Merge pull request #760 from hashicorp/feature-authorize-session-capability

feat: 🎸 add connect target capability UI

addons/api/addon/abilities/target.js

@@ -0,0 +1,15 @@
+import ModelAbility from './model';
+
+/**
+ * Provides a `connect` ability for targets.
+ */
+export default class TargetAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canConnect() {
+    return this.hasAuthorizedAction('authorize-session');
+  }
+}

addons/api/app/abilities/target.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/target';

addons/api/mirage/factories/target.js

@@ -13,6 +13,7 @@ export default factory.extend({
       'read',
       'update',
       'delete',
+      'authorize-session',
     ],
   /**
    * -1 means "unlimited" and we want to generate these on occasion.

addons/api/tests/unit/abilities/target-test.js

@@ -0,0 +1,17 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Abilities | Target', function (hooks) {
+  setupTest(hooks);
+
+  test('it reflects when a given target may connect based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['authorize-session'],
+    };
+    assert.ok(service.can('connect target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('connect target', model));
+  });
+});

ui/desktop/app/templates/scopes/scope/projects/targets/index.hbs

@@ -74,12 +74,14 @@
                 </Rose::Badge>
               </row.cell>
               <row.cell>
-                <Rose::Button
-                  @style='secondary'
-                  {{on 'click' (route-action 'connect' model)}}
-                >
-                  {{t 'resources.session.actions.connect'}}
-                </Rose::Button>
+                {{#if (can 'connect target' model)}}
+                  <Rose::Button
+                    @style='secondary'
+                    {{on 'click' (route-action 'connect' model)}}
+                  >
+                    {{t 'resources.session.actions.connect'}}
+                  </Rose::Button>
+                {{/if}}
               </row.cell>
             </body.row>
           {{/each}}

ui/desktop/tests/acceptance/projects/targets-test.js

@@ -100,7 +100,9 @@ module('Acceptance | projects | targets', function (hooks) {
     );
     instances.target = this.server.create(
       'target',
-      { scope: instances.scopes.project },
+      {
+        scope: instances.scopes.project,
+      },
       'withAssociations'
     );
 
@@ -253,6 +255,24 @@ module('Acceptance | projects | targets', function (hooks) {
     await visit(urls.targets);
   });
 
+  test('cannot connect to a target without proper authorization', async function (assert) {
+    assert.expect(3);
+    instances.target.update({
+      authorized_actions: instances.target.authorized_actions.filter(
+        (action) => action != 'authorize-session'
+      ),
+    });
+    assert.notOk(
+      instances.target.authorized_actions.includes('authorize-session')
+    );
+    later(async () => {
+      run.cancelTimers();
+      assert.ok(find('tbody tr:first-child'));
+      assert.notOk(find('tbody tr:first-child td:last-child button'));
+    }, 750);
+    await visit(urls.targets);
+  });
+
   test('handles cli error on connect', async function (assert) {
     assert.expect(4);
     stubs.ipcService.withArgs('cliExists').returns(true);