Icu 9226 disable all actions for ldap accounts within users (#1688)

* refactor: 💡 disable all actions for ldap accounts within users

✅ Closes: ICU-9226

ui/admin/app/components/auth-methods/auth-method/accounts/account/actions/index.hbs

@@ -3,7 +3,7 @@
   SPDX-License-Identifier: MPL-2.0
 }}
 
-{{#if (can 'delete model' @model)}}
+{{#if (can 'delete account' @model)}}
   <Rose::Dropdown
     @text={{t 'actions.manage'}}
     @dropdownRight={{true}}

ui/admin/app/components/auth-methods/auth-method/actions/index.hbs

@@ -81,7 +81,7 @@
     {{/if}}
   {{/if}}
 
-  {{#if (can 'delete model' @model)}}
+  {{#if (can 'delete auth-method' @model)}}
     <dropdown.separator />
     <dropdown.button
       @style='danger'

ui/admin/app/components/form/user/add-accounts/index.hbs

@@ -30,11 +30,13 @@
         {{#each this.filteredAccounts as |account|}}
           <body.row as |row|>
             <row.cell>
-              <form.checkbox
+              <Hds::Form::Checkbox::Field
-                @label={{account.id}}
+                {{on 'change' (fn this.toggleAccount account)}}
-                @description={{account.description}}
+                as |F|
-                @onChange={{fn this.toggleAccount account}}
+              >
-              />
+                <F.Label>{{account.id}}</F.Label>
+                <F.HelperText>{{account.description}}</F.HelperText>
+              </Hds::Form::Checkbox::Field>
             </row.cell>
             <row.cell>{{account.accountName}}</row.cell>
             <row.cell>

ui/admin/app/components/form/user/add-accounts/index.js

@@ -4,12 +4,13 @@
  */
 
 import Component from '@glimmer/component';
-import { computed, action } from '@ember/object';
+import { action } from '@ember/object';
 import { A } from '@ember/array';
+import { inject as service } from '@ember/service';
 
 export default class FormUserAddAccountsComponent extends Component {
   // =properties
-
+  @service can;
   /**
    * Array of selected account IDs.
    * @type {EmberArray}
@@ -21,7 +22,6 @@ export default class FormUserAddAccountsComponent extends Component {
    * @param {[AccountModel]} filteredAccounts
    * @type {boolean}
    */
-  @computed('filteredAccounts.length')
   get hasAvailableAccounts() {
     return this.filteredAccounts.length > 0;
   }
@@ -30,12 +30,13 @@ export default class FormUserAddAccountsComponent extends Component {
    * Accounts not already added to the user.
    * @type {[AccountModel]}
    */
-  @computed('args.{accounts.[],model.account_ids.[]}')
   get filteredAccounts() {
     // Get IDs for accounts already added to the current user
     const alreadyAddedAccountIDs = this.args.model.account_ids;
     const notAddedAccounts = this.args.accounts.filter(
-      ({ id }) => !alreadyAddedAccountIDs.includes(id)
+      (account) =>
+        !alreadyAddedAccountIDs.includes(account.id) &&
+        this.can.can('addAccount user', this.args.model, { account })
     );
     return notAddedAccounts;
   }

ui/admin/app/routes/scopes/scope/users/user/add-accounts.js

@@ -27,8 +27,8 @@ export default class ScopesScopeUsersUserAddAccountsRoute extends Route {
   }
 
   /**
-   * Returns the current target, all host catalogs, and all host sets.
+   * Returns the current user, all auth methods, and all accounts.
-   * @return {{target: TargetModel, hostCatalogs: [HostCatalogModel], hostSets: [HostSetModel]}}
+   * @return {{user: UserModel, authMethods: [AuthMethodModel], accounts: [AccountModel]}}
    */
   async model() {
     const user = this.modelFor('scopes.scope.users.user');

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs

@@ -41,7 +41,7 @@
             {{#each @model.accounts as |account|}}
               <body.row as |row|>
                 <row.headerCell scope='row'>
-                  {{#if (can 'read model' account)}}
+                  {{#if (can 'read account' account)}}
                     <LinkTo
                       @route='scopes.scope.auth-methods.auth-method.accounts.account'
                       @model={{account.id}}
@@ -95,7 +95,7 @@
             {{#each @model.accounts as |account|}}
               <body.row as |row|>
                 <row.headerCell>
-                  {{#if (can 'read model' account)}}
+                  {{#if (can 'read account' account)}}
                     <LinkTo
                       @route='scopes.scope.auth-methods.auth-method.accounts.account'
                       @model={{account.id}}

ui/admin/app/templates/scopes/scope/users/user/accounts.hbs

@@ -59,7 +59,7 @@
                 </Copyable>
               </row.cell>
               <row.cell>
-                {{#if (can 'removeAccounts user' @model.user)}}
+                {{#if (can 'removeAccount user' @model.user account=account)}}
                   <Rose::Dropdown
                     @icon='flight-icons/svg/more-horizontal-16'
                     @iconOnly={{true}}

