Icu 17393 manage resource button permissions bug (#2927)

* fix: 🐛 hide manage button if no action items

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for credential-stores

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for groups

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for host-sets

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for roles

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage action for targets

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for workers

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for users

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

* fix: 🐛 update manage actions for auth-methods

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-17393

ui/admin/app/components/auth-methods/auth-method/actions/index.hbs

@@ -26,39 +26,54 @@
     {{/each}}
   </Hds::Dropdown>
 {{/if}}
-<Hds::Dropdown data-test-manage-auth-method as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if @model.isPrimary}}
-    <dd.Interactive {{on 'click' (fn @removeAsPrimary @model)}}>
-      {{t 'resources.auth-method.actions.remove-as-primary'}}
-    </dd.Interactive>
-  {{else}}
-    <dd.Interactive {{on 'click' (fn @makePrimary @model)}}>
-      {{t 'resources.auth-method.actions.make-primary'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canCreateAccount=(can 'create model' @model collection='accounts')
+    canCreateManagedGroup=(can
+      'create model' @model collection='managed-groups'
+    )
+    canDelete=(can 'delete auth-method' @model)
+  )
+  as |perms|
+}}
+  {{#if
+    (or perms.canCreateAccount perms.canCreateManagedGroup perms.canDelete)
+  }}
+    <Hds::Dropdown data-test-manage-auth-method as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if @model.isPrimary}}
+        <dd.Interactive {{on 'click' (fn @removeAsPrimary @model)}}>
+          {{t 'resources.auth-method.actions.remove-as-primary'}}
+        </dd.Interactive>
+      {{else}}
+        <dd.Interactive {{on 'click' (fn @makePrimary @model)}}>
+          {{t 'resources.auth-method.actions.make-primary'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canCreateAccount}}
+        <dd.Interactive
+          @route='scopes.scope.auth-methods.auth-method.accounts.new'
+          @model={{@model}}
+        >
+          {{t 'resources.account.actions.create'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canCreateManagedGroup}}
+        {{#if (or @model.isOIDC @model.isLDAP)}}
+          <dd.Interactive
+            @route='scopes.scope.auth-methods.auth-method.managed-groups.new'
+            @model={{@model}}
+          >
+            {{t 'resources.managed-group.actions.create'}}
+          </dd.Interactive>
+        {{/if}}
+      {{/if}}
+      {{#if perms.canDelete}}
+        <dd.Separator />
+        <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
+          {{t 'resources.auth-method.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'create model' @model collection='accounts')}}
-    <dd.Interactive
-      @route='scopes.scope.auth-methods.auth-method.accounts.new'
-      @model={{@model}}
-    >
-      {{t 'resources.account.actions.create'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'create model' @model collection='managed-groups')}}
-    {{#if (or @model.isOIDC @model.isLDAP)}}
-      <dd.Interactive
-        @route='scopes.scope.auth-methods.auth-method.managed-groups.new'
-        @model={{@model}}
-      >
-        {{t 'resources.managed-group.actions.create'}}
-      </dd.Interactive>
-    {{/if}}
-  {{/if}}
-  {{#if (can 'delete auth-method' @model)}}
-    <dd.Separator />
-    <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
-      {{t 'resources.auth-method.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/credential-stores/credential-store/actions/index.hbs

