Tweak logic & add base RBAC import/export test

server/codegen/assets/templates/gocode/envoy/store_encode.go.tpl

@@ -89,9 +89,9 @@ func (e StoreEncoder) Encode(ctx context.Context, p envoyx.EncodeParams, rt stri
 	case types.{{.expIdent}}ResourceType:
 		return e.encode{{.expIdent}}s(ctx, p, s, nodes, tree)
 {{ end -}}
+	default:
+		return e.encode(ctx, p, s, rt, nodes, tree)
 	}
-
-	return
 }
 
 {{- range .resources }}

server/codegen/assets/templates/gocode/envoy/util_rbac.go.tpl

@@ -36,6 +36,7 @@ func SplitResourceIdentifier(ref string) (out map[string]Ref) {
 
 
     case "corteza::{{$rootCmp.ident}}:{{.ident}}":
+      scope := Scope{}
     {{$res := .}}
     {{range $i, $p := .parents}}
       if gRef(pp, {{$i}}) == "" {
@@ -48,9 +49,17 @@ func SplitResourceIdentifier(ref string) (out map[string]Ref) {
         {{ end }}
 
         {{ if eq $p.handle $cmp.ident }}
-          out["{{$i}}"] = Ref{
+          {{ if and (eq $rootCmp.ident "compose") (eq $i 0) }}
+          aux := gRef(pp, {{ $i }})
+          if aux != "" {
+            scope.ResourceType = "corteza::compose:namespace"
+            scope.Identifiers = MakeIdentifiers(aux)
+          }
+          {{ end }}
+          out["Path.{{$i}}"] = Ref{
             ResourceType: "{{$cmp.fqrt}}",
             Identifiers:  MakeIdentifiers(gRef(pp, {{ $i }})),
+            Scope: scope,
           }
           {{break}}
         {{ end }}
@@ -60,9 +69,14 @@ func SplitResourceIdentifier(ref string) (out map[string]Ref) {
     if gRef(pp, {{len .parents}}) == "" {
       return
     }
-    out["{{len .parents}}"] = Ref{
+    {{if eq .ident "namespace"}}
+    scope.ResourceType = "{{.fqrt}}"
+    scope.Identifiers = MakeIdentifiers(gRef(pp, {{len .parents}}))
+    {{end}}
+    out["Path.{{len .parents}}"] = Ref{
       ResourceType: "{{.fqrt}}",
       Identifiers:  MakeIdentifiers(gRef(pp, {{len .parents}})),
+      Scope: scope,
     }
 
   {{ end }}

server/codegen/assets/templates/gocode/envoy/yaml_decode.go.tpl

@@ -91,6 +91,7 @@ func (d *auxYamlDoc) UnmarshalYAML(n *yaml.Node) (err error) {
 			return err
 {{ end }}
 
+	{{ if eq .componentIdent "system" }}
 		// Access control nodes
 		case "allow":
 			aux, err = unmarshalAllowNode(v)
@@ -113,6 +114,7 @@ func (d *auxYamlDoc) UnmarshalYAML(n *yaml.Node) (err error) {
 			if err != nil {
 				return err
 			}
+	{{ end }}
 
 		// Offload to custom handlers
 		default:
@@ -600,10 +602,28 @@ func unmarshalDenyNode(n *yaml.Node) (out envoyx.NodeSet, err error) {
 
 func unmarshalRBACNode(n *yaml.Node, acc rbac.Access) (out envoyx.NodeSet, err error) {
 	if y7s.IsMapping(n.Content[1]) {
-		return unmarshalNestedRBACNode(n, acc)
+		out, err = unmarshalNestedRBACNode(n, acc)
+		if err != nil {
+			return
+		}
+	} else {
+		out, err = unmarshalFlatRBACNode(n, acc)
+		if err != nil {
+			return
+		}
 	}
 
-	return unmarshalFlatRBACNode(n, acc)
+	for _, o := range out {
+		for _, r := range o.References {
+			if r.Scope.IsEmpty() {
+				continue
+			}
+			o.Scope = r.Scope
+			break
+		}
+	}
+
+	return
 }
 
 // unmarshalNestedRBACNode handles RBAC rules when they are nested inside a resource
@@ -624,25 +644,28 @@ func unmarshalRBACNode(n *yaml.Node, acc rbac.Access) (out envoyx.NodeSet, err e
 func unmarshalNestedRBACNode(n *yaml.Node, acc rbac.Access) (out envoyx.NodeSet, err error) {
   // Handles role
 	return out, y7s.EachMap(n, func(role, perm *yaml.Node) error {
-		// Handles operation
-		return y7s.EachMap(perm, func(res, op *yaml.Node) error {
-			out = append(out, &envoyx.Node{
-				Resource: &rbac.Rule{
-					Resource:  res.Value,
-					Operation: op.Value,
-					Access:    acc,
-				},
-				ResourceType: rbac.RuleResourceType,
-				References: envoyx.MergeRefs(
-					map[string]envoyx.Ref{"RoleID": {
-						// Providing resource type as plain text to reduce cross component references
-						ResourceType: "corteza::system:role",
-						Identifiers:  envoyx.MakeIdentifiers(role.Value),
-					}},
-					envoyx.SplitResourceIdentifier(res.Value),
-				),
+		// Handles operations
+		return y7s.EachMap(perm, func(res, ops *yaml.Node) error {
+			// Handle operation (one RBAC rule per op)
+			return y7s.EachSeq(ops, func(op *yaml.Node) error {
+				out = append(out, &envoyx.Node{
+					Resource: &rbac.Rule{
+						Resource:  res.Value,
+						Operation: op.Value,
+						Access:    acc,
+					},
+					ResourceType: rbac.RuleResourceType,
+					References: envoyx.MergeRefs(
+						map[string]envoyx.Ref{"RoleID": {
+							// Providing resource type as plain text to reduce cross component references
+							ResourceType: "corteza::system:role",
+							Identifiers:  envoyx.MakeIdentifiers(role.Value),
+						}},
+						envoyx.SplitResourceIdentifier(res.Value),
+					),
+				})
+				return nil
 			})
-			return nil
 		})
 	})
 }

server/codegen/assets/templates/gocode/envoy/yaml_encode.go.tpl

@@ -67,8 +67,14 @@ func (e YamlEncoder) Encode(ctx context.Context, p envoyx.EncodeParams, rt strin
 		}
 {{ end -}}
 	default:
-		// When this encoder doesn't handle any node it shouldn't write anything;
-		// this just removes the need for an extra check at the end.
+		out, err = e.encode(ctx, out, p, rt, nodes, tt)
+		if err != nil {
+			return
+		}
+	}
+
+	// Don't output nil values since that will produce broken yaml docs
+	if out == nil {
 		return
 	}
 

server/codegen/server.envoy_rbac.cue

@@ -32,9 +32,9 @@ import (
 [
 	{
 		template: "gocode/envoy/rbac_rules_parse.go.tpl"
-		output:   "pkg/envoy/resource/rbac_rules_parse.gen.go"
+		output:   "pkg/envoyx/rbac_rules_parse.gen.go"
 		payload: {
-			package: "resource"
+			package: "envoyx"
 			imports: [
 				for cmp in app.corteza.components {
 					"\(cmp.ident)Types \"github.com/cortezaproject/corteza/server/\(cmp.ident)/types\""