feat: 🎸 auth methods capability

addons/api/addon/abilities/collection.js

@@ -29,7 +29,8 @@ export default class CollectionAbility extends Ability {
    * @return {boolean}
    */
   hasAuthorizedCollectionAction(action) {
-    const { authorized_collection_actions } = this.model;
+    const authorized_collection_actions =
+      (this.model || {}).authorized_collection_actions || {};
     const collection = this.collection || {};
     return authorized_collection_actions[collection]?.includes(action);
   }

addons/api/addon/models/base.js

@@ -42,6 +42,11 @@ export default class BaseModel extends Model {
   })
   authorized_actions;
 
+  @attr({
+    readOnly: true,
+  })
+  authorized_collection_actions;
+
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();

addons/api/mirage/factories/scope.js

@@ -4,6 +4,11 @@ import { trait } from 'ember-cli-mirage';
 export default factory.extend({
   type: 'global',
 
+  authorized_collection_actions: () => {
+    return {
+      'auth-methods': ['create', 'list'],
+    };
+  },
   /**
    * Generates realistic-ish IDs while still being deterministic.
    */

addons/core/translations/en-us.yaml

@@ -32,6 +32,8 @@ titles:
 descriptions:
   empty-set: There are no items to display yet.  You may be able to add items or try back later.
   origin-initialization: To get started, please enter your origin URL
+  create-but-not-list: You do not have permission to list {resource}, but you can create new instances.
+  neither-list-nor-create: You do not have permission to list or create {resource}.
 questions:
   delete-confirm: Are you sure you want to delete this resource?
   remove-confirm: Are you sure you want to remove this association?

ui/admin/app/routes/scopes/scope/auth-methods.js

@@ -11,6 +11,7 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,13 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
    * @return {Promise[AuthMethodModel]}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('auth-method', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (
+      this.can.can('list collection', scope, { collection: 'auth-methods' })
+    ) {
+      return this.store.query('auth-method', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/templates/scopes/scope.hbs

@@ -106,10 +106,12 @@
             <Rose::Icon @name='app-icons/roles' @size='medium' />
             {{t 'resources.role.title_plural'}}
           </nav.link>
-          <nav.link @route='scopes.scope.auth-methods'>
-            <Rose::Icon @name='app-icons/auth-method' @size='medium' />
-            {{t 'resources.auth-method.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='auth-methods')}}
+            <nav.link @route='scopes.scope.auth-methods'>
+              <Rose::Icon @name='app-icons/auth-method' @size='medium' />
+              {{t 'resources.auth-method.title_plural'}}
+            </nav.link>
+          {{/if}}
         </Rose::Nav::Sidebar>
       {{/unless}}
 

ui/admin/app/templates/scopes/scope/auth-methods/index.hbs

@@ -12,25 +12,30 @@
   </page.breadcrumbs>
 
   <page.actions>
+
     {{#if @model}}
-      <Rose::Dropdown
-        @text={{t 'titles.new'}}
-        @dropdownRight={{true}}
-        as |dropdown|
-      >
-        <dropdown.link
-          @route='scopes.scope.auth-methods.new'
-          @query={{hash type='password'}}
-        >
-          {{t 'resources.auth-method.types.password'}}
-        </dropdown.link>
-        <dropdown.link
-          @route='scopes.scope.auth-methods.new'
-          @query={{hash type='oidc'}}
-        >
-          {{t 'resources.auth-method.types.oidc'}}
-        </dropdown.link>
-      </Rose::Dropdown>
+      {{#if (can 'create collection' this.scope collection='auth-methods')}}
+        {{#if @model}}
+          <Rose::Dropdown
+            @text={{t 'titles.new'}}
+            @dropdownRight={{true}}
+            as |dropdown|
+          >
+            <dropdown.link
+              @route='scopes.scope.auth-methods.new'
+              @query={{hash type='password'}}
+            >
+              {{t 'resources.auth-method.types.password'}}
+            </dropdown.link>
+            <dropdown.link
+              @route='scopes.scope.auth-methods.new'
+              @query={{hash type='oidc'}}
+            >
+              {{t 'resources.auth-method.types.oidc'}}
+            </dropdown.link>
+          </Rose::Dropdown>
+        {{/if}}
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -165,7 +170,24 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.auth-method.messages.welcome.description'}}
+            {{#if (can 'list collection' this.scope collection='auth-methods')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.auth-method.messages.welcome.description'}}
+            {{else if (can
+              'create collection' this.scope collection='auth-methods'
+            )}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.auth-method.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.auth-method.title_plural')
+              }}
+            {{/if}}
           </message.description>
           <message.link
             @route='scopes.scope.auth-methods.new'
@@ -174,6 +196,12 @@
             <Rose::Icon @name='plus-circle-outline' />
             {{t 'titles.new'}}
           </message.link>
+          {{#if (can 'create collection' this.scope collection='auth-methods')}}
+            <message.link @route='scopes.scope.auth-method.new'>
+              <Rose::Icon @name='plus-circle-outline' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/tests/acceptance/auth-methods/create-test.js

