Merge branch 'main' into feature-scope-capabilities

addons/api/mirage/factories/scope.js

@@ -19,10 +19,10 @@ export default factory.extend({
       sessions: ['list'],
       groups: ['create', 'list'],
       roles: ['create', 'list'],
+      targets: ['create', 'list'],
+      'credential-stores': ['create', 'list'],
       'auth-methods': ['create', 'list'],
-      // targets: ['create', 'list'],
       'host-catalogs': ['create', 'list'],
-      // 'credential-stores': ['create', 'list'],
     };
   },
 

ui/admin/app/routes/scopes/scope/credential-stores.js

@@ -1,4 +1,5 @@
 import Route from '@ember/routing/route';
+import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 import loading from 'ember-loading/decorator';
 import { confirm } from 'core/decorators/confirm';
@@ -6,14 +7,21 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 
 export default class ScopesScopeCredentialStoresRoute extends Route {
   // =methods
-
+  @service can;
   /**
    * Load all credential stores under current scope
    * @returns {Promise[CredentialStoreModel]}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('credential-store', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (
+      this.can.can('list collection', scope, {
+        collection: 'credential-stores',
+      })
+    ) {
+      return this.store.query('credential-store', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/credential-stores/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeCredentialStoresIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeCredentialStoresIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}

ui/admin/app/routes/scopes/scope/targets.js

@@ -11,6 +11,7 @@ export default class ScopesScopeTargetsRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,11 @@ export default class ScopesScopeTargetsRoute extends Route {
    * @return {Promise{[TargetModel]}}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('target', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'targets' })) {
+      return this.store.query('target', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/targets/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeTargetsIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeTargetsIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}

ui/admin/app/templates/scopes/scope.hbs

@@ -73,25 +73,31 @@
         <Rose::Nav::Sidebar @title={{t 'titles.resources'}} as |nav|>
           {{#if (can 'navigate collection' @model collection='sessions')}}
             <nav.link @route='scopes.scope.sessions'>
-              <Rose::Icon @name='app-icons/action-session' @size='medium' />
+              <Rose::Icon @name='flight-icons/entry-point-16' @size='medium' />
               {{t 'resources.session.title_plural'}}
             </nav.link>
           {{/if}}
-          <nav.link @route='scopes.scope.targets'>
-            <Rose::Icon @name='flight-icons/crosshair-16' @size='medium' />
-            {{t 'resources.target.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='targets')}}
+            <nav.link @route='scopes.scope.targets'>
+              <Rose::Icon @name='flight-icons/crosshair-16' @size='medium' />
+              {{t 'resources.target.title_plural'}}
+            </nav.link>
+          {{/if}}
           {{#if (can 'navigate collection' @model collection='host-catalogs')}}
             <nav.link @route='scopes.scope.host-catalogs'>
               <Rose::Icon @name='flight-icons/collections-16' @size='medium' />
               {{t 'resources.host-catalog.title_plural'}}
             </nav.link>
           {{/if}}
-          {{#if (feature-flag 'credential-store')}}
-            <nav.link @route='scopes.scope.credential-stores'>
-              <Rose::Icon @name='flight-icons/key-16' @size='medium' />
-              {{t 'resources.credential-store.title_plural'}}
-            </nav.link>
+          {{#if
+            (can 'navigate collection' @model collection='credential-stores')
+          }}
+            {{#if (feature-flag 'credential-store')}}
+              <nav.link @route='scopes.scope.credential-stores'>
+                <Rose::Icon @name='flight-icons/key-16' @size='medium' />
+                {{t 'resources.credential-store.title_plural'}}
+              </nav.link>
+            {{/if}}
           {{/if}}
         </Rose::Nav::Sidebar>
       {{/if}}

ui/admin/app/templates/scopes/scope/credential-stores/index.hbs

@@ -14,13 +14,16 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton
-        @route='scopes.scope.credential-stores.new'
-        @style='primary'
-      >
-        {{t 'titles.new'}}
-      </Rose::LinkButton>
+
+    {{#if (can 'create collection' this.scope collection='credential-stores')}}
+      {{#if @model}}
+        <Rose::LinkButton
+          @route='scopes.scope.credential-stores.new'
+          @style='primary'
+        >
+          {{t 'titles.new'}}
+        </Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -79,12 +82,35 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.credential-store.description'}}
+            {{#if
+              (can 'list collection' this.scope collection='credential-stores')
+            }}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.credential-store.description'}}
+            {{else if (can
+              'create collection' this.scope collection='credential-stores'
+            )}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.credential-store.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.user.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.credential-stores.new'>
-            <Rose::Icon @name='flight-icons/plus-circle-16' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if
+            (can 'create collection' this.scope collection='credential-stores')
+          }}
+            <message.link @route='scopes.scope.credential-stores.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/app/templates/scopes/scope/targets/index.hbs

@@ -15,13 +15,14 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.targets.new' @style='primary'>
-        {{t 'titles.new'}}
-      </Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='targets')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.targets.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
-
   <page.body>
 
