From 74df9237753a61afddbf1a7eb03ae9c4d6415386 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Thu, 5 Aug 2021 13:29:33 -0400
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20apply=20base=20singu?=
 =?UTF-8?q?lar=20capabilities=20to=20account?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../components/form/account/oidc/index.hbs    |  14 +-
 .../form/account/password/index.hbs           |  14 +-
 .../auth-method/accounts/account/-actions.hbs |  26 ++--
 .../auth-method/accounts/index.hbs            |  32 ++--
 ui/admin/tests/acceptance/accounts-test.js    | 120 ---------------
 .../tests/acceptance/accounts/delete-test.js  | 102 +++++++++++++
 .../tests/acceptance/accounts/read-test.js    |  76 ++++++++++
 .../tests/acceptance/accounts/update-test.js  | 142 ++++++++++++++++++
 8 files changed, 370 insertions(+), 156 deletions(-)
 create mode 100644 ui/admin/tests/acceptance/accounts/delete-test.js
 create mode 100644 ui/admin/tests/acceptance/accounts/read-test.js
 create mode 100644 ui/admin/tests/acceptance/accounts/update-test.js

diff --git a/ui/admin/app/components/form/account/oidc/index.hbs b/ui/admin/app/components/form/account/oidc/index.hbs
index b3a2dd8a7..16cc9c0b8 100644
--- a/ui/admin/app/components/form/account/oidc/index.hbs
+++ b/ui/admin/app/components/form/account/oidc/index.hbs
@@ -117,11 +117,13 @@
     </form.input>
   {{/if}}
 
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/components/form/account/password/index.hbs b/ui/admin/app/components/form/account/password/index.hbs
index 6c4ac649a..cdfc1ca78 100644
--- a/ui/admin/app/components/form/account/password/index.hbs
+++ b/ui/admin/app/components/form/account/password/index.hbs
@@ -91,11 +91,13 @@
     </form.input>
   {{/if}}
 
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-actions.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-actions.hbs
index 108a22afd..aa7db7b12 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-actions.hbs
@@ -1,13 +1,15 @@
-<Rose::Dropdown
-  @text='{{t 'actions.manage'}}'
-  @dropdownRight={{true}}
-  as |dropdown|
->
-  <dropdown.button
-    @style='danger'
-    @disabled={{@model.canSave}}
-    {{on 'click' (route-action 'deleteAccount' @model)}}
+{{#if (can 'delete model' @model)}}
+  <Rose::Dropdown
+    @text='{{t 'actions.manage'}}'
+    @dropdownRight={{true}}
+    as |dropdown|
   >
-    {{t 'resources.account.actions.delete'}}
-  </dropdown.button>
-</Rose::Dropdown>
\ No newline at end of file
+    <dropdown.button
+      @style='danger'
+      @disabled={{@model.canSave}}
+      {{on 'click' (route-action 'deleteAccount' @model)}}
+    >
+      {{t 'resources.account.actions.delete'}}
+    </dropdown.button>
+  </Rose::Dropdown>
+{{/if}}
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs
index d1ee9dde5..c35071bf7 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs
@@ -18,13 +18,17 @@
         {{#each @model as |account|}}
           <body.row as |row|>
             <row.headerCell scope='row'>
-              <LinkTo
-                @route='scopes.scope.auth-methods.auth-method.accounts.account'
-                @model={{account.id}}
-              >
+              {{#if (can 'read model' account)}}
+                <LinkTo
+                  @route='scopes.scope.auth-methods.auth-method.accounts.account'
+                  @model={{account.id}}
+                >
+                  {{account.accountName}}
+                </LinkTo>
+              {{else}}
                 {{account.accountName}}
-                <p>{{account.description}}</p>
-              </LinkTo>
+              {{/if}}
+              <p>{{account.description}}</p>
             </row.headerCell>
             <row.cell>
               <code>{{account.attributes.issuer}}</code>
@@ -68,13 +72,17 @@
         {{#each @model as |account|}}
           <body.row as |row|>
             <row.headerCell>
-              <LinkTo
-                @route='scopes.scope.auth-methods.auth-method.accounts.account'
-                @model={{account.id}}
-              >
+              {{#if (can 'read model' account)}}
+                <LinkTo
+                  @route='scopes.scope.auth-methods.auth-method.accounts.account'
+                  @model={{account.id}}
+                >
+                  {{account.accountName}}
+                </LinkTo>
+              {{else}}
                 {{account.accountName}}
-                <p>{{account.description}}</p>
-              </LinkTo>
+              {{/if}}
+              <p>{{account.description}}</p>
             </row.headerCell>
             <row.cell>
               {{account.attributes.login_name}}
diff --git a/ui/admin/tests/acceptance/accounts-test.js b/ui/admin/tests/acceptance/accounts-test.js
index 5b16765f8..5430e36db 100644
--- a/ui/admin/tests/acceptance/accounts-test.js
+++ b/ui/admin/tests/acceptance/accounts-test.js
@@ -68,32 +68,6 @@ module('Acceptance | accounts', function (hooks) {
     assert.equal(currentURL(), urls.accounts);
   });
 