@@ -2,7 +2,6 @@ import { module, test } from 'qunit';
 import { visit, currentURL, click, find, fillIn } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
-import a11yAudit from 'ember-a11y-testing/test-support/audit';
 import { Response } from 'miragejs';
 import {
   authenticateSession,
@@ -12,7 +11,7 @@ import {
 } from 'ember-simple-auth/test-support';
 import { enableFeature } from 'ember-feature-flags/test-support';
 
-module('Acceptance | auth methods', function (hooks) {
+module('Acceptance | auth-methods | create ', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -22,66 +21,35 @@ module('Acceptance | auth methods', function (hooks) {
       org: null,
     },
     authMethod: null,
+    orgScope: null,
   };
+
   const urls = {
     orgScope: null,
     authMethods: null,
     newAuthMethod: null,
     authMethod: null,
+    orgURL: null,
   };
 
   hooks.beforeEach(function () {
-    // Setup Mirage mock resources for this test
     authenticateSession({});
-    instances.scopes.global = this.server.create('scope', { id: 'global' });
-    instances.scopes.org = this.server.create('scope', {
+    instances.orgScope = this.server.create('scope', {
       type: 'org',
       scope: { id: 'global', type: 'global' },
     });
+
     instances.authMethod = this.server.create('auth-method', {
-      scope: instances.scopes.org,
+      scope: instances.orgScope,
     });
 
     // Generate route URLs for resources
-    urls.orgScope = `/scopes/${instances.scopes.org.id}`;
-    urls.authMethods = `${urls.orgScope}/auth-methods`;
+    urls.orgURL = `/scopes/${instances.orgScope.id}`;
+    urls.authMethods = `${urls.orgURL}/auth-methods`;
     urls.newAuthMethod = `${urls.authMethods}/new?type=password`;
     urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
   });
 
-  test('visiting auth methods', async function (assert) {
-    assert.expect(1);
-    await visit(urls.authMethods);
-    await a11yAudit();
-    assert.equal(currentURL(), urls.authMethods);
-  });
-
-  test('can navigate to an auth method form', async function (assert) {
-    assert.expect(1);
-    await visit(urls.authMethods);
-    await click('main tbody .rose-table-header-cell:nth-child(1) a');
-    await a11yAudit();
-    assert.equal(currentURL(), urls.authMethod);
-  });
-
-  test('can update an auth method and save changes', async function (assert) {
-    assert.expect(1);
-    await visit(urls.authMethod);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'update name');
-    await click('form [type="submit"]:not(:disabled)');
-    assert.equal(this.server.db.authMethods[0].name, 'update name');
-  });
-
-  test('can update an auth method and cancel changes', async function (assert) {
-    assert.expect(1);
-    await visit(urls.authMethod);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'update name');
-    await click('form button:not([type="submit"])');
-    assert.notEqual(this.server.db.authMethods[0].name, 'update name');
-  });
-
   test('can create new auth method', async function (assert) {
     assert.expect(1);
     const authMethodsCount = this.server.db.authMethods.length;
@@ -92,6 +60,34 @@ module('Acceptance | auth methods', function (hooks) {
     assert.equal(this.server.db.authMethods.length, authMethodsCount + 1);
   });
 
