do not send resource policies map over the wire

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

management/internals/shared/grpc/components_encoder.go

@@ -77,14 +77,11 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		}
 	}
 
-	// Phase 1: build dedup tables. Every routing peer (in c.RouterPeers) and
-	// every regular peer (in c.Peers) must be indexed before any encoder
-	// looks up indexes via e.peerOrder — otherwise routes / routers_map for
-	// peers that exist only in c.RouterPeers would silently lose their
-	// peer_index reference.
+	// build indexes
 	enc := newComponentEncoder(c)
 	enc.indexAllPeers()
 	routerIdxs := enc.indexRouterPeers(c.RouterPeers)
+	enc.indexAllNetworkResources()
 
 	// Phase 2: gather every policy that any consumer references (peer-pair
 	// policies + resource-only policies) so encodeResourcePoliciesMap can
@@ -96,31 +93,29 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 	// every encoder either reads from the dedup tables or works on
 	// independent input.
 	full := &proto.NetworkMapComponentsFull{
-		Serial:              networkSerial(c.Network),
-		PeerConfig:          in.PeerConfig,
-		Network:             toAccountNetwork(c.Network),
-		AccountSettings:     toAccountSettingsCompact(c.AccountSettings),
-		DnsForwarderPort:    in.DNSForwarderPort,
-		UserIdClaim:         in.UserIDClaim,
-		ProxyPatch:          in.ProxyPatch,
-		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
-		DnsDomain:           in.DNSDomain,
-		CustomZoneDomain:    c.CustomZoneDomain,
-		AgentVersions:       enc.agentVersions,
-		Peers:               enc.peers,
-		RouterPeerIndexes:   routerIdxs,
-		Policies:            policies,
-		Groups:              enc.encodeGroups(),
-		Routes:              enc.encodeRoutes(c.Routes),
-		NameserverGroups:    enc.encodeNameServerGroups(c.NameServerGroups),
-		AllDnsRecords:       encodeSimpleRecords(c.AllDNSRecords),
-		AccountZones:        encodeCustomZones(c.AccountZones),
-		NetworkResources:    enc.encodeNetworkResources(c.NetworkResources),
-		RoutersMap:          enc.encodeRoutersMap(c.RoutersMap),
-		ResourcePoliciesMap: enc.encodeResourcePoliciesMap(c.ResourcePoliciesMap),
-		GroupIdToUserIds:    enc.encodeGroupIDToUserIDs(c.GroupIDToUserIDs),
-		AllowedUserIds:      stringSetToSlice(c.AllowedUserIDs),
-		PostureFailedPeers:  enc.encodePostureFailedPeers(c.PostureFailedPeers),
+		Serial:             networkSerial(c.Network),
+		PeerConfig:         in.PeerConfig,
+		Network:            toAccountNetwork(c.Network),
+		AccountSettings:    toAccountSettingsCompact(c.AccountSettings),
+		DnsForwarderPort:   in.DNSForwarderPort,
+		UserIdClaim:        in.UserIDClaim,
+		ProxyPatch:         in.ProxyPatch,
+		DnsSettings:        enc.encodeDNSSettings(c.DNSSettings),
+		DnsDomain:          in.DNSDomain,
+		CustomZoneDomain:   c.CustomZoneDomain,
+		Peers:              enc.peers,
+		RouterPeerIndexes:  routerIdxs,
+		Policies:           policies,
+		Groups:             enc.encodeGroups(),
+		Routes:             enc.encodeRoutes(c.Routes),
+		NameserverGroups:   enc.encodeNameServerGroups(c.NameServerGroups),
+		AllDnsRecords:      encodeSimpleRecords(c.AllDNSRecords),
+		AccountZones:       encodeCustomZones(c.AccountZones),
+		NetworkResources:   enc.encodeNetworkResources(c.NetworkResources),
+		RoutersMap:         enc.encodeRoutersMap(c.RoutersMap),
+		GroupIdToUserIds:   enc.encodeGroupIDToUserIDs(c.GroupIDToUserIDs),
+		AllowedUserIds:     stringSetToSlice(c.AllowedUserIDs),
+		PostureFailedPeers: enc.encodePostureFailedPeers(c.PostureFailedPeers),
 	}
 
 	return &proto.NetworkMapEnvelope{
@@ -141,19 +136,17 @@ func networkSerial(n *types.Network) uint64 {
 type componentEncoder struct {
 	components *types.NetworkMapComponents
 