-  test('can navigate to an account form', async function (assert) {
-    assert.expect(1);
-    await visit(urls.accounts);
-    await click('main tbody .rose-table-header-cell:nth-child(1) a');
-    await a11yAudit();
-    assert.equal(currentURL(), urls.account);
-  });
-
-  test('can update an account and save changes', async function (assert) {
-    assert.expect(1);
-    await visit(urls.account);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'update name');
-    await click('form [type="submit"]:not(:disabled)');
-    assert.equal(this.server.db.accounts[0].name, 'update name');
-  });
-
-  test('can update an account and cancel changes', async function (assert) {
-    assert.expect(1);
-    await visit(urls.account);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'update name');
-    await click('form button:not([type="submit"])');
-    assert.notEqual(this.server.db.accounts[0].name, 'update name');
-  });
-
   test('can create a new account', async function (assert) {
     assert.expect(1);
     const accountsCount = this.server.db.accounts.length;
@@ -116,14 +90,6 @@ module('Acceptance | accounts', function (hooks) {
     assert.equal(currentURL(), urls.accounts);
   });
 
-  test('can delete an account', async function (assert) {
-    assert.expect(1);
-    const accountsCount = this.server.db.accounts.length;
-    await visit(urls.account);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(this.server.db.accounts.length, accountsCount - 1);
-  });
-
   test('saving a new account with invalid fields displays error messages', async function (assert) {
     assert.expect(2);
     this.server.post('/accounts', () => {
@@ -160,90 +126,4 @@ module('Acceptance | accounts', function (hooks) {
       'Displays field-level errors.'
     );
   });
-
-  test('errors are displayed when save on account fails', async function (assert) {
-    assert.expect(1);
-    this.server.patch('/accounts/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(urls.account);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'save account');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'Oops.',
-      'Displays primary error message.'
-    );
-  });
-
-  test('errors are displayed when delete on account fails', async function (assert) {
-    assert.expect(1);
-    this.server.del('/accounts/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(urls.account);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'Oops.',
-      'Displays primary error message.'
-    );
-  });
-
-  test('saving an existing account with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.patch('/accounts/:id', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(urls.account);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'existing account');
-    await click('form [type="submit"]');
-    await a11yAudit();
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.',
-      'Displays primary error message.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.',
-      'Displays field-level errors.'
-    );
-  });
 });
diff --git a/ui/admin/tests/acceptance/accounts/delete-test.js b/ui/admin/tests/acceptance/accounts/delete-test.js
new file mode 100644
index 000000000..8b78b1834
--- /dev/null
+++ b/ui/admin/tests/acceptance/accounts/delete-test.js
@@ -0,0 +1,102 @@
+import { module, test } from 'qunit';
+import { visit, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | accounts | delete', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethods: null,
+    account: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    accounts: null,
+    account: null,
+  };
+
+  hooks.beforeEach(function () {
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+    instances.account = this.server.create('account', {
+      scope: instances.scopes.org,
+      authMethod: instances.authMethod,
+    });
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+    urls.accounts = `${urls.authMethod}/accounts`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+  });
+
+  hooks.afterEach(async function () {
+    const notification = find('.rose-notification');
+    if (notification) {
+      await click('.rose-notification-dismiss');
+    }
+  });
+
+  test('can delete an account', async function (assert) {
+    assert.expect(1);
+    const accountsCount = this.server.db.accounts.length;
+    await visit(urls.account);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(this.server.db.accounts.length, accountsCount - 1);
+  });
+
+  test('cannot delete an account without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.account.authorized_actions =
+      instances.account.authorized_actions.filter((item) => item !== 'delete');
+    await visit(urls.account);
+    assert.notOk(
+      find('.rose-layout-page-actions .rose-dropdown-button-danger')
+    );
+  });
+
+  test('errors are displayed when delete on account fails', async function (assert) {
+    assert.expect(1);
+    this.server.del('/accounts/:id', () => {
+      return new Response(
+        490,
+        {},
+        {
+          status: 490,
+          code: 'error',
+          message: 'Oops.',
+        }
+      );
+    });
+    await visit(urls.account);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'Oops.',
+      'Displays primary error message.'
+    );
+  });
+});
