feat: 🎸 implement user account association abilities

addons/api/addon/abilities/user.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for users.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddAccounts() {
+    return this.hasAuthorizedAction('add-accounts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveAccounts() {
+    return this.hasAuthorizedAction('remove-accounts');
+  }
+}

addons/api/app/abilities/user.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/user';

addons/api/mirage/factories/user.js

@@ -8,6 +8,8 @@ export default factory.extend({
       'read',
       'update',
       'delete',
+      'add-accounts',
+      'remove-accounts',
     ],
   id: (i) => `user-${i}`,
 });

addons/api/tests/unit/abilities/role-test.js

@@ -4,7 +4,7 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Abilities | Account', function (hooks) {
   setupTest(hooks);
 
-  test('it reflects when a given account may set grants based on authorized_actions', function (assert) {
+  test('it reflects when a given role may set grants based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
     const model = {
@@ -15,7 +15,7 @@ module('Unit | Abilities | Account', function (hooks) {
     assert.notOk(service.can('setGrants role', model));
   });
 
-  test('it reflects when a given account may add principals based on authorized_actions', function (assert) {
+  test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
     const model = {
@@ -26,7 +26,7 @@ module('Unit | Abilities | Account', function (hooks) {
     assert.notOk(service.can('addPrincipals role', model));
   });
 
-  test('it reflects when a given account may remove principals based on authorized_actions', function (assert) {
+  test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
     const model = {

addons/api/tests/unit/abilities/user-test.js

@@ -0,0 +1,28 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Abilities | Account', function (hooks) {
+  setupTest(hooks);
+
+  test('it reflects when a given user resource may add accounts based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-accounts'],
+    };
+    assert.ok(service.can('addAccounts user', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addAccounts user', model));
+  });
+
+  test('it reflects when a given user resource may remove accounts based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-accounts'],
+    };
+    assert.ok(service.can('removeAccounts user', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removeAccounts user', model));
+  });
+});

ui/admin/app/templates/scopes/scope/users/user/-actions.hbs

@@ -3,9 +3,11 @@
   @dropdownRight={{true}}
   as |dropdown|
 >
-  <dropdown.link @route='scopes.scope.users.user.add-accounts'>
-    {{t 'resources.user.actions.add-accounts'}}
-  </dropdown.link>
+  {{#if (can 'addAccounts user' @model)}}
+    <dropdown.link @route='scopes.scope.users.user.add-accounts'>
+      {{t 'resources.user.actions.add-accounts'}}
+    </dropdown.link>
+  {{/if}}
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button

ui/admin/app/templates/scopes/scope/users/user/accounts.hbs

@@ -33,24 +33,26 @@
             </Copyable>
           </row.cell>
           <row.cell>
-            <Rose::Dropdown
-              @icon='flight-icons/svg/more-horizontal-16'
-              @iconOnly={{true}}
-              @showCaret={{false}}
-              @dropdownRight={{true}}
-              @text='{{t 'actions.manage'}}'
-              as |dropdown|
-            >
-              <dropdown.button
-                @style='danger'
-                {{on
-                  'click'
-                  (route-action 'removeAccount' @model.user account)
-                }}
+            {{#if (can 'removeAccounts user' @model.user)}}
+              <Rose::Dropdown
+                @icon='flight-icons/svg/more-horizontal-16'
+                @iconOnly={{true}}
+                @showCaret={{false}}
+                @dropdownRight={{true}}
+                @text='{{t 'actions.manage'}}'
+                as |dropdown|
               >
-                {{t 'actions.remove'}}
-              </dropdown.button>
-            </Rose::Dropdown>
+                <dropdown.button
+                  @style='danger'
+                  {{on
+                    'click'
+                    (route-action 'removeAccount' @model.user account)
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </dropdown.button>
+              </Rose::Dropdown>
+            {{/if}}
           </row.cell>
         </body.row>
       {{/each}}

ui/admin/tests/acceptance/users/accounts-test.js

@@ -61,7 +61,7 @@ module('Acceptance | users | accounts', function (hooks) {
     assert.equal(findAll('tbody tr').length, accountsCount);
   });
 
-  test('can remove a account', async function (assert) {
+  test('can remove an account', async function (assert) {
     assert.expect(2);
     await visit(urls.accounts);
     assert.equal(findAll('tbody tr').length, accountsCount);
@@ -69,6 +69,16 @@ module('Acceptance | users | accounts', function (hooks) {
     assert.equal(findAll('tbody tr').length, accountsCount - 1);
   });
 
+  test('cannot remove an account without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.user.authorized_actions.filter(
+      (item) => item !== 'remove-accounts'
+    );
+    instances.user.update({ authorized_actions });
+    await visit(urls.accounts);
+    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+  });
+
   test('shows error message on account remove', async function (assert) {
     assert.expect(2);
     this.server.post('/users/:idMethod', () => {
@@ -92,10 +102,27 @@ module('Acceptance | users | accounts', function (hooks) {
   test('visiting account add accounts', async function (assert) {
     assert.expect(1);
     await visit(urls.addAccounts);
+    await visit(urls.addAccounts);
     await a11yAudit();
     assert.equal(currentURL(), urls.addAccounts);
   });
 
+  test('can navigate to add accounts without proper authorization', async function (assert) {
+    assert.expect(1);
+    await visit(urls.accounts);
+    assert.ok(find(`[href="${urls.addAccounts}"]`));
+  });
+
+  test('cannot navigate to add accounts without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.user.authorized_actions.filter(
+      (item) => item !== 'add-accounts'
+    );
+    instances.user.update({ authorized_actions });
+    await visit(urls.accounts);
+    assert.notOk(find(`[href="${urls.addAccounts}"]`));
+  });
+
   test('select and save accounts to add', async function (assert) {
     assert.expect(3);
     instances.user.update({ accountIds: [] });