ui/admin/tests/acceptance/users/accounts-test.js

@@ -4,7 +4,7 @@
  */
 
 import { module, test } from 'qunit';
-import { visit, currentURL, click, find, findAll } from '@ember/test-helpers';
+import { visit, currentURL, click } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import a11yAudit from 'ember-a11y-testing/test-support/audit';
@@ -15,11 +15,27 @@ import {
   //currentSession,
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
+import { TYPE_AUTH_METHOD_LDAP } from 'api/models/auth-method';
 
 module('Acceptance | users | accounts', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
+  let accountsCount;
+  let features;
+
+  const ACCOUNTS_ACTION_SELECTOR =
+    'tbody .rose-table-row:nth-child(1) .rose-table-cell:last-child .rose-dropdown';
+  const ACCOUNTS_TYPE_SELECTOR =
+    'tbody .rose-table-row:nth-child(1) .rose-table-cell';
+  const ADD_ACCOUNTS_ACTION_SELECTOR = '.rose-layout-page-actions a';
+  const ERROR_MSG_SELECTOR = '[role="alert"]';
+  const TABLE_ROWS_SELECTOR = 'tbody tr';
+  const CHECKBOX_SELECTOR = 'tbody label';
+  const SUBMIT_BTN_SELECTOR = 'form [type="submit"]';
+  const CANCEL_BTN_SELECTOR = 'form [type="button"]';
+  const REMOVE_ACTION_SELECTOR = 'tbody tr .rose-dropdown-button-danger';
+
   const instances = {
     scopes: {
       global: null,
@@ -27,14 +43,13 @@ module('Acceptance | users | accounts', function (hooks) {
     },
     user: null,
   };
+
   const urls = {
-    orgScope: null,
     users: null,
     user: null,
     accounts: null,
     addAccounts: null,
   };
-  let accountsCount;
 
   hooks.beforeEach(function () {
     authenticateSession({});
@@ -50,28 +65,35 @@ module('Acceptance | users | accounts', function (hooks) {
       },
       'withAccountsAndUsersAndManagedGroups'
     );
-    instances.user = this.server.schema.users.all().models[0];
+    instances.user = this.server.schema.users.first();
     accountsCount = instances.user.accountIds.length;
     urls.users = `/scopes/${instances.scopes.org.id}/users`;
     urls.user = `${urls.users}/${instances.user.id}`;
     urls.accounts = `${urls.user}/accounts`;
     urls.addAccounts = `${urls.user}/add-accounts`;
+
+    features = this.owner.lookup('service:features');
   });
 
   test('visiting user accounts', async function (assert) {
     assert.expect(2);
-    await visit(urls.accounts);
+    await visit(urls.user);
+
+    await click(`[href="${urls.accounts}"]`);
     await a11yAudit();
+
     assert.strictEqual(currentURL(), urls.accounts);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount });
   });
 
   test('can remove an account', async function (assert) {
     assert.expect(2);
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount);
+
-    await click('tbody tr .rose-dropdown-button-danger');
+    await click(`[href="${urls.accounts}"]`);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount - 1);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount });
+    await click(REMOVE_ACTION_SELECTOR);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount - 1 });
   });
 
   test('cannot remove an account without proper authorization', async function (assert) {
@@ -80,8 +102,52 @@ module('Acceptance | users | accounts', function (hooks) {
       (item) => item !== 'remove-accounts'
     );
     instances.user.update({ authorized_actions });
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+
+    await click(`[href="${urls.accounts}"]`);
+
+    assert.dom(REMOVE_ACTION_SELECTOR).doesNotExist();
+  });
+
+  test('cannot remove an ldap account when feature flag disabled', async function (assert) {
+    assert.expect(2);
+    const authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+    });
+    const { id } = this.server.create('account', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+      authMethod,
+    });
+    instances.user.update({ accountIds: [id] });
+    await visit(urls.user);
+
+    await click(`[href="${urls.accounts}"]`);
+
+    assert.dom(ACCOUNTS_ACTION_SELECTOR).doesNotExist();
+    assert.dom(ACCOUNTS_TYPE_SELECTOR).hasText('LDAP');
+  });
+
+  test('can remove an ldap account when feature flag enabled', async function (assert) {
+    assert.expect(2);
+    features.enable('ldap-auth-methods');
+    const authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+    });
+    const { id } = this.server.create('account', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+      authMethod,
+    });
+    instances.user.update({ accountIds: [id] });
+    await visit(urls.user);
+
+    await click(`[href="${urls.accounts}"]`);
+
+    assert.dom(ACCOUNTS_ACTION_SELECTOR).exists();
+    assert.dom(ACCOUNTS_TYPE_SELECTOR).hasText('LDAP');
   });
 
   test('shows error message on account remove', async function (assert) {
@@ -98,24 +164,31 @@ module('Acceptance | users | accounts', function (hooks) {
         }
       );
     });
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount);
+
-    await click('tbody tr .rose-dropdown-button-danger');
+    await click(`[href="${urls.accounts}"]`);
-    assert.ok(find('[role="alert"]'));
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount });
+    await click(REMOVE_ACTION_SELECTOR);
+    assert.dom(ERROR_MSG_SELECTOR).isVisible();
   });
 
