Reapply ember-can upgrade (#3111)

* chore: 🤖 reapply previous ember-can upgrade from #3093

* chore: 🤖 add missing ember-inflector dependency

* chore: 🤖 move @ember/string to be a dependency in desktop

* chore: 🤖 re-run pnpm install to resolve lockfile dupe key error

* chore: 🤖 remove unused abilities service injections

Co-Authored-By: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com>

---------

Co-authored-by: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com>

addons/api/addon/abilities/role.js

@@ -16,7 +16,7 @@ class InvalidRolePrincipalTypeError extends Error {
 export default class RoleAbility extends ModelAbility {
   // =services
 
-  @service can;
+  @service abilities;
 
   // =permissions
 
@@ -64,6 +64,6 @@ export default class RoleAbility extends ModelAbility {
         `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`,
       );
     }
-    return this.can.can(`read ${type}`, this.model);
+    return this.abilities.can(`read ${type}`, this.model);
   }
 }

addons/api/package.json

@@ -33,7 +33,7 @@
     "broccoli-plugin": "^4.0.7",
     "broccoli-source": "^3.0.1",
     "ember-auto-import": "^2.10.0",
-    "ember-can": "^4.2.0",
+    "ember-can": "^8.0.0",
     "ember-cli-babel": "^8.2.0",
     "ember-cli-htmlbars": "^6.3.0",
     "ember-data": "~5.3.12",

addons/api/tests/dummy/app/app.js

@@ -7,11 +7,12 @@ import Application from '@ember/application';
 import Resolver from 'ember-resolver';
 import loadInitializers from 'ember-load-initializers';
 import config from 'dummy/config/environment';
+import { extendResolver } from 'ember-can';
 
 export default class App extends Application {
   modulePrefix = config.modulePrefix;
   podModulePrefix = config.podModulePrefix;
-  Resolver = Resolver;
+  Resolver = extendResolver(Resolver);
 }
 
 loadInitializers(App, config.modulePrefix);

addons/api/tests/unit/abilities/account-test.js

@@ -14,11 +14,11 @@ import {
 module('Unit | Abilities | Account', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -26,9 +26,9 @@ module('Unit | Abilities | Account', function (hooks) {
     const account = store.createRecord('auth-method', {
       authorized_actions: ['set-password'],
     });
-    assert.true(canService.can('setPassword account', account));
+    assert.true(abilitiesService.can('setPassword account', account));
     account.authorized_actions = [];
-    assert.false(canService.can('setPassword account', account));
+    assert.false(abilitiesService.can('setPassword account', account));
   });
 
   test('can read known account types when authorized', function (assert) {
@@ -36,13 +36,13 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: ['read'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('read account', account));
+    assert.true(abilitiesService.can('read account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('read account', account));
+    assert.true(abilitiesService.can('read account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('read account', account));
+    assert.true(abilitiesService.can('read account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('read account', account));
+    assert.false(abilitiesService.can('read account', account));
   });
 
   test('cannot read accounts when unauthorized', function (assert) {
@@ -50,13 +50,13 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: [],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.false(canService.can('read account', account));
+    assert.false(abilitiesService.can('read account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.false(canService.can('read account', account));
+    assert.false(abilitiesService.can('read account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.false(canService.can('read account', account));
+    assert.false(abilitiesService.can('read account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('read account', account));
+    assert.false(abilitiesService.can('read account', account));
   });
 
   test('can delete known account types when authorized', function (assert) {
@@ -64,13 +64,13 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: ['delete'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('delete account', account));
+    assert.false(abilitiesService.can('delete account', account));
   });
 
   test('cannot delete accounts when unauthorized', function (assert) {
@@ -78,13 +78,13 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: ['delete'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('delete account', account));
+    assert.true(abilitiesService.can('delete account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('delete account', account));
+    assert.false(abilitiesService.can('delete account', account));
   });
 
   test('can update known account types when authorized', function (assert) {
@@ -92,13 +92,13 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: ['update'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('update account', account));
+    assert.true(abilitiesService.can('update account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('update account', account));
+    assert.true(abilitiesService.can('update account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('update account', account));
+    assert.true(abilitiesService.can('update account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('update account', account));
+    assert.false(abilitiesService.can('update account', account));
   });
 
   test('cannot update accounts when unauthorized', function (assert) {
@@ -106,12 +106,12 @@ module('Unit | Abilities | Account', function (hooks) {
       authorized_actions: [],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.false(canService.can('update account', account));
+    assert.false(abilitiesService.can('update account', account));
     account.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.false(canService.can('update account', account));
+    assert.false(abilitiesService.can('update account', account));
     account.type = TYPE_AUTH_METHOD_LDAP;
-    assert.false(canService.can('update account', account));
+    assert.false(abilitiesService.can('update account', account));
     account.type = 'no-such-type';
-    assert.false(canService.can('update account', account));
+    assert.false(abilitiesService.can('update account', account));
   });
 });

addons/api/tests/unit/abilities/auth-method-test.js

@@ -14,11 +14,11 @@ import {
 module('Unit | Abilities | Auth Method', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -27,13 +27,13 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: ['read'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('cannot read auth methods when unauthorized', function (assert) {
@@ -41,13 +41,13 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: [],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('can delete known auth method types when authorized', function (assert) {
@@ -55,13 +55,13 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: ['delete'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('delete auth-method', authMethod));
+    assert.false(abilitiesService.can('delete auth-method', authMethod));
   });
 
   test('cannot delete auth methods when unauthorized', function (assert) {
@@ -69,13 +69,13 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: ['delete'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('delete auth-method', authMethod));
+    assert.true(abilitiesService.can('delete auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('delete auth-method', authMethod));
+    assert.false(abilitiesService.can('delete auth-method', authMethod));
   });
 
   test('can update known auth method types when authorized', function (assert) {
@@ -83,13 +83,13 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: ['update'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('update auth-method', authMethod));
+    assert.true(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('update auth-method', authMethod));
+    assert.true(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.true(canService.can('update auth-method', authMethod));
+    assert.true(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('update auth-method', authMethod));
+    assert.false(abilitiesService.can('update auth-method', authMethod));
   });
 
   test('cannot update auth methods when unauthorized', function (assert) {
@@ -97,12 +97,12 @@ module('Unit | Abilities | Auth Method', function (hooks) {
       authorized_actions: [],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.false(canService.can('update auth-method', authMethod));
+    assert.false(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.false(canService.can('update auth-method', authMethod));
+    assert.false(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_LDAP;
-    assert.false(canService.can('update auth-method', authMethod));
+    assert.false(abilitiesService.can('update auth-method', authMethod));
     authMethod.type = 'no-such-type';
-    assert.false(canService.can('update auth-method', authMethod));
+    assert.false(abilitiesService.can('update auth-method', authMethod));
   });
 });

addons/api/tests/unit/abilities/channel-recording-test.js

@@ -11,11 +11,11 @@ import { TYPE_SESSION_RECORDING_SSH } from 'api/models/session-recording';
 module('Unit | Ability | channel-recording', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -41,7 +41,10 @@ module('Unit | Ability | channel-recording', function (hooks) {
     });
 
     assert.true(
-      canService.can('getAsciicast channel-recording', channelRecordingModel),
+      abilitiesService.can(
+        'getAsciicast channel-recording',
+        channelRecordingModel,
+      ),
     );
   });
 
@@ -62,7 +65,10 @@ module('Unit | Ability | channel-recording', function (hooks) {
     });
 
     assert.false(
-      canService.can('getAsciicast channel-recording', channelRecordingModel),
+      abilitiesService.can(
+        'getAsciicast channel-recording',
+        channelRecordingModel,
+      ),
     );
   });
 });

addons/api/tests/unit/abilities/group-test.js

@@ -10,7 +10,7 @@ module('Unit | Abilities | Group', function (hooks) {
   setupTest(hooks);
 
   test('it reflects when a given group resource may add members based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['add-members'],
     };
@@ -20,7 +20,7 @@ module('Unit | Abilities | Group', function (hooks) {
   });
 
   test('it reflects when a given group resource may remove members based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['remove-members'],
     };

addons/api/tests/unit/abilities/host-set-test.js

@@ -10,7 +10,7 @@ module('Unit | Abilities | Host Set', function (hooks) {
   setupTest(hooks);
 
   test('it reflects when a given host set resource may add hosts based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['add-hosts'],
     };
@@ -20,7 +20,7 @@ module('Unit | Abilities | Host Set', function (hooks) {
   });
 
   test('it reflects when a given hostSet resource may remove hosts based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['remove-hosts'],
     };

addons/api/tests/unit/abilities/model-test.js

@@ -10,7 +10,7 @@ module('Unit | Abilities | Model', function (hooks) {
   setupTest(hooks);
 
   test('it reflects when a given model may be read based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['read'],
     };
@@ -20,7 +20,7 @@ module('Unit | Abilities | Model', function (hooks) {
   });
 
   test('it reflects when a given model may be updated based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['update'],
     };
@@ -30,7 +30,7 @@ module('Unit | Abilities | Model', function (hooks) {
   });
 
   test('it reflects when a given model may be saved based on isNew and authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     let model = {
       isNew: false,
       authorized_actions: ['update'],
@@ -58,7 +58,7 @@ module('Unit | Abilities | Model', function (hooks) {
   });
 
   test('it reflects when a given model may be deleted based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['delete'],
     };
@@ -70,7 +70,7 @@ module('Unit | Abilities | Model', function (hooks) {
   // =collections
 
   test('it reflects when a resource may be listed based on authorized_collection_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_collection_actions: {
         foobars: ['list'],
@@ -82,7 +82,7 @@ module('Unit | Abilities | Model', function (hooks) {
   });
 
   test('it reflects when a resource may be created based on authorized_collection_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_collection_actions: {
         foobars: ['create'],

addons/api/tests/unit/abilities/role-test.js

@@ -10,7 +10,7 @@ module('Unit | Abilities | Role', function (hooks) {
   setupTest(hooks);
 
   test('it reflects when a given role may set grants based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['set-grants'],
     };
@@ -20,7 +20,7 @@ module('Unit | Abilities | Role', function (hooks) {
   });
 
   test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['add-principals'],
     };
@@ -30,7 +30,7 @@ module('Unit | Abilities | Role', function (hooks) {
   });
 
   test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['remove-principals'],
     };
@@ -40,7 +40,7 @@ module('Unit | Abilities | Role', function (hooks) {
   });
 
   test('it proxies role principal read ability to the appropriate ability type', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const user = {
       constructor: { modelName: 'user' },
       authorized_actions: [],
@@ -65,7 +65,7 @@ module('Unit | Abilities | Role', function (hooks) {
   });
 
   test('it throws an error for unknown principal types on principal read check', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const account = {
       constructor: { modelName: 'account' },
       authorized_actions: ['read'],
@@ -77,7 +77,7 @@ module('Unit | Abilities | Role', function (hooks) {
   });
 
   test('can set grant scopes based on authorized_actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_actions: ['set-grant-scopes'],
     };

addons/api/tests/unit/abilities/scope-test.js

@@ -9,10 +9,10 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Abilities | Scope', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
   });
   test('it exists', function (assert) {
     const ability = this.owner.lookup('ability:scope');
@@ -23,9 +23,9 @@ module('Unit | Abilities | Scope', function (hooks) {
     const model = {
       authorized_actions: ['attach-storage-policy'],
     };
-    assert.true(canService.can('attachStoragePolicy scope', model));
+    assert.true(abilitiesService.can('attachStoragePolicy scope', model));
     model.authorized_actions = [];
-    assert.false(canService.can('attachStoragePolicy scope', model));
+    assert.false(abilitiesService.can('attachStoragePolicy scope', model));
   });
 
   test('it reflects when a given scope may remove a policy in org scope', function (assert) {
@@ -33,8 +33,8 @@ module('Unit | Abilities | Scope', function (hooks) {
       authorized_actions: ['detach-storage-policy'],
     };
 
