaultAccessControl.Whitelist())
+		p   = rbac.NewImporter(service.DefaultAccessControl.Whitelist())
 		imp = NewImporter(
 			p,
 			settings.NewImporter(),
@@ -37,8 +37,8 @@ func Import(ctx context.Context, ff ...io.Reader) (err error) {
 		//
 		// Roles are use for resolving access control
 		roles = sysTypes.RoleSet{
-			&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-			&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+			&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+			&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 		}
 	)
 

messaging/importer/importer.go

@@ -9,7 +9,7 @@ import (
 	"github.com/cortezaproject/corteza-server/messaging/types"
 	"github.com/cortezaproject/corteza-server/pkg/deinterfacer"
 	"github.com/cortezaproject/corteza-server/pkg/importer"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	sysTypes "github.com/cortezaproject/corteza-server/system/types"
 )
 
@@ -63,7 +63,7 @@ func (imp *Importer) Cast(in interface{}) (err error) {
 	})
 }
 
-func (imp *Importer) Store(ctx context.Context, rk channelKeeper, pk permissions.ImportKeeper, sk settings.ImportKeeper, roles sysTypes.RoleSet) (err error) {
+func (imp *Importer) Store(ctx context.Context, rk channelKeeper, pk rbac.ImportKeeper, sk settings.ImportKeeper, roles sysTypes.RoleSet) (err error) {
 	if imp.channels != nil {
 		err = imp.channels.Store(ctx, rk)
 		if err != nil {

messaging/importer/main_test.go

@@ -8,13 +8,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v2"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/system/service"
 )
 
 var (
-	pi *permissions.Importer
+	pi *rbac.Importer
 	si *settings.Importer
 
 	imp *Importer
@@ -27,7 +27,7 @@ func TestMain(m *testing.M) {
 
 func resetMocks() {
 	// whitelist = nil, anything can be added
-	pi = permissions.NewImporter(service.AccessControl(nil).Whitelist())
+	pi = rbac.NewImporter(service.AccessControl(nil).Whitelist())
 	si = settings.NewImporter()
 	imp = NewImporter(
 		pi,

messaging/rest.yaml

@@ -572,7 +572,7 @@ endpoints:
   - Client ID
   - Session ID
   imports:
-    - github.com/cortezaproject/corteza-server/pkg/permissions
+    - github.com/cortezaproject/corteza-server/pkg/rbac
   apis:
   - name: list
     path: "/"
@@ -620,6 +620,6 @@ endpoints:
         title: Role ID
       post:
       - name: rules
-        type: permissions.RuleSet
+        type: rbac.RuleSet
         required: true
         title: List of permission rules to set

messaging/rest/permissions.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/cortezaproject/corteza-server/messaging/rest/request"
 	"github.com/cortezaproject/corteza-server/messaging/service"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -16,10 +16,10 @@ type (
 	}
 
 	permissionsAccessController interface {
-		Effective(context.Context) permissions.EffectiveSet
-		Whitelist() permissions.Whitelist
-		FindRulesByRoleID(context.Context, uint64) (permissions.RuleSet, error)
-		Grant(ctx context.Context, rr ...*permissions.Rule) error
+		Effective(context.Context) rbac.EffectiveSet
+		Whitelist() rbac.Whitelist
+		FindRulesByRoleID(context.Context, uint64) (rbac.RuleSet, error)
+		Grant(ctx context.Context, rr ...*rbac.Rule) error
 	}
 )
 
@@ -47,9 +47,9 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 		return nil, err
 	}
 
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Setting access to "inherit" will make Grant remove the rule
-		rule.Access = permissions.Inherit
+		rule.Access = rbac.Inherit
 		return nil
 	})
 
@@ -58,7 +58,7 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 
 func (ctrl Permissions) Update(ctx context.Context, r *request.PermissionsUpdate) (interface{}, error) {
 	rr := r.Rules
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Make sure everything is properly set
 		rule.RoleID = r.RoleID
 		return nil

messaging/rest/request/permissions.go

@@ -12,7 +12,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/payload"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/go-chi/chi"
 	"io"
 	"mime/multipart"
@@ -63,7 +63,7 @@ type (
 		// Rules POST parameter
 		//
 		// List of permission rules to set
-		Rules permissions.RuleSet
+		Rules rbac.RuleSet
 	}
 )
 
@@ -247,7 +247,7 @@ func (r PermissionsUpdate) GetRoleID() uint64 {
 }
 
 // Auditable returns all auditable/loggable parameters
-func (r PermissionsUpdate) GetRules() permissions.RuleSet {
+func (r PermissionsUpdate) GetRules() rbac.RuleSet {
 	return r.Rules
 }
 
@@ -272,7 +272,7 @@ func (r *PermissionsUpdate) Fill(req *http.Request) (err error) {
 		// POST params
 
 		//if val, ok := req.Form["rules[]"]; ok && len(val) > 0  {
-		//    r.Rules, err = permissions.RuleSet(val), nil
+		//    r.Rules, err = rbac.RuleSet(val), nil
 		//    if err != nil {
 		//        return err
 		//    }

messaging/service/access_control.go

@@ -6,23 +6,23 @@ import (
 	"github.com/cortezaproject/corteza-server/messaging/types"
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	accessControl struct {
-		permissions accessControlPermissionServicer
+		permissions accessControlRBACServicer
 		actionlog   actionlog.Recorder
 	}
 
-	accessControlPermissionServicer interface {
-		Can([]uint64, permissions.Resource, permissions.Operation, ...permissions.CheckAccessFunc) bool
-		Grant(context.Context, permissions.Whitelist, ...*permissions.Rule) error
-		FindRulesByRoleID(roleID uint64) (rr permissions.RuleSet)
+	accessControlRBACServicer interface {
+		Can([]uint64, rbac.Resource, rbac.Operation, ...rbac.CheckAccessFunc) bool
+		Grant(context.Context, rbac.Whitelist, ...*rbac.Rule) error
+		FindRulesByRoleID(roleID uint64) (rr rbac.RuleSet)
 	}
 )
 
-func AccessControl(perm accessControlPermissionServicer) *accessControl {
+func AccessControl(perm accessControlRBACServicer) *accessControl {
 	return &accessControl{
 		permissions: perm,
 		actionlog:   DefaultActionlog,
@@ -30,132 +30,132 @@ func AccessControl(perm accessControlPermissionServicer) *accessControl {
 }
 
 // Effective returns a list of effective service-level permissions
-func (svc accessControl) Effective(ctx context.Context) (ee permissions.EffectiveSet) {
-	ee = permissions.EffectiveSet{}
+func (svc accessControl) Effective(ctx context.Context) (ee rbac.EffectiveSet) {
+	ee = rbac.EffectiveSet{}
 
-	ee.Push(types.MessagingPermissionResource, "access", svc.CanAccess(ctx))
-	ee.Push(types.MessagingPermissionResource, "grant", svc.CanGrant(ctx))
-	ee.Push(types.MessagingPermissionResource, "settings.read", svc.CanReadSettings(ctx))
-	ee.Push(types.MessagingPermissionResource, "settings.manage", svc.CanManageSettings(ctx))
-	ee.Push(types.MessagingPermissionResource, "channel.public.create", svc.CanCreatePublicChannel(ctx))
-	ee.Push(types.MessagingPermissionResource, "channel.private.create", svc.CanCreatePrivateChannel(ctx))
-	ee.Push(types.MessagingPermissionResource, "channel.group.create", svc.CanCreateGroupChannel(ctx))
+	ee.Push(types.MessagingRBACResource, "access", svc.CanAccess(ctx))
+	ee.Push(types.MessagingRBACResource, "grant", svc.CanGrant(ctx))
+	ee.Push(types.MessagingRBACResource, "settings.read", svc.CanReadSettings(ctx))
+	ee.Push(types.MessagingRBACResource, "settings.manage", svc.CanManageSettings(ctx))
+	ee.Push(types.MessagingRBACResource, "channel.public.create", svc.CanCreatePublicChannel(ctx))
+	ee.Push(types.MessagingRBACResource, "channel.private.create", svc.CanCreatePrivateChannel(ctx))
+	ee.Push(types.MessagingRBACResource, "channel.group.create", svc.CanCreateGroupChannel(ctx))
 
 	return
 }
 
 func (svc accessControl) CanAccess(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "access")
+	return svc.can(ctx, types.MessagingRBACResource, "access")
 }
 
 func (svc accessControl) CanGrant(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "grant")
+	return svc.can(ctx, types.MessagingRBACResource, "grant")
 }
 
 func (svc accessControl) CanReadSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "settings.read")
+	return svc.can(ctx, types.MessagingRBACResource, "settings.read")
 }
 
 func (svc accessControl) CanManageSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "settings.manage")
+	return svc.can(ctx, types.MessagingRBACResource, "settings.manage")
 }
 
 func (svc accessControl) CanCreatePublicChannel(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "channel.public.create", permissions.Allowed)
+	return svc.can(ctx, types.MessagingRBACResource, "channel.public.create", rbac.Allowed)
 }
 
 func (svc accessControl) CanCreatePrivateChannel(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "channel.private.create", permissions.Allowed)
+	return svc.can(ctx, types.MessagingRBACResource, "channel.private.create", rbac.Allowed)
 }
 
 func (svc accessControl) CanCreateGroupChannel(ctx context.Context) bool {
-	return svc.can(ctx, types.MessagingPermissionResource, "channel.group.create", permissions.Allowed)
+	return svc.can(ctx, types.MessagingRBACResource, "channel.group.create", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "update", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "update", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanReadChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "read", svc.canReadFallback(ch))
+	return svc.can(ctx, ch.RBACResource(), "read", svc.canReadFallback(ch))
 }
 
 func (svc accessControl) CanJoinChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "join", svc.canJoinFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "join", svc.canJoinFallback(ctx, ch))
 }
 
 func (svc accessControl) CanLeaveChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "leave", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "leave", rbac.Allowed)
 }
 
 func (svc accessControl) CanArchiveChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "archive", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "archive", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanUnarchiveChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "unarchive", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "unarchive", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanDeleteChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "delete", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "delete", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanUndeleteChannel(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "undelete", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "undelete", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanManageChannelMembers(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "members.manage", svc.isChannelOwnerFallback(ctx, ch))
+	return svc.can(ctx, ch.RBACResource(), "members.manage", svc.isChannelOwnerFallback(ctx, ch))
 }
 
 func (svc accessControl) CanChangeChannelMembershipPolicy(ctx context.Context, ch *types.Channel) bool {
 	// @todo introduce dedicated channel op. for this.
-	return svc.can(ctx, types.MessagingPermissionResource, "grant")
+	return svc.can(ctx, types.MessagingRBACResource, "grant")
 }
 
 func (svc accessControl) CanManageChannelAttachments(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "attachments.manage")
+	return svc.can(ctx, ch.RBACResource(), "attachments.manage")
 }
 
 func (svc accessControl) CanSendMessage(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.send", svc.canSendMessagesFallback(ch))
+	return svc.can(ctx, ch.RBACResource(), "message.send", svc.canSendMessagesFallback(ch))
 }
 
 func (svc accessControl) CanReplyMessage(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.reply", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "message.reply", rbac.Allowed)
 }
 
 func (svc accessControl) CanEmbedMessage(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.embed", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "message.embed", rbac.Allowed)
 }
 
 func (svc accessControl) CanAttachMessage(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.attach", svc.canSendMessagesFallback(ch))
+	return svc.can(ctx, ch.RBACResource(), "message.attach", svc.canSendMessagesFallback(ch))
 }
 
 func (svc accessControl) CanUpdateOwnMessages(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.update.own", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "message.update.own", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateMessages(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.update.all")
+	return svc.can(ctx, ch.RBACResource(), "message.update.all")
 }
 
 func (svc accessControl) CanDeleteOwnMessages(ctx context.Context, ch *types.Channel) bool {
 	// @todo implement
-	return svc.can(ctx, ch.PermissionResource(), "message.delete.own", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "message.delete.own", rbac.Allowed)
 }
 
 func (svc accessControl) CanDeleteMessages(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.delete.all")
+	return svc.can(ctx, ch.RBACResource(), "message.delete.all")
 }
 
 func (svc accessControl) CanReactMessage(ctx context.Context, ch *types.Channel) bool {
-	return svc.can(ctx, ch.PermissionResource(), "message.react", permissions.Allowed)
+	return svc.can(ctx, ch.RBACResource(), "message.react", rbac.Allowed)
 }
 
-func (svc accessControl) canJoinFallback(ctx context.Context, ch *types.Channel) func() permissions.Access {
-	return func() permissions.Access {
+func (svc accessControl) canJoinFallback(ctx context.Context, ch *types.Channel) func() rbac.Access {
+	return func() rbac.Access {
 		userID := auth.GetIdentityFromContext(ctx).Identity()
 
 		isMember := ch.Member != nil
@@ -164,32 +164,32 @@ func (svc accessControl) canJoinFallback(ctx context.Context, ch *types.Channel)
 		isPublic := ch.Type == types.ChannelTypePublic
 
 		if (ch.IsValid() && isPublic) || isOwner {
-			return permissions.Allow
+			return rbac.Allow
 		}
-		return permissions.Deny
+		return rbac.Deny
 	}
 }
 
