feat: 🎸 accounts capability

addons/api/mirage/factories/auth-method.js

@@ -12,6 +12,11 @@ export default factory.extend({
       'update',
       'delete',
     ],
+  authorized_collection_actions: () => {
+    return {
+      accounts: ['create', 'list'],
+    };
+  },
   id: (i) => `auth-method-id-${i}`,
 
   // Cycle through available types

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts.js

@@ -10,7 +10,7 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route
 
   @service intl;
   @service notify;
-
+  @service can;
   // =methods
 
   /**
@@ -18,10 +18,15 @@ export default class ScopesScopeAuthMethodsAuthMethodAccountsRoute extends Route
    * @return {Promise{[AccountModel]}}
    */
   model() {
-    const { id: auth_method_id } = this.modelFor(
-      'scopes.scope.auth-methods.auth-method'
-    );
-    return this.store.query('account', { auth_method_id });
+    const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
+    const { id: auth_method_id } = authMethod;
+    if (
+      this.can.can('list collection', authMethod, {
+        collection: 'accounts',
+      })
+    ) {
+      return this.store.query('account', { auth_method_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts/account/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
-
-export default class ScopesScopeAuthMethodsAuthMethodAccountsAccountIndexRoute extends Route {}
+export default class ScopesScopeAuthMethodsAuthMethodAccountsAccountIndexRoute extends Route {
+  // setupController(controller) {
+  //   const authMethod = this.modelFor(
+  //     'scopes.scope.auth-methods.auth-method'
+  //   );
+  //   super.setupController(...arguments);
+  //   controller.setProperties({ authMethod });
+  // }
+}

ui/admin/app/routes/scopes/scope/auth-methods/auth-method/accounts/index.js

@@ -0,0 +1,9 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeAuthMethodsAuthMethodAccountsIndexRoute extends Route {
+  setupController(controller) {
+    const authMethod = this.modelFor('scopes.scope.auth-methods.auth-method');
+    super.setupController(...arguments);
+    controller.setProperties({ authMethod });
+  }
+}

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs

@@ -55,12 +55,16 @@
       </dropdown.button>
     {{/if}}
   {{/if}}
-  <dropdown.link
-    @route='scopes.scope.auth-methods.auth-method.accounts.new'
-    @model={{@model}}
-  >
-    {{t 'resources.account.actions.create'}}
-  </dropdown.link>
+  {{#if (can 'create collection' @model collection='accounts')}}
+
+    <dropdown.link
+      @route='scopes.scope.auth-methods.auth-method.accounts.new'
+      @model={{@model}}
+    >
+      {{t 'resources.account.actions.create'}}
+    </dropdown.link>
+  {{/if}}
+
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs

@@ -2,7 +2,10 @@
   <nav.link @route='scopes.scope.auth-methods.auth-method.index'>
     {{t 'titles.details'}}
   </nav.link>
-  <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
-    {{t 'resources.account.title_plural'}}
-  </nav.link>
+  {{#if (can 'navigate collection' @model collection='accounts')}}
+
+    <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
+      {{t 'resources.account.title_plural'}}
+    </nav.link>
+  {{/if}}
 </Rose::Nav::Tabs>

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs

@@ -112,12 +112,38 @@
       as |message|
     >
       <message.description>
-        {{t 'resources.account.messages.welcome.description'}}
+
+        {{#if (can 'list collection' this.authMethod collection='accounts')}}
+          {{! can list (at least):  show default welcome message}}
+          {{t 'resources.account.description'}}
+
+        {{else if (can
+          'create collection' this.authMethod collection='accounts'
+        )}}
+          {{! can create (only):  show create-but-not-list welcome message}}
+          {{t
+            'descriptions.create-but-not-list'
+            resource=(t 'resources.account.title_plural')
+          }}
+        {{else}}
+          {{! can neither list nor create }}
+          {{t
+            'descriptions.neither-list-nor-create'
+            resource=(t 'resources.account.title_plural')
+          }}
+        {{/if}}
+
       </message.description>
-      <message.link @route='scopes.scope.auth-methods.auth-method.accounts.new'>
-        <Rose::Icon @name='flight-icons/plus-circle-16' />
-        {{t 'resources.account.actions.create'}}
-      </message.link>
+
+      {{#if (can 'create collection' this.authMethod collection='accounts')}}
+
+        <message.link
+          @route='scopes.scope.auth-methods.auth-method.accounts.new'
+        >
+          <Rose::Icon @name='flight-icons/plus-circle-16' />
+          {{t 'resources.account.actions.create'}}
+        </message.link>
+      {{/if}}
     </Rose::Message>
   </Rose::Layout::Centered>
 

ui/admin/tests/acceptance/accounts/create-test.js

@@ -11,7 +11,7 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | accounts', function (hooks) {
+module('Acceptance | accounts | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -80,6 +80,41 @@ module('Acceptance | accounts', function (hooks) {
     assert.equal(this.server.db.accounts.length, accountsCount + 1);
   });
 
+  test('Users cannot create a new account without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`.rose-layout-page-actions [href="${urls.newAccount}"]`));
+  });
+
+  test('Users can navigate to new account route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.authMethod);
+    assert.ok(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.ok(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('Users cannot navigate to new account route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`[href="${urls.accounts}"]`));
+  });
+
   test('can cancel a new account creation', async function (assert) {
     assert.expect(2);
     const accountsCount = this.server.db.accounts.length;

ui/admin/tests/acceptance/accounts/list-test.js

@@ -0,0 +1,92 @@
+import { module, test } from 'qunit';
+import { visit, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | accounts | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethods: null,
+    account: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    accounts: null,
+    newAccount: null,
+    account: null,
+  };
+
+  hooks.beforeEach(function () {
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+    instances.account = this.server.create('account', {
+      scope: instances.scopes.org,
+      authMethod: instances.authMethod,
+    });
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+    urls.accounts = `${urls.authMethod}/accounts`;
+    urls.newAccount = `${urls.accounts}/new`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+  });
+
+  hooks.afterEach(async function () {
+    const notification = find('.rose-notification');
+    if (notification) {
+      await click('.rose-notification-dismiss');
+    }
+  });
+
+  test('Users can navigate to accounts with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.authMethod);
+    assert.ok(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'list'
+      )
+    );
+    assert.ok(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = [];
+    await visit(urls.authMethod);
+    assert.notOk(
+      instances.authMethod.authorized_collection_actions.accounts.includes(
+        'list'
+      )
+    );
+    assert.notOk(find(`[href="${urls.accounts}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(2);
+    instances.authMethod.authorized_collection_actions.accounts = ['create'];
+    await visit(urls.authMethod);
+    assert.ok(find(`[href="${urls.accounts}"]`));
+    assert.ok(find(`.rose-layout-page-actions [href="${urls.newAccount}"]`));
+  });
+});