chore: 🤖 add role readPrincipal ability (#1540)

addons/api/addon/abilities/managed-group.js

@@ -0,0 +1,8 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for managed groups.
+ */
+export default class ManagedGroupAbility extends ModelAbility {
+  // no op
+}

addons/api/addon/abilities/role.js

@@ -1,9 +1,18 @@
 import ModelAbility from './model';
+import { inject as service } from '@ember/service';
+
+class InvalidRolePrincipalTypeError extends Error {
+  name = 'InvalidRolePrincipalTypeError';
+}
 
 /**
  * Provides abilities for roles.
  */
 export default class RoleAbility extends ModelAbility {
+  // =services
+
+  @service can;
+
   // =permissions
 
   /**
@@ -26,4 +35,22 @@ export default class RoleAbility extends ModelAbility {
   get canRemovePrincipals() {
     return this.hasAuthorizedAction('remove-principals');
   }
+
+  /**
+   * Returns the ability check for a principal model instance.
+   * Valid role principal models are: User, Group, and ManagedGroup.
+   * Throws an error if the principal type is invalid.
+   * @type {boolean}
+   * @throws {InvalidRolePrincipalTypeError}
+   */
+  get canReadPrincipal() {
+    const type = this.model.constructor.modelName;
+    const typeIsValid =
+      type === 'user' || type === 'group' || type === 'managed-group';
+    if (!typeIsValid)
+      throw new InvalidRolePrincipalTypeError(
+        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`
+      );
+    return this.can.can(`read ${type}`, this.model);
+  }
 }

addons/api/app/abilities/managed-group.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/managed-group';

addons/api/tests/unit/abilities/role-test.js

@@ -10,9 +10,9 @@ module('Unit | Abilities | Role', function (hooks) {
     const model = {
       authorized_actions: ['set-grants'],
     };
-    assert.ok(service.can('setGrants role', model));
+    assert.true(service.can('setGrants role', model));
     model.authorized_actions = [];
-    assert.notOk(service.can('setGrants role', model));
+    assert.false(service.can('setGrants role', model));
   });
 
   test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
@@ -21,9 +21,9 @@ module('Unit | Abilities | Role', function (hooks) {
     const model = {
       authorized_actions: ['add-principals'],
     };
-    assert.ok(service.can('addPrincipals role', model));
+    assert.true(service.can('addPrincipals role', model));
     model.authorized_actions = [];
-    assert.notOk(service.can('addPrincipals role', model));
+    assert.false(service.can('addPrincipals role', model));
   });
 
   test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
@@ -32,8 +32,47 @@ module('Unit | Abilities | Role', function (hooks) {
     const model = {
       authorized_actions: ['remove-principals'],
     };
-    assert.ok(service.can('removePrincipals role', model));
+    assert.true(service.can('removePrincipals role', model));
     model.authorized_actions = [];
-    assert.notOk(service.can('removePrincipals role', model));
+    assert.false(service.can('removePrincipals role', model));
+  });
+
+  test('it proxies role principal read ability to the appropriate ability type', function (assert) {
+    assert.expect(6);
+    const service = this.owner.lookup('service:can');
+    const user = {
+      constructor: { modelName: 'user' },
+      authorized_actions: [],
+    };
+    const group = {
+      constructor: { modelName: 'group' },
+      authorized_actions: [],
+    };
+    const managedGroup = {
+      constructor: { modelName: 'managed-group' },
+      authorized_actions: [],
+    };
+    assert.false(service.can('readPrincipal role', user));
+    assert.false(service.can('readPrincipal role', group));
+    assert.false(service.can('readPrincipal role', managedGroup));
+    user.authorized_actions.push('read');
+    group.authorized_actions.push('read');
+    managedGroup.authorized_actions.push('read');
+    assert.true(service.can('readPrincipal role', user));
+    assert.true(service.can('readPrincipal role', group));
+    assert.true(service.can('readPrincipal role', managedGroup));
+  });
+
+  test('it throws an error for unknown principal types on principal read check', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const account = {
+      constructor: { modelName: 'account' },
+      authorized_actions: ['read'],
+    };
+    assert.throws(() => {
+      service.can('readPrincipal role', account);
+    });
+    assert.true(service.can('read account', account));
   });
 });