-	peerOrder map[string]uint32
-	peers     []*proto.PeerCompact
-
-	agentVersionOrder map[string]uint32
-	agentVersions     []string
+	peerOrder           map[string]uint32
+	peers               []*proto.PeerCompact
+	networkIdToPublicId map[string]string
 }
 
 func newComponentEncoder(c *types.NetworkMapComponents) *componentEncoder {
 	return &componentEncoder{
-		components:        c,
-		peerOrder:         make(map[string]uint32, len(c.Peers)),
-		peers:             make([]*proto.PeerCompact, 0, len(c.Peers)),
-		agentVersionOrder: make(map[string]uint32),
+		components:          c,
+		peerOrder:           make(map[string]uint32, len(c.Peers)),
+		networkIdToPublicId: make(map[string]string),
+		peers:               make([]*proto.PeerCompact, 0, len(c.Peers)),
 	}
 }
 
@@ -194,6 +187,12 @@ func (e *componentEncoder) indexRouterPeers(routers map[string]*nbpeer.Peer) []u
 	return out
 }
 
+func (e *componentEncoder) indexAllNetworkResources() {
+	for _, r := range e.components.NetworkResources {
+		e.networkIdToPublicId[r.ID] = r.PublicID
+	}
+}
+
 func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
 	if len(e.components.Groups) == 0 {
 		return nil
@@ -346,17 +345,30 @@ func (e *componentEncoder) groupPublicXid(groupID string) (string, bool) {
 // today (Calculate's resource-typed rule path consults SourceResource only
 // for "peer" — other types fall through to group-based lookup).
 func (e *componentEncoder) resourceToProto(r types.Resource) *proto.ResourceCompact {
-	if r.ID == "" && r.Type == "" {
+	t, ok := proto.ResourceCompactType_value[string(r.Type)]
+	if !ok || t == 0 || r.ID == "" {
 		return nil
 	}
-	out := &proto.ResourceCompact{Type: string(r.Type)}
-	if r.Type == types.ResourceTypePeer && r.ID != "" {
-		if idx, ok := e.peerOrder[r.ID]; ok {
-			out.PeerIndexSet = true
-			out.PeerIndex = idx
+	if t == int32(proto.ResourceCompactType_peer) {
+		idx, ok := e.peerOrder[r.ID]
+		if !ok {
+			return nil
+		}
+		return &proto.ResourceCompact{
+			Type:       proto.ResourceCompactType_peer,
+			ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: idx},
 		}
 	}
-	return out
+
+	publicID, ok := e.networkIdToPublicId[r.ID]
+	if !ok {
+		return nil
+	}
+
+	return &proto.ResourceCompact{
+		Type:       proto.ResourceCompactType(t),
+		ResourceId: &proto.ResourceCompact_Id{Id: publicID},
+	}
 }
 
 // postureCheckSeqs translates a slice of posture-check xids to their
@@ -578,37 +590,6 @@ func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*ro
 	return out
 }
 
-func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*types.Policy) map[string]*proto.PolicyIds {
-	if len(rpm) == 0 {
-		return nil
-	}
-	// resourceXIDToPublicID is local to one encode — built from components.NetworkResources
-	// (small slice). Network resources without seq id are dropped, matching how
-	// other components-without-seq are silently filtered.
-	resourceXIDToPublicID := make(map[string]string, len(e.components.NetworkResources))
-	for _, r := range e.components.NetworkResources {
-		if r != nil {
-			resourceXIDToPublicID[r.ID] = r.PublicID
-		}
-	}
-	out := make(map[string]*proto.PolicyIds, len(rpm))
-	for resourceXID, policies := range rpm {
-		resId, ok := resourceXIDToPublicID[resourceXID]
-		if !ok {
-			continue
-		}
-		ids := make([]string, 0, len(policies))
-		for _, pol := range policies {
-			ids = append(ids, pol.PublicID)
-		}
-		if len(ids) == 0 {
-			continue
-		}
-		out[resId] = &proto.PolicyIds{Ids: ids}
-	}
-	return out
-}
-
 func (e *componentEncoder) encodeGroupIDToUserIDs(m map[string][]string) map[string]*proto.UserIDList {
 	if len(m) == 0 {
 		return nil