-func (svc accessControl) canReadFallback(ch *types.Channel) func() permissions.Access {
-	return func() permissions.Access {
+func (svc accessControl) canReadFallback(ch *types.Channel) func() rbac.Access {
+	return func() rbac.Access {
 		if ch.IsValid() && (ch.Type == types.ChannelTypePublic || ch.Member != nil) {
-			return permissions.Allow
+			return rbac.Allow
 		}
-		return permissions.Deny
+		return rbac.Deny
 	}
 }
 
-func (svc accessControl) canSendMessagesFallback(ch *types.Channel) func() permissions.Access {
-	return func() permissions.Access {
+func (svc accessControl) canSendMessagesFallback(ch *types.Channel) func() rbac.Access {
+	return func() rbac.Access {
 		if ch.IsValid() && (ch.Type == types.ChannelTypePublic || ch.Member != nil) {
-			return permissions.Allow
+			return rbac.Allow
 		}
-		return permissions.Deny
+		return rbac.Deny
 	}
 }
 
-func (svc accessControl) isChannelOwnerFallback(ctx context.Context, ch *types.Channel) func() permissions.Access {
-	return func() permissions.Access {
+func (svc accessControl) isChannelOwnerFallback(ctx context.Context, ch *types.Channel) func() rbac.Access {
+	return func() rbac.Access {
 		userID := auth.GetIdentityFromContext(ctx).Identity()
 
 		isMember := ch.Member != nil
@@ -197,13 +197,13 @@ func (svc accessControl) isChannelOwnerFallback(ctx context.Context, ch *types.C
 		isOwner := isCreator || (isMember && ch.Member.Type == types.ChannelMembershipTypeOwner)
 
 		if isOwner {
-			return permissions.Allow
+			return rbac.Allow
 		}
-		return permissions.Deny
+		return rbac.Deny
 	}
 }
 
-func (svc accessControl) can(ctx context.Context, res permissions.Resource, op permissions.Operation, ff ...permissions.CheckAccessFunc) bool {
+func (svc accessControl) can(ctx context.Context, res rbac.Resource, op rbac.Operation, ff ...rbac.CheckAccessFunc) bool {
 	var (
 		u     = auth.GetIdentityFromContext(ctx)
 		roles = u.Roles()
@@ -219,7 +219,7 @@ func (svc accessControl) can(ctx context.Context, res permissions.Resource, op p
 	return svc.permissions.Can(roles, res, op, ff...)
 }
 
-func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) error {
+func (svc accessControl) Grant(ctx context.Context, rr ...*rbac.Rule) error {
 	if !svc.CanGrant(ctx) {
 		return AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -233,7 +233,7 @@ func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) err
 	return nil
 }
 
-func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule) {
+func (svc accessControl) logGrants(ctx context.Context, rr []*rbac.Rule) {
 	if svc.actionlog == nil {
 		return
 	}
@@ -247,7 +247,7 @@ func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule)
 	}
 }
 
-func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (permissions.RuleSet, error) {
+func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (rbac.RuleSet, error) {
 	if !svc.CanGrant(ctx) {
 		return nil, AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -255,11 +255,11 @@ func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (
 	return svc.permissions.FindRulesByRoleID(roleID), nil
 }
 
-func (svc accessControl) Whitelist() permissions.Whitelist {
-	var wl = permissions.Whitelist{}
+func (svc accessControl) Whitelist() rbac.Whitelist {
+	var wl = rbac.Whitelist{}
 
 	wl.Set(
-		types.MessagingPermissionResource,
+		types.MessagingRBACResource,
 		"access",
 		"grant",
 		"settings.read",
@@ -270,7 +270,7 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.ChannelPermissionResource,
+		types.ChannelRBACResource,
 		"update",
 		"read",
 		"join",

messaging/service/access_control_actions.gen.go

@@ -16,12 +16,12 @@ import (
 	"time"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	accessControlActionProps struct {
-		rule *permissions.Rule
+		rule *rbac.Rule
 	}
 
 	accessControlAction struct {
@@ -66,7 +66,7 @@ var (
 //
 // This function is auto-generated.
 //
-func (p *accessControlActionProps) setRule(rule *permissions.Rule) *accessControlActionProps {
+func (p *accessControlActionProps) setRule(rule *rbac.Rule) *accessControlActionProps {
 	p.rule = rule
 	return p
 }

messaging/service/access_control_actions.yaml

@@ -10,11 +10,11 @@ defaultActionSeverity: notice
 defaultErrorSeverity: alert
 
 import:
-  - github.com/cortezaproject/corteza-server/pkg/permissions
+  - github.com/cortezaproject/corteza-server/pkg/rbac
 
 props:
   - name: rule
-    type: "*permissions.Rule"
+    type: "*rbac.Rule"
     fields: [ operation, roleID, access, resource ]
 
 actions:

messaging/service/service.go

@@ -9,7 +9,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/objstore/minio"
 	"github.com/cortezaproject/corteza-server/pkg/objstore/plain"
 	"github.com/cortezaproject/corteza-server/pkg/options"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"go.uber.org/zap"
 	"time"
@@ -20,8 +20,8 @@ type (
 		Transaction(callback func() error) error
 	}
 
-	permissionServicer interface {
-		accessControlPermissionServicer
+	RBACServicer interface {
+		accessControlRBACServicer
 		Watch(ctx context.Context)
 	}
 
@@ -39,8 +39,6 @@ var (
 	// so that we can differentiate between it and the file-only store
 	DefaultStore store.Storer
 
-	DefaultPermissions permissionServicer
-
 	DefaultLogger *zap.Logger
 
 	DefaultActionlog actionlog.Recorder
@@ -90,13 +88,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 		DefaultActionlog = actionlog.NewService(DefaultStore, log, tee, policy)
 	}
 
-	if DefaultPermissions == nil {
-		// Do not override permissions service stored under DefaultPermissions
-		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Global()
-	}
-
-	DefaultAccessControl = AccessControl(DefaultPermissions)
+	DefaultAccessControl = AccessControl(rbac.Global())
 
 	if DefaultObjectStore == nil {
 		const svcPath = "messaging"
@@ -150,5 +142,5 @@ func Activate(ctx context.Context) (err error) {
 }
 
 func Watchers(ctx context.Context) {
-	DefaultPermissions.Watch(ctx)
+	//
 }

messaging/types/channel.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/jmoiron/sqlx/types"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -19,7 +19,7 @@ type (
 
 		MembershipPolicy ChannelMembershipPolicy `json:"membershipPolicy"`
 
-		CreatorID      uint64 `json:"creatorId"`
+		CreatorID uint64 `json:"creatorId"`
 
 		CreatedAt time.Time  `json:"createdAt,omitempty"`
 		UpdatedAt *time.Time `json:"updatedAt,omitempty"`
@@ -78,8 +78,8 @@ type (
 )
 
 // Resource returns a system resource ID for this type
-func (c Channel) PermissionResource() permissions.Resource {
-	return ChannelPermissionResource.AppendID(c.ID)
+func (c Channel) RBACResource() rbac.Resource {
+	return ChannelRBACResource.AppendID(c.ID)
 }
 
 func (c Channel) DynamicRoles(userID uint64) []uint64 {

messaging/types/message.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -144,8 +144,8 @@ func (m *Message) IsValid() bool {
 	return m.DeletedAt == nil
 }
 
-func (m Message) PermissionResource() permissions.Resource {
-	return ChannelPermissionResource.AppendID(m.ChannelID)
+func (m Message) RBACResource() rbac.Resource {
+	return ChannelRBACResource.AppendID(m.ChannelID)
 }
 
 func (c Message) DynamicRoles(userID uint64) []uint64 {

messaging/types/permission_resources.go

@@ -1,8 +1,8 @@
 package types
 
 import (
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
-const MessagingPermissionResource = permissions.Resource("messaging")
-const ChannelPermissionResource = permissions.Resource("messaging:channel:")
+const MessagingRBACResource = rbac.Resource("messaging")
+const ChannelRBACResource = rbac.Resource("messaging:channel:")

pkg/actionlog/types.gen_test.go

@@ -1,68 +0,0 @@
-package actionlog
-
-import (
-	"testing"
-
-	"errors"
-
-	"github.com/stretchr/testify/require"
-)
-
-// 	Hello! This file is auto-generated.
-
-func TestActionSetWalk(t *testing.T) {
-	var (
-		value = make(ActionSet, 3)
-		req   = require.New(t)
-	)
-
-	// check walk with no errors
-	{
-		err := value.Walk(func(*Action) error {
-			return nil
-		})
-		req.NoError(err)
-	}
-
-	// check walk with error
-	req.Error(value.Walk(func(*Action) error { return errors.New("walk error") }))
-
-}
-
-func TestActionSetFilter(t *testing.T) {
-	var (
-		value = make(ActionSet, 3)
-		req   = require.New(t)
-	)
-
-	// filter nothing
-	{
-		set, err := value.Filter(func(*Action) (bool, error) {
-			return true, nil
-		})
-		req.NoError(err)
-		req.Equal(len(set), len(value))
-	}
-
-	// filter one item
-	{
-		found := false
-		set, err := value.Filter(func(*Action) (bool, error) {
-			if !found {
-				found = true
-				return found, nil
-			}
-			return false, nil
-		})
-		req.NoError(err)
-		req.Len(set, 1)
-	}
-
-	// filter error
-	{
-		_, err := value.Filter(func(*Action) (bool, error) {
-			return false, errors.New("filter error")
-		})
-		req.Error(err)
-	}
-}

pkg/corredor/service.go

@@ -18,7 +18,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
 	"github.com/cortezaproject/corteza-server/pkg/options"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/sentry"
 	"github.com/cortezaproject/corteza-server/system/types"
 )
@@ -75,7 +75,7 @@ type (
 		userLookupCache userLookupCacheMap
 
 		// set of permission rules, generated from security info of each script
-		permissions permissions.RuleSet
+		permissions rbac.RuleSet
 	}
 
 	ScriptArgs interface {
@@ -111,7 +111,7 @@ type (
 	}
 
 	permissionRuleChecker interface {
-		Check(res permissions.Resource, op permissions.Operation, roles ...uint64) permissions.Access
+		Check(res rbac.Resource, op rbac.Operation, roles ...uint64) rbac.Access
 	}
 )
 
@@ -145,7 +145,7 @@ var (
 )
 
 const (
-	permOpExec permissions.Operation = "exec"
+	permOpExec rbac.Operation = "exec"
 )
 
 func Service() *service {
@@ -175,7 +175,7 @@ func NewService(logger *zap.Logger, opt options.CorredorOpt) *service {
 
 		authTokenMaker: auth.DefaultJwtHandler,
 		eventRegistry:  eventbus.Service(),
-		permissions:    permissions.RuleSet{},
+		permissions:    rbac.RuleSet{},
 
 		userLookupCache: userLookupCacheMap{},
 
@@ -401,7 +401,7 @@ func (svc service) canExec(ctx context.Context, script string) bool {
 		return true
 	}
 
-	return svc.permissions.Check(permissions.Resource(script), permOpExec, u.Roles()...) != permissions.Deny
+	return svc.permissions.Check(rbac.Resource(script), permOpExec, u.Roles()...) != rbac.Deny
 }
 
 func (svc *service) loadServerScripts(ctx context.Context) {
@@ -452,7 +452,7 @@ func (svc *service) registerServerScripts(ctx context.Context, ss ...*ServerScri
 	svc.explicit = make(map[string]map[string]bool)
 
 	// Reset security
-	svc.permissions = permissions.RuleSet{}
+	svc.permissions = rbac.RuleSet{}
 
 	// reset the cache
 	svc.userLookupCache = userLookupCacheMap{}
@@ -884,7 +884,7 @@ func (svc *service) registerClientScripts(ss ...*ClientScript) {
 // User and role caches (uc, rc args) hold list of users/roles
 // that were already loaded/checked
 //
-func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScript) (sec *ScriptSecurity, rr permissions.RuleSet, err error) {
+func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScript) (sec *ScriptSecurity, rr rbac.RuleSet, err error) {
 	if script.Security == nil {
 		return
 	}
@@ -892,18 +892,18 @@ func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScri
 	var (
 		// collectors for allow&deny rules
 		// we'll merge
-		allow = permissions.RuleSet{}
-		deny  = permissions.RuleSet{}
+		allow = rbac.RuleSet{}
+		deny  = rbac.RuleSet{}
 
