From 8da8fddf293b0973d429fd82baf636272fa1e962 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Thu, 30 Sep 2021 16:04:02 -0400
Subject: [PATCH] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20implement=20add-=20and?=
 =?UTF-8?q?=20remove-principals=20abilities?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 addons/api/addon/abilities/role.js            | 14 ++++++++
 addons/api/mirage/factories/role.js           |  2 ++
 addons/api/tests/unit/abilities/role-test.js  | 22 +++++++++++++
 .../scopes/scope/roles/role/-actions.hbs      |  8 +++--
 .../scopes/scope/roles/role/principals.hbs    | 33 +++++++++++--------
 .../tests/acceptance/roles/principals-test.js | 20 +++++++++++
 6 files changed, 82 insertions(+), 17 deletions(-)

diff --git a/addons/api/addon/abilities/role.js b/addons/api/addon/abilities/role.js
index 9a8c71a12..f0c6d62ec 100644
--- a/addons/api/addon/abilities/role.js
+++ b/addons/api/addon/abilities/role.js
@@ -12,4 +12,18 @@ export default class RoleAbility extends ModelAbility {
   get canSetGrants() {
     return this.hasAuthorizedAction('set-grants');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
 }
diff --git a/addons/api/mirage/factories/role.js b/addons/api/mirage/factories/role.js
index da42cee79..be13712b8 100644
--- a/addons/api/mirage/factories/role.js
+++ b/addons/api/mirage/factories/role.js
@@ -10,6 +10,8 @@ export default factory.extend({
       'update',
       'delete',
       'set-grants',
+      'add-principals',
+      'remove-principals',
     ],
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [
diff --git a/addons/api/tests/unit/abilities/role-test.js b/addons/api/tests/unit/abilities/role-test.js
index f5428d85e..ffaf6a11d 100644
--- a/addons/api/tests/unit/abilities/role-test.js
+++ b/addons/api/tests/unit/abilities/role-test.js
@@ -14,4 +14,26 @@ module('Unit | Abilities | Account', function (hooks) {
     model.authorized_actions = [];
     assert.notOk(service.can('setGrants role', model));
   });
+
+  test('it reflects when a given account may add principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-principals'],
+    };
+    assert.ok(service.can('addPrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addPrincipals role', model));
+  });
+
+  test('it reflects when a given account may remove principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-principals'],
+    };
+    assert.ok(service.can('removePrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removePrincipals role', model));
+  });
 });
diff --git a/ui/admin/app/templates/scopes/scope/roles/role/-actions.hbs b/ui/admin/app/templates/scopes/scope/roles/role/-actions.hbs
index 88add065c..6c01fcc16 100644
--- a/ui/admin/app/templates/scopes/scope/roles/role/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/roles/role/-actions.hbs
@@ -3,9 +3,11 @@
   @dropdownRight={{true}}
   as |dropdown|
 >
-  <dropdown.link @route='scopes.scope.roles.role.add-principals'>
-    {{t 'resources.role.principal.actions.add-principals'}}
-  </dropdown.link>
+  {{#if (can 'addPrincipals role' @model)}}
+    <dropdown.link @route='scopes.scope.roles.role.add-principals'>
+      {{t 'resources.role.principal.actions.add-principals'}}
+    </dropdown.link>
+  {{/if}}
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button
diff --git a/ui/admin/app/templates/scopes/scope/roles/role/principals.hbs b/ui/admin/app/templates/scopes/scope/roles/role/principals.hbs
index fec27196f..6d491d46b 100644
--- a/ui/admin/app/templates/scopes/scope/roles/role/principals.hbs
+++ b/ui/admin/app/templates/scopes/scope/roles/role/principals.hbs
@@ -30,21 +30,26 @@
             </Copyable>
           </row.cell>
           <row.cell>
-            <Rose::Dropdown
-              @icon='flight-icons/svg/more-horizontal-16'
-              @iconOnly={{true}}
-              @showCaret={{false}}
-              @dropdownRight={{true}}
-              @text='{{t 'actions.manage'}}'
-              as |dropdown|
-            >
-              <dropdown.button
-                @style='danger'
-                {{on 'click' (route-action 'removePrincipal' principal.model)}}
+            {{#if (can 'removePrincipals role' @model.role)}}
+              <Rose::Dropdown
+                @icon='flight-icons/svg/more-horizontal-16'
+                @iconOnly={{true}}
+                @showCaret={{false}}
+                @dropdownRight={{true}}
+                @text='{{t 'actions.manage'}}'
+                as |dropdown|
               >
-                {{t 'actions.remove'}}
-              </dropdown.button>
-            </Rose::Dropdown>
+                <dropdown.button
+                  @style='danger'
+                  {{on
+                    'click'
+                    (route-action 'removePrincipal' principal.model)
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </dropdown.button>
+              </Rose::Dropdown>
+            {{/if}}
           </row.cell>
         </body.row>
       {{/each}}
diff --git a/ui/admin/tests/acceptance/roles/principals-test.js b/ui/admin/tests/acceptance/roles/principals-test.js
index b26cfe398..998c9acc5 100644
--- a/ui/admin/tests/acceptance/roles/principals-test.js
+++ b/ui/admin/tests/acceptance/roles/principals-test.js
@@ -69,6 +69,16 @@ module('Acceptance | roles | principals', function (hooks) {
     assert.equal(findAll('tbody tr').length, principalsCount - 1);
   });
 
+  test('principal cannot be removed from a role without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.role.authorized_actions.filter(
+      (item) => item !== 'remove-principals'
+    );
+    instances.role.update({ authorized_actions });
+    await visit(urls.rolePrincipals);
+    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+  });
+
   test('shows error message on principal remove', async function (assert) {
     assert.expect(2);
     this.server.post('/roles/:idMethod', () => {
@@ -89,6 +99,16 @@ module('Acceptance | roles | principals', function (hooks) {
     assert.ok(find('[role="alert"]'));
   });
 
+  test('cannot navigate to add principals without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.role.authorized_actions.filter(
+      (item) => item !== 'add-principals'
+    );
+    instances.role.update({ authorized_actions });
+    await visit(urls.rolePrincipals);
+    assert.notOk(find('.rose-layout-page-actions a'));
+  });
+
   test('select and save principals to add', async function (assert) {
     assert.expect(3);
     instances.role.update({ userIds: [], groupIds: [] });