Add missing rbac envoy resources

pkg/envoy/store/rbac_rule_marshal.go

@@ -324,31 +324,48 @@ func (n *rbacRule) makeRBACResource(pl *payload) (string, error) {
 		return systemTypes.ApplicationRbacResource(p1ID), nil
 
 	case systemTypes.ApigwRouteResourceType:
+		if n.refRbacRes != nil {
+			p1 := resource.FindAPIGateway(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.APIGatewayErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.ApigwRouteRbacResource(p1ID), nil
-	case systemTypes.ApigwFilterResourceType:
-		return systemTypes.ApigwFilterRbacResource(p1ID), nil
+
 	case systemTypes.AuthClientResourceType:
 		// @todo add support for importing rbac rules for specific client
 		return systemTypes.AuthClientRbacResource(p1ID), nil
+
 	case systemTypes.TemplateResourceType:
-		// @todo add support for importing rbac rules for specific template
+		if n.refRbacRes != nil {
+			p1 := resource.FindTemplate(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.TemplateErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.TemplateRbacResource(p1ID), nil
+
 	case systemTypes.ReportResourceType:
+		if n.refRbacRes != nil {
+			p1 := resource.FindReport(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.ReportErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.ReportRbacResource(p1ID), nil
+
 	case messagebus.QueueResourceType:
 		// @todo add support for importing rbac rules for specific queue
 		return messagebus.QueueRbacResource(p1ID), nil
 
 	case federationTypes.NodeResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.NodeRbacResource(p1ID), nil
-
 	case federationTypes.SharedModuleResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.SharedModuleRbacResource(p0ID, p1ID), nil
-
 	case federationTypes.ExposedModuleResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.ExposedModuleRbacResource(p0ID, p1ID), nil
 	}
 

pkg/envoy/yaml/rbac_rules_marshal.go

@@ -3,6 +3,7 @@ package yaml
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"strings"
 
 	automationTypes "github.com/cortezaproject/corteza-server/automation/types"
@@ -258,9 +259,47 @@ func (r *rbacRule) makeRBACResource(state *envoy.ResourceState) (string, error)
 
 		return fmt.Sprintf(systemTypes.ApplicationRbacResourceTpl(), systemTypes.ApplicationResourceType, p1ID), nil
 
-		// // @todo
-		// case systemTypes.ApigwRouteResourceType:
-		// case systemTypes.ApigwFilterResourceType:
+	case systemTypes.ApigwRouteResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindAPIGateway(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.APIGatewayErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = strconv.FormatUint(p1.ID, 10)
+		}
+
+		return fmt.Sprintf(systemTypes.ApigwRouteRbacResourceTpl(), systemTypes.ApigwRouteResourceType, p1ID), nil
+
+	case systemTypes.TemplateResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindTemplate(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.TemplateErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = p1.Handle
+		}
+
+		return fmt.Sprintf(systemTypes.TemplateRbacResourceTpl(), systemTypes.TemplateResourceType, p1ID), nil
+
+	case systemTypes.ReportResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindReport(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.ReportErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = p1.Handle
+		}
+
+		return fmt.Sprintf(systemTypes.ReportRbacResourceTpl(), systemTypes.ReportResourceType, p1ID), nil
+
+	case federationTypes.NodeResourceType:
+		return fmt.Sprintf(federationTypes.NodeRbacResourceTpl(), federationTypes.NodeResourceType, p1ID), nil
+
+	case federationTypes.SharedModuleResourceType:
+		return fmt.Sprintf(federationTypes.SharedModuleRbacResourceTpl(), federationTypes.SharedModuleResourceType, p1ID), nil
+
+	case federationTypes.ExposedModuleResourceType:
+		return fmt.Sprintf(federationTypes.ExposedModuleRbacResourceTpl(), federationTypes.ExposedModuleResourceType, p1ID), nil
 	}
 
 	return "", fmt.Errorf("unsupported resource type '%s' for RBAC YAML encode", r.res.Resource)

provision/000_base/system_access_control.yaml

@@ -86,11 +86,6 @@ allow:
       - update
       - delete
 
-    corteza::system:apigw-filter/*:
-      - read
-      - update
-      - delete
-
     corteza::system:report/*:
       - read
       - update