-		permRuleGenerator = func(script string, access permissions.Access, roles ...string) (permissions.RuleSet, error) {
-			out := make([]*permissions.Rule, len(roles))
+		permRuleGenerator = func(script string, access rbac.Access, roles ...string) (rbac.RuleSet, error) {
+			out := make([]*rbac.Rule, len(roles))
 			for i, role := range roles {
 				if r, err := svc.roles.FindByAny(ctx, role); err != nil {
 					return nil, errors.Wrapf(err, "could not load security role: %s", role)
 				} else {
-					out[i] = &permissions.Rule{
+					out[i] = &rbac.Rule{
 						RoleID:    r.ID,
-						Resource:  permissions.Resource(script),
+						Resource:  rbac.Resource(script),
 						Operation: permOpExec,
 						Access:    access,
 					}
@@ -928,11 +928,11 @@ func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScri
 		}
 	}
 
-	if allow, err = permRuleGenerator(script.Name, permissions.Allow, script.Security.Allow...); err != nil {
+	if allow, err = permRuleGenerator(script.Name, rbac.Allow, script.Security.Allow...); err != nil {
 		return
 	}
 
-	if deny, err = permRuleGenerator(script.Name, permissions.Deny, script.Security.Deny...); err != nil {
+	if deny, err = permRuleGenerator(script.Name, rbac.Deny, script.Security.Deny...); err != nil {
 		return
 	}
 

pkg/corredor/service_test.go

@@ -6,7 +6,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
 	"github.com/cortezaproject/corteza-server/pkg/logger"
 	"github.com/cortezaproject/corteza-server/pkg/options"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/system/types"
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/zap"
@@ -67,7 +67,7 @@ func TestFindOnManual(t *testing.T) {
 		ctx = context.Background()
 
 		svc = &service{
-			permissions: permissions.RuleSet{},
+			permissions: rbac.RuleSet{},
 			sScripts: ScriptSet{
 				&Script{
 					Name: "s1",
@@ -166,7 +166,7 @@ func TestService_canExec(t *testing.T) {
 		svc = &service{
 			users:       &mockUserSvc{user: &types.User{ID: 42, Email: "dummy@mo.ck", Handle: "dummy"}},
 			roles:       &mockRoleSvc{role: &types.Role{ID: 84, Handle: "role", Name: "ROLE"}},
-			permissions: permissions.RuleSet{},
+			permissions: rbac.RuleSet{},
 		}
 
 		ctx = auth.SetIdentityToContext(context.Background(), auth.NewIdentity(42, 84))

pkg/importer/importer.go

@@ -3,7 +3,7 @@ package importer
 import (
 	"context"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 )
 
@@ -18,7 +18,7 @@ type (
 		CastResourcesSet(string, interface{}) error
 		UpdateResources(base string, handle string, ID uint64)
 		UpdateRoles(handle string, ID uint64)
-		Store(context.Context, permissions.ImportKeeper) error
+		Store(context.Context, rbac.ImportKeeper) error
 	}
 
 	SettingImporter interface {

pkg/rbac/effective.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 type (
 	effective struct {

pkg/rbac/importer.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"context"

pkg/rbac/importer_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"testing"

pkg/rbac/permissions.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 // General permission stuff, types, constants
 

pkg/rbac/permissions_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"reflect"

pkg/rbac/resource.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"strconv"
@@ -23,7 +23,7 @@ func (r Resource) append(suffix string) Resource {
 }
 
 // Resource to satisfty interfaces and ease development
-func (r Resource) PermissionResource() Resource {
+func (r Resource) RBACResource() Resource {
 	return r
 }
 

pkg/rbac/resource_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"testing"
@@ -18,7 +18,7 @@ func TestResource(t *testing.T) {
 				Resource("a:b:c"),
 				"a:b:c"},
 			{
-				Resource("a:b:c").PermissionResource(),
+				Resource("a:b:c").RBACResource(),
 				"a:b:c"},
 			{
 				Resource("a:b:").AppendID(1),

pkg/rbac/rule.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"fmt"

pkg/rbac/ruleset_checks.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 // Check verifies if role has access to perform an operation on a resource
 //

pkg/rbac/ruleset_checks_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"testing"

pkg/rbac/ruleset_utils.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import "github.com/cortezaproject/corteza-server/pkg/slice"
 

pkg/rbac/ruleset_utils_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"testing"

pkg/rbac/service.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"context"
@@ -24,11 +24,21 @@ type (
 
 	// RuleFilter is a dummy struct to satisfy store codegen
 	RuleFilter struct{}
+
+	Controller interface {
+		Can(roles []uint64, res Resource, op Operation, ff ...CheckAccessFunc) bool
+		Check(res Resource, op Operation, roles ...uint64) (v Access)
+		Grant(ctx context.Context, wl Whitelist, rules ...*Rule) (err error)
+		Watch(ctx context.Context)
+		FindRulesByRoleID(roleID uint64) (rr RuleSet)
+		Rules() (rr RuleSet)
+		Reload(ctx context.Context)
+	}
 )
 
 var (
-	// Global permissioning service
-	gRBAC *service
+	// Global RBAC service
+	gRBAC Controller
 )
 
 const (
@@ -36,17 +46,21 @@ const (
 )
 
 // Global returns global RBAC service
-func Global() *service {
+func Global() Controller {
 	return gRBAC
 }
 
+func SetGlobal(svc Controller) {
+	gRBAC = svc
+}
+
 func Initialize(logger *zap.Logger, s rbacRulesStore) error {
 	if gRBAC != nil {
 		// Prevent multiple initializations
 		return nil
 	}
 
-	gRBAC = NewService(logger, s)
+	SetGlobal(NewService(logger, s))
 	return nil
 }
 
@@ -77,7 +91,7 @@ func NewService(logger *zap.Logger, s rbacRulesStore) (svc *service) {
 // When not explicitly allowed through rules or fallbacks, function will return FALSE.
 func (svc service) Can(roles []uint64, res Resource, op Operation, ff ...CheckAccessFunc) bool {
 	// Checking rules
-	var v = svc.Check(res.PermissionResource(), op, roles...)
+	var v = svc.Check(res.RBACResource(), op, roles...)
 	if v != Inherit {
 		return v == Allow
 	}

pkg/rbac/service_alt.go

@@ -1,12 +1,11 @@
-package permissions
+package rbac
 
 import (
 	"context"
 	"fmt"
+	"go.uber.org/zap"
 	"strings"
 	"sync"
-
-	"go.uber.org/zap"
 )
 
 type (
@@ -69,13 +68,13 @@ func (svc *TestService) String() (out string) {
 	return
 }
 
-func NewTestService(ctx context.Context, logger *zap.Logger, s rbacRulesStore) (svc *TestService) {
+func NewTestService(logger *zap.Logger, s rbacRulesStore) (svc *TestService) {
 	svc = &TestService{
 		service: service{
 			l: &sync.Mutex{},
 			f: make(chan bool),
 
-			logger: logger.Named("permissions"),
+			logger: logger.Named("rbac-test"),
 			store:  s,
 		},
 	}

pkg/rbac/store_interface.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 import (
 	"context"

pkg/rbac/type_set.gen.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 // This file is auto-generated.
 //
@@ -6,7 +6,7 @@ package permissions
 // the code is regenerated.
 //
 // Definitions file that controls how this file is generated:
-// pkg/permissions/types.yaml
+// pkg/rbac/types.yaml
 
 type (
 

pkg/rbac/type_set.gen_test.go

@@ -1,4 +1,4 @@
-package permissions
+package rbac
 
 // This file is auto-generated.
 //
@@ -6,7 +6,7 @@ package permissions
 // the code is regenerated.
 //
 // Definitions file that controls how this file is generated:
-// pkg/permissions/types.yaml
+// pkg/rbac/types.yaml
 
 import (
 	"fmt"

pkg/rbac/types.yaml

@@ -1,4 +1,4 @@
-package: permissions
+package: rbac
 types:
   Rule:
     noIdField: true

provision/system/provision.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"github.com/cortezaproject/corteza-server/pkg/id"
 	impAux "github.com/cortezaproject/corteza-server/pkg/importer"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/system/importer"
@@ -34,7 +34,7 @@ func checkRoles(ctx context.Context, s store.Storer) (bool, error) {
 
 // Check if any RBAC rules exist
 func checkRbacRules(ctx context.Context, s store.Storer) (bool, error) {
-	if set, _, err := store.SearchRbacRules(ctx, s, permissions.RuleFilter{}); err != nil {
+	if set, _, err := store.SearchRbacRules(ctx, s, rbac.RuleFilter{}); err != nil {
 		return false, err
 	} else {
 		return len(set) > 0, nil

store/rbac_rules.gen.go

@@ -10,51 +10,51 @@ package store
 
 import (
 	"context"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	RbacRules interface {
-		SearchRbacRules(ctx context.Context, f permissions.RuleFilter) (permissions.RuleSet, permissions.RuleFilter, error)
+		SearchRbacRules(ctx context.Context, f rbac.RuleFilter) (rbac.RuleSet, rbac.RuleFilter, error)
 
-		CreateRbacRule(ctx context.Context, rr ...*permissions.Rule) error
+		CreateRbacRule(ctx context.Context, rr ...*rbac.Rule) error
 
-		UpdateRbacRule(ctx context.Context, rr ...*permissions.Rule) error
+		UpdateRbacRule(ctx context.Context, rr ...*rbac.Rule) error
 
-		UpsertRbacRule(ctx context.Context, rr ...*permissions.Rule) error
+		UpsertRbacRule(ctx context.Context, rr ...*rbac.Rule) error
 
-		DeleteRbacRule(ctx context.Context, rr ...*permissions.Rule) error
+		DeleteRbacRule(ctx context.Context, rr ...*rbac.Rule) error
 		DeleteRbacRuleByRoleIDResourceOperation(ctx context.Context, roleID uint64, resource string, operation string) error
 
 		TruncateRbacRules(ctx context.Context) error
 	}
 )
 
-var _ *permissions.Rule
+var _ *rbac.Rule
 var _ context.Context
 
 // SearchRbacRules returns all matching RbacRules from store
-func SearchRbacRules(ctx context.Context, s RbacRules, f permissions.RuleFilter) (permissions.RuleSet, permissions.RuleFilter, error) {
+func SearchRbacRules(ctx context.Context, s RbacRules, f rbac.RuleFilter) (rbac.RuleSet, rbac.RuleFilter, error) {
 	return s.SearchRbacRules(ctx, f)
 }
 
 // CreateRbacRule creates one or more RbacRules in store
-func CreateRbacRule(ctx context.Context, s RbacRules, rr ...*permissions.Rule) error {
+func CreateRbacRule(ctx context.Context, s RbacRules, rr ...*rbac.Rule) error {
 	return s.CreateRbacRule(ctx, rr...)
 }
 
 // UpdateRbacRule updates one or more (existing) RbacRules in store
-func UpdateRbacRule(ctx context.Context, s RbacRules, rr ...*permissions.Rule) error {
+func UpdateRbacRule(ctx context.Context, s RbacRules, rr ...*rbac.Rule) error {
 	return s.UpdateRbacRule(ctx, rr...)
 }
 
 // UpsertRbacRule creates new or updates existing one or more RbacRules in store
-func UpsertRbacRule(ctx context.Context, s RbacRules, rr ...*permissions.Rule) error {
+func UpsertRbacRule(ctx context.Context, s RbacRules, rr ...*rbac.Rule) error {
 	return s.UpsertRbacRule(ctx, rr...)
 }
 
 // DeleteRbacRule Deletes one or more RbacRules from store
-func DeleteRbacRule(ctx context.Context, s RbacRules, rr ...*permissions.Rule) error {
+func DeleteRbacRule(ctx context.Context, s RbacRules, rr ...*rbac.Rule) error {
 	return s.DeleteRbacRule(ctx, rr...)
 }
 

store/rbac_rules.yaml

@@ -1,8 +1,8 @@
 import:
-  - github.com/cortezaproject/corteza-server/pkg/permissions
+  - github.com/cortezaproject/corteza-server/pkg/rbac
 
 types:
-  type: permissions.Rule
+  type: rbac.Rule
 
 fields:
   - { field: RoleID, isPrimaryKey: true }

store/rdbms/rbac_rules.gen.go

@@ -14,7 +14,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/Masterminds/squirrel"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 )
 
