test: 💍 add read capability and test

addons/core/translations/resources/en-us.yaml

@@ -346,3 +346,8 @@ credential-library:
       help: The body of the HTTP request the library sends to Vault when requesting credentials. Only allowed when HTTP method is set to POST.
   types:
     vault: Vault
+scope:
+  title: Scope
+  title_plural: Scopes
+  messages:
+    cannot_read: While you do not have permission to read this scope, you may have permission to view resources within it.

ui/admin/app/templates/scopes/scope/edit.hbs

@@ -28,13 +28,15 @@
     </Copyable>
   </page.header>
 
-  <page.navigation>
-    <Rose::Nav::Tabs as |nav|>
-      <nav.link @route='scopes.scope'>
-        {{t 'titles.details'}}
-      </nav.link>
-    </Rose::Nav::Tabs>
-  </page.navigation>
+  {{#if (can 'read model' @model)}}
+    <page.navigation>
+      <Rose::Nav::Tabs as |nav|>
+        <nav.link @route='scopes.scope'>
+          {{t 'titles.details'}}
+        </nav.link>
+      </Rose::Nav::Tabs>
+    </page.navigation>
+  {{/if}}
 
   {{#if (can 'delete model' @model)}}
     <page.actions>
@@ -59,11 +61,21 @@
   {{/if}}
 
   <page.body>
-    <Form::Scope
-      @model={{@model}}
-      @submit={{route-action 'save' @model}}
-      @cancel={{route-action 'cancel' @model}}
-    />
+    {{#if (can 'read model' @model)}}
+      <Form::Scope
+        @model={{@model}}
+        @submit={{route-action 'save' @model}}
+        @cancel={{route-action 'cancel' @model}}
+      />
+    {{else}}
+      <Rose::Layout::Centered>
+        <Rose::Message as |message|>
+          <message.description>
+            {{t 'resources.scope.messages.cannot_read'}}
+          </message.description>
+        </Rose::Message>
+      </Rose::Layout::Centered>
+    {{/if}}
   </page.body>
 
 </Rose::Layout::Page>

ui/admin/tests/acceptance/scopes/read-test.js

@@ -0,0 +1,55 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | scopes | read', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+  };
+  const urls = {
+    orgScopeEdit: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Generate resources
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    // Generate route URLs for resources
+    urls.orgScopeEdit = `/scopes/${instances.scopes.org.id}/edit`;
+    // Generate resource couner
+    authenticateSession({});
+  });
+
+  test('visiting org scope edit', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScopeEdit);
+    await a11yAudit();
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    assert.ok(find('main .rose-form'));
+  });
+
+  test('visiting org scope edit without read permission results in no form displayed', async function (assert) {
+    assert.expect(2);
+    instances.scopes.org.update({ authorized_actions: [] });
+    await visit(urls.orgScopeEdit);
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    assert.notOk(find('main .rose-form'));
+  });
+});