chore: 🤖 merge main + resolve conflicts

ui/admin/app/components/copyable/index.js

@@ -12,8 +12,8 @@ export default class CopyableComponent extends Component {
   id = generateComponentID();
   copyableButtonId = `copyable-button-${this.id}`;
 
-  actionIcon = 'copy-action';
-  successIcon = 'copy-success';
+  actionIcon = 'flight-icons/clipboard-copy-16';
+  successIcon = 'flight-icons/clipboard-checked-16';
   actionText = this.args.buttonText;
   successText = this.args.acknowledgeText;
 

ui/admin/app/components/form/auth-method/oidc/index.hbs

@@ -177,7 +177,7 @@
               <row.cell @shrink={{true}}>
                 <Rose::Button
                   @style='warning'
-                  @iconOnly='trash'
+                  @iconOnly='flight-icons/trash-16'
                   title={{t 'actions.remove'}}
                   @disabled={{if
                     @model.isNew
@@ -278,7 +278,7 @@
               <row.cell @shrink={{true}}>
                 <Rose::Button
                   @style='warning'
-                  @iconOnly='trash'
+                  @iconOnly='flight-icons/trash-16'
                   title={{t 'actions.remove'}}
                   @disabled={{if
                     @model.isNew
@@ -368,7 +368,7 @@
               <row.cell @shrink={{true}}>
                 <Rose::Button
                   @style='warning'
-                  @iconOnly='trash'
+                  @iconOnly='flight-icons/trash-16'
                   title={{t 'actions.remove'}}
                   @disabled={{if
                     @model.isNew
@@ -477,7 +477,7 @@
               <row.cell @shrink={{true}}>
                 <Rose::Button
                   @style='warning'
-                  @iconOnly='trash'
+                  @iconOnly='flight-icons/trash-16'
                   title={{t 'actions.remove'}}
                   @disabled={{if
                     @model.isNew
@@ -578,7 +578,7 @@
               <row.cell @shrink={{true}}>
                 <Rose::Button
                   @style='warning'
-                  @iconOnly='trash'
+                  @iconOnly='flight-icons/trash-16'
                   title={{t 'actions.remove'}}
                   @disabled={{if
                     @model.isNew

ui/admin/app/components/form/group/add-members/index.hbs

@@ -49,7 +49,7 @@
         {{t 'resources.group.messages.no-members.description'}}
       </message.description>
       <message.link @route='scopes.scope.groups.group.members'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/components/form/host-set/add-hosts/index.hbs

@@ -55,7 +55,7 @@
       <message.link
         @route='scopes.scope.host-catalogs.host-catalog.host-sets.host-set.hosts'
       >
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/components/form/role/add-principals/index.hbs

@@ -58,7 +58,7 @@
         {{t 'resources.role.principal.messages.none.description'}}
       </message.description>
       <message.link @route='scopes.scope.roles.role.principals'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/components/form/role/grants/index.hbs

@@ -74,7 +74,7 @@
         <item.cell>
           <Rose::Button
             @style='secondary'
-            @iconOnly='trash'
+            @iconOnly='flight-icons/trash-16'
             title={{t 'actions.remove'}}
             {{on 'click' (fn @removeGrant grant.value)}}
           >

ui/admin/app/components/form/role/index.hbs

@@ -69,9 +69,11 @@
           @text={{this.selectedGrantScope.displayName}}
           @icon={{if
             this.selectedGrantScope.isProject
-            'app-icons/project'
+            'flight-icons/grid-16'
             (if
-              this.selectedGrantScope.isOrg 'app-icons/org' 'app-icons/global'
+              this.selectedGrantScope.isOrg
+              'flight-icons/org-16'
+              'flight-icons/globe-16'
             )
           }}
           as |dropdown|

ui/admin/app/components/form/target/add-credential-libraries/index.hbs

@@ -55,7 +55,7 @@
         {{t 'resources.target.credential-library.messages.none.description'}}
       </message.description>
       <message.link @route='scopes.scope.targets.target.credential-libraries'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/components/form/target/add-host-sets/index.hbs