   test('visiting account add accounts', async function (assert) {
     assert.expect(1);
-    await visit(urls.addAccounts);
+    await visit(urls.accounts);
-    await visit(urls.addAccounts);
+
+    await click(ADD_ACCOUNTS_ACTION_SELECTOR);
     await a11yAudit();
+
     assert.strictEqual(currentURL(), urls.addAccounts);
   });
 
   test('can navigate to add accounts with proper authorization', async function (assert) {
     assert.expect(1);
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.ok(find(`[href="${urls.addAccounts}"]`));
+
+    await click(`[href="${urls.accounts}"]`);
+
+    assert.dom(`[href="${urls.addAccounts}"]`).exists();
   });
 
   test('cannot navigate to add accounts without proper authorization', async function (assert) {
@@ -124,38 +197,93 @@ module('Acceptance | users | accounts', function (hooks) {
       (item) => item !== 'add-accounts'
     );
     instances.user.update({ authorized_actions });
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.notOk(find(`[href="${urls.addAccounts}"]`));
+
+    await click(`[href="${urls.accounts}"]`);
+    assert.dom(ADD_ACCOUNTS_ACTION_SELECTOR).doesNotExist();
+  });
+
+  test('cannot add ldap accounts to user when feature flag is disabled', async function (assert) {
+    assert.expect(1);
+    const authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+    });
+    this.server.create('account', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+      authMethod,
+    });
+    const accountsAvailableCount =
+      this.server.schema.accounts.all().length -
+      instances.user.accountIds.length;
+    await visit(urls.user);
+
+    await click(`[href="${urls.accounts}"]`);
+    await click(ADD_ACCOUNTS_ACTION_SELECTOR);
+
+    assert
+      .dom(TABLE_ROWS_SELECTOR)
+      .exists({ count: accountsAvailableCount - 1 });
+  });
+
+  test('can add ldap accounts to user when feature flag is enabled', async function (assert) {
+    assert.expect(1);
+    features.enable('ldap-auth-methods');
+    const authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+    });
+    this.server.create('account', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_LDAP,
+      authMethod,
+    });
+    const accountsAvailableCount =
+      this.server.schema.accounts.all().length -
+      instances.user.accountIds.length;
+    await visit(urls.user);
+
+    await click(`[href="${urls.accounts}"]`);
+    await click(ADD_ACCOUNTS_ACTION_SELECTOR);
+
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsAvailableCount });
   });
 
   test('select and save accounts to add', async function (assert) {
-    assert.expect(3);
+    assert.expect(4);
     instances.user.update({ accountIds: [] });
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.strictEqual(findAll('tbody tr').length, 0);
+
-    await click('.rose-layout-page-actions a');
+    await click(`[href="${urls.accounts}"]`);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: 0 });
+    await click(ADD_ACCOUNTS_ACTION_SELECTOR);
     assert.strictEqual(currentURL(), urls.addAccounts);
     // Click three times to select, unselect, then reselect (for coverage)
-    await click('tbody label');
+    await click(CHECKBOX_SELECTOR);
-    await click('tbody label');
+    await click(CHECKBOX_SELECTOR);
-    await click('tbody label');
+    await click(CHECKBOX_SELECTOR);
-    await click('form [type="submit"]');
+    await click(SUBMIT_BTN_SELECTOR);
     await visit(urls.accounts);
-    assert.strictEqual(findAll('tbody tr').length, 1);
+
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: 1 });
+    assert.strictEqual(instances.user.accountIds.length, 1);
   });
 
   test('select and cancel accounts to add', async function (assert) {
     assert.expect(4);
-    await visit(urls.accounts);
+    await visit(urls.user);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount);
+
-    await click('tbody tr .rose-dropdown-button-danger');
+    await click(`[href="${urls.accounts}"]`);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount - 1);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount });
-    await click('.rose-layout-page-actions a');
+    await click(REMOVE_ACTION_SELECTOR);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount - 1 });
+    await click(ADD_ACCOUNTS_ACTION_SELECTOR);
     assert.strictEqual(currentURL(), urls.addAccounts);
-    await click('tbody label');
+    await click(CHECKBOX_SELECTOR);
-    await click('form [type="button"]');
+    await click(CANCEL_BTN_SELECTOR);
     await visit(urls.accounts);
-    assert.strictEqual(findAll('tbody tr').length, accountsCount - 1);
+    assert.dom(TABLE_ROWS_SELECTOR).exists({ count: accountsCount - 1 });
   });
 
   test('shows error message on account add', async function (assert) {
@@ -174,8 +302,8 @@ module('Acceptance | users | accounts', function (hooks) {
     });
     instances.user.update({ accountIds: [] });
     await visit(urls.addAccounts);
-    await click('tbody label');
+    await click(CHECKBOX_SELECTOR);
-    await click('form [type="submit"]');
+    await click(SUBMIT_BTN_SELECTOR);
-    assert.ok(find('[role="alert"]'));
+    assert.dom(ERROR_MSG_SELECTOR).isVisible();
   });
 });