feat: 🎸 add No scopes add to roles/role/scopes route (#2338)

* feat: 🎸 add No scopes add to roles/role/scopes route

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-13878

* feat: 🎸 add new role ability

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-13878

* refactor: 💡 fix permission for setting grant scopes on role

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-13878

addons/api/addon/abilities/role.js

@@ -27,6 +27,13 @@ export default class RoleAbility extends ModelAbility {
     return this.hasAuthorizedAction('set-grants');
   }
 
+  /**
+   * @type {boolean}
+   */
+  get canSetGrantScopes() {
+    return this.hasAuthorizedAction('set-grant-scopes');
+  }
+
   /**
    * @type {boolean}
    */

addons/api/mirage/factories/role.js

@@ -18,6 +18,7 @@ export default factory.extend({
       'set-grants',
       'add-principals',
       'remove-principals',
+      'set-grant-scopes',
     ],
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [

addons/api/mirage/serializers/role.js

@@ -38,11 +38,6 @@ export default ApplicationSerializer.extend({
 
     if (!json.principals.length) delete json.principals;
 
-    // default grant scopes
-    if (json.grant_scope_ids.length === 0) {
-      json.grant_scope_ids = ['this'];
-    }
-
     return json;
   },
 });

addons/api/tests/unit/abilities/role-test.js

@@ -75,4 +75,14 @@ module('Unit | Abilities | Role', function (hooks) {
     });
     assert.true(service.can('read account', account));
   });
+
+  test('can set grant scopes based on authorized_actions', function (assert) {
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['set-grant-scopes'],
+    };
+    assert.true(service.can('setGrantScopes role', model));
+    model.authorized_actions = [];
+    assert.false(service.can('setGrantScopes role', model));
+  });
 });

addons/core/translations/resources/en-us.yaml

@@ -570,6 +570,10 @@ role:
     titles:
       parent_scope: Parent scope
       resource_type: Resource type
+    messages:
+      title: No scopes added
+      description: You haven’t added any scopes to this role’s grant sets.
+      action: Add scopes to this role
     keywords:
       this:
         sub-title: This scope

ui/admin/app/routes/scopes/scope/roles/role/scopes.js

@@ -9,7 +9,10 @@ export default class ScopesScopeRolesRoleScopesRoute extends Route {
 
   async model() {
     const role = this.modelFor('scopes.scope.roles.role');
-    if (!GRANT_SCOPE_KEYWORDS.some((id) => role.grant_scope_ids.includes(id))) {
+    if (
+      role.grant_scope_ids &&
+      !GRANT_SCOPE_KEYWORDS.some((id) => role.grant_scope_ids.includes(id))
+    ) {
       await this.store.query('scope', {
         scope_id: role.scope.id,
         recursive: true,

ui/admin/app/styles/app.scss

@@ -1036,3 +1036,10 @@
 .loading-indicator {
   margin-top: 20%;
 }
+
+// Roles
+.role-grant-scopes {
+  .hds-application-state {
+    margin-top: 3rem;
+  }
+}

ui/admin/app/templates/scopes/scope/roles/role/scopes.hbs

@@ -40,7 +40,7 @@
     <Roles::Role::Nav @model={{@model}} />
   </page.navigation>
 
-  <page.body>
+  <page.body class='role-grant-scopes'>
     {{#if @model.grant_scope_ids}}
       <Hds::Table
         @model={{@model.grantScopes}}
@@ -147,6 +147,21 @@
           </B.Tr>
         </:body>
       </Hds::Table>
+    {{else}}
+      <Hds::ApplicationState as |A|>
+        <A.Header @title={{t 'resources.role.scope.messages.title'}} />
+        <A.Body @text={{t 'resources.role.scope.messages.description'}} />
+        {{#if (can 'setGrantScopes role' @model)}}
+          <A.Footer as |F|>
+            {{! TODO: Update route to manage-scopes once it is implemented }}
+            <F.Link::Standalone
+              @icon='plus-circle'
+              @text={{t 'resources.role.scope.messages.action'}}
+              @route='scopes.scope.roles.role.scopes'
+            />
+          </A.Footer>
+        {{/if}}
+      </Hds::ApplicationState>
     {{/if}}
 
   </page.body>

ui/admin/tests/acceptance/roles/scopes-test.js

@@ -75,4 +75,22 @@ module('Acceptance | roles | scopes', function (hooks) {
       `/scopes/${instances.scopes.global.id}/scopes`,
     );
   });
+
+  test('user sees no scopes message and action when role has no grant scopes', async function (assert) {
+    instances.role.update({ grant_scope_ids: [] });
+    await visit(urls.roleScopes);
+    assert.dom('.role-grant-scopes div').includesText('No scopes added');
+    assert.dom('.role-grant-scopes div div:nth-child(3) a').isVisible();
+  });
+
+  test('user does not see action to add scopes when role has no grant scopes without proper permissions', async function (assert) {
+    instances.role.update({
+      grant_scope_ids: [],
+      authorized_actions: instances.role.authorized_actions.filter(
+        (action) => action !== 'set-grant-scopes',
+      ),
+    });
+    await visit(urls.roleScopes);
+    assert.dom('.role-grant-scopes div div:nth-child(3) a').doesNotExist();
+  });
 });