feat: 🎸 add permissions check for session recording navigation (#164)

ui/admin/app/abilities/session-recording.js

@@ -20,7 +20,8 @@ export default class OverrideSessionRecordingAbility extends SessionRecordingAbi
 
   /**
    * This override ensures that session recordings can only be presented in the global scope
-   * and if the session-recording feature flag is enabled.   */
+   * and if the session-recording feature flag is enabled.
+   */
   get canList() {
     return this.features.isEnabled('session-recording')
       ? this.hasAuthorizedCollectionAction('list') && this.model.isGlobal

ui/admin/app/templates/scopes/scope.hbs

@@ -27,10 +27,18 @@
             {{t 'resources.org.title_plural'}}
           </nav.link>
           {{#if (feature-flag 'session-recording')}}
-            <nav.link @route='scopes.scope.session-recordings'>
-              <Rose::Icon @name='flight-icons/svg/film-16' @size='medium' />
-              {{t 'resources.session-recording.title_plural'}}
-            </nav.link>
+            {{#if
+              (can
+                'navigate session-recording'
+                @model
+                collection='session-recordings'
+              )
+            }}
+              <nav.link @route='scopes.scope.session-recordings'>
+                <Rose::Icon @name='flight-icons/svg/film-16' @size='medium' />
+                {{t 'resources.session-recording.title_plural'}}
+              </nav.link>
+            {{/if}}
             {{#if
               (can
                 'navigate storage-bucket' @model collection='storage-buckets'

ui/admin/tests/acceptance/session-recordings/list-test.js

@@ -3,6 +3,7 @@ import { visit, currentURL, click } from '@ember/test-helpers';
 import { setupApplicationTest } from 'admin/tests/helpers';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import { authenticateSession } from 'ember-simple-auth/test-support';
+import { enableFeature } from 'ember-feature-flags/test-support';
 
 module('Acceptance | session recordings | list', function (hooks) {
   setupApplicationTest(hooks);
@@ -11,6 +12,7 @@ module('Acceptance | session recordings | list', function (hooks) {
   // Selectors
   const LIST_SESSION_RECORDING_BUTTON =
     'table > tbody > tr > td:last-child > a';
+  const SESSION_RECORDING_TITLE = 'Session Recordings';
 
   // Instances
   const instances = {
@@ -43,17 +45,45 @@ module('Acceptance | session recordings | list', function (hooks) {
     urls.globalScope = `/scopes/global`;
     urls.sessionRecordings = `${urls.globalScope}/session-recordings`;
     urls.sessionRecording = `${urls.sessionRecordings}/${instances.sessionRecording.id}`;
+    enableFeature('session-recording');
     authenticateSession({});
   });
 
-  // TODO: When we add abilities to session-recordings this test will be refactor to account for it.
-  test('users can navigate to session-recordings', async function (assert) {
-    assert.expect(1);
+  test('users can navigate to session-recordings with proper authorization', async function (assert) {
+    assert.expect(4);
+
+    await visit(urls.globalScope);
+
+    assert.true(
+      instances.scopes.global.authorized_collection_actions[
+        'session-recordings'
+      ].includes('list')
+    );
+    assert.dom(`[href="${urls.sessionRecordings}"]`).exists();
+    assert.dom('[title="General"]').includesText(SESSION_RECORDING_TITLE);
+
     // Visit session recordings
-    await visit(urls.sessionRecordings);
+    await click(`[href="${urls.sessionRecordings}"]`);
     assert.strictEqual(currentURL(), urls.sessionRecordings);
   });
 
+  test('users cannot navigate to session-recordings without the list action', async function (assert) {
+    assert.expect(3);
+    instances.scopes.global.authorized_collection_actions[
+      'session-recordings'
+    ] = [];
+
+    await visit(urls.globalScope);
+
+    assert.false(
+      instances.scopes.global.authorized_collection_actions[
+        'session-recordings'
+      ].includes('list')
+    );
+    assert.dom('[title="General"]').doesNotIncludeText(SESSION_RECORDING_TITLE);
+    assert.dom(`[href="${urls.sessionRecordings}"]`).doesNotExist();
+  });
+
   // TODO: When we add abilities to session-recordings this test will be refactor to account for it.
   test('user can navigate to a session recording', async function (assert) {
     assert.expect(2);