-    assert.true(canService.can('detachStoragePolicy scope', model));
+    assert.true(abilitiesService.can('detachStoragePolicy scope', model));
     model.authorized_actions = [];
-    assert.false(canService.can('detachStoragePolicy scope', model));
+    assert.false(abilitiesService.can('detachStoragePolicy scope', model));
   });
 });

addons/api/tests/unit/abilities/session-recording-test.js

@@ -14,11 +14,11 @@ import {
 module('Unit | Ability | session-recording', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -42,13 +42,13 @@ module('Unit | Ability | session-recording', function (hooks) {
     );
 
     assert.true(
-      canService.can(
+      abilitiesService.can(
         'download session-recording',
         recordingWithAuthorizedAction,
       ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'download session-recording',
         recordingWithoutAuthorizedAction,
       ),
@@ -70,10 +70,16 @@ module('Unit | Ability | session-recording', function (hooks) {
       state: STATE_SESSION_RECORDING_AVAILABLE,
     });
     assert.false(
-      canService.can('delete session-recording', recordingNotinAvaialableState),
+      abilitiesService.can(
+        'delete session-recording',
+        recordingNotinAvaialableState,
+      ),
     );
     assert.true(
-      canService.can('delete session-recording', recordingInAvailableState),
+      abilitiesService.can(
+        'delete session-recording',
+        recordingInAvailableState,
+      ),
     );
   });
 
@@ -83,7 +89,7 @@ module('Unit | Ability | session-recording', function (hooks) {
     });
 
     assert.true(
-      canService.can('reapplyStoragePolicy session-recording', recording),
+      abilitiesService.can('reapplyStoragePolicy session-recording', recording),
     );
   });
 });

addons/api/tests/unit/abilities/session-test.js

@@ -15,11 +15,11 @@ import {
 module('Unit | Ability | session', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -34,7 +34,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_ACTIVE,
     });
 
-    assert.true(canService.can('read session', session));
+    assert.true(abilitiesService.can('read session', session));
   });
 
   test('can read a session that is pending', function (assert) {
@@ -43,7 +43,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_PENDING,
     });
 
-    assert.true(canService.can('read session', session));
+    assert.true(abilitiesService.can('read session', session));
   });
 
   test('cannot read a session that is not authorized', function (assert) {
@@ -64,10 +64,10 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_TERMINATED,
     });
 
-    assert.false(canService.can('read session', activeSession));
-    assert.false(canService.can('read session', pendingSession));
-    assert.false(canService.can('read session', cancelingSession));
-    assert.false(canService.can('read session', terminatedSession));
+    assert.false(abilitiesService.can('read session', activeSession));
+    assert.false(abilitiesService.can('read session', pendingSession));
+    assert.false(abilitiesService.can('read session', cancelingSession));
+    assert.false(abilitiesService.can('read session', terminatedSession));
   });
 
   test('cannot read a session that is canceling', function (assert) {
@@ -76,7 +76,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_CANCELING,
     });
 
-    assert.false(canService.can('read session', session));
+    assert.false(abilitiesService.can('read session', session));
   });
 
   test('cannot read a session that is terminated', function (assert) {
@@ -85,7 +85,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_TERMINATED,
     });
 
-    assert.false(canService.can('read session', session));
+    assert.false(abilitiesService.can('read session', session));
   });
 
   test('can read a session that has read:self', function (assert) {
@@ -94,7 +94,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_ACTIVE,
     });
 
-    assert.true(canService.can('read session', session));
+    assert.true(abilitiesService.can('read session', session));
   });
 
   test('can cancel a session that is active', function (assert) {
@@ -103,7 +103,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_ACTIVE,
     });
 
-    assert.true(canService.can('cancel session', session));
+    assert.true(abilitiesService.can('cancel session', session));
   });
 
   test('can cancel a session that has cancel:self', function (assert) {
@@ -112,7 +112,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_ACTIVE,
     });
 
-    assert.true(canService.can('cancel session', session));
+    assert.true(abilitiesService.can('cancel session', session));
   });
 
   test('can cancel a session that is pending', function (assert) {
@@ -121,7 +121,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_PENDING,
     });
 
-    assert.true(canService.can('cancel session', session));
+    assert.true(abilitiesService.can('cancel session', session));
   });
 
   test('cannot cancel a session that is canceling', function (assert) {
@@ -130,7 +130,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_CANCELING,
     });
 
-    assert.false(canService.can('cancel session', session));
+    assert.false(abilitiesService.can('cancel session', session));
   });
 
   test('cannot cancel a session that is terminated', function (assert) {
@@ -139,7 +139,7 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_TERMINATED,
     });
 
-    assert.false(canService.can('cancel session', session));
+    assert.false(abilitiesService.can('cancel session', session));
   });
 
   test('cannot cancel a session that is not authorized', function (assert) {
@@ -160,9 +160,9 @@ module('Unit | Ability | session', function (hooks) {
       status: STATUS_SESSION_TERMINATED,
     });
 
-    assert.false(canService.can('cancel session', activeSession));
-    assert.false(canService.can('cancel session', pendingSession));
-    assert.false(canService.can('cancel session', cancelingSession));
-    assert.false(canService.can('cancel session', terminatedSession));
+    assert.false(abilitiesService.can('cancel session', activeSession));
+    assert.false(abilitiesService.can('cancel session', pendingSession));
+    assert.false(abilitiesService.can('cancel session', cancelingSession));
+    assert.false(abilitiesService.can('cancel session', terminatedSession));
   });
 });

addons/api/tests/unit/abilities/target-test.js

@@ -9,55 +9,59 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Abilities | Target', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
   });
 
   test('it reflects when a given target may connect based on authorized_actions', function (assert) {
     const model = {
       authorized_actions: ['authorize-session'],
     };
-    assert.true(canService.can('connect target', model));
+    assert.true(abilitiesService.can('connect target', model));
     model.authorized_actions = [];
-    assert.false(canService.can('connect target', model));
+    assert.false(abilitiesService.can('connect target', model));
   });
 
   test('it reflects when a given target may add host sources', function (assert) {
     const model = {
       authorized_actions: ['add-host-sources'],
     };
-    assert.true(canService.can('addHostSources target', model));
+    assert.true(abilitiesService.can('addHostSources target', model));
     model.authorized_actions = [];
-    assert.false(canService.can('addHostSources target', model));
+    assert.false(abilitiesService.can('addHostSources target', model));
   });
 
   test('it reflects when a given target may remove host sources', function (assert) {
     const model = {
       authorized_actions: ['remove-host-sources'],
     };
-    assert.true(canService.can('removeHostSources target', model));
+    assert.true(abilitiesService.can('removeHostSources target', model));
     model.authorized_actions = [];
-    assert.false(canService.can('removeHostSources target', model));
+    assert.false(abilitiesService.can('removeHostSources target', model));
   });
 
   test('it reflects when a given target may add brokered credential sources', function (assert) {
     const model = {
       authorized_actions: ['add-credential-sources'],
     };
-    assert.true(canService.can('addBrokeredCredentialSources target', model));
+    assert.true(
+      abilitiesService.can('addBrokeredCredentialSources target', model),
+    );
     model.authorized_actions = [];
-    assert.false(canService.can('addBrokeredCredentialSources target', model));
+    assert.false(
+      abilitiesService.can('addBrokeredCredentialSources target', model),
+    );
   });
 
   test('it reflects when a given target may remove credential sources', function (assert) {
     const model = {
       authorized_actions: ['remove-credential-sources'],
     };
-    assert.true(canService.can('removeCredentialSources target', model));
+    assert.true(abilitiesService.can('removeCredentialSources target', model));
     model.authorized_actions = [];
-    assert.false(canService.can('removeCredentialSources target', model));
+    assert.false(abilitiesService.can('removeCredentialSources target', model));
   });
 
   test('it reflects when a given ssh target may add injected application credential sources', function (assert) {
@@ -74,16 +78,19 @@ module('Unit | Abilities | Target', function (hooks) {
     };
 
     assert.true(
-      canService.can('addInjectedApplicationCredentialSources target', model),
+      abilitiesService.can(
+        'addInjectedApplicationCredentialSources target',
+        model,
+      ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'addInjectedApplicationCredentialSources target',
         modelWithoutAuthorizedActions,
       ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'addInjectedApplicationCredentialSources target',
         modelWithoutSSHType,
       ),

addons/api/tests/unit/abilities/user-test.js

@@ -14,7 +14,7 @@ import {
 module('Unit | Abilities | User', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   const instances = {
@@ -23,7 +23,7 @@ module('Unit | Abilities | User', function (hooks) {
   };
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
     instances.user = store.createRecord('user');
     instances.account = store.createRecord('account');
@@ -31,28 +31,28 @@ module('Unit | Abilities | User', function (hooks) {
 
   test('can add accounts to user when authorized and given a known account type', function (assert) {
     instances.user.authorized_actions = ['add-accounts'];
-    assert.true(canService.can('addAccounts user', instances.user));
+    assert.true(abilitiesService.can('addAccounts user', instances.user));
     instances.account.type = TYPE_AUTH_METHOD_OIDC;
     assert.true(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_PASSWORD;
     assert.true(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_LDAP;
     assert.true(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = 'no-such-type';
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
@@ -60,28 +60,28 @@ module('Unit | Abilities | User', function (hooks) {
 