@@ -2,33 +2,63 @@
   Copyright (c) HashiCorp, Inc.
   SPDX-License-Identifier: BUSL-1.1
 }}
-<Hds::Dropdown data-test-manage-credential-stores-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'create model' @model collection='credential-libraries')}}
-    <dd.Interactive
-      @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
-    >
-      {{t 'resources.credential-library.actions.create'}}
-    </dd.Interactive>
+
+{{#let
+  (hash
+    canCreateCredLibraries=(can
+      'create model' @model collection='credential-libraries'
+    )
+    canCreateCredentials=(can 'create model' @model collection='credentials')
+    canDelete=(can 'delete model' @model)
+    canEditWorkerFilter=(and (feature-flag 'worker-filter') @model.isVault)
+  )
+  as |perms|
+}}
+  {{#if
+    (or
+      perms.canCreateCredLibraries
+      perms.canCreateCredentials
+      perms.canEditWorkerFilter
+      perms.canDelete
+    )
+  }}
+    <Hds::Dropdown data-test-manage-credential-stores-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canCreateCredLibraries}}
+        <dd.Interactive
+          @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
+        >
+          {{t 'resources.credential-library.actions.create'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canCreateCredentials}}
+        <dd.Interactive
+          @route='scopes.scope.credential-stores.credential-store.credentials.new'
+        >
+          {{t 'resources.credential.actions.create'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canEditWorkerFilter}}
+        <dd.Interactive
+          @route='scopes.scope.credential-stores.credential-store.edit-worker-filter'
+        >
+          {{t 'actions.edit-worker-filter'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if
+          (or
+            perms.canCreateCredLibraries
+            perms.canCreateCredentials
+            perms.canEditWorkerFilter
+          )
+        }}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive @color='critical' {{on 'click' @delete}}>
+          {{t 'resources.credential-store.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'create model' @model collection='credentials')}}
-    <dd.Interactive
-      @route='scopes.scope.credential-stores.credential-store.credentials.new'
-    >
-      {{t 'resources.credential.actions.create'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (and (feature-flag 'worker-filter') @model.isVault)}}
-    <dd.Interactive
-      @route='scopes.scope.credential-stores.credential-store.edit-worker-filter'
-    >
-      {{t 'actions.edit-worker-filter'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive @color='critical' {{on 'click' @delete}}>
-      {{t 'resources.credential-store.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/groups/group/actions/index.hbs

@@ -3,21 +3,33 @@
   SPDX-License-Identifier: BUSL-1.1
 }}
 
-<Hds::Dropdown data-test-manage-group-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'addMembers group' @model)}}
-    <dd.Interactive @route='scopes.scope.groups.group.add-members'>
-      {{t 'resources.group.actions.add-members'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canAddMembers=(can 'addMembers group' @model)
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canAddMembers perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-group-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canAddMembers}}
+        <dd.Interactive @route='scopes.scope.groups.group.add-members'>
+          {{t 'resources.group.actions.add-members'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if perms.canAddMembers}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive
+          @color='critical'
+          @disabled={{@model.canSave}}
+          {{on 'click' @delete}}
+        >
+          {{t 'resources.group.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive
-      @color='critical'
-      @disabled={{@model.canSave}}
-      {{on 'click' @delete}}
-    >
-      {{t 'resources.group.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/host-catalogs/host-catalog/actions/index.hbs

@@ -3,28 +3,41 @@
   SPDX-License-Identifier: BUSL-1.1
 }}
 
-<Hds::Dropdown data-test-manage-host-catalogs-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'create model' @model collection='hosts')}}
-    <dd.Interactive
-      @route='scopes.scope.host-catalogs.host-catalog.hosts.new'
-      @model={{@model}}
-    >
-      {{t 'resources.host.actions.create'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canCreateHosts=(can 'create model' @model collection='hosts')
+    canCreateHostSets=(can 'create model' @model collection='host-sets')
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canCreateHosts perms.canCreateHostSets perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-host-catalogs-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canCreateHosts}}
+        <dd.Interactive
+          @route='scopes.scope.host-catalogs.host-catalog.hosts.new'
+          @model={{@model}}
+        >
+          {{t 'resources.host.actions.create'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canCreateHostSets}}
+        <dd.Interactive
+          @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
+          @model={{@model}}
+        >
+          {{t 'resources.host-set.actions.create'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if (or perms.canCreateHosts perms.canCreateHostSets)}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
+          {{t 'resources.host-catalog.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'create model' @model collection='host-sets')}}
-    <dd.Interactive
-      @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
-      @model={{@model}}
-    >
-      {{t 'resources.host-set.actions.create'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
-      {{t 'resources.host-catalog.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/host-catalogs/host-catalog/host-sets/host-set/actions/index.hbs

