Merge remote-tracking branch 'origin/main' into debian-support

2021-09-03 15:30:52 -04:00
commit 0bdd1a1f04
@@ -12,6 +12,11 @@ export default factory.extend({
      'update',
      'delete',
    ],
+  authorized_collection_actions: () => {
+    return {
+      accounts: ['create', 'list'],
+    };
+  },
  id: (i) => `auth-method-id-${i}`,

  // Cycle through available types
@@ -13,6 +13,11 @@ export default factory.extend({
      'update',
      'delete',
    ],
+  authorized_collection_actions: () => {
+    return {
+      'credential-libraries': ['create', 'list'],
+    };
+  },
  id: (i) => `credential-store-id-${i}`,
  type: (i) => types[i % types.length],

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route

  @service intl;
  @service notify;
-
+  @service can;
  // =methods

  /**
@@ -18,10 +18,15 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route
   * @return {Promise{[AccountModel]}}
   */
  model() {
-    const { id: auth_method_id } = this.modelFor(
-      'scopes.scope.auth-methods.auth-method'
-    );
-    return this.store.query('account', { auth_method_id });
+    const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
+    const { id: auth_method_id } = authMethod;
+    if (
+      this.can.can('list collection', authMethod, {
+        collection: 'accounts',
+      })
+    ) {
+      return this.store.query('account', { auth_method_id });
+    }
  }

  // =actions
@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
-
-export default class ScopesScopeAuthMethodsAuthMethodAccountsAccountIndexRoute extends Route {}
+export default class ScopesScopeAuthMethodsAuthMethodAccountsAccountIndexRoute extends Route {
+  // setupController(controller) {
+  //   const authMethod = this.modelFor(
+  //     'scopes.scope.auth-methods.auth-method'
+  //   );
+  //   super.setupController(...arguments);
+  //   controller.setProperties({ authMethod });
+  // }
+}
@@ -0,0 +1,9 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeAuthMethodsAuthMethodAccountsIndexRoute extends Route {
+  setupController(controller) {
+    const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
+    super.setupController(...arguments);
+    controller.setProperties({ authMethod });
+  }
+}
@@ -3,19 +3,28 @@ import { action } from '@ember/object';
 import loading from 'ember-loading/decorator';
 import { confirm } from 'core/decorators/confirm';
 import { notifySuccess, notifyError } from 'core/decorators/notify';
+import { inject as service } from '@ember/service';

 export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrariesRoute extends Route {
  // =methods
+  @service can;

  /**
   * Loads all credential libraries under the current credential store.
   * @return {Promise{[CredentialLibraryModel]}}
   */
  model() {
-    const { id: credential_store_id } = this.modelFor(
+    const credentialStore = this.modelFor(
      'scopes.scope.credential-stores.credential-store'
    );
-    return this.store.query('credential-library', { credential_store_id });
+    const { id: credential_store_id } = credentialStore;
+    if (
+      this.can.can('list collection', credentialStore, {
+        collection: 'credential-libraries',
+      })
+    ) {
+      return this.store.query('credential-library', { credential_store_id });
+    }
  }

  // =actions
@@ -1,3 +1,13 @@
 import Route from '@ember/routing/route';

-export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrariesIndexRoute extends Route {}
+export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrariesIndexRoute extends Route {
+  // =methods
+
+  setupController(controller) {
+    const credentialStore = this.modelFor(
+      'scopes.scope.credential-stores.credential-store'
+    );
+    super.setupController(...arguments);
+    controller.setProperties({ credentialStore });
+  }
+}
@@ -55,12 +55,16 @@
      </dropdown.button>
    {{/if}}
  {{/if}}
-  <dropdown.link
-    @route='scopes.scope.auth-methods.auth-method.accounts.new'
-    @model={{@model}}
-  >
-    {{t 'resources.account.actions.create'}}
-  </dropdown.link>
+  {{#if (can 'create collection' @model collection='accounts')}}
+
+    <dropdown.link
+      @route='scopes.scope.auth-methods.auth-method.accounts.new'
+      @model={{@model}}
+    >
+      {{t 'resources.account.actions.create'}}
+    </dropdown.link>
+  {{/if}}
+
  {{#if (can 'delete model' @model)}}
    <dropdown.separator />
    <dropdown.button
@@ -2,7 +2,10 @@
  <nav.link @route='scopes.scope.auth-methods.auth-method.index'>
    {{t 'titles.details'}}
  </nav.link>
-  <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
-    {{t 'resources.account.title_plural'}}
-  </nav.link>
+  {{#if (can 'navigate collection' @model collection='accounts')}}
+
+    <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
+      {{t 'resources.account.title_plural'}}
+    </nav.link>
+  {{/if}}
 </Rose::Nav::Tabs>
@@ -112,12 +112,38 @@
      as |message|
    >
      <message.description>
-        {{t 'resources.account.messages.welcome.description'}}
+
+        {{#if (can 'list collection' this.authMethod collection='accounts')}}
+          {{! can list (at least):  show default welcome message}}
+          {{t 'resources.account.description'}}
+
+        {{else if (can
+          'create collection' this.authMethod collection='accounts'
+        )}}
+          {{! can create (only):  show create-but-not-list welcome message}}
+          {{t
+            'descriptions.create-but-not-list'
+            resource=(t 'resources.account.title_plural')
+          }}
+        {{else}}
+          {{! can neither list nor create }}
+          {{t
+            'descriptions.neither-list-nor-create'
+            resource=(t 'resources.account.title_plural')
+          }}
+        {{/if}}
+
      </message.description>
-      <message.link @route='scopes.scope.auth-methods.auth-method.accounts.new'>
-        <Rose::Icon @name='flight-icons/plus-circle-16' />
-        {{t 'resources.account.actions.create'}}
-      </message.link>
+
+      {{#if (can 'create collection' this.authMethod collection='accounts')}}
+
+        <message.link
+          @route='scopes.scope.auth-methods.auth-method.accounts.new'
+        >
+          <Rose::Icon @name='flight-icons/plus-circle-16' />
+          {{t 'resources.account.actions.create'}}
+        </message.link>
+      {{/if}}
    </Rose::Message>
  </Rose::Layout::Centered>