@@ -23,11 +23,11 @@ var _ = errors.Is
 // SearchRbacRules returns all matching rows
 //
 // This function calls convertRbacRuleFilter with the given
-// permissions.RuleFilter and expects to receive a working squirrel.SelectBuilder
-func (s Store) SearchRbacRules(ctx context.Context, f permissions.RuleFilter) (permissions.RuleSet, permissions.RuleFilter, error) {
+// rbac.RuleFilter and expects to receive a working squirrel.SelectBuilder
+func (s Store) SearchRbacRules(ctx context.Context, f rbac.RuleFilter) (rbac.RuleSet, rbac.RuleFilter, error) {
 	var (
 		err error
-		set []*permissions.Rule
+		set []*rbac.Rule
 		q   squirrel.SelectBuilder
 	)
 	q = s.rbacRulesSelectBuilder()
@@ -47,11 +47,11 @@ func (s Store) SearchRbacRules(ctx context.Context, f permissions.RuleFilter) (p
 func (s Store) QueryRbacRules(
 	ctx context.Context,
 	q squirrel.Sqlizer,
-	check func(*permissions.Rule) (bool, error),
-) ([]*permissions.Rule, uint, *permissions.Rule, error) {
+	check func(*rbac.Rule) (bool, error),
+) ([]*rbac.Rule, uint, *rbac.Rule, error) {
 	var (
-		set = make([]*permissions.Rule, 0, DefaultSliceCapacity)
-		res *permissions.Rule
+		set = make([]*rbac.Rule, 0, DefaultSliceCapacity)
+		res *rbac.Rule
 
 		// Query rows with
 		rows, err = s.Query(ctx, q)
@@ -81,7 +81,7 @@ func (s Store) QueryRbacRules(
 }
 
 // CreateRbacRule creates one or more rows in rbac_rules table
-func (s Store) CreateRbacRule(ctx context.Context, rr ...*permissions.Rule) (err error) {
+func (s Store) CreateRbacRule(ctx context.Context, rr ...*rbac.Rule) (err error) {
 	for _, res := range rr {
 		err = s.checkRbacRuleConstraints(ctx, res)
 		if err != nil {
@@ -98,12 +98,12 @@ func (s Store) CreateRbacRule(ctx context.Context, rr ...*permissions.Rule) (err
 }
 
 // UpdateRbacRule updates one or more existing rows in rbac_rules
-func (s Store) UpdateRbacRule(ctx context.Context, rr ...*permissions.Rule) error {
+func (s Store) UpdateRbacRule(ctx context.Context, rr ...*rbac.Rule) error {
 	return s.config.ErrorHandler(s.partialRbacRuleUpdate(ctx, nil, rr...))
 }
 
 // partialRbacRuleUpdate updates one or more existing rows in rbac_rules
-func (s Store) partialRbacRuleUpdate(ctx context.Context, onlyColumns []string, rr ...*permissions.Rule) (err error) {
+func (s Store) partialRbacRuleUpdate(ctx context.Context, onlyColumns []string, rr ...*rbac.Rule) (err error) {
 	for _, res := range rr {
 		err = s.checkRbacRuleConstraints(ctx, res)
 		if err != nil {
@@ -125,7 +125,7 @@ func (s Store) partialRbacRuleUpdate(ctx context.Context, onlyColumns []string,
 }
 
 // UpsertRbacRule updates one or more existing rows in rbac_rules
-func (s Store) UpsertRbacRule(ctx context.Context, rr ...*permissions.Rule) (err error) {
+func (s Store) UpsertRbacRule(ctx context.Context, rr ...*rbac.Rule) (err error) {
 	for _, res := range rr {
 		err = s.checkRbacRuleConstraints(ctx, res)
 		if err != nil {
@@ -142,7 +142,7 @@ func (s Store) UpsertRbacRule(ctx context.Context, rr ...*permissions.Rule) (err
 }
 
 // DeleteRbacRule Deletes one or more rows from rbac_rules table
-func (s Store) DeleteRbacRule(ctx context.Context, rr ...*permissions.Rule) (err error) {
+func (s Store) DeleteRbacRule(ctx context.Context, rr ...*rbac.Rule) (err error) {
 	for _, res := range rr {
 
 		err = s.execDeleteRbacRules(ctx, squirrel.Eq{
@@ -171,8 +171,8 @@ func (s Store) TruncateRbacRules(ctx context.Context) error {
 }
 
 // execLookupRbacRule prepares RbacRule query and executes it,
-// returning permissions.Rule (or error)
-func (s Store) execLookupRbacRule(ctx context.Context, cnd squirrel.Sqlizer) (res *permissions.Rule, err error) {
+// returning rbac.Rule (or error)
+func (s Store) execLookupRbacRule(ctx context.Context, cnd squirrel.Sqlizer) (res *rbac.Rule, err error) {
 	var (
 		row rowScanner
 	)
@@ -223,11 +223,11 @@ func (s Store) execDeleteRbacRules(ctx context.Context, cnd squirrel.Sqlizer) er
 	return s.config.ErrorHandler(s.Exec(ctx, s.DeleteBuilder(s.rbacRuleTable("rls")).Where(cnd)))
 }
 
-func (s Store) internalRbacRuleRowScanner(row rowScanner) (res *permissions.Rule, err error) {
-	res = &permissions.Rule{}
+func (s Store) internalRbacRuleRowScanner(row rowScanner) (res *rbac.Rule, err error) {
+	res = &rbac.Rule{}
 
 	if _, has := s.config.RowScanners["rbacRule"]; has {
-		scanner := s.config.RowScanners["rbacRule"].(func(_ rowScanner, _ *permissions.Rule) error)
+		scanner := s.config.RowScanners["rbacRule"].(func(_ rowScanner, _ *rbac.Rule) error)
 		err = scanner(row, res)
 	} else {
 		err = row.Scan(
@@ -283,11 +283,11 @@ func (Store) rbacRuleColumns(aa ...string) []string {
 
 // {true true false false false}
 
-// internalRbacRuleEncoder encodes fields from permissions.Rule to store.Payload (map)
+// internalRbacRuleEncoder encodes fields from rbac.Rule to store.Payload (map)
 //
 // Encoding is done by using generic approach or by calling encodeRbacRule
 // func when rdbms.customEncoder=true
-func (s Store) internalRbacRuleEncoder(res *permissions.Rule) store.Payload {
+func (s Store) internalRbacRuleEncoder(res *rbac.Rule) store.Payload {
 	return store.Payload{
 		"rel_role":  res.RoleID,
 		"resource":  res.Resource,
@@ -301,7 +301,7 @@ func (s Store) internalRbacRuleEncoder(res *permissions.Rule) store.Payload {
 //
 // Using built-in constraint checking would be more performant but unfortunately we can not rely
 // on the full support (MySQL does not support conditional indexes)
-func (s *Store) checkRbacRuleConstraints(ctx context.Context, res *permissions.Rule) error {
+func (s *Store) checkRbacRuleConstraints(ctx context.Context, res *rbac.Rule) error {
 	// Consider resource valid when all fields in unique constraint check lookups
 	// have valid (non-empty) value
 	//

store/tests/rbac_rules_test.go

@@ -2,7 +2,7 @@ package tests
 
 import (
 	"context"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	_ "github.com/joho/godotenv/autoload"
 	"github.com/stretchr/testify/require"
@@ -17,40 +17,40 @@ func testRbacRules(t *testing.T, s store.RbacRules) {
 	t.Run("create", func(t *testing.T) {
 		req := require.New(t)
 		req.NoError(s.TruncateRbacRules(ctx))
-		req.NoError(s.CreateRbacRule(ctx, permissions.AllowRule(42, "res1", "op1")))
+		req.NoError(s.CreateRbacRule(ctx, rbac.AllowRule(42, "res1", "op1")))
 	})
 
 	t.Run("update", func(t *testing.T) {
 		req := require.New(t)
 		req.NoError(s.TruncateRbacRules(ctx))
-		req.NoError(s.UpdateRbacRule(ctx, permissions.AllowRule(42, "res1", "op1")))
+		req.NoError(s.UpdateRbacRule(ctx, rbac.AllowRule(42, "res1", "op1")))
 	})
 
 	t.Run("upsert", func(t *testing.T) {
 		req := require.New(t)
 		req.NoError(s.TruncateRbacRules(ctx))
-		req.NoError(s.UpsertRbacRule(ctx, permissions.AllowRule(42, "res1", "op1")))
-		set, _, err := s.SearchRbacRules(ctx, permissions.RuleFilter{})
+		req.NoError(s.UpsertRbacRule(ctx, rbac.AllowRule(42, "res1", "op1")))
+		set, _, err := s.SearchRbacRules(ctx, rbac.RuleFilter{})
 		req.NoError(err)
 		req.Len(set, 1)
-		req.True(set[0].Access == permissions.Allow)
+		req.True(set[0].Access == rbac.Allow)
 
-		req.NoError(s.UpsertRbacRule(ctx, permissions.DenyRule(42, "res1", "op1")))
-		set, _, err = s.SearchRbacRules(ctx, permissions.RuleFilter{})
+		req.NoError(s.UpsertRbacRule(ctx, rbac.DenyRule(42, "res1", "op1")))
+		set, _, err = s.SearchRbacRules(ctx, rbac.RuleFilter{})
 		req.NoError(err)
 		req.Len(set, 1)
-		req.True(set[0].Access == permissions.Deny)
+		req.True(set[0].Access == rbac.Deny)
 	})
 
 	t.Run("search", func(t *testing.T) {
 		req := require.New(t)
 		req.NoError(s.TruncateRbacRules(ctx))
 		req.NoError(s.CreateRbacRule(ctx,
-			permissions.AllowRule(42, "res1", "op1"),
-			permissions.AllowRule(42, "res2", "op2"),
+			rbac.AllowRule(42, "res1", "op1"),
+			rbac.AllowRule(42, "res2", "op2"),
 		))
 
-		set, _, err := s.SearchRbacRules(ctx, permissions.RuleFilter{})
+		set, _, err := s.SearchRbacRules(ctx, rbac.RuleFilter{})
 		req.NoError(err)
 		req.Len(set, 2)
 	})

system/commands/exporter.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/cli"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	sysExporter "github.com/cortezaproject/corteza-server/system/exporter"
 	"github.com/cortezaproject/corteza-server/system/service"
@@ -59,12 +59,12 @@ func Exporter() *cobra.Command {
 
 func permissionExporter(ctx context.Context, out *System) {
 	roles := sysTypes.RoleSet{
-		&sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"},
-		&sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"},
+		&sysTypes.Role{ID: rbac.EveryoneRoleID, Handle: "everyone"},
+		&sysTypes.Role{ID: rbac.AdminsRoleID, Handle: "admins"},
 	}
 
-	out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow)
-	out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny)
+	out.Allow = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Allow)
+	out.Deny = sysExporter.ExportableServicePermissions(roles, rbac.Global(), rbac.Deny)
 }
 
 func settingExporter(ctx context.Context, out *System) {

system/commands/rbac.go

@@ -6,7 +6,7 @@ import (
 	cmptyp "github.com/cortezaproject/corteza-server/compose/types"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/cli"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	syssvc "github.com/cortezaproject/corteza-server/system/service"
 	systyp "github.com/cortezaproject/corteza-server/system/types"
 	"github.com/spf13/cobra"
@@ -21,7 +21,7 @@ type (
 
 	rbacModule struct {
 		res   *cmptyp.Module
-		rules permissions.RuleSet
+		rules rbac.RuleSet
 
 		Allow rbacRoleOps `yaml:"allow"`
 		Deny  rbacRoleOps `yaml:"deny"`
@@ -29,7 +29,7 @@ type (
 
 	rbacNamespace struct {
 		res   *cmptyp.Namespace
-		rules permissions.RuleSet
+		rules rbac.RuleSet
 
 		Allow rbacRoleOps `yaml:"allow"`
 		Deny  rbacRoleOps `yaml:"deny"`
@@ -79,7 +79,7 @@ func rbacCheck(app serviceInitializer) *cobra.Command {
 
 				p = rbacPreloads{}
 
-				currentRules = cmpsvc.DefaultPermissions.(interface{ Rules() permissions.RuleSet }).Rules()
+				currentRules = rbac.Global().Rules()
 			)
 
 			if len(args) > 0 {
@@ -164,8 +164,8 @@ func (r *rbacRoot) Resolve(p rbacPreloads) (err error) {
 //		d = ns.Deny.CollectRbacRules()
 //	)
 //
-//	a.Update(cmptyp.NamespacePermissionResource, permissions.Allow)
-//	d.Update(cmptyp.NamespacePermissionResource, permissions.Deny)
+//	a.Update(cmptyp.NamespaceRBACResource, permissions.Allow)
+//	d.Update(cmptyp.NamespaceRBACResource, permissions.Deny)
 //
 //	rr = rr.Merge(a).Merge(d)
 //
@@ -188,15 +188,15 @@ func (ns *rbacNamespace) Resolve(nsHandle string, p rbacPreloads) error {
 		}
 	}
 
-	ns.rules = permissions.RuleSet{}
+	ns.rules = rbac.RuleSet{}
 
-	if allows, err := ns.Allow.Resolve(ns.res.PermissionResource(), permissions.Allow, p); err != nil {
+	if allows, err := ns.Allow.Resolve(ns.res.RBACResource(), rbac.Allow, p); err != nil {
 		return fmt.Errorf("failed to resolve allow rules on namespace %q: %w", nsHandle, err)
 	} else {
 		ns.rules = append(ns.rules, allows...)
 	}
 
