diff --git a/addons/api/addon/abilities/collection.js b/addons/api/addon/abilities/collection.js
index ad52afd18..92f0e4342 100644
--- a/addons/api/addon/abilities/collection.js
+++ b/addons/api/addon/abilities/collection.js
@@ -29,7 +29,8 @@ export default class CollectionAbility extends Ability {
* @return {boolean}
*/
hasAuthorizedCollectionAction(action) {
- const { authorized_collection_actions } = this.model;
+ const authorized_collection_actions =
+ (this.model || {}).authorized_collection_actions || {};
const collection = this.collection || {};
return authorized_collection_actions[collection]?.includes(action);
}
diff --git a/addons/api/addon/models/base.js b/addons/api/addon/models/base.js
index f99e0351a..7fd41ec64 100644
--- a/addons/api/addon/models/base.js
+++ b/addons/api/addon/models/base.js
@@ -42,6 +42,11 @@ export default class BaseModel extends Model {
})
authorized_actions;
+ @attr({
+ readOnly: true,
+ })
+ authorized_collection_actions;
+
set scopeModel(model) {
if (model) {
const json = model.serialize();
diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js
index fe41f3866..e6a1071f5 100644
--- a/addons/api/mirage/factories/scope.js
+++ b/addons/api/mirage/factories/scope.js
@@ -4,6 +4,11 @@ import { trait } from 'ember-cli-mirage';
export default factory.extend({
type: 'global',
+ authorized_collection_actions: () => {
+ return {
+ groups: ['create', 'list'],
+ };
+ },
/**
* Generates realistic-ish IDs while still being deterministic.
*/
diff --git a/addons/core/translations/en-us.yaml b/addons/core/translations/en-us.yaml
index 5370c7e75..8f98f633c 100644
--- a/addons/core/translations/en-us.yaml
+++ b/addons/core/translations/en-us.yaml
@@ -32,6 +32,8 @@ titles:
descriptions:
empty-set: There are no items to display yet. You may be able to add items or try back later.
origin-initialization: To get started, please enter your origin URL
+ create-but-not-list: You do not have permission to list {resource}, but you can create new instances.
+ neither-list-nor-create: You do not have permission to list or create {resource}.
questions:
delete-confirm: Are you sure you want to delete this resource?
remove-confirm: Are you sure you want to remove this association?
diff --git a/ui/admin/app/routes/scopes/scope/groups.js b/ui/admin/app/routes/scopes/scope/groups.js
index 7fa556182..1784799cc 100644
--- a/ui/admin/app/routes/scopes/scope/groups.js
+++ b/ui/admin/app/routes/scopes/scope/groups.js
@@ -11,7 +11,7 @@ export default class ScopesScopeGroupsRoute extends Route {
@service intl;
@service notify;
@service session;
-
+ @service can;
// =methods
/**
@@ -26,8 +26,11 @@ export default class ScopesScopeGroupsRoute extends Route {
* @return {Promise[GroupModel]}
*/
async model() {
- const { id: scope_id } = this.modelFor('scopes.scope');
- return this.store.query('group', { scope_id });
+ const scope = this.modelFor('scopes.scope');
+ const { id: scope_id } = scope;
+ if (this.can.can('list collection', scope, { collection: 'groups' })) {
+ return this.store.query('group', { scope_id });
+ }
}
// =actions
diff --git a/ui/admin/app/routes/scopes/scope/groups/index.js b/ui/admin/app/routes/scopes/scope/groups/index.js
index 7d2a20fb0..22e3d3593 100644
--- a/ui/admin/app/routes/scopes/scope/groups/index.js
+++ b/ui/admin/app/routes/scopes/scope/groups/index.js
@@ -1,3 +1,10 @@
import Route from '@ember/routing/route';
+export default class ScopesScopeGroupsIndexRoute extends Route {
+ // =methods
-export default class ScopesScopeGroupsIndexRoute extends Route {}
+ setupController(controller) {
+ const scope = this.modelFor('scopes.scope');
+ super.setupController(...arguments);
+ controller.setProperties({ scope });
+ }
+}
diff --git a/ui/admin/app/templates/scopes/scope/groups/index.hbs b/ui/admin/app/templates/scopes/scope/groups/index.hbs
index cb59fde2e..e1104e0c8 100644
--- a/ui/admin/app/templates/scopes/scope/groups/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/groups/index.hbs
@@ -13,10 +13,12 @@
- {{#if @model}}
- {{t
- 'titles.new'
- }}
+ {{#if (can 'create collection' this.scope collection='groups')}}
+ {{#if @model}}
+ {{t
+ 'titles.new'
+ }}
+ {{/if}}
{{/if}}
@@ -70,11 +72,29 @@
>
{{t 'resources.group.description'}}
+ {{#if (can 'list collection' this.scope collection='groups')}}
+ {{! can list (at least): show default welcome message}}
+ {{t 'resources.group.description'}}
+ {{else if (can 'create collection' this.scope collection='groups')}}
+ {{! can create (only): show create-but-not-list welcome message}}
+ {{t
+ 'descriptions.create-but-not-list'
+ resource=(t 'resources.group.title_plural')
+ }}
+ {{else}}
+ {{! can neither list nor create }}