   test('cannot add accounts to user when unauthorized', function (assert) {
     instances.user.authorized_actions = [];
-    assert.false(canService.can('addAccounts user', instances.user));
+    assert.false(abilitiesService.can('addAccounts user', instances.user));
     instances.account.type = TYPE_AUTH_METHOD_OIDC;
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_PASSWORD;
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_LDAP;
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = 'no-such-type';
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
@@ -89,28 +89,28 @@ module('Unit | Abilities | User', function (hooks) {
 
   test('can remove accounts from user when authorized and given a known account type', function (assert) {
     instances.user.authorized_actions = ['remove-accounts'];
-    assert.true(canService.can('removeAccounts user', instances.user));
+    assert.true(abilitiesService.can('removeAccounts user', instances.user));
     instances.account.type = TYPE_AUTH_METHOD_OIDC;
     assert.true(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_PASSWORD;
     assert.true(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_LDAP;
     assert.true(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = 'no-such-type';
     assert.false(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
@@ -118,28 +118,28 @@ module('Unit | Abilities | User', function (hooks) {
 
   test('cannot remove accounts from user when unauthorized', function (assert) {
     instances.user.authorized_actions = [];
-    assert.false(canService.can('removeAccounts user', instances.user));
+    assert.false(abilitiesService.can('removeAccounts user', instances.user));
     instances.account.type = TYPE_AUTH_METHOD_OIDC;
     assert.false(
-      canService.can('addAccount user', instances.user, {
+      abilitiesService.can('addAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_PASSWORD;
     assert.false(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = TYPE_AUTH_METHOD_LDAP;
     assert.false(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );
     instances.account.type = 'no-such-type';
     assert.false(
-      canService.can('removeAccount user', instances.user, {
+      abilitiesService.can('removeAccount user', instances.user, {
         account: instances.account,
       }),
     );

addons/api/tests/unit/abilities/worker-test.js

@@ -9,7 +9,7 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Abilities | Worker', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   const instances = {
@@ -17,7 +17,7 @@ module('Unit | Abilities | Worker', function (hooks) {
   };
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
     instances.worker = store.createRecord('worker');
   });
@@ -27,7 +27,7 @@ module('Unit | Abilities | Worker', function (hooks) {
       authorized_collection_actions: { workers: ['create:worker-led'] },
     };
     assert.true(
-      canService.can('createWorkerLed worker', model, {
+      abilitiesService.can('createWorkerLed worker', model, {
         collection: 'workers',
       }),
     );
@@ -38,7 +38,7 @@ module('Unit | Abilities | Worker', function (hooks) {
       authorized_collection_actions: { workers: [] },
     };
     assert.true(
-      canService.cannot('createWorkerLed worker', model, {
+      abilitiesService.cannot('createWorkerLed worker', model, {
         collection: 'workers',
       }),
     );
@@ -46,11 +46,13 @@ module('Unit | Abilities | Worker', function (hooks) {
 
   test('can set worker tags', function (assert) {
     instances.worker.authorized_actions = ['set-worker-tags'];
-    assert.true(canService.can('setWorkerTags worker', instances.worker));
+    assert.true(abilitiesService.can('setWorkerTags worker', instances.worker));
   });
 
   test('cannot set worker tags', function (assert) {
     instances.worker.authorized_actions = [];
-    assert.true(canService.cannot('setWorkerTags worker', instances.worker));
+    assert.true(
+      abilitiesService.cannot('setWorkerTags worker', instances.worker),
+    );
   });
 });

pnpm-lock.yaml

@@ -77,8 +77,8 @@ importers:
         specifier: ^2.10.0
         version: 2.10.0(@glint/template@1.5.2)(webpack@5.104.1(esbuild@0.25.9))
       ember-can:
-        specifier: ^4.2.0
-        version: 4.2.0(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9)))
+        specifier: ^8.0.0
+        version: 8.0.0(@babel/core@7.27.1)(@ember/string@4.0.1)(ember-inflector@6.0.0(@babel/core@7.27.1))(ember-resolver@12.0.1(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9)))
       ember-cli-babel:
         specifier: ^8.2.0
         version: 8.2.0(@babel/core@7.27.1)
@@ -978,6 +978,9 @@ importers:
       '@babel/runtime':
         specifier: 7.27.6
         version: 7.27.6
+      '@ember/string':
+        specifier: ^4.0.0
+        version: 4.0.1
       '@xterm/addon-canvas':
         specifier: ^0.7.0
         version: 0.7.0(@xterm/xterm@5.5.0)
@@ -987,6 +990,9 @@ importers:
       '@xterm/xterm':
         specifier: ^5.5.0
         version: 5.5.0
+      ember-inflector:
+        specifier: ^6.0.0
+        version: 6.0.0(@babel/core@7.27.1)
       ember-named-blocks-polyfill:
         specifier: ^0.2.5
         version: 0.2.5
@@ -1012,9 +1018,6 @@ importers:
       '@ember/render-modifiers':
         specifier: ^2.0.4
         version: 2.1.0(@babel/core@7.27.1)(@glint/template@1.5.2)(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9)))
-      '@ember/string':
-        specifier: ^4.0.0
-        version: 4.0.1
       '@ember/test-helpers':
         specifier: ^5.2.1
         version: 5.2.2(@babel/core@7.27.1)(@glint/template@1.5.2)
@@ -4669,9 +4672,13 @@ packages:
   ember-browser-services@4.0.4:
     resolution: {integrity: sha512-ZjQPD7wlqMhHIq+uuesW+SWYCN+TsQtyY2Fy7QpluxEQff/j2JHiQAk3K0GUtEwef1gJ8/dRsBqSnaG2/Fxhmg==}
 
-  ember-can@4.2.0:
-    resolution: {integrity: sha512-hiaWZspmI4zWeWmmFWgyw1+yEStSo6edGRHHUXCUPR+vBoqlT/hEfmndlfDGso2GFP8IV59DORMVY0KReMcO+w==}
-    engines: {node: 12.* || 14.* || >= 16}
+  ember-can@8.0.0:
+    resolution: {integrity: sha512-JsS7tJ7sg52p8jPY2ND9uqHdEpAB+RpJLN8+lo7t5j65JgBX5gWXCCJ8seJ28AE278Im2ok0OoQBv5VXWqkvOw==}
+    peerDependencies:
+      '@ember/string': '>= 3.0.1'
+      ember-inflector: '>= 5.0.1'
+      ember-resolver: '>= 10.0.0'
+      ember-source: '>= 4.12.0'
 
   ember-cli-babel-plugin-helpers@1.1.1:
     resolution: {integrity: sha512-sKvOiPNHr5F/60NLd7SFzMpYPte/nnGkq/tMIfXejfKHIhaiIkYFqX8Z9UFTKWLLn+V7NOaby6niNPZUdvKCRw==}
@@ -4912,12 +4919,6 @@ packages:
     resolution: {integrity: sha512-uNmv1cPG/4qsac8oIf5txJ2FZ8p88LEpG4P3dNcjsJS98Y8hd0GPMFwVqpnzI78Lz7VYRGQWY4jnE4qm5R3j4g==}
     engines: {node: 12.* || 14.* || >= 16}
 
-  ember-inflector@4.0.3:
-    resolution: {integrity: sha512-E+NnmzybMRWn1JyEfDxY7arjOTJLIcGjcXnUxizgjD4TlvO1s3O65blZt+Xq2C2AFSPeqHLC6PXd6XHYM8BxdQ==}
-    engines: {node: 14.* || 16.* || >= 18}
-    peerDependencies:
-      ember-source: ^3.16.0 || ^4.0.0 || ^5.0.0
-
   ember-inflector@6.0.0:
     resolution: {integrity: sha512-g6trqBhQHRwlq9bBmoyxhAl0tD0/CaTKK0xWPUgi3BfxFOgGG1bbiwAx+tjyiAkLzDqU+ihyjtT+sd41y6K1hA==}
 
@@ -7736,7 +7737,6 @@ packages:
     engines: {node: '>=0.6.0', teleport: '>=0.2.0'}
     deprecated: |-
       You or someone you depend on is using Q, the JavaScript Promise library that gave JavaScript developers strong feelings about promises. They can almost certainly migrate to the native JavaScript promise now. Thank you literally everyone for joining me in this bet against the odds. Be excellent to each other.
-
       (For a CapTP with native promises, see @endo/eventual-send and @endo/captp)
 
   qs@6.14.1:
@@ -13653,13 +13653,16 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-can@4.2.0(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))):
+  ember-can@8.0.0(@babel/core@7.27.1)(@ember/string@4.0.1)(ember-inflector@6.0.0(@babel/core@7.27.1))(ember-resolver@12.0.1(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))))(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))):
     dependencies:
-      ember-cli-babel: 7.26.11
-      ember-cli-htmlbars: 6.3.0
-      ember-inflector: 4.0.3(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9)))
+      '@ember/string': 4.0.1
+      '@embroider/addon-shim': 1.10.2
+      decorator-transforms: 2.3.0(@babel/core@7.27.1)
+      ember-inflector: 6.0.0(@babel/core@7.27.1)
+      ember-resolver: 12.0.1(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9)))
+      ember-source: 5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))
     transitivePeerDependencies:
-      - ember-source
+      - '@babel/core'
       - supports-color
 
   ember-cli-babel-plugin-helpers@1.1.1: {}
@@ -14308,13 +14311,6 @@ snapshots:
       - '@glint/template'
       - supports-color
 