management/internals/shared/grpc/components_encoder_test.go

@@ -125,9 +125,6 @@ func canonicalize(full *proto.NetworkMapComponentsFull) {
 	for newIdx, p := range full.Policies {
 		policyRemap[policyOldOrder[p]] = uint32(newIdx)
 	}
-	for _, idxs := range full.ResourcePoliciesMap {
-		slices.Sort(idxs.Ids)
-	}
 	for _, list := range full.GroupIdToUserIds {
 		slices.Sort(list.UserIds)
 	}
@@ -308,6 +305,32 @@ func TestEncodeNetworkMapEnvelope_GroupsByAccountPublicId(t *testing.T) {
 	assert.Len(t, groupByID["2"].PeerIndexes, 2)
 }
 
+func TestEncodePolicy(t *testing.T) {
+	encoder := componentEncoder{peerOrder: map[string]uint32{"peerId": uint32(1234)}, networkIdToPublicId: map[string]string{"domain": "publicDomain", "host": "publicHost", "subnet": "publicSubnet"}}
+	assert.Equal(t,
+		encoder.resourceToProto(types.Resource{Type: "peer", ID: "peerId"}),
+		&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(1234)}})
+	// verify invalid peer id results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(types.Resource{Type: "peer", ID: "boom"}))
+	assert.Equal(t,
+		encoder.resourceToProto(types.Resource{Type: "domain", ID: "domain"}),
+		&proto.ResourceCompact{Type: proto.ResourceCompactType_domain, ResourceId: &proto.ResourceCompact_Id{Id: "publicDomain"}})
+	assert.Equal(t,
+		encoder.resourceToProto(types.Resource{Type: "host", ID: "host"}),
+		&proto.ResourceCompact{Type: proto.ResourceCompactType_host, ResourceId: &proto.ResourceCompact_Id{Id: "publicHost"}})
+	assert.Equal(t,
+		encoder.resourceToProto(types.Resource{Type: "subnet", ID: "subnet"}),
+		&proto.ResourceCompact{Type: proto.ResourceCompactType_subnet, ResourceId: &proto.ResourceCompact_Id{Id: "publicSubnet"}})
+	// verify invalid resource type results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(types.Resource{Type: "boom", ID: "boom"}))
+	// verify invalid networkresource id results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(types.Resource{Type: "host", ID: "boom"}))
+
+}
+
 func TestEncodeNetworkMapEnvelope_PolicyExpansion(t *testing.T) {
 	c := newTestComponents()
 
@@ -574,9 +597,6 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 	require.Contains(t, policyByID, "10", "original peer-traffic policy id 10")
 	require.Contains(t, policyByID, "99", "resource-only policy id 99")
 
-	require.Contains(t, full.ResourcePoliciesMap, "77")
-	ids := full.ResourcePoliciesMap["77"].Ids
-	require.Len(t, ids, 2)
 	assert.ElementsMatch(t, policyIds, ids,
 		"resource policies map must reference both wire policy indexes")
 }

shared/management/networkmap/decode.go

@@ -173,23 +173,14 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		}
 	}
 
-	// Phase 8: resource_policies_map (resource seq id → list of *types.Policy
-	// pointers from the decoded policies slice). Resource ID is synthesized
-	// the same way as in decodeNetworkResource.
-	for resourceID, ids := range full.ResourcePoliciesMap {
-		if len(ids.Ids) == 0 {
-			continue
+	// Phase 8: resource_policies_map
+	for _, p := range c.Policies {
+		rule := p.Rules[0] // there's always only one rule
+		if rule.SourceResource.Type != types.ResourceTypePeer && rule.SourceResource.ID != "" {
+			c.ResourcePoliciesMap[rule.SourceResource.ID] = append(c.ResourcePoliciesMap[rule.SourceResource.ID], p)
 		}
-		policies := make([]*types.Policy, 0, len(ids.Ids))
-		for _, id := range ids.Ids {
-			if p, ok := policyByID[id]; ok {
-				policies = append(policies, p)
-			} else {
-				log.WithField("policy id", id).Error("unrecognized policy when decoding resource policies")
-			}
-		}
-		if len(policies) > 0 {
-			c.ResourcePoliciesMap[resourceID] = policies
+		if rule.SourceResource.Type != types.ResourceTypePeer && rule.DestinationResource.Type != "" {
+			c.ResourcePoliciesMap[rule.SourceResource.ID] = append(c.ResourcePoliciesMap[rule.SourceResource.ID], p)
 		}
 	}
 