+  test('can navigate to new auth-methods route with proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions['auth-methods'] = [
+      'create',
+      'list',
+    ];
+    await visit(urls.orgURL);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions['auth-methods'].includes(
+        'create'
+      )
+    );
+    console.log(urls.orgURL);
+    assert.ok(find(`[href="${urls.authMethods}"]`));
+  });
+
+  test('cannot navigate to new auth-methods route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions['auth-methods'] = [];
+    await visit(urls.orgURL);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions['auth-methods'].includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`[href="${urls.authMethods}"]`));
+  });
+
   test('can cancel new auth method creation', async function (assert) {
     assert.expect(2);
     const authMethodsCount = this.server.db.authMethods.length;
@@ -106,7 +102,7 @@ module('Acceptance | auth methods', function (hooks) {
   test('user can make primary an auth method', async function (assert) {
     assert.expect(2);
     assert.notOk(
-      instances.scopes.org.primaryAuthMethodId,
+      instances.orgScope.primaryAuthMethodId,
       'Primary auth method is not yet set.'
     );
     enableFeature('primary-auth-method');
@@ -114,7 +110,7 @@ module('Acceptance | auth methods', function (hooks) {
     await click(
       '.rose-layout-page-actions .rose-dropdown-content [type="button"]:first-child'
     );
-    const scope = this.server.schema.scopes.find(instances.scopes.org.id);
+    const scope = this.server.schema.scopes.find(instances.orgScope.id);
     assert.equal(
       scope.primaryAuthMethodId,
       instances.authMethod.id,
@@ -136,7 +132,7 @@ module('Acceptance | auth methods', function (hooks) {
       );
     });
     assert.notOk(
-      instances.scopes.org.primaryAuthMethodId,
+      instances.orgScope.primaryAuthMethodId,
       'Primary auth method is not yet set.'
     );
     enableFeature('primary-auth-method');
@@ -149,11 +145,11 @@ module('Acceptance | auth methods', function (hooks) {
 
   test('user can remove as primary an auth method', async function (assert) {
     assert.expect(2);
-    instances.scopes.org.update({
+    instances.orgScope.update({
       primaryAuthMethodId: instances.authMethod.id,
     });
     assert.ok(
-      instances.scopes.org.primaryAuthMethodId,
+      instances.orgScope.primaryAuthMethodId,
       'Primary auth method is set.'
     );
     enableFeature('primary-auth-method');
@@ -161,7 +157,7 @@ module('Acceptance | auth methods', function (hooks) {
     await click(
       '.rose-layout-page-actions .rose-dropdown-content [type="button"]:first-child'
     );
-    const scope = this.server.schema.scopes.find(instances.scopes.org.id);
+    const scope = this.server.schema.scopes.find(instances.orgScope.id);
     assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.');
   });
 
@@ -178,11 +174,11 @@ module('Acceptance | auth methods', function (hooks) {
         }
       );
     });
-    instances.scopes.org.update({
+    instances.orgScope.update({
       primaryAuthMethodId: instances.authMethod.id,
     });
     assert.ok(
-      instances.scopes.org.primaryAuthMethodId,
+      instances.orgScope.primaryAuthMethodId,
       'Primary auth method is set.'
     );
     enableFeature('primary-auth-method');
@@ -196,7 +192,7 @@ module('Acceptance | auth methods', function (hooks) {
   test('user can make and remove primary auth methods from index', async function (assert) {
     assert.expect(3);
     assert.notOk(
-      instances.scopes.org.primaryAuthMethodId,
+      instances.orgScope.primaryAuthMethodId,
       'Primary auth method is not yet set.'
     );
     enableFeature('primary-auth-method');
@@ -204,7 +200,7 @@ module('Acceptance | auth methods', function (hooks) {
     await click(
       '.rose-table-body .rose-table-row:first-child .rose-dropdown-content [type="button"]:first-child'
     );
-    let scope = this.server.schema.scopes.find(instances.scopes.org.id);
+    let scope = this.server.schema.scopes.find(instances.orgScope.id);
     assert.equal(
       scope.primaryAuthMethodId,
       instances.authMethod.id,
@@ -213,7 +209,7 @@ module('Acceptance | auth methods', function (hooks) {
     await click(
       '.rose-table-body .rose-table-row:first-child .rose-dropdown-content [type="button"]:first-child'
     );
-    scope = this.server.schema.scopes.find(instances.scopes.org.id);
+    scope = this.server.schema.scopes.find(instances.orgScope.id);
     assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.');
   });
 });

ui/admin/tests/acceptance/auth-methods/list-test.js

@@ -0,0 +1,87 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | auth-methods | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+  let orgURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    authMethods: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.org = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+
+    orgURL = `/scopes/${instances.orgScope.id}`;
+    urls.authMethods = `/scopes/${instances.orgScope.id}/auth-methods`;
+    authenticateSession({});
+  });
+
+  test('can navigate to users with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(orgURL);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions['auth-methods'].includes(
+        'list'
+      )
+    );
+    assert.ok(find(`[href="${urls.authMethods}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions['auth-methods'] = [];
+    await visit(orgURL);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions['auth-methods'].includes(
+        'list'
+      )
+    );
+    assert.notOk(find(`[href="${urls.authMethods}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.orgScope.authorized_collection_actions['auth-methods'] = [
+      'create',
+    ];
+    await visit(orgURL);
+    assert.ok(find(`[href="${urls.authMethods}"]`));
+  });
+});