@@ -3,12 +3,15 @@
  @dropdownRight={{true}}
  as |dropdown|
 >
-  <dropdown.link
-    @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
-    @model={{@model}}
-  >
-    {{t 'resources.credential-library.actions.create'}}
-  </dropdown.link>
+  {{#if (can 'create collection' @model collection='credential-libraries')}}
+
+    <dropdown.link
+      @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
+      @model={{@model}}
+    >
+      {{t 'resources.credential-library.actions.create'}}
+    </dropdown.link>
+  {{/if}}
  {{#if (can 'delete model' @model)}}
    <dropdown.separator />
    <dropdown.button
@@ -2,9 +2,12 @@
  <nav.link @route='scopes.scope.credential-stores.credential-store.index'>
    {{t 'titles.details'}}
  </nav.link>
-  <nav.link
-    @route='scopes.scope.credential-stores.credential-store.credential-libraries'
-  >
-    {{t 'resources.credential-library.title_plural'}}
-  </nav.link>
+  {{#if (can 'navigate collection' @model collection='credential-libraries')}}
+
+    <nav.link
+      @route='scopes.scope.credential-stores.credential-store.credential-libraries'
+    >
+      {{t 'resources.credential-library.title_plural'}}
+    </nav.link>
+  {{/if}}
 </Rose::Nav::Tabs>
@@ -53,14 +53,49 @@
      as |message|
    >
      <message.description>
-        {{t 'resources.credential-library.messages.none.description'}}
+        {{#if
+          (can
+            'list collection'
+            this.credentialStore
+            collection='credential-libraries'
+          )
+        }}
+          {{! can list (at least):  show default welcome message}}
+          {{t 'resources.credential-library.description'}}
+
+        {{else if (can
+          'create collection'
+          this.credentialStore
+          collection='credential-libraries'
+        )}}
+          {{! can create (only):  show create-but-not-list welcome message}}
+          {{t
+            'descriptions.create-but-not-list'
+            resource=(t 'resources.credential-library.title_plural')
+          }}
+        {{else}}
+          {{! can neither list nor create }}
+          {{t
+            'descriptions.neither-list-nor-create'
+            resource=(t 'resources.credential-library.title_plural')
+          }}
+        {{/if}}
+
      </message.description>
-      <message.link
-        @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
-      >
-        <Rose::Icon @name='flight-icons/plus-circle-16' />
-        {{t 'titles.new'}}
-      </message.link>
+      {{#if
+        (can
+          'create collection'
+          this.credentialStore
+          collection='credential-libraries'
+        )
+      }}
+        <message.link
+          @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
+        >
+          <Rose::Icon @name='flight-icons/plus-circle-16' />
+          {{t 'titles.new'}}
+        </message.link>
+      {{/if}}
    </Rose::Message>
  </Rose::Layout::Centered>

@@ -94,7 +94,7 @@ module.exports = function (environment) {
      'oidc-account-crud': true,
      search: false,
      filter: false,
-      capabilities: false,
+      capabilities: true,
      'credential-store': true,
    },
  };
@@ -11,7 +11,7 @@ import {
  //invalidateSession,
 } from 'ember-simple-auth/test-support';

-module('Acceptance | accounts', function (hooks) {
+module('Acceptance | accounts | create', function (hooks) {
  setupApplicationTest(hooks);
  setupMirage(hooks);

@@ -80,6 +80,41 @@ module('Acceptance | accounts', function (hooks) {
    assert.equal(this.server.db.accounts.length, accountsCount + 1);
  });