@@ -344,11 +335,27 @@ func resourceFromProto(r *proto.ResourceCompact, peerIDByIndex []string) types.R
 	if r == nil {
 		return types.Resource{}
 	}
-	out := types.Resource{Type: types.ResourceType(r.Type)}
-	if r.PeerIndexSet && int(r.PeerIndex) < len(peerIDByIndex) {
-		out.ID = peerIDByIndex[r.PeerIndex]
+
+	t, ok := proto.ResourceCompactType_name[int32(r.Type)]
+	if !ok || r.Type == proto.ResourceCompactType_unknown_type {
+		return types.Resource{}
+	}
+
+	if r.Type == proto.ResourceCompactType_peer && int(r.GetPeerIndex()) >= len(peerIDByIndex) {
+		return types.Resource{}
+	}
+
+	if r.Type == proto.ResourceCompactType_peer && int(r.GetPeerIndex()) < len(peerIDByIndex) {
+		return types.Resource{
+			Type: types.ResourceTypePeer,
+			ID:   peerIDByIndex[int(r.GetPeerIndex())],
+		}
+	}
+
+	return types.Resource{
+		Type: types.ResourceType(t),
+		ID:   r.GetId(),
 	}
-	return out
 }
 
 // authorizedGroupsFromProto inverts encodeAuthorizedGroups: the wire form

shared/management/networkmap/decode_test.go

@@ -0,0 +1,40 @@
+package networkmap
+
+import (
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDecodePolicy(t *testing.T) {
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(1)}},
+			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}),
+		types.Resource{Type: "peer", ID: "valid-id"})
+	// check invalid peer index returns an empty resource
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(100)}},
+			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}),
+		types.Resource{})
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_domain, ResourceId: &proto.ResourceCompact_Id{Id: "domain"}}, []string{}),
+		types.Resource{Type: "domain", ID: "domain"})
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_host, ResourceId: &proto.ResourceCompact_Id{Id: "host"}}, []string{}),
+		types.Resource{Type: "host", ID: "host"})
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_subnet, ResourceId: &proto.ResourceCompact_Id{Id: "subnet"}}, []string{}),
+		types.Resource{Type: "subnet", ID: "subnet"})
+	// an unknown resource type return an empty resource
+	assert.Equal(t,
+		resourceFromProto(
+			&proto.ResourceCompact{Type: proto.ResourceCompactType_unknown_type, ResourceId: &proto.ResourceCompact_Id{Id: "boom"}}, []string{}),
+		types.Resource{})
+}

shared/management/proto/management.proto

@@ -825,80 +825,68 @@ message NetworkMapComponentsFull {
   // the peer has no custom zone records.
   string custom_zone_domain = 7;
 
-  // Deduplicated agent versions; PeerCompact.agent_version_idx indexes here.
-  // Empty string at index 0 if any peer has no version.
-  repeated string agent_versions = 8;
-
   // All peers (deduplicated). The client splits peers into online / offline
   // locally using account_settings.peer_login_expiration on receive.
-  repeated PeerCompact peers = 9;
+  repeated PeerCompact peers = 8;
 
   // Indexes into peers for the subset that may act as routers.
-  repeated uint32 router_peer_indexes = 10;
+  repeated uint32 router_peer_indexes = 9;
 
   // Policies that affect the receiving peer.
-  repeated PolicyCompact policies = 11;
+  repeated PolicyCompact policies = 10;
 
   // Groups in unspecified order — clients key off id (public_id).
-  repeated GroupCompact groups = 12;
+  repeated GroupCompact groups = 11;
 
   // Routes relevant to this peer, raw shape (mirrors []*route.Route).
-  repeated RouteRaw routes = 13;
+  repeated RouteRaw routes = 12;
 