     {{#if @model}}
@@ -79,12 +80,34 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.target.description'}}
+
+            {{#if (can 'list collection' this.scope collection='targets')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.target.description'}}
+            {{else if (can
+              'create collection' this.scope collection='targets'
+            )}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.target.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.target.title_plural')
+              }}
+
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.targets.new'>
-            <Rose::Icon @name='flight-icons/plus-circle-16' />
-            {{t 'titles.new'}}
-          </message.link>
+
+          {{#if (can 'create collection' this.scope collection='targets')}}
+            <message.link @route='scopes.scope.targets.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/tests/acceptance/credential-store/create-test.js

@@ -5,7 +5,7 @@ import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import { authenticateSession } from 'ember-simple-auth/test-support';
 import { Response } from 'miragejs';
 
-module('Acceptance | credential-stores', function (hooks) {
+module('Acceptance | credential-stores | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -21,7 +21,6 @@ module('Acceptance | credential-stores', function (hooks) {
 
   const urls = {
     globalScope: null,
-    orgScope: null,
     projectScope: null,
     credentialStores: null,
     credentialStore: null,
@@ -45,7 +44,6 @@ module('Acceptance | credential-stores', function (hooks) {
     });
     // Generate route URLs for resources
     urls.globalScope = `/scopes/global/scopes`;
-    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
     urls.projectScope = `/scopes/${instances.scopes.project.id}`;
     urls.credentialStores = `${urls.projectScope}/credential-stores`;
     urls.credentialStore = `${urls.credentialStores}/${instances.credentialStore.id}`;
@@ -58,7 +56,7 @@ module('Acceptance | credential-stores', function (hooks) {
     authenticateSession({});
   });
 
-  test('can create a new credential stores', async function (assert) {
+  test('Users can create a new credential stores', async function (assert) {
     assert.expect(1);
     const count = getCredentialStoresCount();
     await visit(urls.newCredentialStore);
@@ -67,7 +65,7 @@ module('Acceptance | credential-stores', function (hooks) {
     assert.equal(getCredentialStoresCount(), count + 1);
   });
 
-  test('can cancel create new credential stores', async function (assert) {
+  test('Users can cancel create new credential stores', async function (assert) {
     assert.expect(2);
     const count = getCredentialStoresCount();
     await visit(urls.newCredentialStore);
@@ -77,6 +75,20 @@ module('Acceptance | credential-stores', function (hooks) {
     assert.equal(getCredentialStoresCount(), count);
   });
 
+  test('Users cannot navigate to new credential stores route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('create')
+    );
+    assert.notOk(find(`[href="${urls.credentialStores}"]`));
+  });
+
   test('saving a new credential store with invalid fields displays error messages', async function (assert) {
     assert.expect(2);
     this.server.post('/credential-stores', () => {

ui/admin/tests/acceptance/credential-store/list-test.js

@@ -0,0 +1,84 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | credential-stores | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      project: null,
+    },
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    projectScope: null,
+    credentialStores: null,
+    credentialStore: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.credentialStore = this.server.create('credential-store', {
+      scope: instances.scopes.project,
+    });
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.credentialStores = `${urls.projectScope}/credential-stores`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to credential-stores with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.projectScope);
+    assert.ok(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('list')
+    );
+    assert.ok(find(`[href="${urls.credentialStores}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('list')
+    );
+    assert.notOk(find(`[href="${urls.credentialStores}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = ['create'];
+    await visit(urls.projectScope);
+    assert.ok(find(`[href="${urls.credentialStores}"]`));
+  });
+});

ui/admin/tests/acceptance/targets/create-test.js

@@ -10,7 +10,7 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | targets', function (hooks) {
+module('Acceptance | targets | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -33,7 +33,6 @@ module('Acceptance | targets', function (hooks) {
   };
 
   hooks.beforeEach(function () {
-    // Generate resources
     instances.scopes.global = this.server.create('scope', { id: 'global' });
     instances.scopes.org = this.server.create('scope', {
       type: 'org',
@@ -68,6 +67,29 @@ module('Acceptance | targets', function (hooks) {
     assert.equal(getTargetCount(), count + 1);
   });
 
+  test('can navigate to new targets route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.projectScope);
+    assert.ok(
+      instances.scopes.project.authorized_collection_actions.targets.includes(
+        'create'
+      )
+    );
+    assert.ok(find(`[href="${urls.targets}"]`));
+  });
+
+  test('cannot navigate to new targets route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.targets = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions.targets.includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`[href="${urls.targets}"]`));
+  });
+
   test('can cancel create new targets', async function (assert) {
     assert.expect(2);
     const count = getTargetCount();

ui/admin/tests/acceptance/targets/list-test.js

@@ -0,0 +1,84 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | targets | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+      project: null,
+    },
+    targets: null,
+    projectScope: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.orgScope.id, type: 'org' },
+    });
+    instances.target = this.server.create('target', {
+      scope: instances.scopes.project,
+    });
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.targets = `${urls.projectScope}/targets`;
+    authenticateSession({});
+  });
+
+  test('can navigate to targets with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.projectScope);
+    assert.ok(
+      instances.scopes.project.authorized_collection_actions.targets.includes(
+        'list'
+      )
+    );
+    assert.ok(find(`[href="${urls.targets}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.targets = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions.targets.includes(
+        'list'
+      )
+    );
+    assert.notOk(find(`[href="${urls.targets}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.scopes.project.authorized_collection_actions.targets = ['create'];
+    await visit(urls.projectScope);
+    assert.ok(find(`[href="${urls.targets}"]`));
+  });
+});