diff --git a/ui/admin/tests/acceptance/accounts/read-test.js b/ui/admin/tests/acceptance/accounts/read-test.js
new file mode 100644
index 000000000..b32e5e865
--- /dev/null
+++ b/ui/admin/tests/acceptance/accounts/read-test.js
@@ -0,0 +1,76 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | accounts | read', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethods: null,
+    account: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    accounts: null,
+    account: null,
+  };
+
+  hooks.beforeEach(function () {
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+    instances.account = this.server.create('account', {
+      scope: instances.scopes.org,
+      authMethod: instances.authMethod,
+    });
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+    urls.accounts = `${urls.authMethod}/accounts`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+  });
+
+  hooks.afterEach(async function () {
+    const notification = find('.rose-notification');
+    if (notification) {
+      await click('.rose-notification-dismiss');
+    }
+  });
+
+  test('can navigate to an account form', async function (assert) {
+    assert.expect(1);
+    await visit(urls.accounts);
+    await click('main tbody .rose-table-header-cell:nth-child(1) a');
+    await a11yAudit();
+    assert.equal(currentURL(), urls.account);
+  });
+
+  test('cannot navigate to an account form without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.account.authorized_actions =
+      instances.account.authorized_actions.filter((item) => item !== 'read');
+    await visit(urls.accounts);
+    assert.notOk(find('main tbody .rose-table-header-cell:nth-child(1) a'));
+  });
+});
diff --git a/ui/admin/tests/acceptance/accounts/update-test.js b/ui/admin/tests/acceptance/accounts/update-test.js
new file mode 100644
index 000000000..ecce31da0
--- /dev/null
+++ b/ui/admin/tests/acceptance/accounts/update-test.js
@@ -0,0 +1,142 @@
+import { module, test } from 'qunit';
+import { visit, click, find, fillIn } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | accounts | update', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    authMethods: null,
+    account: null,
+  };
+  const urls = {
+    orgScope: null,
+    authMethods: null,
+    accounts: null,
+    account: null,
+  };
+
+  hooks.beforeEach(function () {
+    authenticateSession({});
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+    });
+    instances.account = this.server.create('account', {
+      scope: instances.scopes.org,
+      authMethod: instances.authMethod,
+    });
+    // Generate route URLs for resources
+    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
+    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
+    urls.accounts = `${urls.authMethod}/accounts`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+  });
+
+  hooks.afterEach(async function () {
+    const notification = find('.rose-notification');
+    if (notification) {
+      await click('.rose-notification-dismiss');
+    }
+  });
+
+  test('can update an account and save changes', async function (assert) {
+    assert.expect(1);
+    await visit(urls.account);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'update name');
+    await click('form [type="submit"]:not(:disabled)');
+    assert.equal(this.server.db.accounts[0].name, 'update name');
+  });
+
+  test('can update an account and cancel changes', async function (assert) {
+    assert.expect(1);
+    await visit(urls.account);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'update name');
+    await click('form button:not([type="submit"])');
+    assert.notEqual(this.server.db.accounts[0].name, 'update name');
+  });
+
+  test('errors are displayed when save on account fails', async function (assert) {
+    assert.expect(1);
+    this.server.patch('/accounts/:id', () => {
+      return new Response(
+        490,
+        {},
+        {
+          status: 490,
+          code: 'error',
+          message: 'Oops.',
+        }
+      );
+    });
+    await visit(urls.account);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'save account');
+    await click('form [type="submit"]');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'Oops.',
+      'Displays primary error message.'
+    );
+  });
+
+  test('saving an existing account with invalid fields displays error messages', async function (assert) {
+    assert.expect(2);
+    this.server.patch('/accounts/:id', () => {
+      return new Response(
+        400,
+        {},
+        {
+          status: 400,
+          code: 'invalid_argument',
+          message: 'The request was invalid.',
+          details: {
+            request_fields: [
+              {
+                name: 'name',
+                description: 'Name is required.',
+              },
+            ],
+          },
+        }
+      );
+    });
+    await visit(urls.account);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'existing account');
+    await click('form [type="submit"]');
+    await a11yAudit();
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'The request was invalid.',
+      'Displays primary error message.'
+    );
+    assert.ok(
+      find('.rose-form-error-message').textContent.trim(),
+      'Name is required.',
+      'Displays field-level errors.'
+    );
+  });
+});