   // Nameserver groups (mirrors []*nbdns.NameServerGroup).
-  repeated NameServerGroupRaw nameserver_groups = 14;
+  repeated NameServerGroupRaw nameserver_groups = 13;
 
   // All DNS records the client needs to assemble its custom zone. Reuses
   // the existing SimpleRecord wire shape.
-  repeated SimpleRecord all_dns_records = 15;
+  repeated SimpleRecord all_dns_records = 14;
 
   // Custom zones (typically the peer's own zone). Reuses the existing
   // CustomZone wire shape.
-  repeated CustomZone account_zones = 16;
+  repeated CustomZone account_zones = 15;
 
   // Network resources (mirrors []*resourceTypes.NetworkResource).
-  repeated NetworkResourceRaw network_resources = 17;
+  repeated NetworkResourceRaw network_resources = 16;
 
   // Routers per network. Outer key: network public_id. Each entry is
   // the set of routers backing that network for this peer's view.
-  map<string, NetworkRouterList> routers_map = 18;
-
-  // For each NetworkResource public_id, the indexes into policies[]
-  // that apply to it.
-  map<string, PolicyIds> resource_policies_map = 19;
+  map<string, NetworkRouterList> routers_map = 17;
 
   // Group-id (public_id) → user ids authorized for SSH on members.
-  map<string, UserIDList> group_id_to_user_ids = 20;
+  map<string, UserIDList> group_id_to_user_ids = 19;
 
   // Account-level allowed user ids (used by Calculate() when assembling SSH
   // authorized users for the receiving peer).
-  repeated string allowed_user_ids = 21;
+  repeated string allowed_user_ids = 20;
 
   // Per posture-check public_id, the set of peer indexes that failed
   // the check. Server-side evaluation result; clients do not re-evaluate.
-  map<string, PeerIndexSet> posture_failed_peers = 22;
+  map<string, PeerIndexSet> posture_failed_peers = 21;
 
   // Account-level DNS forwarder port (mirrors the legacy
   // proto.DNSConfig.ForwarderPort). Computed by the controller from peer
   // versions; clients fold it into their Calculate() DNS output.
-  int64 dns_forwarder_port = 23;
+  int64 dns_forwarder_port = 22;
 
   // Pre-expanded NetworkMap fragments injected post-Calculate by external
   // controllers (BYOP / port-forwarding proxies). The receiving client
   // merges these into its locally-computed NetworkMap the same way the
   // legacy server does via NetworkMap.Merge — so downstream consumers see
   // a unified merged result regardless of source.
-  ProxyPatch proxy_patch = 24;
+  ProxyPatch proxy_patch = 23;
 
   // SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
   // "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
   // client rebuilds the NetworkMap from this envelope. Empty when the
   // account has no AuthorizedUsers (and thus no SshAuth to populate).
-  string user_id_claim = 25;
-
-  // Reserved for future component additions (incremental_serial, parent_seq,
-  // etc.) without forcing a renumber.
-  reserved 26 to 50;
+  string user_id_claim = 24;
 }
 
 // ProxyPatch carries NetworkMap fragments that don't fit the component-graph
@@ -1066,16 +1054,23 @@ message PolicyCompact {
   repeated string source_posture_check_ids = 13;
 }
 
+enum ResourceCompactType {
+  unknown_type = 0; //placeholder
+  peer = 1;
+	domain = 2;
+	host = 3;
+	subnet = 4;
+}
+
 // ResourceCompact mirrors types.Resource. Used by PolicyCompact to carry
 // rule.SourceResource / rule.DestinationResource when the rule targets a
 // specific resource (typically a peer) rather than groups.
-// peer_index_set tells whether peer_index is valid (proto3 uint32 cannot
-// disambiguate "0" from "unset"); set only when type == "peer".
 message ResourceCompact {
-  string type = 1;
-  bool peer_index_set = 2;
-  uint32 peer_index = 3;
-  reserved 4; // future: host/subnet/domain references when needed
+  ResourceCompactType type = 1;
+  oneof resource_id {
+    string id = 2; // for domain/host/subnet resources
+    uint32 peer_index = 3; // for peers
+  }
 }
 
 // UserNameList is a list of local-user names — used as the value type in