@@ -3,24 +3,36 @@
   SPDX-License-Identifier: BUSL-1.1
 }}
 
-<Hds::Dropdown data-test-manage-dropdown-host-sets as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'addHosts hostSet' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.host-catalogs.host-catalog.host-sets.host-set.create-and-add-host'
-    >
-      {{t 'resources.host-set.actions.create-and-add-host'}}
-    </dd.Interactive>
-    <dd.Interactive
-      @route='scopes.scope.host-catalogs.host-catalog.host-sets.host-set.add-hosts'
-    >
-      {{t 'resources.host-set.actions.add-hosts'}}
-    </dd.Interactive>
-    <dd.Separator />
+{{#let
+  (hash
+    canAddHosts=(can 'addHosts hostSet' @model)
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canAddHosts perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-dropdown-host-sets as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canAddHosts}}
+        <dd.Interactive
+          @route='scopes.scope.host-catalogs.host-catalog.host-sets.host-set.create-and-add-host'
+        >
+          {{t 'resources.host-set.actions.create-and-add-host'}}
+        </dd.Interactive>
+        <dd.Interactive
+          @route='scopes.scope.host-catalogs.host-catalog.host-sets.host-set.add-hosts'
+        >
+          {{t 'resources.host-set.actions.add-hosts'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if perms.canAddHosts}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
+          {{t 'resources.host-set.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
-      {{t 'resources.host-set.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/roles/role/actions/index.hbs

@@ -3,32 +3,45 @@
   SPDX-License-Identifier: BUSL-1.1
 }}
 
-<Hds::Dropdown data-test-manage-roles-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'addPrincipals role' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.roles.role.add-principals'
-      data-test-manage-role-principals
-    >
-      {{t 'resources.role.principal.actions.add-principals'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canAddPrincipals=(can 'addPrincipals role' @model)
+    canSetGrantScopes=(can 'setGrantScopes role' @model)
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canAddPrincipals perms.canSetGrantScopes perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-roles-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canAddPrincipals}}
+        <dd.Interactive
+          @route='scopes.scope.roles.role.add-principals'
+          data-test-manage-role-principals
+        >
+          {{t 'resources.role.principal.actions.add-principals'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canSetGrantScopes}}
+        <dd.Interactive
+          @route='scopes.scope.roles.role.manage-scopes'
+          data-test-manage-dropdown-scopes
+        >
+          {{t 'resources.role.scope.actions.manage-scopes'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if (or perms.canAddPrincipals perms.canSetGrantScopes)}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive
+          @color='critical'
+          @disabled={{@model.canSave}}
+          {{on 'click' (fn @delete @model)}}
+        >
+          {{t 'resources.role.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'setGrantScopes role' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.roles.role.manage-scopes'
-      data-test-manage-dropdown-scopes
-    >
-      {{t 'resources.role.scope.actions.manage-scopes'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive
-      @color='critical'
-      @disabled={{@model.canSave}}
-      {{on 'click' (fn @delete @model)}}
-    >
-      {{t 'resources.role.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/targets/target/actions/index.hbs

@@ -2,38 +2,68 @@
   Copyright (c) HashiCorp, Inc.
   SPDX-License-Identifier: BUSL-1.1
 }}
-<Hds::Dropdown data-test-manage-targets-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'addHostSources target' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.targets.target.add-host-sources'
-      data-test-add-host-sources-action
-    >
-      {{t 'resources.target.actions.add-host-sources'}}
-    </dd.Interactive>
+
+{{#let
+  (hash
+    canAddHostSources=(can 'addHostSources target' @model)
+    canAddBrokeredCredSources=(can 'addBrokeredCredentialSources target' @model)
+    canAddInjectedApplicationCredSources=(can
+      'addInjectedApplicationCredentialSources target' @model
+    )
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if
+    (or
+      perms.canAddHostSources
+      perms.canAddBrokeredCredSources
+      perms.canAddInjectedApplicationCredSources
+      perms.canDelete
+    )
+  }}
+    <Hds::Dropdown data-test-manage-targets-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canAddHostSources}}
+        <dd.Interactive
+          @route='scopes.scope.targets.target.add-host-sources'
+          data-test-add-host-sources-action
+        >
+          {{t 'resources.target.actions.add-host-sources'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canAddBrokeredCredSources}}
+        <dd.Interactive
+          @route='scopes.scope.targets.target.add-brokered-credential-sources'
+          data-test-add-brokered-cred-sources-action
+        >
+          {{t 'resources.target.actions.add-brokered-credential-sources'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canAddInjectedApplicationCredSources}}
+        <dd.Interactive
+          @route='scopes.scope.targets.target.add-injected-application-credential-sources'
+          data-test-add-injected-cred-sources-action
+        >
+          {{t
+            'resources.target.actions.add-injected-application-credential-sources'
+          }}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if
+          (or
+            perms.canAddHostSources
+            perms.canAddBrokeredCredSources
+            perms.canAddInjectedApplicationCredSources
+          )
+        }}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
+          {{t 'resources.target.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'addBrokeredCredentialSources target' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.targets.target.add-brokered-credential-sources'
-      data-test-add-brokered-cred-sources-action
-    >
-      {{t 'resources.target.actions.add-brokered-credential-sources'}}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'addInjectedApplicationCredentialSources target' @model)}}
-    <dd.Interactive
-      @route='scopes.scope.targets.target.add-injected-application-credential-sources'
-      data-test-add-injected-cred-sources-action
-    >
-      {{t
-        'resources.target.actions.add-injected-application-credential-sources'
-      }}
-    </dd.Interactive>
-  {{/if}}
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive @color='critical' {{on 'click' (fn @delete @model)}}>
-      {{t 'resources.target.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/users/user/actions/index.hbs

