Merge pull request #726 from hashicorp/roles-create-list

Roles capabilities create/list

addons/api/mirage/factories/scope.js

@@ -8,7 +8,7 @@ export default factory.extend({
     return {
       users: ['create', 'list'],
       groups: ['create', 'list'],
-      // roles: ['create', 'list'],
+      roles: ['create', 'list'],
       // 'auth-methods': ['create', 'list'],
       // sessopms: ['list'],
       // targets: ['create', 'list'],

ui/admin/app/routes/scopes/scope/roles.js

@@ -11,6 +11,7 @@ export default class ScopesScopeRolesRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,11 @@ export default class ScopesScopeRolesRoute extends Route {
    * @return {Promise{[RoleModel]}}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('role', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'roles' })) {
+      return this.store.query('role', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/roles/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeRolesIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeRolesIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}

ui/admin/app/templates/scopes/scope.hbs

@@ -106,10 +106,15 @@
               {{t 'resources.group.title_plural'}}
             </nav.link>
           {{/if}}
-          <nav.link @route='scopes.scope.roles'>
-            <Rose::Icon @name='flight-icons/identity-user-16' @size='medium' />
-            {{t 'resources.role.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='roles')}}
+            <nav.link @route='scopes.scope.roles'>
+              <Rose::Icon
+                @name='flight-icons/identity-user-16'
+                @size='medium'
+              />
+              {{t 'resources.role.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.auth-methods'>
             <Rose::Icon @name='flight-icons/lock-16' @size='medium' />
             {{t 'resources.auth-method.title_plural'}}

ui/admin/app/templates/scopes/scope/roles/index.hbs

@@ -15,10 +15,12 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.roles.new' @style='primary'>{{t
-          'titles.new'
-        }}</Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='roles')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.roles.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -68,12 +70,29 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.role.description'}}
+            {{#if (can 'list collection' this.scope collection='roles')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.roles.description'}}
+            {{else if (can 'create collection' this.scope collection='roles')}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.role.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.role.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.roles.new'>
-            <Rose::Icon @name='flight-icons/plus-circle-16' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if (can 'create collection' this.scope collection='roles')}}
+            <message.link @route='scopes.scope.roles.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/tests/acceptance/roles/create-test.js

@@ -11,7 +11,7 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | roles', function (hooks) {
+module('Acceptance | roles | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -22,38 +22,44 @@ module('Acceptance | roles', function (hooks) {
       project: null,
     },
     role: null,
+    orgScope: null,
   };
   const urls = {
-    orgScope: null,
     roles: null,
     role: null,
     newRole: null,
+    orgScope: null,
   };
 
   hooks.beforeEach(function () {
     authenticateSession({});
-    instances.scopes.global = this.server.create('scope', { id: 'global' });
-    instances.scopes.org = this.server.create('scope', {
-      type: 'org',
-      scope: { id: 'global', type: 'global' },
-    });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+
     // The project scope is not yet used for role tests (though it will be
     // in the future).  This is created simply to test the grant scope loading
     // mechanism.
     instances.scopes.project = this.server.create('scope', {
       type: 'project',
-      scope: { id: instances.scopes.org.id, type: instances.scopes.org.type },
+      scope: { id: instances.orgScope.id, type: instances.orgScope.type },
     });
     instances.role = this.server.create(
       'role',
       {
-        scope: instances.scopes.org,
+        scope: instances.orgScope,
       },
       'withPrincipals'
     );
-    urls.roles = `/scopes/${instances.scopes.org.id}/roles`;
+    urls.roles = `/scopes/${instances.orgScope.id}/roles`;
     urls.role = `${urls.roles}/${instances.role.id}`;
     urls.newRole = `${urls.roles}/new`;
+    urls.orgScope = `/scopes/${instances.orgScope.id}`;
   });
 
   test('can create new role', async function (assert) {
@@ -65,6 +71,25 @@ module('Acceptance | roles', function (hooks) {
     assert.equal(this.server.db.roles.length, rolesCount + 1);
   });
 
+  test('Users can navigate to new roles route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScope);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.roles.includes('create')
+    );
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users cannot navigate to new roles route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.roles = [];
+    await visit(urls.orgScope);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.roles.includes('create')
+    );
+    assert.notOk(find(`[href="${urls.roles}"]`));
+  });
+
   test('can cancel new role creation', async function (assert) {
     assert.expect(2);
     const rolesCount = this.server.db.roles.length;

ui/admin/tests/acceptance/roles/list-test.js

@@ -0,0 +1,75 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | roles | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    roles: null,
+    orgScope: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.role = this.server.create('role', {
+      scope: instances.orgScope,
+    });
+    urls.orgScope = `/scopes/${instances.orgScope.id}`;
+
+    urls.roles = `/scopes/${instances.orgScope.id}/roles`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to roles with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScope);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.roles.includes('list')
+    );
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.roles = [];
+    await visit(urls.orgScope);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.roles.includes('list')
+    );
+    assert.notOk(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.orgScope.authorized_collection_actions.roles = ['create'];
+    await visit(urls.orgScope);
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+});