Merge pull request #707 from hashicorp/auth-capabilities

feat: 🎸 auth capabilities

addons/api/mirage/factories/auth-method.js

@@ -1,9 +1,17 @@
 import factory from '../generated/factories/auth-method';
 import { trait } from 'ember-cli-mirage';
+import permissions from '../helpers/permissions';
 
 const types = ['password', 'oidc'];
 
 export default factory.extend({
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('auth-method') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
   id: (i) => `auth-method-id-${i}`,
 
   // Cycle through available types

ui/admin/app/components/form/auth-method/oidc/index.hbs

@@ -6,7 +6,6 @@
   @showEditToggle={{if @model.isNew false true}}
   as |form|
 >
-
   <form.actions
     @disabled={{if @model.cannotSave @model.cannotSave}}
     @enableEditText={{t 'actions.edit-form'}}
@@ -678,11 +677,12 @@
       @disabled={{true}}
     />
   {{/unless}}
-
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 </Rose::Form>

ui/admin/app/components/form/auth-method/password/index.hbs

@@ -51,11 +51,12 @@
       </field.errors>
     {{/if}}
   </form.textarea>
-
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 </Rose::Form>

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs

@@ -59,12 +59,14 @@
   >
     {{t 'resources.account.actions.create'}}
   </dropdown.link>
-  <dropdown.separator />
-  <dropdown.button
-    @style='danger'
-    @disabled={{@model.canSave}}
-    {{on 'click' (route-action 'delete' @model)}}
-  >
-    {{t 'resources.auth-method.actions.delete'}}
-  </dropdown.button>
+  {{#if (can 'delete model' @model)}}
+    <dropdown.separator />
+    <dropdown.button
+      @style='danger'
+      @disabled={{@model.canSave}}
+      {{on 'click' (route-action 'delete' @model)}}
+    >
+      {{t 'resources.auth-method.actions.delete'}}
+    </dropdown.button>
+  {{/if}}
 </Rose::Dropdown>

ui/admin/app/templates/scopes/scope/auth-methods/index.hbs

@@ -76,6 +76,19 @@
                 }}
                 {{#if authMethod.isOIDC}}
                   {{#if (feature-flag 'oidc-crud')}}
+                    {{#if (can 'read model' authMethod)}}
+                      <LinkTo
+                        @route='scopes.scope.auth-methods.auth-method'
+                        @model={{authMethod.id}}
+                      >
+                        {{authMethod.displayName}}
+                      </LinkTo>
+                    {{else}}
+                      {{authMethod.displayName}}
+                    {{/if}}
+                  {{/if}}
+                {{else}}
+                  {{#if (can 'read model' authMethod)}}
                     <LinkTo
                       @route='scopes.scope.auth-methods.auth-method'
                       @model={{authMethod.id}}
@@ -85,13 +98,6 @@
                   {{else}}
                     {{authMethod.displayName}}
                   {{/if}}
-                {{else}}
-                  <LinkTo
-                    @route='scopes.scope.auth-methods.auth-method'
-                    @model={{authMethod.id}}
-                  >
-                    {{authMethod.displayName}}
-                  </LinkTo>
                 {{/if}}
                 <p>{{authMethod.description}}</p>
               </row.headerCell>

ui/admin/tests/acceptance/auth-methods-test.js

@@ -103,175 +103,6 @@ module('Acceptance | auth methods', function (hooks) {
     assert.equal(currentURL(), urls.authMethods);
   });
 
-  test('can delete an auth method', async function (assert) {
-    assert.expect(1);
-    const authMethodsCount = this.server.db.authMethods.length;
-    await visit(urls.authMethod);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(this.server.db.authMethods.length, authMethodsCount - 1);
-  });
-
-  test('saving a new auth method with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.post('/auth-methods', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(urls.newAuthMethod);
-    await fillIn('[name="name"]', 'new auth method');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.',
-      'Displays primary error message.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.',
-      'Displays field-level errors.'
-    );
-  });
-
-  test('errors are displayed when save on auth method fails', async function (assert) {
-    assert.expect(1);
-    this.server.patch('/auth-methods/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(urls.authMethod);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'save auth method');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'Oops.',
-      'Displays primary error message.'
-    );
-  });
-
-  test('errors are displayed when delete on an auth method fails', async function (assert) {
-    assert.expect(1);
-    this.server.del('/auth-methods/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(urls.authMethod);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'Oops.',
-      'Displays primary error message.'
-    );
-  });
-
-  test('saving an existing auth method with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.patch('/auth-methods/:id', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(urls.authMethod);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'existing auth method');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.',
-      'Displays primary error message.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.',
-      'Displays field-level errors.'
-    );
-  });
-
-  test('saving an existing auth method with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.patch('/auth-methods/:id', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(urls.authMethod);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'existing auth method');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.',
-      'Displays primary error message.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.',
-      'Displays field-level errors.'
-    );
-  });
-
   test('user can make primary an auth method', async function (assert) {
     assert.expect(2);
     assert.notOk(