-  ember-inflector@4.0.3(ember-source@5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))):
-    dependencies:
-      ember-cli-babel: 7.26.11
-      ember-source: 5.12.0(@glimmer/component@2.0.0)(@glint/template@1.5.2)(rsvp@4.8.5)(webpack@5.104.1(esbuild@0.25.9))
-    transitivePeerDependencies:
-      - supports-color
-
   ember-inflector@6.0.0(@babel/core@7.27.1):
     dependencies:
       '@embroider/addon-shim': 1.10.0

ui/admin/app/app.js

@@ -14,11 +14,12 @@ import {
   getOwnConfig,
   isTesting,
 } from '@embroider/macros';
+import { extendResolver } from 'ember-can';
 
 export default class App extends Application {
   modulePrefix = config.modulePrefix;
   podModulePrefix = config.podModulePrefix;
-  Resolver = Resolver;
+  Resolver = extendResolver(Resolver);
 }
 
 loadInitializers(App, config.modulePrefix);

ui/admin/app/components/form/user/add-accounts/index.js

@@ -10,7 +10,7 @@ import { service } from '@ember/service';
 
 export default class FormUserAddAccountsComponent extends Component {
   // =properties
-  @service can;
+  @service abilities;
   /**
    * Array of selected account IDs.
    * @type {EmberArray}
@@ -36,7 +36,7 @@ export default class FormUserAddAccountsComponent extends Component {
     const notAddedAccounts = this.args.accounts.filter(
       (account) =>
         !alreadyAddedAccountIDs.includes(account.id) &&
-        this.can.can('addAccount user', this.args.model, { account }),
+        this.abilities.can('addAccount user', this.args.model, { account }),
     );
     return notAddedAccounts;
   }

ui/admin/app/controllers/scopes/scope/aliases/index.js

@@ -14,7 +14,7 @@ import { confirm } from 'core/decorators/confirm';
 export default class ScopesScopeAliasesIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -41,10 +41,10 @@ export default class ScopesScopeAliasesIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'aliases',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'aliases',
     });
     const resource = this.intl.t('resources.alias.title_plural');
@@ -84,7 +84,7 @@ export default class ScopesScopeAliasesIndexController extends Controller {
   )
   async save(alias) {
     await alias.save();
-    if (this.can.can('read model', alias)) {
+    if (this.abilities.can('read model', alias)) {
       await this.router.transitionTo('scopes.scope.aliases.alias', alias);
     } else {
       this.router.transitionTo('scopes.scope.aliases');

ui/admin/app/controllers/scopes/scope/auth-methods/auth-method/accounts/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsIndexController ext
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -28,10 +28,10 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsIndexController ext
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.authMethod, {
+    const canList = this.abilities.can('list model', this.authMethod, {
       collection: 'accounts',
     });
-    const canCreate = this.can.can('create model', this.authMethod, {
+    const canCreate = this.abilities.can('create model', this.authMethod, {
       collection: 'accounts',
     });
     const resource = this.intl.t('resources.account.title_plural');
@@ -80,7 +80,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsIndexController ext
       adapterOptions.password = password;
     }
     await account.save({ adapterOptions });
-    if (this.can.can('read model', account)) {
+    if (this.abilities.can('read model', account)) {
       await this.router.transitionTo(
         'scopes.scope.auth-methods.auth-method.accounts.account',
         account,

ui/admin/app/controllers/scopes/scope/auth-methods/auth-method/managed-groups/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsIndexControlle
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -28,10 +28,10 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsIndexControlle
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.authMethod, {
+    const canList = this.abilities.can('list model', this.authMethod, {
       collection: 'managed-groups',
     });
-    const canCreate = this.can.can('create model', this.authMethod, {
+    const canCreate = this.abilities.can('create model', this.authMethod, {
       collection: 'managed-groups',
     });
     const resource = this.intl.t('resources.managed-group.title_plural');
@@ -75,7 +75,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsIndexControlle
   )
   async save(managedGroup) {
     await managedGroup.save();
-    if (this.can.can('read model', managedGroup)) {
+    if (this.abilities.can('read model', managedGroup)) {
       await this.router.transitionTo(
         'scopes.scope.auth-methods.auth-method.managed-groups.managed-group',
         managedGroup,

ui/admin/app/controllers/scopes/scope/auth-methods/index.js

@@ -16,7 +16,7 @@ export default class ScopesScopeAuthMethodsIndexController extends Controller {
   // =services
 
   @service router;
-  @service can;
+  @service abilities;
   @service intl;
   @service store;
 
@@ -82,10 +82,10 @@ export default class ScopesScopeAuthMethodsIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scopeModel, {
+    const canList = this.abilities.can('list model', this.scopeModel, {
       collection: 'auth-methods',
     });
-    const canCreate = this.can.can('create model', this.scopeModel, {
+    const canCreate = this.abilities.can('create model', this.scopeModel, {
       collection: 'auth-methods',
     });
     const resource = this.intl.t('resources.auth-method.title_plural');
@@ -148,7 +148,7 @@ export default class ScopesScopeAuthMethodsIndexController extends Controller {
   )
   async save(authMethod) {
     await authMethod.save();
-    if (this.can.can('read model', authMethod)) {
+    if (this.abilities.can('read model', authMethod)) {
       await this.router.transitionTo(
         'scopes.scope.auth-methods.auth-method',
         authMethod,

ui/admin/app/controllers/scopes/scope/credential-stores/credential-store/credential-libraries/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -28,10 +28,10 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.credentialStore, {
+    const canList = this.abilities.can('list model', this.credentialStore, {
       collection: 'credential-libraries',
     });
-    const canCreate = this.can.can('create model', this.credentialStore, {
+    const canCreate = this.abilities.can('create model', this.credentialStore, {
       collection: 'credential-libraries',
     });
     const resource = this.intl.t('resources.credential-library.title_plural');
@@ -75,7 +75,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
   )
   async save(credentialLibrary) {
     await credentialLibrary.save();
-    if (this.can.can('read model', credentialLibrary)) {
+    if (this.abilities.can('read model', credentialLibrary)) {
       await this.router.transitionTo(
         'scopes.scope.credential-stores.credential-store.credential-libraries.credential-library',
         credentialLibrary,

ui/admin/app/controllers/scopes/scope/credential-stores/credential-store/credentials/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsIndexC
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -28,10 +28,10 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsIndexC
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.credentialStore, {
+    const canList = this.abilities.can('list model', this.credentialStore, {
       collection: 'credentials',
     });
-    const canCreate = this.can.can('create model', this.credentialStore, {
+    const canCreate = this.abilities.can('create model', this.credentialStore, {
       collection: 'credentials',
     });
     const resource = this.intl.t('resources.credential.title_plural');
@@ -75,7 +75,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsIndexC
   )
   async save(credential) {
     await credential.save();
-    if (this.can.can('read credential', credential)) {
+    if (this.abilities.can('read credential', credential)) {
       await this.router.transitionTo(
         'scopes.scope.credential-stores.credential-store.credentials.credential',
         credential,

ui/admin/app/controllers/scopes/scope/credential-stores/index.js

@@ -15,7 +15,7 @@ import { TYPES_CREDENTIAL_STORE } from 'api/models/credential-store';
 export default class ScopesScopeCredentialStoresIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service router;
   @service intl;
 
@@ -58,10 +58,10 @@ export default class ScopesScopeCredentialStoresIndexController extends Controll
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'credential-stores',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'credential-stores',
     });
     const resource = this.intl.t('resources.credential-store.title_plural');
@@ -88,7 +88,7 @@ export default class ScopesScopeCredentialStoresIndexController extends Controll
   @notifySuccess('notifications.save-success')
   async save(credentialStore) {
     await credentialStore.save();
-    if (this.can.can('read model', credentialStore)) {
+    if (this.abilities.can('read model', credentialStore)) {
       await this.router.transitionTo(
         'scopes.scope.credential-stores.credential-store',
         credentialStore,

ui/admin/app/controllers/scopes/scope/groups/index.js

@@ -14,7 +14,7 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 export default class ScopesScopeGroupsIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -41,10 +41,10 @@ export default class ScopesScopeGroupsIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'groups',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'groups',
     });
     const resource = this.intl.t('resources.group.title_plural');
@@ -84,7 +84,7 @@ export default class ScopesScopeGroupsIndexController extends Controller {
   )
   async save(group) {
     await group.save();
-    if (this.can.can('read model', group)) {
+    if (this.abilities.can('read model', group)) {
       await this.router.transitionTo('scopes.scope.groups.group', group);
     } else {
       this.router.transitionTo('scopes.scope.groups');

ui/admin/app/controllers/scopes/scope/host-catalogs/host-catalog/host-sets/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexController e
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
   @service store;
@@ -29,10 +29,10 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexController e
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.hostCatalog, {
+    const canList = this.abilities.can('list model', this.hostCatalog, {
       collection: 'host-sets',
     });
-    const canCreate = this.can.can('create model', this.hostCatalog, {
+    const canCreate = this.abilities.can('create model', this.hostCatalog, {
       collection: 'host-sets',
     });
     const resource = this.intl.t('resources.host-set.title_plural');
@@ -79,7 +79,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexController e
     // Fetch newest host set as updates to host set attributes cause an async db update which
     // updates the version again and can cause a version mismatch if the host set is updated
     // again and we haven't fetched the newest version.
-    if (this.can.can('read host-set', hostSet)) {
+    if (this.abilities.can('read host-set', hostSet)) {
       const newestHostSet = await this.store.findRecord(
         'host-set',
         hostSet.id,
@@ -93,7 +93,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexController e
 
     await hostSet.save();
 
-    if (this.can.can('read host-set', hostSet)) {
+    if (this.abilities.can('read host-set', hostSet)) {
       await this.router.transitionTo(
         'scopes.scope.host-catalogs.host-catalog.host-sets.host-set',
         hostSet,

ui/admin/app/controllers/scopes/scope/host-catalogs/host-catalog/hosts/index.js

@@ -15,7 +15,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsIndexController exte
 
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -28,10 +28,10 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsIndexController exte
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.hostCatalog, {
+    const canList = this.abilities.can('list model', this.hostCatalog, {
       collection: 'hosts',
     });
-    const canCreate = this.can.can('create model', this.hostCatalog, {
+    const canCreate = this.abilities.can('create model', this.hostCatalog, {
       collection: 'hosts',
     });
     const resource = this.intl.t('resources.host.title_plural');
@@ -74,7 +74,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsIndexController exte
   )
   async save(host) {
     await host.save();
-    if (this.can.can('read model', host)) {
+    if (this.abilities.can('read model', host)) {
       await this.router.transitionTo(
         'scopes.scope.host-catalogs.host-catalog.hosts.host',
         host,

ui/admin/app/controllers/scopes/scope/host-catalogs/index.js

@@ -15,7 +15,7 @@ import { TYPE_CREDENTIAL_STATIC } from 'api/models/host-catalog';
 export default class ScopesScopeHostCatalogsIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -42,10 +42,10 @@ export default class ScopesScopeHostCatalogsIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'host-catalogs',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'host-catalogs',
     });
     const resource = this.intl.t('resources.host-catalog.title_plural');
@@ -101,7 +101,7 @@ export default class ScopesScopeHostCatalogsIndexController extends Controller {
       hostCatalog.credentialType = TYPE_CREDENTIAL_STATIC;
     }
     await hostCatalog.save();
-    if (this.can.can('read host-catalog', hostCatalog)) {
+    if (this.abilities.can('read host-catalog', hostCatalog)) {
       await this.router.transitionTo(
         'scopes.scope.host-catalogs.host-catalog',
         hostCatalog,

ui/admin/app/controllers/scopes/scope/policies/index.js

@@ -13,7 +13,7 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 export default class ScopesScopePoliciesIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -26,10 +26,10 @@ export default class ScopesScopePoliciesIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'policies',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'policies',
     });
     const resource = this.intl.t('resources.policy.title_plural');
@@ -67,7 +67,7 @@ export default class ScopesScopePoliciesIndexController extends Controller {
   @notifySuccess('notifications.save-success')
   async save(policy) {
     await policy.save();
-    if (this.can.can('read model', policy)) {
+    if (this.abilities.can('read model', policy)) {
       await this.router.transitionTo('scopes.scope.policies.policy', policy);
     } else {
       await this.router.transitionTo('scopes.scope.policies');