From 14f6b30b2611d089930ba729ffbb4ef70f7a9c32 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Tue, 10 Aug 2021 16:19:06 -0400
Subject: [PATCH 2/2] =?UTF-8?q?chore:=20=F0=9F=A4=96=20adds=20support=20fo?=
 =?UTF-8?q?r=20development=20capabilities=20toggle?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 addons/api/mirage/factories/account.js   |  9 +++-
 addons/api/mirage/helpers/permissions.js | 58 ++++++++++++++++++++++++
 yarn.lock                                | 27 ++---------
 3 files changed, 71 insertions(+), 23 deletions(-)
 create mode 100644 addons/api/mirage/helpers/permissions.js

diff --git a/addons/api/mirage/factories/account.js b/addons/api/mirage/factories/account.js
index 569d4d8fc..5b7a14c09 100644
--- a/addons/api/mirage/factories/account.js
+++ b/addons/api/mirage/factories/account.js
@@ -1,8 +1,15 @@
 import factory from '../generated/factories/account';
 import { random, internet } from 'faker';
+import permissions from '../helpers/permissions';
 
 export default factory.extend({
-  authorized_actions: () => ['no-op', 'read', 'update', 'delete'],
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('account') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
   attributes() {
     switch (this.type) {
       case 'password':
diff --git a/addons/api/mirage/helpers/permissions.js b/addons/api/mirage/helpers/permissions.js
new file mode 100644
index 000000000..7547b5e7c
--- /dev/null
+++ b/addons/api/mirage/helpers/permissions.js
@@ -0,0 +1,58 @@
+import { copy } from 'ember-copy';
+
+/**
+ * Allows development-time toggling of resource permissions via the window
+ * querystring.  Pass a JSON object into the query to toggle permissions.
+ * Note that the value must be a valid JSON object in order to be parsed.
+ *
+ * @example
+ *   ?authorized_actions={"account": ["read"]}
+ *
+ * Within a Mirage factory, pass the actions into the mock:
+ *
+ * @example
+ *   import { Factory } from 'ember-cli-mirage';
+ *   import permissions from '../helpers/permissions';
+ *
+ *   export default Factory.extend({
+ *     authorized_actions: () =>
+ *       permissions.authorizedActionsFor('account') ||
+ *       ['no-op', 'read', 'update', 'delete']
+ *   });
+ */
+class ToggledCapabilities {
+  // =attributes
+
+  // Get the query string and drop the leading '?'
+  #rawQuery = window.location.search.substring(1);
+
+  // Split the querystring into key/value pairs
+  #queryPairs = this.#rawQuery.split('&').map((item) => item.split('='));
+
+  // Find the value of a pair with key `authorized_actions`
+  // Safe-ish when the item is not present
+  #rawAuthorizedActions = (this.#queryPairs.find(
+    (item) => item[0] === 'authorized_actions'
+  ) || [])[1];
+
+  // Safe-ish when the value is not present
+  #authorizedActions =
+    JSON.parse(
+      decodeURIComponent(this.#rawAuthorizedActions || '') || 'null'
+    ) || {};
+
+  // =methods
+
+  /**
+   * Returns authorized actions for the specified field, if any are defined
+   * in the `authorized_actions` query.  Returns undefined otherwise.