@@ -59,7 +59,7 @@
         {{t 'resources.target.host-set.messages.none.description'}}
       </message.description>
       <message.link @route='scopes.scope.targets.target.host-sets'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/components/form/user/add-accounts/index.hbs

@@ -59,7 +59,7 @@
         {{t 'resources.user.messages.no-accounts.description'}}
       </message.description>
       <message.link @route='scopes.scope.users.user.accounts'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/routes/scopes/scope/groups.js

@@ -11,7 +11,7 @@ export default class ScopesScopeGroupsRoute extends Route {
   @service intl;
   @service notify;
   @service session;
-
+  @service can;
   // =methods
 
   /**
@@ -26,8 +26,11 @@ export default class ScopesScopeGroupsRoute extends Route {
    * @return {Promise[GroupModel]}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('group', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'groups' })) {
+      return this.store.query('group', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/groups/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeGroupsIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeGroupsIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}

ui/admin/app/routes/scopes/scope/roles.js

@@ -11,6 +11,7 @@ export default class ScopesScopeRolesRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,11 @@ export default class ScopesScopeRolesRoute extends Route {
    * @return {Promise{[RoleModel]}}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('role', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'roles' })) {
+      return this.store.query('role', { scope_id });
+    }
   }
 
   // =actions

ui/admin/app/routes/scopes/scope/roles/index.js

@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeRolesIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeRolesIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}

ui/admin/app/styles/app.scss

@@ -189,14 +189,6 @@
   }
 }
 
-.doc-link {
-  .large {
-    svg {
-      transform: scale(0.8);
-    }
-  }
-}
-
 [class*='session-status-'] {
   color: var(--ui-gray-subtler-2);
 }

ui/admin/app/templates/application.hbs

@@ -16,7 +16,7 @@
         <header.utilities as |utilities|>
           <utilities.dropdown
             @text={{this.session.data.authenticated.username}}
-            @icon='app-icons/user-profile'
+            @icon='flight-icons/user-circle-16'
             as |dropdown|
           >
             <dropdown.link @route='account.change-password'>
@@ -100,7 +100,7 @@
     <Rose::Dialog
       @heading={{t 'titles.abandon-confirm'}}
       @dismissButtonText={{t 'actions.cancel'}}
-      @icon='alert-triangle'
+      @icon='flight-icons/alert-triangle-16'
       @style='warning'
       @modal={{true}}
       @dismiss={{deny}}
@@ -126,7 +126,7 @@
         (t 'actions.confirm')
       }}
       @dismissButtonText={{t 'actions.cancel'}}
-      @icon='alert-triangle'
+      @icon='flight-icons/alert-triangle-16'
       @style='warning'
       @modal={{true}}
       @dismiss={{deny}}

ui/admin/app/templates/scopes/index.hbs

@@ -8,7 +8,7 @@
         <Rose::Layout::Centered>
           <Rose::Message
             @title={{t 'auth.titles.no-scopes'}}
-            @icon='alert-circle-outline'
+            @icon='flight-icons/alert-circle-16'
             as |message|
           >
             <message.description>