ui/admin/app/controllers/scopes/scope/roles/index.js

@@ -15,7 +15,7 @@ import { GRANT_SCOPE_THIS } from 'api/models/role';
 export default class ScopesScopeRolesIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -44,10 +44,10 @@ export default class ScopesScopeRolesIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'roles',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'roles',
     });
     const resource = this.intl.t('resources.role.title_plural');
@@ -98,7 +98,7 @@ export default class ScopesScopeRolesIndexController extends Controller {
   )
   async save(role) {
     await role.save();
-    if (this.can.can('read model', role)) {
+    if (this.abilities.can('read model', role)) {
       await this.router.transitionTo('scopes.scope.roles.role', role);
     } else {
       this.router.transitionTo('scopes.scope.roles');

ui/admin/app/controllers/scopes/scope/storage-buckets/index.js

@@ -14,7 +14,7 @@ import { TYPE_CREDENTIAL_STATIC } from 'api/models/storage-bucket';
 export default class ScopesScopeStorageBucketsIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -27,10 +27,10 @@ export default class ScopesScopeStorageBucketsIndexController extends Controller
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list scope', this.scope, {
+    const canList = this.abilities.can('list scope', this.scope, {
       collection: 'storage-buckets',
     });
-    const canCreate = this.can.can('create scope', this.scope, {
+    const canCreate = this.abilities.can('create scope', this.scope, {
       collection: 'storage-buckets',
     });
     const resource = this.intl.t('resources.storage-bucket.title_plural');

ui/admin/app/controllers/scopes/scope/targets/index.js

@@ -20,7 +20,7 @@ export default class ScopesScopeTargetsIndexController extends Controller {
   // =services
 
   @service intl;
-  @service can;
+  @service abilities;
   @service router;
   @service confirm;
   @service features;
@@ -80,10 +80,10 @@ export default class ScopesScopeTargetsIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'targets',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'targets',
     });
     const resource = this.intl.t('resources.target.title_plural');
@@ -187,7 +187,7 @@ export default class ScopesScopeTargetsIndexController extends Controller {
   )
   async save(target) {
     await target.save();
-    if (this.can.can('read model', target)) {
+    if (this.abilities.can('read model', target)) {
       await this.router.transitionTo('scopes.scope.targets.target', target);
     } else {
       this.router.transitionTo('scopes.scope.targets');

ui/admin/app/controllers/scopes/scope/targets/target/index.js

@@ -13,7 +13,7 @@ export default class ScopesScopeTargetsTargetIndexController extends Controller
 
   // =services
 
-  @service can;
+  @service abilities;
   @service router;
 
   // =attributes

ui/admin/app/controllers/scopes/scope/users/index.js

@@ -14,7 +14,7 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 export default class ScopesScopeUsersIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
   @tracked sortAttribute;
@@ -41,10 +41,10 @@ export default class ScopesScopeUsersIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list model', this.scope, {
+    const canList = this.abilities.can('list model', this.scope, {
       collection: 'users',
     });
-    const canCreate = this.can.can('create model', this.scope, {
+    const canCreate = this.abilities.can('create model', this.scope, {
       collection: 'users',
     });
     const resource = this.intl.t('resources.user.title_plural');
@@ -98,7 +98,7 @@ export default class ScopesScopeUsersIndexController extends Controller {
   )
   async save(user) {
     await user.save();
-    if (this.can.can('read model', user)) {
+    if (this.abilities.can('read model', user)) {
       await this.router.transitionTo('scopes.scope.users.user', user);
     } else {
       this.router.transitionTo('scopes.scope.users');

ui/admin/app/controllers/scopes/scope/workers/index.js

@@ -14,7 +14,7 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 export default class ScopesScopeWorkersIndexController extends Controller {
   // =services
 
-  @service can;
+  @service abilities;
   @service intl;
   @service router;
 
@@ -79,12 +79,16 @@ export default class ScopesScopeWorkersIndexController extends Controller {
    * @type {string}
    */
   get messageDescription() {
-    const canList = this.can.can('list worker', this.scope, {
-      collection: 'workers',
-    });
-    const canCreate = this.can.can('create worker led worker', this.scope, {
+    const canList = this.abilities.can('list worker', this.scope, {
       collection: 'workers',
     });
+    const canCreate = this.abilities.can(
+      'create worker led worker',
+      this.scope,
+      {
+        collection: 'workers',
+      },
+    );
     const resource = this.intl.t('titles.workers');
     let description = 'descriptions.neither-list-nor-create';
 
@@ -159,7 +163,7 @@ export default class ScopesScopeWorkersIndexController extends Controller {
   )
   async save(worker) {
     await worker.save();
-    if (this.can.can('read model', worker)) {
+    if (this.abilities.can('read model', worker)) {
       await this.router.transitionTo('scopes.scope.workers.worker', worker);
     } else {
       this.router.transitionTo('scopes.scope.workers');

ui/admin/app/routes/scopes/scope/aliases/index.js

@@ -11,7 +11,7 @@ export default class ScopesScopeAliasesIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -69,7 +69,7 @@ export default class ScopesScopeAliasesIndexRoute extends Route {
       let totalItems = 0;
 
       if (
-        this.can.can('list model', scope, {
+        this.abilities.can('list model', scope, {
           collection: 'aliases',
         })
       ) {

ui/admin/app/routes/scopes/scope/aliases/new.js

@@ -11,7 +11,7 @@ export default class ScopesScopeAliasesNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -22,7 +22,9 @@ export default class ScopesScopeAliasesNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, { collection: 'aliases' })
+      this.abilities.cannot('create model', scopeModel, {
+        collection: 'aliases',
+      })
     ) {
       this.router.replaceWith('scopes.scope.aliases');
     }

ui/admin/app/routes/scopes/scope/auth-methods/auth-method.js

@@ -11,7 +11,6 @@ export default class ScopesScopeAuthMethodsAuthMethodRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -24,7 +24,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route
     let accounts;
 
     if (
-      this.can.can('list model', authMethod, {
+      this.abilities.can('list model', authMethod, {
         collection: 'accounts',
       })
     ) {

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts/account.js

@@ -10,7 +10,6 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsAccountRoute extend
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsNewRoute extends Ro
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -21,7 +21,9 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsNewRoute extends Ro
   beforeModel() {
     const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
     if (
-      this.can.cannot('create model', authMethod, { collection: 'accounts' })
+      this.abilities.cannot('create model', authMethod, {
+        collection: 'accounts',
+      })
     ) {
       this.router.replaceWith('scopes.scope.auth-methods.auth-method.accounts');
     }

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsRoute extends
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   //=methods
 
@@ -21,7 +21,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsRoute extends
   async model() {
     const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
     const { id: auth_method_id } = authMethod;
-    const canListManagedGroups = this.can.can('list model', authMethod, {
+    const canListManagedGroups = this.abilities.can('list model', authMethod, {
       collection: 'managed-groups',
     });
     let managedGroups;

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/managed-groups/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsNewRoute exten
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -21,7 +21,7 @@ export default class ScopesScopeAuthMethodsAuthMethodManagedGroupsNewRoute exten
   beforeModel() {
     const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
     if (
-      this.can.cannot('create model', authMethod, {
+      this.abilities.cannot('create model', authMethod, {
         collection: 'managed-groups',
       })
     ) {

ui/admin/app/routes/scopes/scope/auth-methods/index.js

@@ -11,7 +11,7 @@ export default class ScopesScopeAuthMethodsIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =attributes
@@ -101,7 +101,9 @@ export default class ScopesScopeAuthMethodsIndexRoute extends Route {
       let authMethods;
       let totalItems = 0;
       let doAuthMethodsExist = false;
-      if (this.can.can('list model', scope, { collection: 'auth-methods' })) {
+      if (
+        this.abilities.can('list model', scope, { collection: 'auth-methods' })
+      ) {
         // TODO: Remove storeToken option as this is a temporary fix for auth-methods.
         const options = { storeToken: false };
         authMethods = await this.store.query(

ui/admin/app/routes/scopes/scope/auth-methods/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =attributes
@@ -29,7 +29,7 @@ export default class ScopesScopeAuthMethodsNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, {
+      this.abilities.cannot('create model', scopeModel, {
         collection: 'auth-methods',
       })
     ) {

ui/admin/app/routes/scopes/scope/credential-stores/credential-store.js

@@ -11,7 +11,6 @@ export default class ScopesScopeCredentialStoresCredentialStoreRoute extends Rou
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   /**

ui/admin/app/routes/scopes/scope/credential-stores/credential-store/credential-libraries.js

@@ -10,7 +10,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -24,7 +24,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
     );
     const { id: credential_store_id } = credentialStore;
     if (
-      this.can.can('list model', credentialStore, {
+      this.abilities.can('list model', credentialStore, {
         collection: 'credential-libraries',
       })
     ) {

ui/admin/app/routes/scopes/scope/credential-stores/credential-store/credential-libraries/new.js

@@ -16,7 +16,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
   @service store;
   @service router;
   @service features;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -36,7 +36,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialLibrari
       'scopes.scope.credential-stores.credential-store',
     );
     if (
-      this.can.cannot('create model', credentialStore, {
+      this.abilities.cannot('create model', credentialStore, {
         collection: 'credential-libraries',
       })
     ) {

ui/admin/app/routes/scopes/scope/credential-stores/credential-store/credentials.js

@@ -10,7 +10,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsRoute
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -24,7 +24,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsRoute
     );
     const { id: credential_store_id } = credentialStore;
     if (
-      this.can.can('list model', credentialStore, {
+      this.abilities.can('list model', credentialStore, {
         collection: 'credentials',
       })
     ) {

ui/admin/app/routes/scopes/scope/credential-stores/credential-store/credentials/credential.js

@@ -10,7 +10,6 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsCreden
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/credential-stores/credential-store/credentials/new.js

@@ -11,7 +11,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsNewRou
 
   @service store;
   @service router;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -31,7 +31,7 @@ export default class ScopesScopeCredentialStoresCredentialStoreCredentialsNewRou
       'scopes.scope.credential-stores.credential-store',
     );
     if (
-      this.can.cannot('create model', credentialStore, {
+      this.abilities.cannot('create model', credentialStore, {
         collection: 'credentials',
       })
     ) {

ui/admin/app/routes/scopes/scope/credential-stores/index.js

@@ -11,7 +11,7 @@ export default class ScopesScopeCredentialStoresIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -90,7 +90,7 @@ export default class ScopesScopeCredentialStoresIndexRoute extends Route {
       let totalItems = 0;
       let doCredentialStoresExist = false;
       if (
-        this.can.can('list model', scope, {
+        this.abilities.can('list model', scope, {
           collection: 'credential-stores',
         })
       ) {

ui/admin/app/routes/scopes/scope/credential-stores/new.js

@@ -12,7 +12,7 @@ export default class ScopesScopeCredentialStoresNewRoute extends Route {
   @service store;
   @service router;
   @service features;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -30,7 +30,7 @@ export default class ScopesScopeCredentialStoresNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, {
+      this.abilities.cannot('create model', scopeModel, {
         collection: 'credential-stores',
       })
     ) {

ui/admin/app/routes/scopes/scope/groups/group.js

@@ -10,7 +10,6 @@ export default class ScopesScopeGroupsGroupRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/groups/index.js

