feat: 🎸 implement add- and remove-principals abilities

addons/api/addon/abilities/role.js

@@ -12,4 +12,18 @@ export default class RoleAbility extends ModelAbility {
   get canSetGrants() {
     return this.hasAuthorizedAction('set-grants');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
 }

addons/api/mirage/factories/role.js

@@ -10,6 +10,8 @@ export default factory.extend({
       'update',
       'delete',
       'set-grants',
+      'add-principals',
+      'remove-principals',
     ],
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [

addons/api/tests/unit/abilities/role-test.js

@@ -14,4 +14,26 @@ module('Unit | Abilities | Account', function (hooks) {
     model.authorized_actions = [];
     assert.notOk(service.can('setGrants role', model));
   });
+
+  test('it reflects when a given account may add principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-principals'],
+    };
+    assert.ok(service.can('addPrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addPrincipals role', model));
+  });
+
+  test('it reflects when a given account may remove principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-principals'],
+    };
+    assert.ok(service.can('removePrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removePrincipals role', model));
+  });
 });

ui/admin/app/templates/scopes/scope/roles/role/-actions.hbs

@@ -3,9 +3,11 @@
   @dropdownRight={{true}}
   as |dropdown|
 >
-  <dropdown.link @route='scopes.scope.roles.role.add-principals'>
-    {{t 'resources.role.principal.actions.add-principals'}}
-  </dropdown.link>
+  {{#if (can 'addPrincipals role' @model)}}
+    <dropdown.link @route='scopes.scope.roles.role.add-principals'>
+      {{t 'resources.role.principal.actions.add-principals'}}
+    </dropdown.link>
+  {{/if}}
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button

ui/admin/app/templates/scopes/scope/roles/role/principals.hbs

@@ -30,21 +30,26 @@
             </Copyable>
           </row.cell>
           <row.cell>
-            <Rose::Dropdown
-              @icon='flight-icons/svg/more-horizontal-16'
-              @iconOnly={{true}}
-              @showCaret={{false}}
-              @dropdownRight={{true}}
-              @text='{{t 'actions.manage'}}'
-              as |dropdown|
-            >
-              <dropdown.button
-                @style='danger'
-                {{on 'click' (route-action 'removePrincipal' principal.model)}}
+            {{#if (can 'removePrincipals role' @model.role)}}
+              <Rose::Dropdown
+                @icon='flight-icons/svg/more-horizontal-16'
+                @iconOnly={{true}}
+                @showCaret={{false}}
+                @dropdownRight={{true}}
+                @text='{{t 'actions.manage'}}'
+                as |dropdown|
               >
-                {{t 'actions.remove'}}
-              </dropdown.button>
-            </Rose::Dropdown>
+                <dropdown.button
+                  @style='danger'
+                  {{on
+                    'click'
+                    (route-action 'removePrincipal' principal.model)
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </dropdown.button>
+              </Rose::Dropdown>
+            {{/if}}
           </row.cell>
         </body.row>
       {{/each}}

ui/admin/tests/acceptance/roles/principals-test.js

@@ -69,6 +69,16 @@ module('Acceptance | roles | principals', function (hooks) {
     assert.equal(findAll('tbody tr').length, principalsCount - 1);
   });
 
+  test('principal cannot be removed from a role without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.role.authorized_actions.filter(
+      (item) => item !== 'remove-principals'
+    );
+    instances.role.update({ authorized_actions });
+    await visit(urls.rolePrincipals);
+    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+  });
+
   test('shows error message on principal remove', async function (assert) {
     assert.expect(2);
     this.server.post('/roles/:idMethod', () => {
@@ -89,6 +99,16 @@ module('Acceptance | roles | principals', function (hooks) {
     assert.ok(find('[role="alert"]'));
   });
 
+  test('cannot navigate to add principals without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.role.authorized_actions.filter(
+      (item) => item !== 'add-principals'
+    );
+    instances.role.update({ authorized_actions });
+    await visit(urls.rolePrincipals);
+    assert.notOk(find('.rose-layout-page-actions a'));
+  });
+
   test('select and save principals to add', async function (assert) {
     assert.expect(3);
     instances.role.update({ userIds: [], groupIds: [] });