-	if allows, err := ns.Deny.Resolve(ns.res.PermissionResource(), permissions.Allow, p); err != nil {
+	if allows, err := ns.Deny.Resolve(ns.res.RBACResource(), rbac.Allow, p); err != nil {
 		return fmt.Errorf("failed to resolve deny rules on namespace %q: %w", nsHandle, err)
 	} else {
 		ns.rules = append(ns.rules, allows...)
@@ -216,27 +216,27 @@ func (ns *rbacNamespace) SortedModuleHandles() []string {
 }
 
 func (m *rbacModule) Resolve(handle string, p rbacPreloads) error {
-	var permRes permissions.Resource
+	var permRes rbac.Resource
 	if handle != "*" {
 		m.res = p.modules.FindByHandle(handle)
 		if m.res == nil {
 			return fmt.Errorf("could not find module by handle: %q", handle)
 		}
 
-		permRes = m.res.PermissionResource()
+		permRes = m.res.RBACResource()
 	} else {
-		permRes = cmptyp.ModulePermissionResource.AppendWildcard()
+		permRes = cmptyp.ModuleRBACResource.AppendWildcard()
 	}
 
-	m.rules = permissions.RuleSet{}
+	m.rules = rbac.RuleSet{}
 
-	if allows, err := m.Allow.Resolve(permRes, permissions.Allow, p); err != nil {
+	if allows, err := m.Allow.Resolve(permRes, rbac.Allow, p); err != nil {
 		return fmt.Errorf("failed to resolve allow rules on module %q: %w", handle, err)
 	} else {
 		m.rules = append(m.rules, allows...)
 	}
 
-	if allows, err := m.Deny.Resolve(permRes, permissions.Allow, p); err != nil {
+	if allows, err := m.Deny.Resolve(permRes, rbac.Allow, p); err != nil {
 		return fmt.Errorf("failed to resolve deny rules on module %q: %w", handle, err)
 	} else {
 		m.rules = append(m.rules, allows...)
@@ -245,27 +245,27 @@ func (m *rbacModule) Resolve(handle string, p rbacPreloads) error {
 	return nil
 }
 
-func (m *rbacModule) diagnose(currentRules permissions.RuleSet, p rbacPreloads) {
+func (m *rbacModule) diagnose(currentRules rbac.RuleSet, p rbacPreloads) {
 	// all modules
 	var (
-		res = cmptyp.ModulePermissionResource.AppendWildcard()
+		res = cmptyp.ModuleRBACResource.AppendWildcard()
 	)
 
 	if m.res != nil {
 		// specific module
-		res = m.res.PermissionResource()
+		res = m.res.RBACResource()
 	}
 
 	// all rules that belong to the module
 	currentRules = currentRules.ByResource(res)
 
-	printRuleDiffs(currentRules, m.rules, permissions.Allow, p)
-	printRuleDiffs(currentRules, m.rules, permissions.Deny, p)
+	printRuleDiffs(currentRules, m.rules, rbac.Allow, p)
+	printRuleDiffs(currentRules, m.rules, rbac.Deny, p)
 
 }
 
-func (rules rbacRoleOps) Resolve(res permissions.Resource, access permissions.Access, p rbacPreloads) (permissions.RuleSet, error) {
-	prs := permissions.RuleSet{}
+func (rules rbacRoleOps) Resolve(res rbac.Resource, access rbac.Access, p rbacPreloads) (rbac.RuleSet, error) {
+	prs := rbac.RuleSet{}
 
 	for roleHandle, ops := range rules {
 		role := p.roles.FindByHandle(roleHandle)
@@ -274,10 +274,10 @@ func (rules rbacRoleOps) Resolve(res permissions.Resource, access permissions.Ac
 		}
 
 		for _, op := range ops {
-			prs = append(prs, &permissions.Rule{
+			prs = append(prs, &rbac.Rule{
 				RoleID:    role.ID,
 				Resource:  res,
-				Operation: permissions.Operation(op),
+				Operation: rbac.Operation(op),
 				Access:    access,
 			})
 		}
@@ -286,7 +286,7 @@ func (rules rbacRoleOps) Resolve(res permissions.Resource, access permissions.Ac
 	return prs, nil
 }
 
-func (r *rbacRoot) diagnose(c permissions.RuleSet, p rbacPreloads) {
+func (r *rbacRoot) diagnose(c rbac.RuleSet, p rbacPreloads) {
 	for _, ns := range r.Namespaces {
 		fmt.Printf("=> [%d] %s\n", ns.res.ID, ns.res.Slug)
 		fmt.Printf("  checking with %d module(s) from YAML\n", len(ns.Modules))
@@ -314,7 +314,7 @@ func (r *rbacRoot) diagnose(c permissions.RuleSet, p rbacPreloads) {
 	}
 }
 
-func printRuleDiffs(current, required permissions.RuleSet, a permissions.Access, p rbacPreloads) {
+func printRuleDiffs(current, required rbac.RuleSet, a rbac.Access, p rbacPreloads) {
 	diff := required.ByAccess(a).Diff(current.ByAccess(a))
 
 	if len(diff) > 0 {

system/exporter/export.go

@@ -3,21 +3,21 @@ package exporter
 import (
 	"strings"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/system/types"
 )
 
 type (
 	ruleFinder interface {
-		FindRulesByRoleID(uint64) permissions.RuleSet
+		FindRulesByRoleID(uint64) rbac.RuleSet
 	}
 )
 
-func ExportableServicePermissions(roles types.RoleSet, rf ruleFinder, access permissions.Access) map[string]map[string][]string {
+func ExportableServicePermissions(roles types.RoleSet, rf ruleFinder, access rbac.Access) map[string]map[string][]string {
 	var (
 		has   bool
 		res   string
-		rules permissions.RuleSet
+		rules rbac.RuleSet
 		sp    = make(map[string]map[string][]string)
 	)
 
@@ -54,10 +54,10 @@ func ExportableServicePermissions(roles types.RoleSet, rf ruleFinder, access per
 	return sp
 }
 
-func ExportableResourcePermissions(roles types.RoleSet, rf ruleFinder, access permissions.Access, resource permissions.Resource) map[string][]string {
+func ExportableResourcePermissions(roles types.RoleSet, rf ruleFinder, access rbac.Access, resource rbac.Resource) map[string][]string {
 	var (
 		has   bool
-		rules permissions.RuleSet
+		rules rbac.RuleSet
 		sp    = make(map[string][]string)
 	)
 

system/importer/default.go

@@ -3,7 +3,7 @@ package importer
 import (
 	"context"
 	"errors"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/system/service"
 	"github.com/cortezaproject/corteza-server/system/types"
@@ -28,7 +28,7 @@ func Import(ctx context.Context, ff ...io.Reader) (err error) {
 		return err
 	}
 
-	pi := permissions.NewImporter(service.DefaultAccessControl.Whitelist())
+	pi := rbac.NewImporter(service.DefaultAccessControl.Whitelist())
 	imp := NewImporter(
 		pi,
 		settings.NewImporter(),

system/importer/importer.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/deinterfacer"
 	"github.com/cortezaproject/corteza-server/pkg/importer"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/system/types"
 )
@@ -72,7 +72,7 @@ func (imp *Importer) Cast(in interface{}) (err error) {
 func (imp *Importer) Store(
 	ctx context.Context,
 	rk roleKeeper,
-	pk permissions.ImportKeeper,
+	pk rbac.ImportKeeper,
 	sk settings.ImportKeeper,
 	roles types.RoleSet,
 ) (err error) {

system/importer/main_test.go

@@ -8,13 +8,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v2"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/settings"
 	"github.com/cortezaproject/corteza-server/system/service"
 )
 
 var (
-	pi  *permissions.Importer
+	pi  *rbac.Importer
 	si  *settings.Importer
 	imp *Importer
 )
@@ -26,7 +26,7 @@ func TestMain(m *testing.M) {
 
 func resetMocks() {
 	// whitelist = nil, anything can be added
-	pi = permissions.NewImporter(service.AccessControl(nil).Whitelist())
+	pi = rbac.NewImporter(service.AccessControl(nil).Whitelist())
 	si = settings.NewImporter()
 	imp = NewImporter(
 		pi,

system/importer/role.go

@@ -83,7 +83,7 @@ func (rImp *Role) Cast(handle string, def interface{}) (err error) {
 			role.Name = name
 
 		case "allow", "deny":
-			return rImp.permissions.CastSet(types.RolePermissionResource.String()+role.Handle, key, val)
+			return rImp.permissions.CastSet(types.RoleRBACResource.String()+role.Handle, key, val)
 
 		default:
 			return fmt.Errorf("unexpected key %q for role %q", key, role.Handle)
@@ -121,7 +121,7 @@ func (rImp *Role) Store(ctx context.Context, k roleKeeper) error {
 			return
 		}
 
-		rImp.permissions.UpdateResources(types.RolePermissionResource.String(), handle, role.ID)
+		rImp.permissions.UpdateResources(types.RoleRBACResource.String(), handle, role.ID)
 		rImp.permissions.UpdateRoles(role.Handle, role.ID)
 
 		return

system/rest.yaml

@@ -807,7 +807,7 @@ endpoints:
   - Client ID
   - Session ID
   imports:
-    - github.com/cortezaproject/corteza-server/pkg/permissions
+    - github.com/cortezaproject/corteza-server/pkg/rbac
   apis:
   - name: list
     path: "/"
@@ -856,7 +856,7 @@ endpoints:
         title: Role ID
       post:
       - name: rules
-        type: permissions.RuleSet
+        type: rbac.RuleSet
         required: true
         title: List of permission rules to set
 - title: Reminders

system/rest/permissions.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/titpetric/factory/resputil"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/system/rest/request"
 	"github.com/cortezaproject/corteza-server/system/service"
 )
@@ -16,10 +16,10 @@ type (
 	}
 
 	permissionsAccessController interface {
-		Effective(context.Context) permissions.EffectiveSet
-		Whitelist() permissions.Whitelist
-		FindRulesByRoleID(context.Context, uint64) (permissions.RuleSet, error)
-		Grant(ctx context.Context, rr ...*permissions.Rule) error
+		Effective(context.Context) rbac.EffectiveSet
+		Whitelist() rbac.Whitelist
+		FindRulesByRoleID(context.Context, uint64) (rbac.RuleSet, error)
+		Grant(ctx context.Context, rr ...*rbac.Rule) error
 	}
 )
 
@@ -47,9 +47,9 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 		return nil, err
 	}
 
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Setting access to "inherit" will make Grant remove the rule
-		rule.Access = permissions.Inherit
+		rule.Access = rbac.Inherit
 		return nil
 	})
 
@@ -58,7 +58,7 @@ func (ctrl Permissions) Delete(ctx context.Context, r *request.PermissionsDelete
 
 func (ctrl Permissions) Update(ctx context.Context, r *request.PermissionsUpdate) (interface{}, error) {
 	rr := r.Rules
-	_ = rr.Walk(func(rule *permissions.Rule) error {
+	_ = rr.Walk(func(rule *rbac.Rule) error {
 		// Make sure everything is properly set
 		rule.RoleID = r.RoleID
 		return nil

system/rest/request/permissions.go

@@ -12,7 +12,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/payload"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/go-chi/chi"
 	"io"
 	"mime/multipart"
@@ -63,7 +63,7 @@ type (
 		// Rules POST parameter
 		//
 		// List of permission rules to set
-		Rules permissions.RuleSet
+		Rules rbac.RuleSet
 	}
 )
 
@@ -247,7 +247,7 @@ func (r PermissionsUpdate) GetRoleID() uint64 {
 }
 
 // Auditable returns all auditable/loggable parameters
-func (r PermissionsUpdate) GetRules() permissions.RuleSet {
+func (r PermissionsUpdate) GetRules() rbac.RuleSet {
 	return r.Rules
 }
 
@@ -272,7 +272,7 @@ func (r *PermissionsUpdate) Fill(req *http.Request) (err error) {
 		// POST params
 
 		//if val, ok := req.Form["rules[]"]; ok && len(val) > 0  {
-		//    r.Rules, err = permissions.RuleSet(val), nil
+		//    r.Rules, err = rbac.RuleSet(val), nil
 		//    if err != nil {
 		//        return err
 		//    }

system/service/access_control.go

@@ -6,28 +6,28 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	internalAuth "github.com/cortezaproject/corteza-server/pkg/auth"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/system/types"
 )
 
 type (
 	accessControl struct {
-		permissions accessControlPermissionServicer
+		permissions accessControlRBACServicer
 		actionlog   actionlog.Recorder
 	}
 