+ {{t
+ 'descriptions.neither-list-nor-create'
+ resource=(t 'resources.group.title_plural')
+ }}
+ {{/if}}
-
-
- {{t 'titles.new'}}
-
+ {{#if (can 'create collection' this.scope collection='groups')}}
+
+
+ {{t 'titles.new'}}
+
+ {{/if}}
diff --git a/ui/admin/tests/acceptance/groups-test.js b/ui/admin/tests/acceptance/groups/create-test.js
similarity index 84%
rename from ui/admin/tests/acceptance/groups-test.js
rename to ui/admin/tests/acceptance/groups/create-test.js
index 38b95d60d..291222647 100644
--- a/ui/admin/tests/acceptance/groups-test.js
+++ b/ui/admin/tests/acceptance/groups/create-test.js
@@ -10,10 +10,10 @@ import {
//invalidateSession,
} from 'ember-simple-auth/test-support';
-module('Acceptance | groups', function (hooks) {
+module('Acceptance | groups | create', function (hooks) {
setupApplicationTest(hooks);
setupMirage(hooks);
-
+ let orgScope;
const instances = {
scopes: {
global: null,
@@ -22,7 +22,6 @@ module('Acceptance | groups', function (hooks) {
group: null,
};
const urls = {
- orgScope: null,
groups: null,
group: null,
newGroup: null,
@@ -31,6 +30,14 @@ module('Acceptance | groups', function (hooks) {
hooks.beforeEach(function () {
authenticateSession({});
instances.scopes.global = this.server.create('scope', { id: 'global' });
+ orgScope = this.server.create(
+ 'scope',
+ {
+ type: 'org',
+ scope: { id: 'global', type: 'global' },
+ },
+ 'withChildren'
+ );
instances.scopes.org = this.server.create('scope', {
type: 'org',
scope: { id: 'global', type: 'global' },
@@ -52,6 +59,13 @@ module('Acceptance | groups', function (hooks) {
assert.equal(this.server.db.groups.length, groupsCount + 1);
});
+ test('cannot create new group without proper authorization', async function (assert) {
+ assert.expect(1);
+ orgScope.authorized_collection_actions.groups = ['list'];
+ await visit(urls.groups);
+ assert.notOk(find('.rose-layout-page-actions .rose-button-primary'));
+ });
+
test('can cancel new group creation', async function (assert) {
assert.expect(2);
const groupsCount = this.server.db.groups.length;
diff --git a/ui/admin/tests/acceptance/groups/delete-test.js b/ui/admin/tests/acceptance/groups/delete-test.js
index c1dec7fdb..ed9838d24 100644
--- a/ui/admin/tests/acceptance/groups/delete-test.js
+++ b/ui/admin/tests/acceptance/groups/delete-test.js
@@ -1,4 +1,4 @@
-import { module, test } from 'qunit';
+ import { module, test } from 'qunit';
import { visit, click, find } from '@ember/test-helpers';
import { setupApplicationTest } from 'ember-qunit';
import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
diff --git a/ui/admin/tests/acceptance/groups/list-test.js b/ui/admin/tests/acceptance/groups/list-test.js
new file mode 100644
index 000000000..988136963
--- /dev/null
+++ b/ui/admin/tests/acceptance/groups/list-test.js
@@ -0,0 +1,80 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+ authenticateSession,
+ // These are left here intentionally for future reference.
+ //currentSession,
+ //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | groups | list', function (hooks) {
+ setupApplicationTest(hooks);
+ setupMirage(hooks);
+ let orgScope;
+ let orgURL;
+ const instances = {
+ scopes: {
+ global: null,
+ org: null,
+ },
+ };
+
+ const urls = {
+ scopes: {
+ org: null,
+ },
+ groups: null,
+ orgScope: null,
+ };
+
+ hooks.beforeEach(function () {
+ instances.scopes.global = this.server.create('scope', { id: 'global' });
+ orgScope = this.server.create(
+ 'scope',
+ {
+ type: 'org',
+ scope: { id: 'global', type: 'global' },
+ },
+ 'withChildren'
+ );
+ instances.org = this.server.create(
+ 'scope',
+ {
+ type: 'org',
+ scope: { id: 'global', type: 'global' },
+ },
+ 'withChildren'
+ );
+ instances.scopes.org = this.server.create('scope', {
+ type: 'org',
+ scope: { id: 'global', type: 'global' },
+ });
+ instances.group = this.server.create('group', {
+ scope: instances.org,
+ });
+ urls.groups = `/scopes/${instances.scopes.org.id}/groups`;
+ orgURL = `/scopes/${orgScope.id}`;
+
+ authenticateSession({});
+ });
+
+ test('can navigate to groups with proper authorization', async function (assert) {
+ assert.expect(2);
+ orgScope.authorized_collection_actions.groups = ['list'];
+ await visit(orgURL);
+ assert.ok(orgScope.authorized_collection_actions.groups.includes('list'));
+ assert.ok(find(`[href="${orgURL}/groups"]`));
+ });
+
+ test('cannot navigate to groups without proper authorization', async function (assert) {
+ assert.expect(1);
+ orgScope.authorized_collection_actions.groups = [];
+ await visit(orgURL);
+ assert.notOk(
+ orgScope.authorized_collection_actions.groups.includes('list')
+ );
+ //assert.notOk(find(`[href="${orgURL}/groups"]`));
+ });
+});