@@ -11,7 +11,7 @@ export default class ScopesScopeGroupsIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -77,7 +77,7 @@ export default class ScopesScopeGroupsIndexRoute extends Route {
       let groups = [];
       let totalItems = 0;
       let doGroupsExist = false;
-      if (this.can.can('list model', scope, { collection: 'groups' })) {
+      if (this.abilities.can('list model', scope, { collection: 'groups' })) {
         groups = await this.store.query('group', {
           scope_id,
           query: { filters, search, sort },

ui/admin/app/routes/scopes/scope/groups/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeGroupsNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -20,7 +20,11 @@ export default class ScopesScopeGroupsNewRoute extends Route {
    */
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
-    if (this.can.cannot('create model', scopeModel, { collection: 'groups' })) {
+    if (
+      this.abilities.cannot('create model', scopeModel, {
+        collection: 'groups',
+      })
+    ) {
       this.router.replaceWith('scopes.scope.groups');
     }
   }

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog.js

@@ -11,7 +11,6 @@ export default class ScopesScopeHostCatalogsHostCatalogRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets.js

@@ -10,7 +10,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsRoute extends Rou
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -26,7 +26,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsRoute extends Rou
     let hostSets;
 
     if (
-      this.can.can('list model', hostCatalog, {
+      this.abilities.can('list model', hostCatalog, {
         collection: 'host-sets',
       })
     ) {

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/host-set.js

@@ -11,7 +11,6 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsHostSetRoute exte
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/host-set/create-and-add-host.js

@@ -11,7 +11,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsHostSetCreateAndA
 
   @service store;
   @service router;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -22,7 +22,11 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsHostSetCreateAndA
     const hostCatalog = this.modelFor(
       'scopes.scope.host-catalogs.host-catalog',
     );
-    if (this.can.cannot('create model', hostCatalog, { collection: 'hosts' })) {
+    if (
+      this.abilities.cannot('create model', hostCatalog, {
+        collection: 'hosts',
+      })
+    ) {
       this.router.replaceWith(
         'scopes.scope.host-catalogs.host-catalog.host-sets.host-set.hosts',
       );

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/host-set/hosts/host.js

@@ -10,7 +10,6 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsHostSetHostsHostR
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/new.js

@@ -11,7 +11,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsNewRoute extends
 
   @service store;
   @service router;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -23,7 +23,9 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsNewRoute extends
       'scopes.scope.host-catalogs.host-catalog',
     );
     if (
-      this.can.cannot('create model', hostCatalog, { collection: 'host-sets' })
+      this.abilities.cannot('create model', hostCatalog, {
+        collection: 'host-sets',
+      })
     ) {
       this.router.replaceWith(
         'scopes.scope.host-catalogs.host-catalog.host-sets',

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/hosts.js

@@ -10,7 +10,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsRoute extends Route
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -26,7 +26,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsRoute extends Route
     let hosts;
 
     if (
-      this.can.can('list model', hostCatalog, {
+      this.abilities.can('list model', hostCatalog, {
         collection: 'hosts',
       })
     ) {

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/hosts/host.js

@@ -10,7 +10,6 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsHostRoute extends Ro
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/hosts/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsNewRoute extends Rou
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -22,7 +22,11 @@ export default class ScopesScopeHostCatalogsHostCatalogHostsNewRoute extends Rou
     const hostCatalog = this.modelFor(
       'scopes.scope.host-catalogs.host-catalog',
     );
-    if (this.can.cannot('create model', hostCatalog, { collection: 'hosts' })) {
+    if (
+      this.abilities.cannot('create model', hostCatalog, {
+        collection: 'hosts',
+      })
+    ) {
       this.router.replaceWith('scopes.scope.host-catalogs.host-catalog.hosts');
     }
   }

ui/admin/app/routes/scopes/scope/host-catalogs/index.js

@@ -11,7 +11,7 @@ export default class ScopesScopeHostCatalogsIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -82,7 +82,9 @@ export default class ScopesScopeHostCatalogsIndexRoute extends Route {
       let hostCatalogs;
       let totalItems = 0;
       let doHostCatalogsExist = false;
-      if (this.can.can('list model', scope, { collection: 'host-catalogs' })) {
+      if (
+        this.abilities.can('list model', scope, { collection: 'host-catalogs' })
+      ) {
         hostCatalogs = await this.store.query('host-catalog', {
           scope_id,
           query: { search, filters, sort },

ui/admin/app/routes/scopes/scope/host-catalogs/new.js

@@ -11,7 +11,7 @@ export default class ScopesScopeHostCatalogsNewRoute extends Route {
 
   @service store;
   @service router;
-  @service can;
+  @service abilities;
 
   // =attributes
 
@@ -29,7 +29,7 @@ export default class ScopesScopeHostCatalogsNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, {
+      this.abilities.cannot('create model', scopeModel, {
         collection: 'host-catalogs',
       })
     ) {

ui/admin/app/routes/scopes/scope/policies.js

@@ -11,7 +11,7 @@ export default class ScopesScopePoliciesRoute extends Route {
 
   @service store;
   @service session;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -32,7 +32,7 @@ export default class ScopesScopePoliciesRoute extends Route {
     const { id: scope_id } = scope;
 
     if (
-      this.can.can('list model', scope, {
+      this.abilities.can('list model', scope, {
         collection: 'policies',
       })
     ) {

ui/admin/app/routes/scopes/scope/policies/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopePoliciesNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -21,7 +21,9 @@ export default class ScopesScopePoliciesNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, { collection: 'policies' })
+      this.abilities.cannot('create model', scopeModel, {
+        collection: 'policies',
+      })
     ) {
       this.router.replaceWith('scopes.scope.policies');
     }

ui/admin/app/routes/scopes/scope/policies/policy.js

@@ -8,7 +8,6 @@ import { service } from '@ember/service';
 
 export default class ScopesScopePoliciesPolicyRoute extends Route {
   @service store;
-  @service can;
 
   // =methods
 

ui/admin/app/routes/scopes/scope/roles/index.js

@@ -33,7 +33,7 @@ export default class ScopesScopeRolesIndexRoute extends Route {
 
   // =services
 
-  @service can;
+  @service abilities;
   @service store;
 
   // =methods
@@ -79,7 +79,7 @@ export default class ScopesScopeRolesIndexRoute extends Route {
       let roles;
       let totalItems = 0;
       let doRolesExist = false;
-      if (this.can.can('list model', scope, { collection: 'roles' })) {
+      if (this.abilities.can('list model', scope, { collection: 'roles' })) {
         roles = await this.store.query('role', {
           scope_id,
           query: { search, filters, sort },

ui/admin/app/routes/scopes/scope/roles/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeRolesNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -20,7 +20,9 @@ export default class ScopesScopeRolesNewRoute extends Route {
    */
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
-    if (this.can.cannot('create model', scopeModel, { collection: 'roles' })) {
+    if (
+      this.abilities.cannot('create model', scopeModel, { collection: 'roles' })
+    ) {
       this.router.replaceWith('scopes.scope.roles');
     }
   }

ui/admin/app/routes/scopes/scope/roles/role.js

@@ -11,7 +11,6 @@ export default class ScopesScopeRolesRoleRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/scopes/index.js

@@ -33,7 +33,6 @@ export default class ScopesScopeScopesIndexRoute extends Route {
 
   // =services
 
-  @service can;
   @service store;
 
   // =methods

ui/admin/app/routes/scopes/scope/session-recordings/index.js

@@ -16,7 +16,7 @@ export default class ScopesScopeSessionRecordingsIndexRoute extends Route {
   // =services
   @service store;
   @service router;
-  @service can;
+  @service abilities;
   @service intl;
 
   // =attributes
@@ -124,7 +124,7 @@ export default class ScopesScopeSessionRecordingsIndexRoute extends Route {
           : { attributes: [sortAttribute], direction: sortDirection };
 
       if (
-        this.can.can('list scope', scope, {
+        this.abilities.can('list scope', scope, {
           collection: 'session-recordings',
         })
       ) {

ui/admin/app/routes/scopes/scope/session-recordings/session-recording.js

@@ -12,7 +12,6 @@ export default class ScopesScopeSessionRecordingsSessionRecordingRoute extends R
   @service store;
   @service session;
   @service router;
-  @service can;
 
   // =methods
 

ui/admin/app/routes/scopes/scope/session-recordings/session-recording/channels-by-connection/channel.js

@@ -9,7 +9,6 @@ import { service } from '@ember/service';
 export default class ScopesScopeSessionRecordingsSessionRecordingChannelsByConnectionChannelRoute extends Route {
   // =services
   @service store;
-  @service can;
   @service router;
   @service flashMessages;
   @service intl;

ui/admin/app/routes/scopes/scope/session-recordings/session-recording/channels-by-connection/channel/index.js

@@ -8,7 +8,7 @@ import { service } from '@ember/service';
 
 export default class ScopesScopeSessionRecordingsSessionRecordingChannelsByConnectionChannelIndexRoute extends Route {
   // =services
-  @service can;
+  @service abilities;
   @service flashMessages;
   @service intl;
 
@@ -22,7 +22,9 @@ export default class ScopesScopeSessionRecordingsSessionRecordingChannelsByConne
       'scopes.scope.session-recordings.session-recording.channels-by-connection.channel',
     );
 
-    if (this.can.can('getAsciicast channel-recording', channelRecording)) {
+    if (
+      this.abilities.can('getAsciicast channel-recording', channelRecording)
+    ) {
       try {
         asciicast = await channelRecording.getAsciicast();
       } catch (e) {

ui/admin/app/routes/scopes/scope/sessions/index.js

@@ -10,7 +10,7 @@ import { restartableTask, timeout } from 'ember-concurrency';
 export default class ScopesScopeSessionsIndexRoute extends Route {
   // =services
 
-  @service can;
+  @service abilities;
   @service store;
 
   // =attributes
@@ -134,7 +134,7 @@ export default class ScopesScopeSessionsIndexRoute extends Route {
 