@@ -2,23 +2,34 @@
   Copyright (c) HashiCorp, Inc.
   SPDX-License-Identifier: BUSL-1.1
 }}
-<Hds::Dropdown data-test-manage-user-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
 
-  {{#if (can 'addAccounts user' @model)}}
-    <dd.Interactive @route='scopes.scope.users.user.add-accounts'>
-      {{t 'resources.user.actions.add-accounts'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canAddAccounts=(can 'addAccounts user' @model)
+    canDelete=(can 'delete model' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canAddAccounts perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-user-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canAddAccounts}}
+        <dd.Interactive @route='scopes.scope.users.user.add-accounts'>
+          {{t 'resources.user.actions.add-accounts'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if perms.canAddAccounts}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive
+          @color='critical'
+          @disabled={{@model.canSave}}
+          {{on 'click' (fn @delete @model)}}
+        >
+          {{t 'resources.user.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-
-  {{#if (can 'delete model' @model)}}
-    <dd.Separator />
-    <dd.Interactive
-      @color='critical'
-      @disabled={{@model.canSave}}
-      {{on 'click' (fn @delete @model)}}
-    >
-      {{t 'resources.user.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/app/components/workers/worker/actions/index.hbs

@@ -3,20 +3,33 @@
   SPDX-License-Identifier: BUSL-1.1
 }}
 
-<Hds::Dropdown data-test-manage-worker-dropdown as |dd|>
-  <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
-  {{#if (can 'setWorkerTags worker' @model)}}
-    <dd.Interactive @route='scopes.scope.workers.worker.create-tags'>
-      {{t 'resources.worker.actions.create_tags'}}
-    </dd.Interactive>
+{{#let
+  (hash
+    canSetWorkerTags=(can 'setWorkerTags worker' @model)
+    canDelete=(can 'delete worker' @model)
+  )
+  as |perms|
+}}
+  {{#if (or perms.canSetWorkerTags perms.canDelete)}}
+    <Hds::Dropdown data-test-manage-worker-dropdown as |dd|>
+      <dd.ToggleButton @text={{t 'actions.manage'}} @color='secondary' />
+      {{#if perms.canSetWorkerTags}}
+        <dd.Interactive @route='scopes.scope.workers.worker.create-tags'>
+          {{t 'resources.worker.actions.create_tags'}}
+        </dd.Interactive>
+      {{/if}}
+      {{#if perms.canDelete}}
+        {{#if perms.canSetWorkerTags}}
+          <dd.Separator />
+        {{/if}}
+        <dd.Interactive
+          @icon='trash'
+          @color='critical'
+          {{on 'click' (fn @delete @model)}}
+        >
+          {{t 'resources.worker.actions.delete'}}
+        </dd.Interactive>
+      {{/if}}
+    </Hds::Dropdown>
   {{/if}}
-  {{#if (can 'delete worker' @model)}}
-    <dd.Interactive
-      @icon='trash'
-      @color='critical'
-      {{on 'click' (fn @delete @model)}}
-    >
-      {{t 'resources.worker.actions.delete'}}
-    </dd.Interactive>
-  {{/if}}
-</Hds::Dropdown>
+{{/let}}

