diff --git a/addons/api/addon/abilities/collection.js b/addons/api/addon/abilities/collection.js index ad52afd18..92f0e4342 100644 --- a/addons/api/addon/abilities/collection.js +++ b/addons/api/addon/abilities/collection.js @@ -29,7 +29,8 @@ export default class CollectionAbility extends Ability { * @return {boolean} */ hasAuthorizedCollectionAction(action) { - const { authorized_collection_actions } = this.model; + const authorized_collection_actions = + (this.model || {}).authorized_collection_actions || {}; const collection = this.collection || {}; return authorized_collection_actions[collection]?.includes(action); } diff --git a/addons/api/addon/models/base.js b/addons/api/addon/models/base.js index f99e0351a..7fd41ec64 100644 --- a/addons/api/addon/models/base.js +++ b/addons/api/addon/models/base.js @@ -42,6 +42,11 @@ export default class BaseModel extends Model { }) authorized_actions; + @attr({ + readOnly: true, + }) + authorized_collection_actions; + set scopeModel(model) { if (model) { const json = model.serialize(); diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js index fe41f3866..a3081887b 100644 --- a/addons/api/mirage/factories/scope.js +++ b/addons/api/mirage/factories/scope.js @@ -4,6 +4,11 @@ import { trait } from 'ember-cli-mirage'; export default factory.extend({ type: 'global', + authorized_collection_actions: () => { + return { + 'auth-methods': ['create', 'list'], + }; + }, /** * Generates realistic-ish IDs while still being deterministic. */ diff --git a/addons/core/translations/en-us.yaml b/addons/core/translations/en-us.yaml index 5370c7e75..8f98f633c 100644 --- a/addons/core/translations/en-us.yaml +++ b/addons/core/translations/en-us.yaml @@ -32,6 +32,8 @@ titles: descriptions: empty-set: There are no items to display yet. You may be able to add items or try back later. origin-initialization: To get started, please enter your origin URL + create-but-not-list: You do not have permission to list {resource}, but you can create new instances. + neither-list-nor-create: You do not have permission to list or create {resource}. questions: delete-confirm: Are you sure you want to delete this resource? remove-confirm: Are you sure you want to remove this association? diff --git a/ui/admin/app/routes/scopes/scope/auth-methods.js b/ui/admin/app/routes/scopes/scope/auth-methods.js index 31c0778a5..938ce6d16 100644 --- a/ui/admin/app/routes/scopes/scope/auth-methods.js +++ b/ui/admin/app/routes/scopes/scope/auth-methods.js @@ -11,6 +11,7 @@ export default class ScopesScopeAuthMethodsRoute extends Route { @service intl; @service notify; @service session; + @service can; // =methods @@ -26,8 +27,13 @@ export default class ScopesScopeAuthMethodsRoute extends Route { * @return {Promise[AuthMethodModel]} */ async model() { - const { id: scope_id } = this.modelFor('scopes.scope'); - return this.store.query('auth-method', { scope_id }); + const scope = this.modelFor('scopes.scope'); + const { id: scope_id } = scope; + if ( + this.can.can('list collection', scope, { collection: 'auth-methods' }) + ) { + return this.store.query('auth-method', { scope_id }); + } } // =actions diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs index 65e456c51..30e63cc29 100644 --- a/ui/admin/app/templates/scopes/scope.hbs +++ b/ui/admin/app/templates/scopes/scope.hbs @@ -106,10 +106,12 @@ {{t 'resources.role.title_plural'}} - - - {{t 'resources.auth-method.title_plural'}} - + {{#if (can 'navigate collection' @model collection='auth-methods')}} + + + {{t 'resources.auth-method.title_plural'}} + + {{/if}} {{/unless}} diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs index 4bd1bd2a4..a795d6449 100644 --- a/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs +++ b/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs @@ -12,25 +12,30 @@ + {{#if @model}} - - - {{t 