-	accessControlPermissionServicer interface {
-		Can([]uint64, permissions.Resource, permissions.Operation, ...permissions.CheckAccessFunc) bool
-		Grant(context.Context, permissions.Whitelist, ...*permissions.Rule) error
-		FindRulesByRoleID(roleID uint64) (rr permissions.RuleSet)
+	accessControlRBACServicer interface {
+		Can([]uint64, rbac.Resource, rbac.Operation, ...rbac.CheckAccessFunc) bool
+		Grant(context.Context, rbac.Whitelist, ...*rbac.Rule) error
+		FindRulesByRoleID(roleID uint64) (rr rbac.RuleSet)
 	}
 
-	permissionResource interface {
-		PermissionResource() permissions.Resource
+	RBACResource interface {
+		RBACResource() rbac.Resource
 	}
 )
 
-func AccessControl(perm accessControlPermissionServicer) *accessControl {
+func AccessControl(perm accessControlRBACServicer) *accessControl {
 	return &accessControl{
 		permissions: perm,
 		actionlog:   DefaultActionlog,
@@ -35,112 +35,112 @@ func AccessControl(perm accessControlPermissionServicer) *accessControl {
 }
 
 // Effective returns a list of effective service-level permissions
-func (svc accessControl) Effective(ctx context.Context) (ee permissions.EffectiveSet) {
-	ee = permissions.EffectiveSet{}
+func (svc accessControl) Effective(ctx context.Context) (ee rbac.EffectiveSet) {
+	ee = rbac.EffectiveSet{}
 
-	ee.Push(types.SystemPermissionResource, "access", svc.CanAccess(ctx))
-	ee.Push(types.SystemPermissionResource, "grant", svc.CanGrant(ctx))
-	ee.Push(types.SystemPermissionResource, "settings.read", svc.CanReadSettings(ctx))
-	ee.Push(types.SystemPermissionResource, "settings.manage", svc.CanManageSettings(ctx))
-	ee.Push(types.SystemPermissionResource, "application.create", svc.CanCreateApplication(ctx))
-	ee.Push(types.SystemPermissionResource, "role.create", svc.CanCreateRole(ctx))
+	ee.Push(types.SystemRBACResource, "access", svc.CanAccess(ctx))
+	ee.Push(types.SystemRBACResource, "grant", svc.CanGrant(ctx))
+	ee.Push(types.SystemRBACResource, "settings.read", svc.CanReadSettings(ctx))
+	ee.Push(types.SystemRBACResource, "settings.manage", svc.CanManageSettings(ctx))
+	ee.Push(types.SystemRBACResource, "application.create", svc.CanCreateApplication(ctx))
+	ee.Push(types.SystemRBACResource, "role.create", svc.CanCreateRole(ctx))
 
 	return
 }
 
 func (svc accessControl) CanAccess(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "access")
+	return svc.can(ctx, types.SystemRBACResource, "access")
 }
 
 func (svc accessControl) CanGrant(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "grant")
+	return svc.can(ctx, types.SystemRBACResource, "grant")
 }
 
 func (svc accessControl) CanReadSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "settings.read")
+	return svc.can(ctx, types.SystemRBACResource, "settings.read")
 }
 
 func (svc accessControl) CanManageSettings(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "settings.manage")
+	return svc.can(ctx, types.SystemRBACResource, "settings.manage")
 }
 
 func (svc accessControl) CanCreateUser(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "user.create")
+	return svc.can(ctx, types.SystemRBACResource, "user.create")
 }
 
 func (svc accessControl) CanCreateRole(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "role.create")
+	return svc.can(ctx, types.SystemRBACResource, "role.create")
 }
 
 func (svc accessControl) CanCreateApplication(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "application.create")
+	return svc.can(ctx, types.SystemRBACResource, "application.create")
 }
 
 func (svc accessControl) CanAssignReminder(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "reminder.assign")
+	return svc.can(ctx, types.SystemRBACResource, "reminder.assign")
 }
 
 func (svc accessControl) CanReadRole(ctx context.Context, rl *types.Role) bool {
-	return svc.can(ctx, rl.PermissionResource(), "read", permissions.Allowed)
+	return svc.can(ctx, rl.RBACResource(), "read", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateRole(ctx context.Context, rl *types.Role) bool {
-	if rl.ID == permissions.EveryoneRoleID {
+	if rl.ID == rbac.EveryoneRoleID {
 		return false
 	}
 
-	return svc.can(ctx, rl.PermissionResource(), "update")
+	return svc.can(ctx, rl.RBACResource(), "update")
 }
 
 func (svc accessControl) CanDeleteRole(ctx context.Context, rl *types.Role) bool {
-	if rl.ID == permissions.EveryoneRoleID {
+	if rl.ID == rbac.EveryoneRoleID {
 		return false
 	}
 
-	return svc.can(ctx, rl.PermissionResource(), "delete")
+	return svc.can(ctx, rl.RBACResource(), "delete")
 }
 
 func (svc accessControl) CanManageRoleMembers(ctx context.Context, rl *types.Role) bool {
-	if rl.ID == permissions.EveryoneRoleID {
+	if rl.ID == rbac.EveryoneRoleID {
 		return false
 	}
-	return svc.can(ctx, rl.PermissionResource(), "members.manage")
+	return svc.can(ctx, rl.RBACResource(), "members.manage")
 }
 
 func (svc accessControl) CanReadApplication(ctx context.Context, app *types.Application) bool {
-	return svc.can(ctx, app.PermissionResource(), "read", permissions.Allowed)
+	return svc.can(ctx, app.RBACResource(), "read", rbac.Allowed)
 }
 
 func (svc accessControl) CanUpdateApplication(ctx context.Context, app *types.Application) bool {
-	return svc.can(ctx, app.PermissionResource(), "update")
+	return svc.can(ctx, app.RBACResource(), "update")
 }
 
 func (svc accessControl) CanDeleteApplication(ctx context.Context, app *types.Application) bool {
-	return svc.can(ctx, app.PermissionResource(), "delete")
+	return svc.can(ctx, app.RBACResource(), "delete")
 }
 
 func (svc accessControl) CanReadUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "read")
+	return svc.can(ctx, u.RBACResource(), "read")
 }
 
 func (svc accessControl) CanUpdateUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "update")
+	return svc.can(ctx, u.RBACResource(), "update")
 }
 
 func (svc accessControl) CanSuspendUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "suspend")
+	return svc.can(ctx, u.RBACResource(), "suspend")
 }
 
 func (svc accessControl) CanUnsuspendUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "unsuspend")
+	return svc.can(ctx, u.RBACResource(), "unsuspend")
 }
 
 func (svc accessControl) CanDeleteUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "delete")
+	return svc.can(ctx, u.RBACResource(), "delete")
 }
 
 func (svc accessControl) CanImpersonateUser(ctx context.Context, u *types.User) bool {
-	return svc.can(ctx, u.PermissionResource(), "impersonate", permissions.Denied)
+	return svc.can(ctx, u.RBACResource(), "impersonate", rbac.Denied)
 }
 
 func (svc accessControl) CanUnmaskEmail(ctx context.Context, u *types.User) bool {
@@ -149,7 +149,7 @@ func (svc accessControl) CanUnmaskEmail(ctx context.Context, u *types.User) bool
 		return true
 	}
 
-	return svc.can(ctx, u.PermissionResource(), "unmask.email")
+	return svc.can(ctx, u.RBACResource(), "unmask.email")
 }
 
 func (svc accessControl) CanUnmaskName(ctx context.Context, u *types.User) bool {
@@ -158,10 +158,10 @@ func (svc accessControl) CanUnmaskName(ctx context.Context, u *types.User) bool
 		return true
 	}
 
-	return svc.can(ctx, u.PermissionResource(), "unmask.name")
+	return svc.can(ctx, u.RBACResource(), "unmask.name")
 }
 
-func (svc accessControl) can(ctx context.Context, res permissions.Resource, op permissions.Operation, ff ...permissions.CheckAccessFunc) bool {
+func (svc accessControl) can(ctx context.Context, res rbac.Resource, op rbac.Operation, ff ...rbac.CheckAccessFunc) bool {
 	var (
 		u     = internalAuth.GetIdentityFromContext(ctx)
 		roles = u.Roles()
@@ -174,10 +174,10 @@ func (svc accessControl) can(ctx context.Context, res permissions.Resource, op p
 		return true
 	}
 
-	return svc.permissions.Can(roles, res.PermissionResource(), op, ff...)
+	return svc.permissions.Can(roles, res.RBACResource(), op, ff...)
 }
 
-func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) error {
+func (svc accessControl) Grant(ctx context.Context, rr ...*rbac.Rule) error {
 	if !svc.CanGrant(ctx) {
 		return AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -191,7 +191,7 @@ func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) err
 	return nil
 }
 
-func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule) {
+func (svc accessControl) logGrants(ctx context.Context, rr []*rbac.Rule) {
 	if svc.actionlog == nil {
 		return
 	}
@@ -205,7 +205,7 @@ func (svc accessControl) logGrants(ctx context.Context, rr []*permissions.Rule)
 	}
 }
 
-func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (permissions.RuleSet, error) {
+func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (rbac.RuleSet, error) {
 	if !svc.CanGrant(ctx) {
 		return nil, AccessControlErrNotAllowedToSetPermissions()
 	}
@@ -213,11 +213,11 @@ func (svc accessControl) FindRulesByRoleID(ctx context.Context, roleID uint64) (
 	return svc.permissions.FindRulesByRoleID(roleID), nil
 }
 
-func (svc accessControl) Whitelist() permissions.Whitelist {
-	var wl = permissions.Whitelist{}
+func (svc accessControl) Whitelist() rbac.Whitelist {
+	var wl = rbac.Whitelist{}
 
 	wl.Set(
-		types.SystemPermissionResource,
+		types.SystemRBACResource,
 		"access",
 		"grant",
 		"settings.read",
@@ -229,14 +229,14 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.ApplicationPermissionResource,
+		types.ApplicationRBACResource,
 		"read",
 		"update",
 		"delete",
 	)
 
 	wl.Set(
-		types.UserPermissionResource,
+		types.UserRBACResource,
 		"read",
 		"update",
 		"delete",
@@ -248,7 +248,7 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 	)
 
 	wl.Set(
-		types.RolePermissionResource,
+		types.RoleRBACResource,
 		"read",
 		"update",
 		"delete",

system/service/access_control_actions.gen.go

@@ -16,12 +16,12 @@ import (
 	"time"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
 	accessControlActionProps struct {
-		rule *permissions.Rule
+		rule *rbac.Rule
 	}
 
 	accessControlAction struct {
@@ -66,7 +66,7 @@ var (
 //
 // This function is auto-generated.
 //
-func (p *accessControlActionProps) setRule(rule *permissions.Rule) *accessControlActionProps {
+func (p *accessControlActionProps) setRule(rule *rbac.Rule) *accessControlActionProps {
 	p.rule = rule
 	return p
 }

system/service/access_control_actions.yaml

@@ -10,11 +10,11 @@ defaultActionSeverity: notice
 defaultErrorSeverity: alert
 
 import:
-  - github.com/cortezaproject/corteza-server/pkg/permissions
+  - github.com/cortezaproject/corteza-server/pkg/rbac
 
 props:
   - name: rule
-    type: "*permissions.Rule"
+    type: "*rbac.Rule"
     fields: [ operation, roleID, access, resource ]
 
 actions:

system/service/auth.go

@@ -8,8 +8,8 @@ import (
 	internalAuth "github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
 	"github.com/cortezaproject/corteza-server/pkg/handle"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
 	"github.com/cortezaproject/corteza-server/pkg/rand"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/system/service/event"
 	"github.com/cortezaproject/corteza-server/system/types"
@@ -1010,7 +1010,7 @@ func (svc auth) createUserToken(ctx context.Context, u *types.User, kind string)
 func (svc auth) autoPromote(ctx context.Context, u *types.User) (err error) {
 	var (
 		c      uint
-		roleID = permissions.AdminsRoleID
+		roleID = rbac.AdminsRoleID
 		aam    = &authActionProps{user: u, role: &types.Role{ID: roleID}}
 	)
 

system/service/role.go

@@ -5,7 +5,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
 	"github.com/cortezaproject/corteza-server/pkg/handle"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/system/service/event"
 	"github.com/cortezaproject/corteza-server/system/types"
@@ -434,7 +434,7 @@ func (svc role) MemberList(roleID uint64) (mm types.RoleMemberSet, err error) {
 	)
 
 	err = func() error {
-		if roleID == permissions.EveryoneRoleID || roleID == 0 {
+		if roleID == rbac.EveryoneRoleID || roleID == 0 {
 			return RoleErrInvalidID()
 		}
 
@@ -466,7 +466,7 @@ func (svc role) MemberAdd(roleID, memberID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if roleID == permissions.EveryoneRoleID || roleID == 0 || memberID == 0 {
+		if roleID == rbac.EveryoneRoleID || roleID == 0 || memberID == 0 {
 			return RoleErrInvalidID()
 		}
 