       // Preload the associated targets and users into the cache
       let refreshUsersPromise, refreshTargetsPromise;
-      const canListTargets = this.can.can('list model', scope, {
+      const canListTargets = this.abilities.can('list model', scope, {
         collection: 'targets',
       });
       if (canListTargets) {
@@ -152,8 +152,10 @@ export default class ScopesScopeSessionsIndexRoute extends Route {
       const orgScope = await this.store.findRecord('scope', scope.scope.id);
       const globalScope = await this.store.findRecord('scope', 'global');
       const canListUsers =
-        this.can.can('list model', globalScope, { collection: 'users' }) ||
-        this.can.can('list model', orgScope, { collection: 'users' });
+        this.abilities.can('list model', globalScope, {
+          collection: 'users',
+        }) ||
+        this.abilities.can('list model', orgScope, { collection: 'users' });
 
       if (canListUsers) {
         refreshUsersPromise = this.store.query(

ui/admin/app/routes/scopes/scope/storage-buckets.js

@@ -11,7 +11,7 @@ export default class ScopesScopeStorageBucketsRoute extends Route {
 
   @service store;
   @service session;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -31,7 +31,7 @@ export default class ScopesScopeStorageBucketsRoute extends Route {
     const scope = this.modelFor('scopes.scope');
     const { id: scope_id } = scope;
     if (
-      this.can.can('list scope', scope, {
+      this.abilities.can('list scope', scope, {
         collection: 'storage-buckets',
       })
     ) {

ui/admin/app/routes/scopes/scope/storage-buckets/new.js

@@ -14,7 +14,7 @@ export default class ScopesScopeStorageBucketsNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =attributes
@@ -32,7 +32,7 @@ export default class ScopesScopeStorageBucketsNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create scope', scopeModel, {
+      this.abilities.cannot('create scope', scopeModel, {
         collection: 'storage-buckets',
       })
     ) {

ui/admin/app/routes/scopes/scope/storage-buckets/storage-bucket.js

@@ -10,7 +10,6 @@ export default class ScopesScopeStorageBucketsStorageBucketRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/targets/index.js

@@ -17,7 +17,7 @@ import { TYPE_TARGET_SSH, TYPE_TARGET_TCP } from 'api/models/target';
 export default class ScopesScopeTargetsIndexRoute extends Route {
   // =services
 
-  @service can;
+  @service abilities;
   @service store;
   @service session;
   @service intl;
@@ -93,7 +93,7 @@ export default class ScopesScopeTargetsIndexRoute extends Route {
         filters.type.push({ equals: type });
       });
 
-      if (this.can.can('list model', scope, { collection: 'sessions' })) {
+      if (this.abilities.can('list model', scope, { collection: 'sessions' })) {
         await this.store.query(
           'session',
           {
@@ -133,7 +133,7 @@ export default class ScopesScopeTargetsIndexRoute extends Route {
       let targets;
       let totalItems = 0;
       let doTargetsExist = false;
-      if (this.can.can('list model', scope, { collection: 'targets' })) {
+      if (this.abilities.can('list model', scope, { collection: 'targets' })) {
         targets = await this.store.query('target', {
           scope_id,
           query: { search, filters, sort },

ui/admin/app/routes/scopes/scope/targets/new.js

@@ -13,7 +13,7 @@ export default class ScopesScopeTargetsNewRoute extends Route {
   @service store;
   @service router;
   @service features;
-  @service can;
+  @service abilities;
 
   // =attributes
   queryParams = {
@@ -30,7 +30,9 @@ export default class ScopesScopeTargetsNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create model', scopeModel, { collection: 'targets' })
+      this.abilities.cannot('create model', scopeModel, {
+        collection: 'targets',
+      })
     ) {
       this.router.replaceWith('scopes.scope.targets');
     }

ui/admin/app/routes/scopes/scope/targets/target.js

@@ -10,7 +10,6 @@ export default class ScopesScopeTargetsTargetRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/users/index.js

@@ -34,7 +34,7 @@ export default class ScopesScopeUsersIndexRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
 
   // =methods
 
@@ -80,7 +80,7 @@ export default class ScopesScopeUsersIndexRoute extends Route {
       let users;
       let totalItems = 0;
       let doUsersExist = false;
-      if (this.can.can('list model', scope, { collection: 'users' })) {
+      if (this.abilities.can('list model', scope, { collection: 'users' })) {
         users = await this.store.query('user', {
           scope_id,
           query: { search, filters, sort },

ui/admin/app/routes/scopes/scope/users/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeUsersNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -20,7 +20,9 @@ export default class ScopesScopeUsersNewRoute extends Route {
    */
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
-    if (this.can.cannot('create model', scopeModel, { collection: 'users' })) {
+    if (
+      this.abilities.cannot('create model', scopeModel, { collection: 'users' })
+    ) {
       this.router.replaceWith('scopes.scope.users');
     }
   }

ui/admin/app/routes/scopes/scope/users/user.js

@@ -10,7 +10,6 @@ export default class ScopesScopeUsersUserRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/app/routes/scopes/scope/workers.js

@@ -10,7 +10,7 @@ export default class ScopesScopeWorkersRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service session;
   @service router;
 
@@ -30,7 +30,7 @@ export default class ScopesScopeWorkersRoute extends Route {
   model() {
     const scope = this.modelFor('scopes.scope');
     const { id: scope_id } = scope;
-    if (this.can.can('list worker', scope, { collection: 'workers' })) {
+    if (this.abilities.can('list worker', scope, { collection: 'workers' })) {
       return this.store.query('worker', { scope_id });
     }
   }

ui/admin/app/routes/scopes/scope/workers/new.js

@@ -10,7 +10,7 @@ export default class ScopesScopeWorkersNewRoute extends Route {
   // =services
 
   @service store;
-  @service can;
+  @service abilities;
   @service router;
 
   // =methods
@@ -21,7 +21,7 @@ export default class ScopesScopeWorkersNewRoute extends Route {
   beforeModel() {
     const scopeModel = this.modelFor('scopes.scope');
     if (
-      this.can.cannot('create worker led worker', scopeModel, {
+      this.abilities.cannot('create worker led worker', scopeModel, {
         collection: 'workers',
       })
     ) {

ui/admin/app/routes/scopes/scope/workers/worker.js

@@ -10,7 +10,6 @@ export default class ScopesScopeWorkersWorkerRoute extends Route {
   // =services
 
   @service store;
-  @service can;
   @service router;
 
   // =methods

ui/admin/tests/unit/abilities/auth-method-test.js

@@ -14,12 +14,12 @@ import {
 module('Unit | Abilities | auth-method', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
   let features;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
     features = this.owner.lookup('service:features');
   });
@@ -30,9 +30,9 @@ module('Unit | Abilities | auth-method', function (hooks) {
       authorized_actions: ['read'],
       type: TYPE_AUTH_METHOD_LDAP,
     });
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
     authMethod.authorized_actions = [];
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('cannot read LDAP auth-method when authorized and feature flag disabled', function (assert) {
@@ -40,9 +40,9 @@ module('Unit | Abilities | auth-method', function (hooks) {
       authorized_actions: ['read'],
       type: TYPE_AUTH_METHOD_LDAP,
     });
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
     authMethod.authorized_actions = [];
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('can read non-LDAP auth-method when authorized', function (assert) {
@@ -50,9 +50,9 @@ module('Unit | Abilities | auth-method', function (hooks) {
       authorized_actions: ['read'],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('read auth-method', authMethod));
+    assert.true(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('cannot read non-LDAP auth-method when unauthorized', function (assert) {
@@ -60,16 +60,16 @@ module('Unit | Abilities | auth-method', function (hooks) {
       authorized_actions: [],
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.false(canService.can('read auth-method', authMethod));
+    assert.false(abilitiesService.can('read auth-method', authMethod));
   });
 
   test('cannot make LDAP auth-method primary when feature flag disabled', function (assert) {
     const authMethod = store.createRecord('auth-method', {
       type: TYPE_AUTH_METHOD_LDAP,
     });
-    assert.false(canService.can('makePrimary auth-method', authMethod));
+    assert.false(abilitiesService.can('makePrimary auth-method', authMethod));
   });
 
   test('can make LDAP auth-method primary when feature flag enabled', function (assert) {
@@ -77,15 +77,15 @@ module('Unit | Abilities | auth-method', function (hooks) {
     const authMethod = store.createRecord('auth-method', {
       type: TYPE_AUTH_METHOD_LDAP,
     });
-    assert.true(canService.can('makePrimary auth-method', authMethod));
+    assert.true(abilitiesService.can('makePrimary auth-method', authMethod));
   });
 
   test('can make non-LDAP auth-method primary', function (assert) {
     const authMethod = store.createRecord('auth-method', {
       type: TYPE_AUTH_METHOD_OIDC,
     });
-    assert.true(canService.can('makePrimary auth-method', authMethod));
+    assert.true(abilitiesService.can('makePrimary auth-method', authMethod));
     authMethod.type = TYPE_AUTH_METHOD_PASSWORD;
-    assert.true(canService.can('makePrimary auth-method', authMethod));
+    assert.true(abilitiesService.can('makePrimary auth-method', authMethod));
   });
 });

ui/admin/tests/unit/abilities/channel-recording-test.js

@@ -11,7 +11,7 @@ import { MIME_TYPE_ASCIICAST } from 'api/models/channel-recording';
 module('Unit | Abilities | channel-recording', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
   let sessionRecording;
   let connectionRecording;
@@ -19,7 +19,7 @@ module('Unit | Abilities | channel-recording', function (hooks) {
   let noneAsciicastChannel;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
 
     sessionRecording = store.createRecord('session-recording', {
@@ -39,18 +39,20 @@ module('Unit | Abilities | channel-recording', function (hooks) {
   });
 
   test('returns true if session recording complete and channel mime type is asciicast', function (assert) {
-    assert.true(canService.can('play channel-recording', asciicastChannel));
+    assert.true(
+      abilitiesService.can('play channel-recording', asciicastChannel),
+    );
     assert.false(
-      canService.can('play channel-recording', noneAsciicastChannel),
+      abilitiesService.can('play channel-recording', noneAsciicastChannel),
     );
   });
 
   test('returns false if session recording complete and channel mime type is not asciicast', function (assert) {
     assert.true(
-      canService.can('viewOnly channel-recording', noneAsciicastChannel),
+      abilitiesService.can('viewOnly channel-recording', noneAsciicastChannel),
     );
     assert.false(
-      canService.can('viewOnly channel-recording', asciicastChannel),
+      abilitiesService.can('viewOnly channel-recording', asciicastChannel),
     );
   });
 });

ui/admin/tests/unit/abilities/collection-test.js

@@ -10,7 +10,7 @@ module('Unit | Abilities | model', function (hooks) {
   setupTest(hooks);
 