'resources.auth-method.types.password'}} - - - {{t 'resources.auth-method.types.oidc'}} - - + {{#if (can 'create collection' this.scope collection='auth-methods')}} + {{#if @model}} + + + {{t 'resources.auth-method.types.password'}} + + + {{t 'resources.auth-method.types.oidc'}} + + + {{/if}} + {{/if}} {{/if}} @@ -165,7 +170,24 @@ as |message| > - {{t 'resources.auth-method.messages.welcome.description'}} + {{#if (can 'list collection' this.scope collection='auth-methods')}} + {{! can list (at least): show default welcome message}} + {{t 'resources.auth-method.messages.welcome.description'}} + {{else if (can + 'create collection' this.scope collection='auth-methods' + )}} + {{! can create (only): show create-but-not-list welcome message}} + {{t + 'descriptions.create-but-not-list' + resource=(t 'resources.auth-method.title_plural') + }} + {{else}} + {{! can neither list nor create }} + {{t + 'descriptions.neither-list-nor-create' + resource=(t 'resources.auth-method.title_plural') + }} + {{/if}} {{t 'titles.new'}} + {{#if (can 'create collection' this.scope collection='auth-methods')}} + + + {{t 'titles.new'}} + + {{/if}} diff --git a/ui/admin/tests/acceptance/auth-methods-test.js b/ui/admin/tests/acceptance/auth-methods/create-test.js similarity index 69% rename from ui/admin/tests/acceptance/auth-methods-test.js rename to ui/admin/tests/acceptance/auth-methods/create-test.js index 61d8071a3..55a76243b 100644 --- a/ui/admin/tests/acceptance/auth-methods-test.js +++ b/ui/admin/tests/acceptance/auth-methods/create-test.js @@ -2,7 +2,6 @@ import { module, test } from 'qunit'; import { visit, currentURL, click, find, fillIn } from '@ember/test-helpers'; import { setupApplicationTest } from 'ember-qunit'; import setupMirage from 'ember-cli-mirage/test-support/setup-mirage'; -import a11yAudit from 'ember-a11y-testing/test-support/audit'; import { Response } from 'miragejs'; import { authenticateSession, @@ -12,7 +11,7 @@ import { } from 'ember-simple-auth/test-support'; import { enableFeature } from 'ember-feature-flags/test-support'; -module('Acceptance | auth methods', function (hooks) { +module('Acceptance | auth-methods | create ', function (hooks) { setupApplicationTest(hooks); setupMirage(hooks); @@ -22,66 +21,35 @@ module('Acceptance | auth methods', function (hooks) { org: null, }, authMethod: null, + orgScope: null, }; + const urls = { orgScope: null, authMethods: null, newAuthMethod: null, authMethod: null, + orgURL: null, }; hooks.beforeEach(function () { - // Setup Mirage mock resources for this test authenticateSession({}); - instances.scopes.global = this.server.create('scope', { id: 'global' }); - instances.scopes.org = this.server.create('scope', { + instances.orgScope = this.server.create('scope', { type: 'org', scope: { id: 'global', type: 'global' }, }); + instances.authMethod = this.server.create('auth-method', { - scope: instances.scopes.org, + scope: instances.orgScope, }); // Generate route URLs for resources - urls.orgScope = `/scopes/${instances.scopes.org.id}`; - urls.authMethods = `${urls.orgScope}/auth-methods`; + urls.orgURL = `/scopes/${instances.orgScope.id}`; + urls.authMethods = `${urls.orgURL}/auth-methods`; urls.newAuthMethod = `${urls.authMethods}/new?type=password`; urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`; }); - test('visiting auth methods', async function (assert) { - assert.expect(1); - await visit(urls.authMethods); - await a11yAudit(); - assert.equal(currentURL(), urls.authMethods); - }); - - test('can navigate to an auth method form', async function (assert) { - assert.expect(1); - await visit(urls.authMethods); - await click('main tbody .rose-table-header-cell:nth-child(1) a'); - await a11yAudit(); - assert.equal(currentURL(), urls.authMethod); - }); - - test('can update an auth method and save changes', async function (assert) { - assert.expect(1); - await