Merge pull request #589 from hashicorp/feature-oidc-accounts

Feature oidc accounts

addons/api/addon/models/account.js

@@ -17,6 +17,11 @@ export default class AccountModel extends GeneratedAccountModel {
    */
   @equal('type', 'password') isPassword;
 
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'oidc') isOIDC;
+
   /**
    * Convenience for getting username in account.
    * @type {string}

addons/api/addon/models/fragment-account-attributes.js

@@ -2,8 +2,16 @@ import Fragment from 'ember-data-model-fragments/fragment';
 import { attr } from '@ember-data/model';
 
 export default class FragmentAccountAttributesModel extends Fragment {
+  // =attributes (password)
   @attr('string', {
+    for: 'password',
     description: 'The account login name',
   })
   login_name;
+
+  // =attributes (OIDC)
+  @attr('string', { for: 'oidc' }) subject;
+  @attr('string', { for: 'oidc' }) issuer;
+  @attr('string', { for: 'oidc', readOnly: true }) email;
+  @attr('string', { for: 'oidc', readOnly: true }) full_name;
 }

addons/api/addon/serializers/account.js

@@ -20,13 +20,36 @@ export default class AccountSerializer extends ApplicationSerializer {
    * @return {object}
    */
   serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'password':
+        return this.serializePassword(...arguments);
+    }
+  }
+
+  /**
+   * Password serialization omits `attributes` and handles password-related
+   * custom methods.
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serializePassword(snapshot) {
     const password = snapshot?.adapterOptions?.password;
     let serialized = super.serialize(...arguments);
+    // Only login_name is serialized into password attributes.
+    const { login_name } = serialized.attributes;
+    if (login_name) {
+      serialized.attributes = { login_name };
+    } else {
+      serialized.attributes = {};
+    }
+    // New record case
     if (password && snapshot?.record?.isNew)
       serialized.attributes.password = password;
+    // Set password custom method
     if (snapshot?.adapterOptions?.method === 'set-password') {
       serialized = this.serializeForSetPassword(snapshot, password);
     }
+    // Change password custom method
     if (snapshot?.adapterOptions?.method === 'change-password') {
       const { currentPassword, newPassword } = snapshot?.adapterOptions;
       serialized = this.serializeForChangePassword(

addons/api/addon/serializers/fragment-account-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAccountAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/app/serializers/fragment-account-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-account-attributes';

addons/api/tests/unit/serializers/fragment-account-attributes-test.js

@@ -0,0 +1,23 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Serializer | fragment account attributes', function (hooks) {
+  setupTest(hooks);
+
+  // Replace this with your real tests.
+  test('it exists', function (assert) {
+    let store = this.owner.lookup('service:store');
+    let serializer = store.serializerFor('fragment-account-attributes');
+
+    assert.ok(serializer);
+  });
+
+  test('it serializes records', function (assert) {
+    let store = this.owner.lookup('service:store');
+    let record = store.createRecord('fragment-account-attributes', {});
+
+    let serializedRecord = record.serialize();
+
+    assert.ok(serializedRecord);
+  });
+});

addons/core/translations/form/en-us.yaml

@@ -100,3 +100,9 @@ signing_algorithms:
   help: The signing algorithms allowed for the auth method.
 algorithm:
   label: Algorithm
+subject:
+  label: Subject
+email:
+  label: Email
+full_name:
+  label: Full Name

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs

@@ -37,14 +37,6 @@
   as |dropdown|
 >
   {{#if (feature-flag 'primary-auth-method')}}
-    {{#unless @model.isPrimary}}
-      <dropdown.button
-        @disabled={{@model.canSave}}
-        {{on 'click' (route-action 'makePrimary' @model)}}
-      >
-        {{t 'resources.auth-method.actions.make-primary'}}
-      </dropdown.button>
-    {{/unless}}
     {{#if @model.isPrimary}}
       <dropdown.button
         @disabled={{@model.canSave}}
@@ -52,14 +44,32 @@
       >
         {{t 'resources.auth-method.actions.remove-as-primary'}}
       </dropdown.button>
+    {{else}}
+      <dropdown.button
+        @disabled={{@model.canSave}}
+        {{on 'click' (route-action 'makePrimary' @model)}}
+      >
+        {{t 'resources.auth-method.actions.make-primary'}}
+      </dropdown.button>
     {{/if}}
   {{/if}}
-  <dropdown.link
-    @route='scopes.scope.auth-methods.auth-method.accounts.new'
-    @model={{@model}}
-  >
-    {{t 'resources.account.actions.create'}}
-  </dropdown.link>
+  {{#if @model.isOIDC}}
+    {{#if (feature-flag 'oidc-account-crud')}}
+      <dropdown.link
+        @route='scopes.scope.auth-methods.auth-method.accounts.new'
+        @model={{@model}}
+      >
+        {{t 'resources.account.actions.create'}}
+      </dropdown.link>
+    {{/if}}
+  {{else}}
+    <dropdown.link
+      @route='scopes.scope.auth-methods.auth-method.accounts.new'
+      @model={{@model}}
+    >
+      {{t 'resources.account.actions.create'}}
+    </dropdown.link>
+  {{/if}}
   <dropdown.separator />
   <dropdown.button
     @style='danger'

