feat: 🎸 implement add- and remove-principals abilities

addons/api/addon/abilities/role.js

@@ -12,4 +12,18 @@ export default class RoleAbility extends ModelAbility {
   get canSetGrants() {
     return this.hasAuthorizedAction('set-grants');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
 }

addons/api/mirage/factories/role.js

@@ -10,6 +10,8 @@ export default factory.extend({
       'update',
       'delete',
       'set-grants',
+      'add-principals',
+      'remove-principals',
     ],
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [

addons/api/tests/unit/abilities/role-test.js

@@ -14,4 +14,26 @@ module('Unit | Abilities | Account', function (hooks) {
     model.authorized_actions = [];
     assert.notOk(service.can('setGrants role', model));
   });
+
+  test('it reflects when a given account may add principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-principals'],
+    };
+    assert.ok(service.can('addPrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addPrincipals role', model));
+  });
+
+  test('it reflects when a given account may remove principals based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-principals'],
+    };
+    assert.ok(service.can('removePrincipals role', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removePrincipals role', model));
+  });
 });