visit(urls.authMethod); - await click('form [type="button"]', 'Activate edit mode'); - await fillIn('[name="name"]', 'update name'); - await click('form [type="submit"]:not(:disabled)'); - assert.equal(this.server.db.authMethods[0].name, 'update name'); - }); - - test('can update an auth method and cancel changes', async function (assert) { - assert.expect(1); - await visit(urls.authMethod); - await click('form [type="button"]', 'Activate edit mode'); - await fillIn('[name="name"]', 'update name'); - await click('form button:not([type="submit"])'); - assert.notEqual(this.server.db.authMethods[0].name, 'update name'); - }); - test('can create new auth method', async function (assert) { assert.expect(1); const authMethodsCount = this.server.db.authMethods.length; @@ -92,6 +60,34 @@ module('Acceptance | auth methods', function (hooks) { assert.equal(this.server.db.authMethods.length, authMethodsCount + 1); }); + test('can navigate to new auth-methods route with proper authorization', async function (assert) { + assert.expect(2); + instances.orgScope.authorized_collection_actions['auth-methods'] = [ + 'create', + 'list', + ]; + await visit(urls.orgURL); + assert.ok( + instances.orgScope.authorized_collection_actions['auth-methods'].includes( + 'create' + ) + ); + console.log(urls.orgURL); + assert.ok(find(`[href="${urls.authMethods}"]`)); + }); + + test('cannot navigate to new auth-methods route without proper authorization', async function (assert) { + assert.expect(2); + instances.orgScope.authorized_collection_actions['auth-methods'] = []; + await visit(urls.orgURL); + assert.notOk( + instances.orgScope.authorized_collection_actions['auth-methods'].includes( + 'create' + ) + ); + assert.notOk(find(`[href="${urls.authMethods}"]`)); + }); + test('can cancel new auth method creation', async function (assert) { assert.expect(2); const authMethodsCount = this.server.db.authMethods.length; @@ -106,7 +102,7 @@ module('Acceptance | auth methods', function (hooks) { test('user can make primary an auth method', async function (assert) { assert.expect(2); assert.notOk( - instances.scopes.org.primaryAuthMethodId, + instances.orgScope.primaryAuthMethodId, 'Primary auth method is not yet set.' ); enableFeature('primary-auth-method'); @@ -114,7 +110,7 @@ module('Acceptance | auth methods', function (hooks) { await click( '.rose-layout-page-actions .rose-dropdown-content [type="button"]:first-child' ); - const scope = this.server.schema.scopes.find(instances.scopes.org.id); + const scope = this.server.schema.scopes.find(instances.orgScope.id); assert.equal( scope.primaryAuthMethodId, instances.authMethod.id, @@ -136,7 +132,7 @@ module('Acceptance | auth methods', function (hooks) { ); }); assert.notOk( - instances.scopes.org.primaryAuthMethodId, + instances.orgScope.primaryAuthMethodId, 'Primary auth method is not yet set.' ); enableFeature('primary-auth-method'); @@ -149,11 +145,11 @@ module('Acceptance | auth methods', function (hooks) { test('user can remove as primary an auth method', async function (assert) { assert.expect(2); - instances.scopes.org.update({ + instances.orgScope.update({ primaryAuthMethodId: instances.authMethod.id, }); assert.ok( - instances.scopes.org.primaryAuthMethodId, + instances.orgScope.primaryAuthMethodId, 'Primary auth method is set.' ); enableFeature('primary-auth-method'); @@ -161,7 +157,7 @@ module('Acceptance | auth methods', function (hooks) { await click( '.rose-layout-page-actions .rose-dropdown-content [type="button"]:first-child' ); - const scope = this.server.schema.scopes.find(instances.scopes.org.id); + const scope = this.server.schema.scopes.find(instances.orgScope.id); assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.'); }); @@ -178,11 +174,11 @@ module('Acceptance | auth methods', function (hooks) { } ); }); - instances.scopes.org.update({ + instances.orgScope.update({ primaryAuthMethodId: instances.authMethod.id, }); assert.ok( - instances.scopes.org.primaryAuthMethodId, + instances.orgScope.primaryAuthMethodId, 'Primary auth method is set.' ); enableFeature('primary-auth-method'); @@ -196,7 +192,7 @@ module('Acceptance | auth methods', function (hooks) { test('user can make and remove primary auth methods from index', async function (assert) { assert.expect(3); assert.notOk( - instances.scopes.org.primaryAuthMethodId, + instances.orgScope.primaryAuthMethodId, 'Primary auth method is not yet set.' ); enableFeature('primary-auth-method'); @@ -204,7 +200,7 @@ module('Acceptance | auth methods', function (hooks) { await click( '.rose-table-body .rose-table-row:first-child .rose-dropdown-content [type="button"]:first-child' ); - let scope = this.server.schema.scopes.find(instances.scopes.org.id); + let scope = this.server.schema.scopes.find(instances.orgScope.id); assert.equal( scope.primaryAuthMethodId, instances.authMethod.id, @@ -213,7 +209,7 @@ module('Acceptance | auth methods', function (hooks) { await click( '.rose-table-body .rose-table-row:first-child .rose-dropdown-content [type="button"]:first-child' ); - scope = this.server.schema.scopes.find(instances.scopes.org.id); + scope = this.server.schema.scopes.find(instances.orgScope.id); assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.'); }); }); diff --git a/ui/admin/tests/acceptance/auth-methods/list-test.js b/ui/admin/tests/acceptance/auth-methods/list-test.js new file mode 100644 index 000000000..bd9a8dfcd --- /dev/null +++ b/ui/admin/tests/acceptance/auth-methods/list-test.js @@ -0,0 +1,87 @@ +import { module, test } from 'qunit'; +import { visit, find } from '@ember/test-helpers'; +import { setupApplicationTest } from 'ember-qunit'; +import setupMirage from 'ember-cli-mirage/test-support/setup-mirage'; +import { + authenticateSession, + // These are left here intentionally for future reference. + //currentSession, + //invalidateSession, +} from 'ember-simple-auth/test-support'; + +module('Acceptance | auth-methods | list', function (hooks) { + setupApplicationTest(hooks); + setupMirage(hooks); + let orgURL; + + const instances = { + scopes: { + global: null, + org: null, + }, + orgScope: null, + }; + + const urls = { + scopes: { + org: null, + }, + authMethods: null, + }; + + hooks.beforeEach(function () { + instances.scopes.global = this.server.create('scope', { id: 'global' }); + instances.orgScope = this.server.create( + 'scope', + { + type: 'org', + scope: { id: 'global', type: 'global' }, + }, + 'withChildren' + ); + instances.org = this.server.create( + 'scope', + { + type: 'org', + scope: { id: 'global', type: 'global' }, + }, + 'withChildren' + ); + + orgURL = `/scopes/${instances.orgScope.id}`; + urls.authMethods = `/scopes/${instances.orgScope.id}/auth-methods`; + authenticateSession({}); + }); + + test('can navigate to users with proper authorization', async function (assert) { + assert.expect(2); + await visit(orgURL); + assert.ok( + instances.orgScope.authorized_collection_actions['auth-methods'].includes( + 'list' + ) + ); + assert.ok(find(`[href="${urls.authMethods}"]`)); + }); + + test('User cannot navigate to index without either list or create actions', async function (assert) { + assert.expect(2); + instances.orgScope.authorized_collection_actions['auth-methods'] = []; + await visit(orgURL); + assert.notOk( + instances.orgScope.authorized_collection_actions['auth-methods'].includes( + 'list' + ) + ); + assert.notOk(find(`[href="${urls.authMethods}"]`)); + }); + + test('User can navigate to index with only create action', async function (assert) { + assert.expect(1); + instances.orgScope.authorized_collection_actions['auth-methods'] = [ + 'create', + ]; + await visit(orgURL); + assert.ok(find(`[href="${urls.authMethods}"]`)); + }); +});