From edcac041bcaf423ff7c3c63c613f794dcf898196 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toma=C5=BE=20Jerman?= <tomaz.jerman121@gmail.com>
Date: Tue, 28 Sep 2021 12:08:19 +0200
Subject: [PATCH] Add missing rbac envoy resources

---
 pkg/envoy/store/rbac_rule_marshal.go          | 33 ++++++++++----
 pkg/envoy/yaml/rbac_rules_marshal.go          | 45 +++++++++++++++++--
 provision/000_base/system_access_control.yaml |  5 ---
 3 files changed, 67 insertions(+), 16 deletions(-)

diff --git a/pkg/envoy/store/rbac_rule_marshal.go b/pkg/envoy/store/rbac_rule_marshal.go
index 7196ac016..1beb87009 100644
--- a/pkg/envoy/store/rbac_rule_marshal.go
+++ b/pkg/envoy/store/rbac_rule_marshal.go
@@ -324,31 +324,48 @@ func (n *rbacRule) makeRBACResource(pl *payload) (string, error) {
 		return systemTypes.ApplicationRbacResource(p1ID), nil
 
 	case systemTypes.ApigwRouteResourceType:
+		if n.refRbacRes != nil {
+			p1 := resource.FindAPIGateway(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.APIGatewayErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.ApigwRouteRbacResource(p1ID), nil
-	case systemTypes.ApigwFilterResourceType:
-		return systemTypes.ApigwFilterRbacResource(p1ID), nil
+
 	case systemTypes.AuthClientResourceType:
 		// @todo add support for importing rbac rules for specific client
 		return systemTypes.AuthClientRbacResource(p1ID), nil
+
 	case systemTypes.TemplateResourceType:
-		// @todo add support for importing rbac rules for specific template
+		if n.refRbacRes != nil {
+			p1 := resource.FindTemplate(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.TemplateErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.TemplateRbacResource(p1ID), nil
+
 	case systemTypes.ReportResourceType:
+		if n.refRbacRes != nil {
+			p1 := resource.FindReport(pl.state.ParentResources, n.refRbacRes.Identifiers)
+			if p1 == nil {
+				return "", resource.ReportErrUnresolved(n.refRbacRes.Identifiers)
+			}
+			p1ID = p1.ID
+		}
 		return systemTypes.ReportRbacResource(p1ID), nil
+
 	case messagebus.QueueResourceType:
 		// @todo add support for importing rbac rules for specific queue
 		return messagebus.QueueRbacResource(p1ID), nil
 
 	case federationTypes.NodeResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.NodeRbacResource(p1ID), nil
-
 	case federationTypes.SharedModuleResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.SharedModuleRbacResource(p0ID, p1ID), nil
-
 	case federationTypes.ExposedModuleResourceType:
-		// @todo add support for importing rbac rules for specific queue
 		return federationTypes.ExposedModuleRbacResource(p0ID, p1ID), nil
 	}
 
diff --git a/pkg/envoy/yaml/rbac_rules_marshal.go b/pkg/envoy/yaml/rbac_rules_marshal.go
index 6698f9560..b8281b7e7 100644
--- a/pkg/envoy/yaml/rbac_rules_marshal.go
+++ b/pkg/envoy/yaml/rbac_rules_marshal.go
@@ -3,6 +3,7 @@ package yaml
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"strings"
 
 	automationTypes "github.com/cortezaproject/corteza-server/automation/types"
@@ -258,9 +259,47 @@ func (r *rbacRule) makeRBACResource(state *envoy.ResourceState) (string, error)
 
 		return fmt.Sprintf(systemTypes.ApplicationRbacResourceTpl(), systemTypes.ApplicationResourceType, p1ID), nil
 
-		// // @todo
-		// case systemTypes.ApigwRouteResourceType:
-		// case systemTypes.ApigwFilterResourceType:
+	case systemTypes.ApigwRouteResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindAPIGateway(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.APIGatewayErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = strconv.FormatUint(p1.ID, 10)
+		}
+
+		return fmt.Sprintf(systemTypes.ApigwRouteRbacResourceTpl(), systemTypes.ApigwRouteResourceType, p1ID), nil
+
+	case systemTypes.TemplateResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindTemplate(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.TemplateErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = p1.Handle
+		}
+
+		return fmt.Sprintf(systemTypes.TemplateRbacResourceTpl(), systemTypes.TemplateResourceType, p1ID), nil
+
+	case systemTypes.ReportResourceType:
+		if res.RefRes != nil {
+			p1 := resource.FindReport(state.ParentResources, res.RefRes.Identifiers)
+			if p1 == nil {
+				return "", resource.ReportErrUnresolved(res.RefRes.Identifiers)
+			}
+			p1ID = p1.Handle
+		}
+
+		return fmt.Sprintf(systemTypes.ReportRbacResourceTpl(), systemTypes.ReportResourceType, p1ID), nil
+
+	case federationTypes.NodeResourceType:
+		return fmt.Sprintf(federationTypes.NodeRbacResourceTpl(), federationTypes.NodeResourceType, p1ID), nil
+
+	case federationTypes.SharedModuleResourceType:
+		return fmt.Sprintf(federationTypes.SharedModuleRbacResourceTpl(), federationTypes.SharedModuleResourceType, p1ID), nil
+
+	case federationTypes.ExposedModuleResourceType:
+		return fmt.Sprintf(federationTypes.ExposedModuleRbacResourceTpl(), federationTypes.ExposedModuleResourceType, p1ID), nil
 	}
 
 	return "", fmt.Errorf("unsupported resource type '%s' for RBAC YAML encode", r.res.Resource)
diff --git a/provision/000_base/system_access_control.yaml b/provision/000_base/system_access_control.yaml
index 7d6624db7..f17c10663 100644
--- a/provision/000_base/system_access_control.yaml
+++ b/provision/000_base/system_access_control.yaml
@@ -86,11 +86,6 @@ allow:
       - update
       - delete
 
-    corteza::system:apigw-filter/*:
-      - read
-      - update
-      - delete
-
     corteza::system:report/*:
       - read
       - update