@@ -513,7 +513,7 @@ func (svc role) MemberRemove(roleID, memberID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if roleID == permissions.EveryoneRoleID || roleID == 0 || memberID == 0 {
+		if roleID == rbac.EveryoneRoleID || roleID == 0 || memberID == 0 {
 			return RoleErrInvalidID()
 		}
 

system/service/service.go

@@ -12,7 +12,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/objstore/minio"
 	"github.com/cortezaproject/corteza-server/pkg/objstore/plain"
 	"github.com/cortezaproject/corteza-server/pkg/options"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/system/types"
 	"go.uber.org/zap"
@@ -20,8 +20,8 @@ import (
 )
 
 type (
-	permissionServicer interface {
-		accessControlPermissionServicer
+	RBACServicer interface {
+		accessControlRBACServicer
 		Watch(ctx context.Context)
 	}
 
@@ -63,9 +63,6 @@ var (
 	// something that suits their needs.
 	CurrentSubscription permitChecker
 
-	// DefaultPermissions Retrieves & stores permissions
-	DefaultPermissions permissionServicer
-
 	// DefaultSettings controls system's settings
 	DefaultSettings *settings
 
@@ -127,13 +124,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 		DefaultActionlog = actionlog.NewService(DefaultStore, log, tee, policy)
 	}
 
-	if DefaultPermissions == nil {
-		// Do not override permissions service stored under DefaultPermissions
-		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Global()
-	}
-
-	DefaultAccessControl = AccessControl(DefaultPermissions)
+	DefaultAccessControl = AccessControl(rbac.Global())
 
 	DefaultSettings = Settings(DefaultStore, DefaultLogger, DefaultAccessControl, CurrentSettings)
 
@@ -198,8 +189,7 @@ func Activate(ctx context.Context) (err error) {
 }
 
 func Watchers(ctx context.Context) {
-	// Reloading permissions on change
-	DefaultPermissions.Watch(ctx)
+	//
 }
 
 // isGeneric returns true if given error is generic

system/types/applications.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -68,8 +68,8 @@ func (r *Application) DynamicRoles(userID uint64) []uint64 {
 }
 
 // Resource returns a resource ID for this type
-func (r Application) PermissionResource() permissions.Resource {
-	return ApplicationPermissionResource.AppendID(r.ID)
+func (r Application) RBACResource() rbac.Resource {
+	return ApplicationRBACResource.AppendID(r.ID)
 }
 
 func (au *ApplicationUnify) Scan(value interface{}) error {

system/types/permission_resources.go

@@ -1,11 +1,11 @@
 package types
 
 import (
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
-const SystemPermissionResource = permissions.Resource("system")
-const ApplicationPermissionResource = permissions.Resource("system:application:")
-const OrganisationPermissionResource = permissions.Resource("system:organisation:")
-const UserPermissionResource = permissions.Resource("system:user:")
-const RolePermissionResource = permissions.Resource("system:role:")
+const SystemRBACResource = rbac.Resource("system")
+const ApplicationRBACResource = rbac.Resource("system:application:")
+const OrganisationRBACResource = rbac.Resource("system:organisation:")
+const UserRBACResource = rbac.Resource("system:user:")
+const RoleRBACResource = rbac.Resource("system:role:")

system/types/role.go

@@ -4,7 +4,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/filter"
 	"time"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -55,8 +55,8 @@ type (
 )
 
 // Resource returns a resource ID for this type
-func (r *Role) PermissionResource() permissions.Resource {
-	return RolePermissionResource.AppendID(r.ID)
+func (r *Role) RBACResource() rbac.Resource {
+	return RoleRBACResource.AppendID(r.ID)
 }
 
 func (r *Role) DynamicRoles(userID uint64) []uint64 {

system/types/user.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/pkg/errors"
 
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 )
 
 type (
@@ -103,8 +103,8 @@ func (u *User) SetRoles(rr []uint64) {
 }
 
 // Resource returns a resource ID for this type
-func (u *User) PermissionResource() permissions.Resource {
-	return UserPermissionResource.AppendID(u.ID)
+func (u *User) RBACResource() rbac.Resource {
+	return UserRBACResource.AppendID(u.ID)
 }
 
 func (u *User) DynamicRoles(userID uint64) []uint64 {

tests/compose/chart_test.go

@@ -42,8 +42,8 @@ func TestChartRead(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeChart(ns, "some-chart")
 
@@ -61,8 +61,8 @@ func TestChartReadByHandle(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	c := h.makeChart(ns, "some-chart")
 
@@ -78,7 +78,7 @@ func TestChartList(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.makeChart(ns, "chart1")
@@ -96,13 +96,13 @@ func TestChartList_filterForbiden(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.makeChart(ns, "chart")
 	f := h.makeChart(ns, "chart_forbidden")
 
-	h.deny(types.ChartPermissionResource.AppendID(f.ID), "read")
+	h.deny(types.ChartRBACResource.AppendID(f.ID), "read")
 
 	h.apiInit().
 		Get(fmt.Sprintf("/namespace/%d/chart/", ns.ID)).
@@ -132,8 +132,8 @@ func TestChartCreate(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "chart.create")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "chart.create")
 
 	ns := h.makeNamespace("some-namespace")
 
@@ -150,7 +150,7 @@ func TestChartUpdateForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeChart(ns, "some-chart")
 
@@ -167,10 +167,10 @@ func TestChartUpdate(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	res := h.makeChart(ns, "some-chart")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "update")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "update")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/chart/%d", ns.ID, res.ID)).
@@ -189,8 +189,8 @@ func TestChartDeleteForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeChart(ns, "some-chart")
 
@@ -206,9 +206,9 @@ func TestChartDelete(t *testing.T) {
 	h := newHelper(t)
 	h.clearCharts()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "read")
-	h.allow(types.ChartPermissionResource.AppendWildcard(), "delete")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "read")
+	h.allow(types.ChartRBACResource.AppendWildcard(), "delete")
 
 	ns := h.makeNamespace("some-namespace")
 	res := h.makeChart(ns, "some-chart")

tests/compose/main_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/id"
 	"github.com/cortezaproject/corteza-server/pkg/logger"
 	"github.com/cortezaproject/corteza-server/pkg/objstore/plain"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	sysTypes "github.com/cortezaproject/corteza-server/system/types"
 	"github.com/cortezaproject/corteza-server/tests/helpers"
 	"github.com/go-chi/chi"
@@ -54,14 +54,13 @@ func InitTestApp() {
 
 		testApp = helpers.NewIntegrationTestApp(ctx, func(app *app.CortezaApp) (err error) {
 			service.DefaultStore = app.Store
-			service.DefaultPermissions = permissions.NewTestService(ctx, zap.NewNop(), app.Store)
+			rbac.SetGlobal(rbac.NewTestService(zap.NewNop(), app.Store))
 			service.DefaultObjectStore, err = plain.NewWithAfero(afero.NewMemMapFs(), "test")
 			if err != nil {
 				return err
 			}
 
 			eventbus.Set(eventBus)
-			service.DefaultPermissions.(*permissions.TestService).Reload(ctx)
 			return nil
 		})
 
@@ -92,7 +91,7 @@ func newHelper(t *testing.T) helper {
 
 	h.cUser.SetRoles([]uint64{h.roleID})
 
-	service.DefaultPermissions.(*permissions.TestService).ClearGrants()
+	rbac.Global().(*rbac.TestService).ClearGrants()
 	h.mockPermissionsWithAccess()
 
 	return h
@@ -114,8 +113,8 @@ func (h helper) apiInit() *apitest.APITest {
 
 }
 
-func (h helper) mockPermissions(rules ...*permissions.Rule) {
-	h.noError(service.DefaultPermissions.(*permissions.TestService).Grant(
+func (h helper) mockPermissions(rules ...*rbac.Rule) {
+	h.noError(rbac.Global().Grant(
 		// TestService we use does not have any backend storage,
 		context.Background(),
 		// We want to make sure we did not make a mistake with any of the mocked resources or actions
@@ -125,23 +124,23 @@ func (h helper) mockPermissions(rules ...*permissions.Rule) {
 }
 
 // Prepends allow access rule for compose service for everyone
-func (h helper) mockPermissionsWithAccess(rules ...*permissions.Rule) {
+func (h helper) mockPermissionsWithAccess(rules ...*rbac.Rule) {
 	rules = append(
 		rules,
-		permissions.AllowRule(permissions.EveryoneRoleID, types.ComposePermissionResource, "access"),
+		rbac.AllowRule(rbac.EveryoneRoleID, types.ComposeRBACResource, "access"),
 	)
 
 	h.mockPermissions(rules...)
 }
 
 // Set allow permision for test role
-func (h helper) allow(r permissions.Resource, o permissions.Operation) {
-	h.mockPermissions(permissions.AllowRule(h.roleID, r, o))
+func (h helper) allow(r rbac.Resource, o rbac.Operation) {
+	h.mockPermissions(rbac.AllowRule(h.roleID, r, o))
 }
 
 // set deny permission for test role
-func (h helper) deny(r permissions.Resource, o permissions.Operation) {
-	h.mockPermissions(permissions.DenyRule(h.roleID, r, o))
+func (h helper) deny(r rbac.Resource, o rbac.Operation) {
+	h.mockPermissions(rbac.DenyRule(h.roleID, r, o))
 }
 
 // Unwraps error before it passes it to the tester

tests/compose/module_test.go

@@ -60,8 +60,8 @@ func TestModuleRead(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module")
 
@@ -79,8 +79,8 @@ func TestModuleReadByHandle(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	c := h.makeModule(ns, "some-module")
 
@@ -96,7 +96,7 @@ func TestModuleList(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.makeModule(ns, "app")
@@ -114,7 +114,7 @@ func TestModuleListQuery(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.createModule(&types.Module{
@@ -137,13 +137,13 @@ func TestModuleList_filterForbiden(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.makeModule(ns, "module")
 	f := h.makeModule(ns, "module_forbiden")
 
-	h.deny(types.ModulePermissionResource.AppendID(f.ID), "read")
+	h.deny(types.ModuleRBACResource.AppendID(f.ID), "read")
 
 	h.apiInit().
 		Get(fmt.Sprintf("/namespace/%d/module/", ns.ID)).
@@ -173,8 +173,8 @@ func TestModuleCreate(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "module.create")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "module.create")
 
 	ns := h.makeNamespace("some-namespace")
 
@@ -191,7 +191,7 @@ func TestModuleUpdateForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module")
 
@@ -208,10 +208,10 @@ func TestModuleUpdate(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "update")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/module/%d", ns.ID, m.ID)).
@@ -232,10 +232,10 @@ func TestModuleFieldsUpdate(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module", &types.ModuleField{ID: id.Next(), Kind: "String", Name: "existing"})
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "update")
 
 	f := m.Fields[0]
 	fjs := fmt.Sprintf(`{ "name": "%s", "fields": [{ "fieldID": "%d", "name": "existing_edited", "kind": "Number" }, { "name": "new", "kind": "DateTime" }] }`, m.Name, f.ID)
@@ -264,11 +264,11 @@ func TestModuleFieldsPreventUpdate_ifRecordExists(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module", &types.ModuleField{ID: id.Next(), Kind: "String", Name: "existing"})
 	h.makeRecord(m, &types.RecordValue{Name: "existing", Value: "value"})
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "update")
 
 	f := m.Fields[0]
 	fjs := fmt.Sprintf(`{ "name": "%s", "fields": [{ "fieldID": "%d", "name": "existing_edited", "kind": "Number" }, { "name": "new", "kind": "DateTime" }] }`, m.Name, f.ID)
@@ -297,8 +297,8 @@ func TestModuleDeleteForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.makeModule(ns, "some-module")
 
@@ -314,9 +314,9 @@ func TestModuleDelete(t *testing.T) {
 	h := newHelper(t)
 	h.clearModules()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "delete")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "delete")
 
 	ns := h.makeNamespace("some-namespace")
 	res := h.makeModule(ns, "some-module")

tests/compose/namespace_test.go

@@ -53,8 +53,8 @@ func TestNamespaceReadByHandle(t *testing.T) {
 	h := newHelper(t)
 	h.clearNamespaces()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace-" + string(rand.Bytes(20)))
 
 	nsbh, err := service.DefaultNamespace.With(h.secCtx()).FindByHandle(ns.Slug)
@@ -87,7 +87,7 @@ func TestNamespaceList_filterForbiden(t *testing.T) {
 	h.makeNamespace("namespace")
 	f := h.makeNamespace("namespace_forbiden")
 
-	h.deny(types.NamespacePermissionResource.AppendID(f.ID), "read")
+	h.deny(types.NamespaceRBACResource.AppendID(f.ID), "read")
 
 	h.apiInit().
 		Get("/namespace/").
@@ -115,7 +115,7 @@ func TestNamespaceCreate(t *testing.T) {
 	h := newHelper(t)
 	h.clearNamespaces()
 