+  test('Users cannot create a new account without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`.rose-layout-page-actions [href="${urls.newAccount}"]`));
+  });
+
+  test('Users can navigate to new account route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.authMethod);
+    assert.ok(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.ok(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('Users cannot navigate to new account route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`[href="${urls.accounts}"]`));
+  });
+
  test('can cancel a new account creation', async function (assert) {
    assert.expect(2);
    const accountsCount = this.server.db.accounts.length;
@@ -0,0 +1,92 @@
+import { module, test } from 'qunit';
+import { visit, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | accounts | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethods: null,
+    account: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    accounts: null,
+    newAccount: null,
+    account: null,
+  };
+
+  hooks.beforeEach(function () {
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+    instances.account = this.server.create('account', {
+      scope: instances.scopes.org,
+      authMethod: instances.authMethod,
+    });
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+    urls.accounts = `${urls.authMethod}/accounts`;
+    urls.newAccount = `${urls.accounts}/new`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+  });
+
+  hooks.afterEach(async function () {
+    const notification = find('.rose-notification');
+    if (notification) {
+      await click('.rose-notification-dismiss');
+    }
+  });
+
+  test('Users can navigate to accounts with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.authMethod);
+    assert.ok(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'list'
+      )
+    );
+    assert.ok(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'list'
+      )
+    );
+    assert.notOk(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = ['create'];
+    await visit(urls.authMethod);
+    assert.ok(find(`[href="${urls.accounts}"]`));
+    assert.ok(find(`.rose-layout-page-actions [href="${urls.newAccount}"]`));
+  });
+});
@@ -6,7 +6,7 @@ import a11yAudit from 'ember-a11y-testing/test-support/audit';
 import { authenticateSession } from 'ember-simple-auth/test-support';
 import { Response } from 'miragejs';

-module('Acceptance | credential-libraries', function (hooks) {
+module('Acceptance | credential-libraries | create', function (hooks) {
  setupApplicationTest(hooks);
  setupMirage(hooks);

@@ -93,6 +93,20 @@ module('Acceptance | credential-libraries', function (hooks) {
    assert.equal(getCredentialLibraryCount(), count + 1);
  });

+  test('Users cannot navigate to new credential library route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.credentialStore.authorized_collection_actions[
+      'credential-libraries'
+    ] = [];
+    await visit(urls.credentialStore);
+    assert.notOk(
+      instances.credentialStore.authorized_collection_actions[
+        'credential-libraries'
+      ].includes('create')
+    );
+    assert.notOk(find(`[href="${urls.credentialLibraries}"]`));
+  });
+
  test('can cancel create a new credential library', async function (assert) {
    assert.expect(2);
    const count = getCredentialLibraryCount();
@@ -0,0 +1,95 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | credential-libraries | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      project: null,
+    },
+  };
+
+  const urls = {
+    globalScope: null,
+    orgScope: null,
+    projectScope: null,
+    credentialStores: null,
+    credentialStore: null,
+    credentialLibrary: null,
+    credentialLibraries: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.credentialStore = this.server.create('credential-store', {
+      scope: instances.scopes.project,
+    });
+    instances.credentialLibrary = this.server.create('credential-library', {
+      scope: instances.scopes.project,
+      credentialStore: instances.credentialStore,
+    });
+    // Generate route URLs for resources
+    urls.globalScope = `/scopes/global/scopes`;
+    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.credentialStores = `${urls.projectScope}/credential-stores`;
+    urls.credentialStore = `${urls.credentialStores}/${instances.credentialStore.id}`;
+    urls.credentialLibraries = `${urls.credentialStore}/credential-libraries`;
+    urls.credentialLibrary = `${urls.credentialLibraries}/${instances.credentialLibrary.id}`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to credential libraries with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.credentialStore);
+    assert.ok(
+      instances.credentialStore.authorized_collection_actions[
+        'credential-libraries'
+      ].includes('list')
+    );
+    assert.ok(find(`[href="${urls.credentialLibraries}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.credentialStore.authorized_collection_actions[
+      'credential-libraries'
+    ] = [];
+    await visit(urls.credentialStore);
+    assert.notOk(
+      instances.credentialStore.authorized_collection_actions[
+        'credential-libraries'
+      ].includes('list')
+    );
+    assert.notOk(find(`[href="${urls.credentialLibraries}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.credentialStore.authorized_collection_actions[
+      'credential-libraries'
+    ] = ['create'];
+    await visit(urls.credentialStore);
+    assert.ok(find(`[href="${urls.credentialLibraries}"]`));
+  });
+});
@@ -58,7 +58,7 @@ module.exports = function (environment) {
      oidc: true,
      search: false,
      filter: false,
-      capabilities: false,
+      capabilities: true,
      'credential-store': false,
    },
  };