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs

@@ -2,15 +2,7 @@
   <nav.link @route='scopes.scope.auth-methods.auth-method.index'>
     {{t 'titles.details'}}
   </nav.link>
-  {{#if @model.isOIDC}}
-    {{#if (feature-flag 'oidc-account-crud')}}
-      <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
-        {{t 'resources.account.title_plural'}}
-      </nav.link>
-    {{/if}}
-  {{else}}
-    <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
-      {{t 'resources.account.title_plural'}}
-    </nav.link>
-  {{/if}}
+  <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
+    {{t 'resources.account.title_plural'}}
+  </nav.link>
 </Rose::Nav::Tabs>

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs

@@ -1,46 +1,91 @@
 {{#if @model}}
 
-  <Rose::Table as |table|>
-    <table.header as |header|>
-      <header.row as |row|>
-        <row.headerCell>{{t 'form.name.label'}}</row.headerCell>
-        <row.headerCell>
-          {{#if @model.firstObject.isPassword}}
-            {{t 'form.login_name.label'}}
-          {{/if}}
-        </row.headerCell>
-        <row.headerCell>{{t 'form.id.label'}}</row.headerCell>
-      </header.row>
-    </table.header>
-    <table.body as |body|>
-      {{#each @model as |account|}}
-        <body.row as |row|>
-          <row.headerCell>
-            <LinkTo
-              @route='scopes.scope.auth-methods.auth-method.accounts.account'
-              @model={{account.id}}
-            >
+  {{! OIDC accounts display more fields }}
+  {{#if @model.firstObject.isOIDC}}
+    <Rose::Table as |table|>
+      <table.header as |header|>
+        <header.row as |row|>
+          <row.headerCell>{{t 'form.name.label'}}</row.headerCell>
+          <row.headerCell>{{t 'form.issuer.label'}}</row.headerCell>
+          <row.headerCell>{{t 'form.subject.label'}}</row.headerCell>
+          <row.headerCell>{{t 'form.email.label'}}</row.headerCell>
+          <row.headerCell>{{t 'form.full_name.label'}}</row.headerCell>
+          <row.headerCell>{{t 'form.id.label'}}</row.headerCell>
+        </header.row>
+      </table.header>
+      <table.body as |body|>
+        {{#each @model as |account|}}
+          <body.row as |row|>
+            <row.headerCell scope='row'>
               {{account.displayName}}
-            </LinkTo>
-            <p>{{account.description}}</p>
+            </row.headerCell>
+            <row.cell>
+              <code>{{account.attributes.issuer}}</code>
+            </row.cell>
+            <row.cell>
+              <code>{{account.attributes.subject}}</code>
+            </row.cell>
+            <row.cell>
+              <code>{{account.attributes.email}}</code>
+            </row.cell>
+            <row.cell>
+              {{account.attributes.full_name}}
+            </row.cell>
+            <row.cell>
+              <Copyable
+                @text={{account.id}}
+                @buttonText={{t 'actions.copy-to-clipboard'}}
+                @acknowledgeText={{t 'states.copied'}}
+              >
+                <code>{{account.id}}</code>
+              </Copyable>
+            </row.cell>
+          </body.row>
+        {{/each}}
+      </table.body>
+    </Rose::Table>
+  {{else}}
+    <Rose::Table as |table|>
+      <table.header as |header|>
+        <header.row as |row|>
+          <row.headerCell>{{t 'form.name.label'}}</row.headerCell>
+          <row.headerCell>
+            {{#if @model.firstObject.isPassword}}
+              {{t 'form.login_name.label'}}
+            {{/if}}
           </row.headerCell>
-          <row.cell>
-            {{account.username}}
-          </row.cell>
-          <row.cell>
-            <Copyable
-              @text={{account.id}}
-              @buttonText={{t 'actions.copy-to-clipboard'}}
-              @acknowledgeText={{t 'states.copied'}}
-            >
-              <code>{{account.id}}</code>
-            </Copyable>
-          </row.cell>
-        </body.row>
-      {{/each}}
-    </table.body>
-  </Rose::Table>
-
+          <row.headerCell>{{t 'form.id.label'}}</row.headerCell>
+        </header.row>
+      </table.header>
+      <table.body as |body|>
+        {{#each @model as |account|}}
+          <body.row as |row|>
+            <row.headerCell>
+              <LinkTo
+                @route='scopes.scope.auth-methods.auth-method.accounts.account'
+                @model={{account.id}}
+              >
+                {{account.displayName}}
+              </LinkTo>
+              <p>{{account.description}}</p>
+            </row.headerCell>
+            <row.cell>
+              {{account.username}}
+            </row.cell>
+            <row.cell>
+              <Copyable
+                @text={{account.id}}
+                @buttonText={{t 'actions.copy-to-clipboard'}}
+                @acknowledgeText={{t 'states.copied'}}
+              >
+                <code>{{account.id}}</code>
+              </Copyable>
+            </row.cell>
+          </body.row>
+        {{/each}}
+      </table.body>
+    </Rose::Table>
+  {{/if}}
 {{else}}
 
   <Rose::Layout::Centered>