+   * @return {?string[]}
+   */
+  authorizedActionsFor(field) {
+    if (this.#authorizedActions[field]) {
+      return copy(this.#authorizedActions[field], true);
+    }
+  }
+}
+
+export default new ToggledCapabilities();
diff --git a/yarn.lock b/yarn.lock
index f0fedc5a6..ccb020564 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7680,7 +7680,7 @@ debug@^3.0.0, debug@^3.0.1, debug@^3.1.0, debug@^3.1.1, debug@^3.2.6:
   dependencies:
     ms "^2.1.1"
 
-debuglog@*, debuglog@^1.0.1:
+debuglog@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
   integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI=
@@ -12389,7 +12389,7 @@ import-lazy@^4.0.0:
   resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-4.0.0.tgz#e8eb627483a0a43da3c03f3e35548be5cb0cc153"
   integrity sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==
 
-imurmurhash@*, imurmurhash@^0.1.4:
+imurmurhash@^0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea"
   integrity sha1-khi5srkoojixPcT7a21XbyMUU+o=
@@ -14073,11 +14073,6 @@ lodash._baseflatten@^3.0.0:
     lodash.isarguments "^3.0.0"
     lodash.isarray "^3.0.0"
 
-lodash._baseindexof@*:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c"
-  integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw=
-
 lodash._baseuniq@~4.6.0:
   version "4.6.0"
   resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8"
@@ -14086,16 +14081,11 @@ lodash._baseuniq@~4.6.0:
     lodash._createset "~4.0.0"
     lodash._root "~3.0.0"
 
-lodash._bindcallback@*, lodash._bindcallback@^3.0.0:
+lodash._bindcallback@^3.0.0:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e"
   integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4=
 
-lodash._cacheindexof@*:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92"
-  integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI=
-
 lodash._createassigner@^3.0.0:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11"
@@ -14105,19 +14095,12 @@ lodash._createassigner@^3.0.0:
     lodash._isiterateecall "^3.0.0"
     lodash.restparam "^3.0.0"
 
-lodash._createcache@*:
-  version "3.1.2"
-  resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093"
-  integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM=
-  dependencies:
-    lodash._getnative "^3.0.0"
-
 lodash._createset@~4.0.0:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26"
   integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY=
 
-lodash._getnative@*, lodash._getnative@^3.0.0:
+lodash._getnative@^3.0.0:
   version "3.9.1"
   resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5"
   integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U=
@@ -14335,7 +14318,7 @@ lodash.pick@^4.4.0:
   resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3"
   integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM=
 
-lodash.restparam@*, lodash.restparam@^3.0.0:
+lodash.restparam@^3.0.0:
   version "3.6.1"
   resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805"
   integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=