diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js index c98b1fa23..0e7056957 100644 --- a/addons/api/mirage/factories/scope.js +++ b/addons/api/mirage/factories/scope.js @@ -8,7 +8,7 @@ export default factory.extend({ return { users: ['create', 'list'], groups: ['create', 'list'], - // roles: ['create', 'list'], + roles: ['create', 'list'], 'auth-methods': ['create', 'list'], // sessopms: ['list'], // targets: ['create', 'list'], diff --git a/ui/admin/app/routes/scopes/scope/roles.js b/ui/admin/app/routes/scopes/scope/roles.js index 88d05373b..cbc1dfcc5 100644 --- a/ui/admin/app/routes/scopes/scope/roles.js +++ b/ui/admin/app/routes/scopes/scope/roles.js @@ -11,6 +11,7 @@ export default class ScopesScopeRolesRoute extends Route { @service intl; @service notify; @service session; + @service can; // =methods @@ -26,8 +27,11 @@ export default class ScopesScopeRolesRoute extends Route { * @return {Promise{[RoleModel]}} */ async model() { - const { id: scope_id } = this.modelFor('scopes.scope'); - return this.store.query('role', { scope_id }); + const scope = this.modelFor('scopes.scope'); + const { id: scope_id } = scope; + if (this.can.can('list collection', scope, { collection: 'roles' })) { + return this.store.query('role', { scope_id }); + } } // =actions diff --git a/ui/admin/app/routes/scopes/scope/roles/index.js b/ui/admin/app/routes/scopes/scope/roles/index.js index f2a8d7af1..56c143beb 100644 --- a/ui/admin/app/routes/scopes/scope/roles/index.js +++ b/ui/admin/app/routes/scopes/scope/roles/index.js @@ -1,3 +1,10 @@ import Route from '@ember/routing/route'; +export default class ScopesScopeRolesIndexRoute extends Route { + // =methods -export default class ScopesScopeRolesIndexRoute extends Route {} + setupController(controller) { + const scope = this.modelFor('scopes.scope'); + super.setupController(...arguments); + controller.setProperties({ scope }); + } +} diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs index cabac1f4a..d8704d9c8 100644 --- a/ui/admin/app/templates/scopes/scope.hbs +++ b/ui/admin/app/templates/scopes/scope.hbs @@ -106,10 +106,15 @@ {{t 'resources.group.title_plural'}} {{/if}} - - - {{t 'resources.role.title_plural'}} - + {{#if (can 'navigate collection' @model collection='roles')}} + + + {{t 'resources.role.title_plural'}} + + {{/if}} {{#if (can 'navigate collection' @model collection='auth-methods')}} diff --git a/ui/admin/app/templates/scopes/scope/roles/index.hbs b/ui/admin/app/templates/scopes/scope/roles/index.hbs index ae8157f05..241093ea4 100644 --- a/ui/admin/app/templates/scopes/scope/roles/index.hbs +++ b/ui/admin/app/templates/scopes/scope/roles/index.hbs @@ -15,10 +15,12 @@ - {{#if @model}} - {{t - 'titles.new' - }} + {{#if (can 'create collection' this.scope collection='roles')}} + {{#if @model}} + {{t + 'titles.new' + }} + {{/if}} {{/if}} @@ -68,12 +70,29 @@ as |message| > - {{t 'resources.role.description'}} + {{#if (can 'list collection' this.scope collection='roles')}} + {{! can list (at least): show default welcome message}} + {{t 'resources.roles.description'}} + {{else if (can 'create collection' this.scope collection='roles')}} + {{! can create (only): show create-but-not-list welcome message}} + {{t + 'descriptions.create-but-not-list' + resource=(t 'resources.role.title_plural') + }} + {{else}} + {{! can neither list nor create }} + {{t + 'descriptions.neither-list-nor-create' + resource=(t 'resources.role.title_plural') + }} + {{/if}} - - - {{t 'titles.new'}} - + {{#if (can 'create collection' this.scope collection='roles')}} + + + {{t 'titles.new'}} + + {{/if}} diff --git a/ui/admin/tests/acceptance/auth-methods/create-test.js b/ui/admin/tests/acceptance/auth-methods/create-test.js index 8554157e1..684984999 100644 --- a/ui/admin/tests/acceptance/auth-methods/create-test.js +++ b/ui/admin/tests/acceptance/auth-methods/create-test.js @@ -19,6 +19,7 @@ module('Acceptance | auth-methods | create ', function (hooks) { scopes: { global: null, org: null, + project: null, }, authMethod: null, orgScope: null, @@ -29,14 +30,22 @@ module('Acceptance | auth-methods | create ', function (hooks) { authMethods: null, newAuthMethod: null, authMethod: null, - orgURL: null, }; hooks.beforeEach(function () { authenticateSession({}); - instances.orgScope = this.server.create('scope', { - type: 'org', - scope: { id: 'global', type: 'global' }, + instances.orgScope = this.server.create( + 'scope', + { + type: 'org', + scope: { id: 'global', type: 'global' }, + }, + 'withChildren' + ); + + instances.scopes.project = this.server.create('scope', { + type: 'project', + scope: { id: instances.orgScope.id, type: instances.orgScope.type }, }); instances.authMethod = this.server.create('auth-method', { @@ -44,8 +53,8 @@ module('Acceptance | auth-methods | create ', function (hooks) { }); // Generate route URLs for resources - urls.orgURL = `/scopes/${instances.orgScope.id}`; - urls.authMethods = `${urls.orgURL}/auth-methods`; + urls.orgScope = `/scopes/${instances.orgScope.id}`; + urls.authMethods = `${urls.orgScope}/auth-methods`; urls.newAuthMethod = `${urls.authMethods}/new?type=password`; urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`; }); @@ -66,7 +75,7 @@ module('Acceptance | auth-methods | create ', function (hooks) { 'create', 'list', ]; - await visit(urls.orgURL); + await visit(urls.orgScope); assert.ok( instances.orgScope.authorized_collection_actions['auth-methods'].includes( 'create' @@ -78,7 +87,7 @@ module('Acceptance | auth-methods | create ', function (hooks) { test('Users cannot navigate to new auth-methods route without proper authorization', async function (assert) { assert.expect(2); instances.orgScope.authorized_collection_actions['auth-methods'] = []; - await visit(urls.orgURL); + await visit(urls.orgScope); assert.notOk( instances.orgScope.authorized_collection_actions['auth-methods'].includes( 'create' diff --git a/ui/admin/tests/acceptance/auth-methods/list-test.js b/ui/admin/tests/acceptance/auth-methods/list-test.js index c943c01e8..385c8cb1a 100644 --- a/ui/admin/tests/acceptance/auth-methods/list-test.js +++ b/ui/admin/tests/acceptance/auth-methods/list-test.js @@ -39,14 +39,6 @@ module('Acceptance | auth-methods | list', function (hooks) { }, 'withChildren' ); - instances.org = this.server.create( - 'scope', - { - type: 'org', - scope: { id: 'global', type: 'global' }, - }, - 'withChildren' - ); urls.orgScope = `/scopes/${instances.orgScope.id}`; urls.authMethods = `/scopes/${instances.orgScope.id}/auth-methods`; diff --git a/ui/admin/tests/acceptance/roles-test.js b/ui/admin/tests/acceptance/roles/create-test.js similarity index 70% rename from ui/admin/tests/acceptance/roles-test.js rename to ui/admin/tests/acceptance/roles/create-test.js index 77b971f46..a0564f67d 100644 --- a/ui/admin/tests/acceptance/roles-test.js +++ b/ui/admin/tests/acceptance/roles/create-test.js @@ -11,7 +11,7 @@ import { //invalidateSession, } from 'ember-simple-auth/test-support'; -module('Acceptance | roles', function (hooks) { +module('Acceptance | roles | create', function (hooks) { setupApplicationTest(hooks); setupMirage(hooks); @@ -22,38 +22,44 @@ module('Acceptance | roles', function (hooks) { project: null, }, role: null, + orgScope: null, }; const urls = { - orgScope: null, roles: null, role: null, newRole: null, + orgScope: null, }; hooks.beforeEach(function () { authenticateSession({}); - instances.scopes.global = this.server.create('scope', { id: 'global' }); - instances.scopes.org = this.server.create('scope', { - type: 'org', - scope: { id: 'global', type: 'global' }, - }); + instances.orgScope = this.server.create( + 'scope', + { + type: 'org', + scope: { id: 'global', type: 'global' }, + }, + 'withChildren' + ); + // The project scope is not yet used for role tests (though it will be // in the future). This