feature(capabilities): preliminary user create/list abilities

addons/api/addon/models/base.js

@@ -42,6 +42,11 @@ export default class BaseModel extends Model {
   })
   authorized_actions;
 
+  @attr({
+    readOnly: true,
+  })
+  authorized_collection_actions;
+
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();

addons/api/mirage/factories/scope.js

@@ -4,6 +4,19 @@ import { trait } from 'ember-cli-mirage';
 export default factory.extend({
   type: 'global',
 
+  authorized_collection_actions: () => {
+    return {
+      users: ['create', ''],
+      // groups: ['create', 'list'],
+      // roles: ['create', 'list'],
+      // 'auth-methods': ['create', 'list'],
+      // sessopms: ['list'],
+      // targets: ['create', 'list'],
+      // 'host-catalogs': ['create', 'list'],
+      // 'credential-stores': ['create', 'list'],
+    };
+  },
+
   /**
    * Generates realistic-ish IDs while still being deterministic.
    */

ui/admin/app/routes/scopes/scope/users.js

@@ -11,6 +11,7 @@ export default class ScopesScopeUsersRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,11 @@ export default class ScopesScopeUsersRoute extends Route {
    * @return {Promise{[UserModel]}}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('user', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'users' })) {
+      return this.store.query('user', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/users/index.js

@@ -1,3 +1,13 @@
 import Route from '@ember/routing/route';
 
-export default class ScopesScopeUsersIndexRoute extends Route {}
+export default class ScopesScopeUsersIndexRoute extends Route {
+
+  // =methods
+
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+
+}

ui/admin/app/templates/scopes/scope.hbs

@@ -94,10 +94,12 @@
 
       {{#unless @model.isProject}}
         <Rose::Nav::Sidebar @title={{t 'titles.iam'}} as |nav|>
-          <nav.link @route='scopes.scope.users'>
-            <Rose::Icon @name='app-icons/users' @size='medium' />
-            {{t 'resources.user.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='users')}}
+            <nav.link @route='scopes.scope.users'>
+              <Rose::Icon @name='app-icons/users' @size='medium' />
+              {{t 'resources.user.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.groups'>
             <Rose::Icon @name='app-icons/group' @size='medium' />
             {{t 'resources.group.title_plural'}}

ui/admin/app/templates/scopes/scope/users/index.hbs

@@ -15,10 +15,12 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.users.new' @style='primary'>{{t
-          'titles.new'
-        }}</Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='users')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.users.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -69,11 +71,26 @@
         >
           <message.description>
             {{t 'resources.user.description'}}
+            {{#if (can 'create collection' this.scope collection='users')}}
+              {{#unless (can 'list collection' this.scope collection='users')}}
+                <br>
+                <br>
+                <Rose::Notification
+                  @style="info"
+                  @heading="Create Only"
+                >
+                  Oh noes!  Resources you create won't appear here because you
+                  have create permission, but not list.
+                </Rose::Notification>
+              {{/unless}}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.users.new'>
-            <Rose::Icon @name='plus-circle-outline' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if (can 'create collection' this.scope collection='users')}}
+            <message.link @route='scopes.scope.users.new'>
+              <Rose::Icon @name='plus-circle-outline' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>