ui/admin/tests/acceptance/auth-methods/delete-test.js

@@ -0,0 +1,93 @@
+import { module, test } from 'qunit';
+import { visit, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  //   // These are left here intentionally for future reference.
+  //   //currentSession,
+  //   //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | auth methods | delete', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethod: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    newAuthMethod: null,
+    authMethod: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Setup Mirage mock resources for this test
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.newAuthMethod = `${urls.authMethods}/new?type=password`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+  });
+
+  test('can delete an auth method', async function (assert) {
+    assert.expect(1);
+    const authMethodsCount = this.server.db.authMethods.length;
+    await visit(urls.authMethod);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(this.server.db.authMethods.length, authMethodsCount - 1);
+  });
+
+  test('errors are displayed when delete on an auth method fails', async function (assert) {
+    assert.expect(1);
+    this.server.del('/auth-methods/:id', () => {
+      return new Response(
+        490,
+        {},
+        {
+          status: 490,
+          code: 'error',
+          message: 'Oops.',
+        }
+      );
+    });
+    await visit(urls.authMethod);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'Oops.',
+      'Displays primary error message.'
+    );
+  });
+
+  test('cannot delete an auth method without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.authMethod.authorized_actions =
+      instances.authMethod.authorized_actions.filter(
+        (item) => item !== 'delete'
+      );
+    await visit(urls.authMethod);
+    assert.notOk(
+      find('.rose-layout-page-actions .rose-dropdown-button-danger')
+    );
+  });
+});

ui/admin/tests/acceptance/auth-methods/read-test.js

@@ -0,0 +1,72 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import {
+  authenticateSession,
+  //   // These are left here intentionally for future reference.
+  //   //currentSession,
+  //   //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | auth methods | read', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethod: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    newAuthMethod: null,
+    authMethod: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Setup Mirage mock resources for this test
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.newAuthMethod = `${urls.authMethods}/new?type=password`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+  });
+
+  test('visiting auth methods', async function (assert) {
+    assert.expect(1);
+    await visit(urls.authMethods);
+    await a11yAudit();
+    assert.equal(currentURL(), urls.authMethods);
+  });
+
+  test('can navigate to an auth method form', async function (assert) {
+    assert.expect(1);
+    await visit(urls.authMethods);
+    await click('main tbody .rose-table-header-cell:nth-child(1) a');
+    await a11yAudit();
+    assert.equal(currentURL(), urls.authMethod);
+  });
+
+  test('cannot navigate to an auth method form without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.authMethod.authorized_actions =
+      instances.authMethod.authorized_actions.filter((item) => item !== 'read');
+    await visit(urls.authMethod);
+    assert.notOk(find('main tbody .rose-table-header-cell:nth-child(1) a'));
+  });
+});

ui/admin/tests/acceptance/auth-methods/update-test.js

@@ -0,0 +1,154 @@
+import { module, test } from 'qunit';
+import { visit, click, find, fillIn } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  //   // These are left here intentionally for future reference.
+  //   //currentSession,
+  //   //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | auth methods | update', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethod: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    newAuthMethod: null,
+    authMethod: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Setup Mirage mock resources for this test
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.newAuthMethod = `${urls.authMethods}/new?type=password`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+  });
+
+  test('can update an auth method and save changes', async function (assert) {
+    assert.expect(1);
+    await visit(urls.authMethod);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'update name');
+    await click('form [type="submit"]:not(:disabled)');
+    assert.equal(this.server.db.authMethods[0].name, 'update name');
+  });
+
+  test('can update an auth method and cancel changes', async function (assert) {
+    assert.expect(1);
+    await visit(urls.authMethod);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'update name');
+    await click('form button:not([type="submit"])');
+    assert.notEqual(this.server.db.authMethods[0].name, 'update name');
+  });
+
+  test('cannot make changes to an existing auth method without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.authMethod.authorized_actions =
+      instances.authMethod.authorized_actions.filter(
+        (item) => item !== 'update'
+      );
+    await visit(urls.authMethod);
+    assert.notOk(find('.rose-layout-page-actions .rose-button-secondary'));
+  });
+
+  test('saving an existing auth method with invalid fields displays error messages', async function (assert) {
+    assert.expect(2);
+    this.server.patch('/auth-methods/:id', () => {
+      return new Response(
+        400,
+        {},
+        {
+          status: 400,
+          code: 'invalid_argument',
+          message: 'The request was invalid.',
+          details: {
+            request_fields: [
+              {
+                name: 'name',
+                description: 'Name is required.',
+              },
+            ],
+          },
+        }
+      );
+    });
+    await visit(urls.authMethod);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'existing auth method');
+    await click('form [type="submit"]');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'The request was invalid.',
+      'Displays primary error message.'
+    );
+    assert.ok(
+      find('.rose-form-error-message').textContent.trim(),
+      'Name is required.',
+      'Displays field-level errors.'
+    );
+  });
+
+  test('saving an existing auth method with invalid fields displays error messages', async function (assert) {
+    assert.expect(2);
+    this.server.patch('/auth-methods/:id', () => {
+      return new Response(
+        400,
+        {},
+        {
+          status: 400,
+          code: 'invalid_argument',
+          message: 'The request was invalid.',
+          details: {
+            request_fields: [
+              {
+                name: 'name',
+                description: 'Name is required.',
+              },
+            ],
+          },
+        }
+      );
+    });
+    await visit(urls.authMethod);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'existing auth method');
+    await click('form [type="submit"]');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'The request was invalid.',
+      'Displays primary error message.'
+    );
+    assert.ok(
+      find('.rose-form-error-message').textContent.trim(),
+      'Name is required.',
+      'Displays field-level errors.'
+    );
+  });
+});