is created simply to test the grant scope loading // mechanism. instances.scopes.project = this.server.create('scope', { type: 'project', - scope: { id: instances.scopes.org.id, type: instances.scopes.org.type }, + scope: { id: instances.orgScope.id, type: instances.orgScope.type }, }); instances.role = this.server.create( 'role', { - scope: instances.scopes.org, + scope: instances.orgScope, }, 'withPrincipals' ); - urls.roles = `/scopes/${instances.scopes.org.id}/roles`; + urls.roles = `/scopes/${instances.orgScope.id}/roles`; urls.role = `${urls.roles}/${instances.role.id}`; urls.newRole = `${urls.roles}/new`; + urls.orgScope = `/scopes/${instances.orgScope.id}`; }); test('can create new role', async function (assert) { @@ -65,6 +71,25 @@ module('Acceptance | roles', function (hooks) { assert.equal(this.server.db.roles.length, rolesCount + 1); }); + test('Users can navigate to new roles route with proper authorization', async function (assert) { + assert.expect(2); + await visit(urls.orgScope); + assert.ok( + instances.orgScope.authorized_collection_actions.roles.includes('create') + ); + assert.ok(find(`[href="${urls.roles}"]`)); + }); + + test('Users cannot navigate to new roles route without proper authorization', async function (assert) { + assert.expect(2); + instances.orgScope.authorized_collection_actions.roles = []; + await visit(urls.orgScope); + assert.notOk( + instances.orgScope.authorized_collection_actions.roles.includes('create') + ); + assert.notOk(find(`[href="${urls.roles}"]`)); + }); + test('can cancel new role creation', async function (assert) { assert.expect(2); const rolesCount = this.server.db.roles.length; diff --git a/ui/admin/tests/acceptance/roles/list-test.js b/ui/admin/tests/acceptance/roles/list-test.js new file mode 100644 index 000000000..ff170aeb7 --- /dev/null +++ b/ui/admin/tests/acceptance/roles/list-test.js @@ -0,0 +1,75 @@ +import { module, test } from 'qunit'; +import { visit, find } from '@ember/test-helpers'; +import { setupApplicationTest } from 'ember-qunit'; +import setupMirage from 'ember-cli-mirage/test-support/setup-mirage'; +import { + authenticateSession, + // These are left here intentionally for future reference. + //currentSession, + //invalidateSession, +} from 'ember-simple-auth/test-support'; + +module('Acceptance | roles | list', function (hooks) { + setupApplicationTest(hooks); + setupMirage(hooks); + + const instances = { + scopes: { + global: null, + org: null, + }, + orgScope: null, + }; + + const urls = { + scopes: { + org: null, + }, + roles: null, + orgScope: null, + }; + + hooks.beforeEach(function () { + instances.orgScope = this.server.create( + 'scope', + { + type: 'org', + scope: { id: 'global', type: 'global' }, + }, + 'withChildren' + ); + instances.role = this.server.create('role', { + scope: instances.orgScope, + }); + urls.orgScope = `/scopes/${instances.orgScope.id}`; + + urls.roles = `/scopes/${instances.orgScope.id}/roles`; + authenticateSession({}); + }); + + test('Users can navigate to roles with proper authorization', async function (assert) { + assert.expect(2); + await visit(urls.orgScope); + assert.ok( + instances.orgScope.authorized_collection_actions.roles.includes('list') + ); + assert.ok(find(`[href="${urls.roles}"]`)); + }); + + test('Users cannot navigate to index without either list or create actions', async function (assert) { + assert.expect(2); + instances.orgScope.authorized_collection_actions.roles = []; + await visit(urls.orgScope); + assert.notOk( + instances.orgScope.authorized_collection_actions.roles.includes('list') + ); + assert.notOk(find(`[href="${urls.roles}"]`)); + }); + + test('Users can navigate to index with only create action', async function (assert) { + assert.expect(1); + instances.orgScope.authorized_collection_actions.roles = ['create']; + await visit(urls.orgScope); + assert.ok(find(`[href="${urls.roles}"]`)); + }); +});