fix: 🐛 Add read:self permission for sessions in ability check (#1974)

addons/api/addon/abilities/session.js

@@ -18,6 +18,9 @@ export default class SessionAbility extends ModelAbility {
    * @type {boolean}
    */
   get canRead() {
-    return (this.model.isActive || this.model.isPending) && super.canRead;
+    return (
+      (this.model.isActive || this.model.isPending) &&
+      (this.hasAuthorizedAction('read:self') || super.canRead)
+    );
   }
 }

addons/api/tests/unit/abilities/session-test.js

@@ -97,4 +97,15 @@ module('Unit | Ability | session', function (hooks) {
 
     assert.false(canService.can('read session', session));
   });
+
+  test('can read a session that has read:self', function (assert) {
+    assert.expect(1);
+
+    const session = store.createRecord('session', {
+      authorized_actions: ['read:self'],
+      status: STATUS_SESSION_ACTIVE,
+    });
+
+    assert.true(canService.can('read session', session));
+  });
 });

ui/desktop/tests/acceptance/projects/sessions/index-test.js

@@ -189,6 +189,26 @@ module('Acceptance | projects | sessions', function (hooks) {
       .isVisible();
   });
 
+  test('can link to an active session with read:self permissions', async function (assert) {
+    assert.expect(1);
+    this.server.schema.sessions.all().destroy();
+    this.server.create('session', {
+      authorized_actions: ['read:self'],
+      scope: instances.scopes.project,
+      target: instances.target,
+      status: STATUS_SESSION_ACTIVE,
+      user: instances.user,
+    });
+
+    await visit(urls.sessions);
+
+    assert
+      .dom(
+        'tbody tr:first-child td:first-child [data-test-session-detail-link]'
+      )
+      .isVisible();
+  });
+
   test('can link to a pending session', async function (assert) {
     assert.expect(1);
     instances.session.update({ status: STATUS_SESSION_PENDING });