   test('it reflects when a resource may be navigated to based on list and create actions', function (assert) {
-    const service = this.owner.lookup('service:can');
+    const service = this.owner.lookup('service:abilities');
     const model = {
       authorized_collection_actions: { foobars: [] },
     };

ui/admin/tests/unit/abilities/credential-library-test.js

@@ -21,32 +21,40 @@ module('Unit | Abilities | credential-library', function (hooks) {
 
   test('can read credential library type when authorized and feature is enabled', function (assert) {
     features.enable('ssh-target');
-    const canService = this.owner.lookup('service:can');
+    const abilitiesService = this.owner.lookup('service:abilities');
     const store = this.owner.lookup('service:store');
     const credentialLibrary = store.createRecord('credential-library', {
       authorized_actions: ['read'],
       type: TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
     });
-    assert.true(canService.can('read credential-library', credentialLibrary));
+    assert.true(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
     credentialLibrary.type = TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
-    assert.true(canService.can('read credential-library', credentialLibrary));
+    assert.true(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
   });
 
   test('cannot read credential library type when unauthorized and feature is enabled', function (assert) {
     features.enable('ssh-target');
-    const canService = this.owner.lookup('service:can');
+    const abilitiesService = this.owner.lookup('service:abilities');
     const store = this.owner.lookup('service:store');
     const credentialLibrary = store.createRecord('credential-library', {
       authorized_actions: [],
       type: TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
     });
-    assert.false(canService.can('read credential-library', credentialLibrary));
+    assert.false(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
     credentialLibrary.type = TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
-    assert.false(canService.can('read credential-library', credentialLibrary));
+    assert.false(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
   });
 
   test('cannot read credential library type when unauthorized and feature is disabled', function (assert) {
-    const canService = this.owner.lookup('service:can');
+    const abilitiesService = this.owner.lookup('service:abilities');
     const store = this.owner.lookup('service:store');
     const featuresService = this.owner.lookup('service:features');
     const credentialLibrary = store.createRecord('credential-library', {
@@ -54,13 +62,17 @@ module('Unit | Abilities | credential-library', function (hooks) {
       type: TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
     });
     assert.false(featuresService.isEnabled('ssh-target'));
-    assert.false(canService.can('read credential-library', credentialLibrary));
+    assert.false(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
     credentialLibrary.type = TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
-    assert.false(canService.can('read credential-library', credentialLibrary));
+    assert.false(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
   });
 
   test('can read vault-generic but not vault-ssh-certificate when authorized and feature is disabled', function (assert) {
-    const canService = this.owner.lookup('service:can');
+    const abilitiesService = this.owner.lookup('service:abilities');
     const store = this.owner.lookup('service:store');
     const featuresService = this.owner.lookup('service:features');
     const credentialLibrary = store.createRecord('credential-library', {
@@ -68,8 +80,12 @@ module('Unit | Abilities | credential-library', function (hooks) {
       type: TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
     });
     assert.false(featuresService.isEnabled('ssh-target'));
-    assert.false(canService.can('read credential-library', credentialLibrary));
+    assert.false(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
     credentialLibrary.type = TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
-    assert.true(canService.can('read credential-library', credentialLibrary));
+    assert.true(
+      abilitiesService.can('read credential-library', credentialLibrary),
+    );
   });
 });

ui/admin/tests/unit/abilities/role-test.js

@@ -9,11 +9,11 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Abilities | role', function (hooks) {
   setupTest(hooks);
 
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -23,9 +23,9 @@ module('Unit | Abilities | role', function (hooks) {
       authorized_actions: ['set-grant-scopes'],
       scope: globalScope,
     });
-    assert.true(canService.can('setGrantScopes role', role));
+    assert.true(abilitiesService.can('setGrantScopes role', role));
     role.authorized_actions = [];
-    assert.false(canService.can('setGrantScopes role', role));
+    assert.false(abilitiesService.can('setGrantScopes role', role));
   });
 
   test('can setGrantScopes on role when authorized and scope is org type', function (assert) {
@@ -38,9 +38,9 @@ module('Unit | Abilities | role', function (hooks) {
       authorized_actions: ['set-grant-scopes'],
       scope: orgScope,
     });
-    assert.true(canService.can('setGrantScopes role', role));
+    assert.true(abilitiesService.can('setGrantScopes role', role));
     role.authorized_actions = [];
-    assert.false(canService.can('setGrantScopes role', role));
+    assert.false(abilitiesService.can('setGrantScopes role', role));
   });
 
   test('cannot setGrantScopes on role when authorized and scope is project type', function (assert) {
@@ -57,8 +57,8 @@ module('Unit | Abilities | role', function (hooks) {
       authorized_actions: ['set-grant-scopes'],
       scope: projectScope,
     });
-    assert.false(canService.can('setGrantScopes role', role));
+    assert.false(abilitiesService.can('setGrantScopes role', role));
     role.authorized_actions = [];
-    assert.false(canService.can('setGrantScopes role', role));
+    assert.false(abilitiesService.can('setGrantScopes role', role));
   });
 });

ui/admin/tests/unit/abilities/scope-test.js

@@ -10,12 +10,12 @@ module('Unit | Abilities | Scope', function (hooks) {
   setupTest(hooks);
 
   let features;
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
     store = this.owner.lookup('service:store');
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     features = this.owner.lookup('service:features');
   });
 
@@ -25,7 +25,7 @@ module('Unit | Abilities | Scope', function (hooks) {
     const scopeModel = store.createRecord('scope', {
       authorized_actions: ['attach-storage-policy'],
     });
-    assert.true(canService.can('attachStoragePolicy scope', scopeModel));
+    assert.true(abilitiesService.can('attachStoragePolicy scope', scopeModel));
   });
 
   test('cannot attach storage policy when unauthorized', function (assert) {
@@ -35,7 +35,7 @@ module('Unit | Abilities | Scope', function (hooks) {
       authorized_actions: [],
     });
 
-    assert.false(canService.can('attachStoragePolicy scope', scopeModel));
+    assert.false(abilitiesService.can('attachStoragePolicy scope', scopeModel));
   });
 
   test('can detach storage policy when authorized', function (assert) {
@@ -44,6 +44,6 @@ module('Unit | Abilities | Scope', function (hooks) {
     const scopeModel = store.createRecord('scope', {
       authorized_actions: ['detach-storage-policy'],
     });
-    assert.true(canService.can('detachStoragePolicy scope', scopeModel));
+    assert.true(abilitiesService.can('detachStoragePolicy scope', scopeModel));
   });
 });

ui/admin/tests/unit/abilities/session-recording-test.js

@@ -15,12 +15,12 @@ module('Unit | Abilities | session-recording', function (hooks) {
   setupTest(hooks);
 
   let features;
-  let canService;
+  let abilitiesService;
   let store;
 
   hooks.beforeEach(function () {
     features = this.owner.lookup('service:features');
-    canService = this.owner.lookup('service:can');
+    abilitiesService = this.owner.lookup('service:abilities');
     store = this.owner.lookup('service:store');
   });
 
@@ -43,10 +43,13 @@ module('Unit | Abilities | session-recording', function (hooks) {
     );
 
     assert.true(
-      canService.can('read session-recording', recordingWithAuthorizedAction),
+      abilitiesService.can(
+        'read session-recording',
+        recordingWithAuthorizedAction,
+      ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'read session-recording',
         recordingWithoutAuthorizedAction,
       ),
@@ -70,10 +73,13 @@ module('Unit | Abilities | session-recording', function (hooks) {
     );
 
     assert.false(
-      canService.can('read session-recording', recordingWithAuthorizedAction),
+      abilitiesService.can(
+        'read session-recording',
+        recordingWithAuthorizedAction,
+      ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'read session-recording',
         recordingWithoutAuthorizedAction,
       ),
@@ -95,12 +101,12 @@ module('Unit | Abilities | session-recording', function (hooks) {
     });
 
     assert.true(
-      canService.can('list scope', scopeModelWithAuthorizedAction, {
+      abilitiesService.can('list scope', scopeModelWithAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
     assert.false(
-      canService.can('list scope', scopeModelWithoutAuthorizedAction, {
+      abilitiesService.can('list scope', scopeModelWithoutAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
@@ -121,12 +127,12 @@ module('Unit | Abilities | session-recording', function (hooks) {
     });
 
     assert.true(
-      canService.can('list scope', scopeModelWithAuthorizedAction, {
+      abilitiesService.can('list scope', scopeModelWithAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
     assert.false(
-      canService.can('list scope', scopeModelWithoutAuthorizedAction, {
+      abilitiesService.can('list scope', scopeModelWithoutAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
@@ -147,14 +153,18 @@ module('Unit | Abilities | session-recording', function (hooks) {
     });
 
     assert.true(
-      canService.can('navigate scope', scopeModelWithAuthorizedAction, {
+      abilitiesService.can('navigate scope', scopeModelWithAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
     assert.false(
-      canService.can('navigate scope', scopeModelWithoutAuthorizedAction, {
-        collection: 'session-recordings',
-      }),
+      abilitiesService.can(
+        'navigate scope',
+        scopeModelWithoutAuthorizedAction,
+        {
+          collection: 'session-recordings',
+        },
+      ),
     );
   });
 
@@ -171,14 +181,18 @@ module('Unit | Abilities | session-recording', function (hooks) {
     });
 
     assert.false(
-      canService.can('navigate scope', scopeModelWithAuthorizedAction, {
+      abilitiesService.can('navigate scope', scopeModelWithAuthorizedAction, {
         collection: 'session-recordings',
       }),
     );
     assert.false(
-      canService.can('navigate scope', scopeModelWithoutAuthorizedAction, {
-        collection: 'session-recordings',
-      }),
+      abilitiesService.can(
+        'navigate scope',
+        scopeModelWithoutAuthorizedAction,
+        {
+          collection: 'session-recordings',
+        },
+      ),
     );
   });
 
@@ -204,10 +218,13 @@ module('Unit | Abilities | session-recording', function (hooks) {
     );
 
     assert.true(
-      canService.can('delete session-recording', recordingWithAuthorizedAction),
+      abilitiesService.can(
+        'delete session-recording',
+        recordingWithAuthorizedAction,
+      ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'delete session-recording',
         recordingWithoutAuthorizedAction,
       ),
@@ -236,10 +253,13 @@ module('Unit | Abilities | session-recording', function (hooks) {
     );
 
     assert.false(
-      canService.can('delete session-recording', recordingWithAuthorizedAction),
+      abilitiesService.can(
+        'delete session-recording',
+        recordingWithAuthorizedAction,
+      ),
     );
     assert.false(
-      canService.can(
+      abilitiesService.can(
         'delete session-recording',
         recordingWithoutAuthorizedAction,
       ),