ui/admin/tests/acceptance/credential-library/create-test.js

@@ -215,6 +215,7 @@ module('Acceptance | credential-libraries | create', function (hooks) {
       'credential-libraries'
     ] = [];
     await visit(urls.credentialLibraries);
+    await click(selectors.MANAGE_DROPDOWN_CREDENTIAL_STORE);
 
     assert.notOk(
       instances.credentialStore.authorized_collection_actions[

ui/admin/tests/acceptance/credential-library/selectors.js

@@ -51,3 +51,6 @@ export const MANAGE_DROPDOWN_CRED_LIB =
   '[data-test-manage-credential-library-dropdown] button:first-child';
 export const MANAGE_DROPDOWN_CRED_LIB_DELETE =
   '[data-test-manage-credential-library-dropdown] ul li button';
+
+export const MANAGE_DROPDOWN_CREDENTIAL_STORE =
+  '[data-test-manage-credential-stores-dropdown] button';

ui/admin/tests/acceptance/credential-store/credentials/create-test.js

@@ -344,6 +344,23 @@ module(
       assert.dom(selectors.FIELD_TYPE_JSON).doesNotExist();
     });
 
+    test('users cannot create a new credential without proper authorization', async function (assert) {
+      instances.staticCredentialStore.authorized_collection_actions.credentials =
+        instances.staticCredentialStore.authorized_collection_actions.credentials.filter(
+          (item) => item !== 'create',
+        );
+
+      await visit(urls.credentials);
+      await click(selectors.MANAGE_DROPDOWN_CREDENTIAL_STORE);
+
+      assert.false(
+        instances.staticCredentialStore.authorized_collection_actions.credentials.includes(
+          'create',
+        ),
+      );
+      assert.dom(commonSelectors.HREF(urls.newCredential)).doesNotExist();
+    });
+
     test('users cannot directly navigate to new credential route without proper authorization', async function (assert) {
       instances.staticCredentialStore.authorized_collection_actions.credentials =
         instances.staticCredentialStore.authorized_collection_actions.credentials.filter(

ui/admin/tests/acceptance/credential-store/credentials/selectors.js

@@ -21,4 +21,7 @@ export const MANAGE_DROPDOWN_DELETE =
 export const MANAGE_DROPDOWN_NEW_CREDENTIAL =
   '[data-test-manage-credential-stores-dropdown] a';
 
+export const MANAGE_DROPDOWN_CREDENTIAL_STORE =
+  '[data-test-manage-credential-stores-dropdown] button';
+
 export const REPLACE_SECRET_BTN = '.secret-editor button';

ui/admin/tests/acceptance/groups/members-test.js

@@ -129,6 +129,7 @@ module('Acceptance | groups | members', function (hooks) {
     instances.group.update({ authorized_actions });
 
     await visit(urls.group);
+    await click(selectors.MANAGE_DROPDOWN);
 
     assert.dom(commonSelectors.HREF(urls.addMembers)).doesNotExist();
   });

ui/admin/tests/acceptance/host-catalogs/host-sets/create-test.js

@@ -174,8 +174,12 @@ module('Acceptance | host-catalogs | host sets | create', function (hooks) {
   });
 
   test('Users cannot create a new host set without proper authorization', async function (assert) {
-    instances.hostCatalog.authorized_collection_actions['host-sets'] = [];
+    instances.hostCatalog.authorized_collection_actions['host-sets'] =
+      instances.hostCatalog.authorized_collection_actions['host-sets'].filter(
+        (item) => item !== 'create',
+      );
     await visit(urls.hostCatalog);
+    await click(selectors.MANAGE_DROPDOWN_HOST_CATALOG);
 
     assert.notOk(
       instances.hostCatalog.authorized_collection_actions['host-sets'].includes(

ui/admin/tests/acceptance/host-catalogs/host-sets/selectors.js

@@ -15,6 +15,9 @@ export const FIELD_AZURE_FILTER = '[name=filter]';
 export const FIELD_FILTERS_REMOVE_BTN =
   '[name=filters] [data-test-remove-button]';
 
+export const MANAGE_DROPDOWN_HOST_CATALOG =
+  '[data-test-manage-host-catalogs-dropdown] button';
+
 export const MANAGE_DROPDOWN_HOST_SETS =
   '[data-test-manage-dropdown-host-sets] button:first-child';
 export const MANAGE_DROPDOWN_HOST_SETS_DELETE =