-	h.allow(types.ComposePermissionResource, "namespace.create")
+	h.allow(types.ComposeRBACResource, "namespace.create")
 
 	h.apiInit().
 		Post("/namespace/").
@@ -146,7 +146,7 @@ func TestNamespaceUpdate(t *testing.T) {
 	h.clearNamespaces()
 
 	ns := h.makeNamespace("some-namespace")
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "update")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "update")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d", ns.ID)).
@@ -179,7 +179,7 @@ func TestNamespaceDelete(t *testing.T) {
 	h := newHelper(t)
 	h.clearNamespaces()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "delete")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "delete")
 
 	ns := h.makeNamespace("some-namespace")
 

tests/compose/page_test.go

@@ -54,8 +54,8 @@ func TestPageRead(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.repoMakePage(ns, "some-page")
 
@@ -73,8 +73,8 @@ func TestPageReadByHandle(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	c := h.repoMakePage(ns, "some-page")
 
@@ -90,7 +90,7 @@ func TestPageList(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.repoMakePage(ns, "app")
@@ -108,13 +108,13 @@ func TestPageList_filterForbiden(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 
 	h.repoMakePage(ns, "page")
 	f := h.repoMakePage(ns, "page_forbiden")
 
-	h.deny(types.PagePermissionResource.AppendID(f.ID), "read")
+	h.deny(types.PageRBACResource.AppendID(f.ID), "read")
 
 	h.apiInit().
 		Get(fmt.Sprintf("/namespace/%d/page/", ns.ID)).
@@ -144,8 +144,8 @@ func TestPageCreate(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "page.create")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "page.create")
 
 	ns := h.makeNamespace("some-namespace")
 
@@ -162,7 +162,7 @@ func TestPageUpdateForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.repoMakePage(ns, "some-page")
 
@@ -179,10 +179,10 @@ func TestPageUpdate(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	res := h.repoMakePage(ns, "some-page")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "update")
+	h.allow(types.PageRBACResource.AppendWildcard(), "update")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/page/%d", ns.ID, res.ID)).
@@ -201,8 +201,8 @@ func TestPageDeleteForbidden(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	m := h.repoMakePage(ns, "some-page")
 
@@ -218,9 +218,9 @@ func TestPageDelete(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "delete")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "delete")
 
 	ns := h.makeNamespace("some-namespace")
 	res := h.repoMakePage(ns, "some-page")
@@ -240,8 +240,8 @@ func TestPageTreeRead(t *testing.T) {
 	h := newHelper(t)
 	h.clearPages()
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.PagePermissionResource.AppendWildcard(), "read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.PageRBACResource.AppendWildcard(), "read")
 	ns := h.makeNamespace("some-namespace")
 	h.repoMakeWeightedPage(ns, "p1", 1)
 	h.repoMakeWeightedPage(ns, "p4", 4)

tests/compose/permissions_delete_test.go

@@ -2,9 +2,8 @@ package compose
 
 import (
 	"fmt"
-	"github.com/cortezaproject/corteza-server/compose/service"
 	"github.com/cortezaproject/corteza-server/compose/types"
-	"github.com/cortezaproject/corteza-server/pkg/permissions"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/tests/helpers"
 	"net/http"
 	"testing"
@@ -12,20 +11,20 @@ import (
 
 func TestPermissionsDelete(t *testing.T) {
 	h := newHelper(t)
-	p := service.DefaultPermissions
+	p := rbac.Global()
 
 	// Make sure our user can grant
-	h.allow(types.ComposePermissionResource, "grant")
+	h.allow(types.ComposeRBACResource, "grant")
 
 	// New role.
 	permDelRole := h.roleID + 1
 
-	h.a.Len(service.DefaultPermissions.FindRulesByRoleID(permDelRole), 0)
+	h.a.Len(rbac.Global().FindRulesByRoleID(permDelRole), 0)
 
 	// Setup a few fake rules for new roke
 	h.mockPermissions(
-		permissions.AllowRule(permDelRole, types.ComposePermissionResource, "access"),
-		permissions.DenyRule(permDelRole, types.ComposePermissionResource, "namespace.create"),
+		rbac.AllowRule(permDelRole, types.ComposeRBACResource, "access"),
+		rbac.DenyRule(permDelRole, types.ComposeRBACResource, "namespace.create"),
 	)
 
 	h.a.Len(p.FindRulesByRoleID(permDelRole), 2)
@@ -38,8 +37,8 @@ func TestPermissionsDelete(t *testing.T) {
 		End()
 
 	// Make sure everything is deleted
-	rr, _ := p.FindRulesByRoleID(permDelRole).Filter(func(r *permissions.Rule) (b bool, e error) {
-		return r.Access != permissions.Inherit, nil
+	rr, _ := p.FindRulesByRoleID(permDelRole).Filter(func(r *rbac.Rule) (b bool, e error) {
+		return r.Access != rbac.Inherit, nil
 	})
 
 	h.a.Empty(rr)

tests/compose/permissions_effective_test.go

@@ -9,8 +9,8 @@ import (
 
 func TestPermissionsEffective(t *testing.T) {
 	h := newHelper(t)
-	h.allow(types.ComposePermissionResource, "access")
-	h.deny(types.ComposePermissionResource, "namespace.create")
+	h.allow(types.ComposeRBACResource, "access")
+	h.deny(types.ComposeRBACResource, "namespace.create")
 
 	h.apiInit().
 		Get("/permissions/effective").

tests/compose/permissions_read_test.go

@@ -10,9 +10,9 @@ import (
 
 func TestPermissionsRead(t *testing.T) {
 	h := newHelper(t)
-	h.allow(types.ComposePermissionResource, "access")
-	h.allow(types.ComposePermissionResource, "grant")
-	h.deny(types.ComposePermissionResource, "namespace.create")
+	h.allow(types.ComposeRBACResource, "access")
+	h.allow(types.ComposeRBACResource, "grant")
+	h.deny(types.ComposeRBACResource, "namespace.create")
 
 	h.apiInit().
 		Get(fmt.Sprintf("/permissions/%d/rules", h.roleID)).

tests/compose/record_batch_test.go

@@ -17,7 +17,7 @@ func TestRecordCreate_batch(t *testing.T) {
 	ns := h.makeNamespace("batch testing namespace")
 	module := h.makeRecordModuleWithFieldsOnNs("record testing module", ns)
 	childModule := h.makeRecordModuleWithFieldsOnNs("record testing module child", ns)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.create")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/module/%d/record/", module.NamespaceID, module.ID)).
@@ -38,7 +38,7 @@ func TestRecordUpdate_batch(t *testing.T) {
 	ns := h.makeNamespace("batch testing namespace")
 	module := h.makeRecordModuleWithFieldsOnNs("record testing module", ns)
 	childModule := h.makeRecordModuleWithFieldsOnNs("record testing module child", ns)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
 
 	record := h.makeRecord(module)
 	childRecord := h.makeRecord(childModule, &types.RecordValue{Name: "another_record", Value: strconv.FormatUint(record.ID, 10), Ref: record.ID})
@@ -62,8 +62,8 @@ func TestRecordDelete_batch(t *testing.T) {
 	ns := h.makeNamespace("batch testing namespace")
 	module := h.makeRecordModuleWithFieldsOnNs("record testing module", ns)
 	childModule := h.makeRecordModuleWithFieldsOnNs("record testing module child", ns)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.delete")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.delete")
 
 	record := h.makeRecord(module)
 	childRecord := h.makeRecord(childModule, &types.RecordValue{Name: "another_record", Value: strconv.FormatUint(record.ID, 10), Ref: record.ID})
@@ -90,8 +90,8 @@ func TestRecordMixed_batch(t *testing.T) {
 	ns := h.makeNamespace("batch testing namespace")
 	module := h.makeRecordModuleWithFieldsOnNs("record testing module", ns)
 	childModule := h.makeRecordModuleWithFieldsOnNs("record testing module child", ns)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.create")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
 
 	record := h.makeRecord(module)
 	childRecord := h.makeRecord(childModule, &types.RecordValue{Name: "another_record", Value: strconv.FormatUint(record.ID, 10), Ref: record.ID})

tests/compose/record_exec_test.go

@@ -40,7 +40,7 @@ func TestRecordExecOrganize(t *testing.T) {
 	h := newHelper(t)
 	h.clearRecords()
 
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
 
 	module := h.repoMakeRecordModuleWithFields(
 		"record testing module",

tests/compose/record_test.go

@@ -33,9 +33,9 @@ type (
 )
 
 func (h helper) makeRecordModuleWithFieldsOnNs(name string, namespace *types.Namespace, ff ...*types.ModuleField) *types.Module {
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.read")
 
 	if len(ff) == 0 {
 		// Default fields
@@ -66,9 +66,9 @@ func (h helper) makeRecordModuleWithFieldsOnNs(name string, namespace *types.Nam
 func (h helper) repoMakeRecordModuleWithFields(name string, ff ...*types.ModuleField) *types.Module {
 	namespace := h.makeNamespace("record testing namespace")
 
-	h.allow(types.NamespacePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "read")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.read")
+	h.allow(types.NamespaceRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "read")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.read")
 
 	if len(ff) == 0 {
 		// Default fields
@@ -169,7 +169,7 @@ func TestRecordCreate(t *testing.T) {
 	h.clearRecords()
 
 	module := h.repoMakeRecordModuleWithFields("record testing module")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.create")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/module/%d/record/", module.NamespaceID, module.ID)).
@@ -196,7 +196,7 @@ func TestRecordCreateWithErrors(t *testing.T) {
 		},
 	}
 	module := h.repoMakeRecordModuleWithFields("record testing module", fields...)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.create")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/module/%d/record/", module.NamespaceID, module.ID)).
@@ -234,7 +234,7 @@ func TestRecordUpdate(t *testing.T) {
 
 	module := h.repoMakeRecordModuleWithFields("record testing module")
 	record := h.makeRecord(module)
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
 
 	h.apiInit().
 		Post(fmt.Sprintf("/namespace/%d/module/%d/record/%d", module.NamespaceID, module.ID, record.ID)).
@@ -270,7 +270,7 @@ func TestRecordDelete(t *testing.T) {
 	module := h.repoMakeRecordModuleWithFields("record testing module")
 	record := h.makeRecord(module)
 
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.delete")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.delete")
 
 	h.apiInit().
 		Delete(fmt.Sprintf("/namespace/%d/module/%d/record/%d", module.NamespaceID, module.ID, record.ID)).
@@ -474,10 +474,10 @@ func TestRecordFieldModulePermissionCheck(t *testing.T) {
 	// make a standard module, and prevent current user to
 	// read from "name" and update "email" fields
 	module := h.repoMakeRecordModuleWithFields("record testing module")
-	h.deny(module.Fields.FindByName("name").PermissionResource(), "record.value.read")
-	h.deny(module.Fields.FindByName("email").PermissionResource(), "record.value.update")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.create")
-	h.allow(types.ModulePermissionResource.AppendWildcard(), "record.update")
+	h.deny(module.Fields.FindByName("name").RBACResource(), "record.value.read")
+	h.deny(module.Fields.FindByName("email").RBACResource(), "record.value.update")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
 
 	record := h.makeRecord(
 		module,

tests/messaging/channel_create_test.go

@@ -35,7 +35,7 @@ func (h helper) apiChPubCreate(name string) *apitest.Response {
 
 func TestChannelCreateDenied(t *testing.T) {
 	h := newHelper(t)
-	h.deny(types.MessagingPermissionResource, "channel.public.create")
+	h.deny(types.MessagingRBACResource, "channel.public.create")
 
 	h.apiChPubCreate("should not be created").
 		Assert(helpers.AssertError("not allowed to create channels")).
@@ -44,7 +44,7 @@ func TestChannelCreateDenied(t *testing.T) {
 
 func TestChannelCreate(t *testing.T) {
 	h := newHelper(t)
-	h.allow(types.MessagingPermissionResource, "channel.public.create")
+	h.allow(types.MessagingRBACResource, "channel.public.create")
 
 	h.apiChPubCreate("test channel").
 		Assert(helpers.AssertNoErrors).
@@ -57,7 +57,7 @@ func TestChannelCreate(t *testing.T) {
 
 func TestChannelCreateWithShortName(t *testing.T) {
 	h := newHelper(t)
-	h.allow(types.MessagingPermissionResource, "channel.public.create")
+	h.allow(types.MessagingRBACResource, "channel.public.create")
 
 	h.apiChPubCreate("").
 		Status(http.StatusOK).
@@ -67,7 +67,7 @@ func TestChannelCreateWithShortName(t *testing.T) {
 
 func TestChannelCreateWithLongName(t *testing.T) {
 	h := newHelper(t)
-	h.allow(types.MessagingPermissionResource, "channel.public.create")
+	h.allow(types.MessagingRBACResource, "channel.public.create")
 
 	h.apiChPubCreate(strings.Repeat("X ", 1000)).
 		Status(http.StatusOK).