ui/admin/app/templates/scopes/scope.hbs

@@ -18,7 +18,7 @@
       {{#if @model.isGlobal}}
         <Rose::Nav::Sidebar @title={{t 'titles.general'}} as |nav|>
           <nav.link @route='scopes.scope.scopes'>
-            <Rose::Icon @name='app-icons/org' @size='medium' />
+            <Rose::Icon @name='flight-icons/org-16' @size='medium' />
             {{t 'resources.org.title_plural'}}
           </nav.link>
         </Rose::Nav::Sidebar>
@@ -28,12 +28,12 @@
         <Rose::Nav::Sidebar @title={{t 'titles.general'}} as |nav|>
           {{#if this.session.data.authenticated.isGlobal}}
             <nav.link @route='scopes.scope.scopes' @model='global'>
-              <Rose::Icon @name='app-icons/org' @size='medium' />
+              <Rose::Icon @name='flight-icons/org-16' @size='medium' />
               {{t 'resources.org.title_plural'}}
             </nav.link>
           {{/if}}
           <nav.link @route='scopes.scope.scopes'>
-            <Rose::Icon @name='app-icons/project' @size='medium' />
+            <Rose::Icon @name='flight-icons/grid-16' @size='medium' />
             {{t 'resources.project.title_plural'}}
           </nav.link>
         </Rose::Nav::Sidebar>
@@ -43,12 +43,12 @@
         <Rose::Nav::Sidebar @title={{t 'titles.general'}} as |nav|>
           {{#if this.session.data.authenticated.isGlobal}}
             <nav.link @route='scopes.scope.scopes' @model='global'>
-              <Rose::Icon @name='app-icons/org' @size='medium' />
+              <Rose::Icon @name='flight-icons/org-16' @size='medium' />
               {{t 'resources.org.title_plural'}}
             </nav.link>
           {{/if}}
           <nav.link @route='scopes.scope.scopes' @model={{@model.scopeID}}>
-            <Rose::Icon @name='app-icons/project' @size='medium' />
+            <Rose::Icon @name='flight-icons/grid-16' @size='medium' />
             {{t 'resources.project.title_plural'}}
           </nav.link>
         </Rose::Nav::Sidebar>
@@ -58,13 +58,13 @@
         <Rose::Nav::Sidebar @title={{t "titles.iam"}} as |nav|>
           <nav.link @route="scopes.scope.groups">
             <Rose::Icon
-              @name="app-icons/group"
+              @name="flight-icons/folder-users-16"
               @size="medium" />
             {{t "resources.group.title_plural"}}
           </nav.link>
           <nav.link @route="scopes.scope.roles">
             <Rose::Icon
-              @name="app-icons/roles"
+              @name="flight-icons/identity-user-16"
               @size="medium" />
             {{t "resources.role.title_plural"}}
           </nav.link>
@@ -72,22 +72,22 @@
         --}}
         <Rose::Nav::Sidebar @title={{t 'titles.resources'}} as |nav|>
           <nav.link @route='scopes.scope.sessions'>
-            <Rose::Icon @name='app-icons/action-session' @size='medium' />
+            <Rose::Icon @name='flight-icons/entry-point-16' @size='medium' />
             {{t 'resources.session.title_plural'}}
           </nav.link>
           {{#if (can 'navigate collection' @model collection='targets')}}
             <nav.link @route='scopes.scope.targets'>
-              <Rose::Icon @name='app-icons/target' @size='medium' />
+              <Rose::Icon @name='flight-icons/crosshair-16' @size='medium' />
               {{t 'resources.target.title_plural'}}
             </nav.link>
           {{/if}}
           <nav.link @route='scopes.scope.host-catalogs'>
-            <Rose::Icon @name='app-icons/host-catalogs' @size='medium' />
+            <Rose::Icon @name='flight-icons/collections-16' @size='medium' />
             {{t 'resources.host-catalog.title_plural'}}
           </nav.link>
           {{#if (feature-flag 'credential-store')}}
             <nav.link @route='scopes.scope.credential-stores'>
-              <Rose::Icon @name='app-icons/credentials' @size='medium' />
+              <Rose::Icon @name='flight-icons/key-16' @size='medium' />
               {{t 'resources.credential-store.title_plural'}}
             </nav.link>
           {{/if}}
@@ -98,20 +98,27 @@
         <Rose::Nav::Sidebar @title={{t 'titles.iam'}} as |nav|>
           {{#if (can 'navigate collection' @model collection='users')}}
             <nav.link @route='scopes.scope.users'>
-              <Rose::Icon @name='app-icons/users' @size='medium' />
+              <Rose::Icon @name='flight-icons/users-16' @size='medium' />
               {{t 'resources.user.title_plural'}}
             </nav.link>
           {{/if}}
-          <nav.link @route='scopes.scope.groups'>
-            <Rose::Icon @name='app-icons/group' @size='medium' />
-            {{t 'resources.group.title_plural'}}
-          </nav.link>
-          <nav.link @route='scopes.scope.roles'>
-            <Rose::Icon @name='app-icons/roles' @size='medium' />
-            {{t 'resources.role.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='groups')}}
+            <nav.link @route='scopes.scope.groups'>
+              <Rose::Icon @name='flight-icons/folder-users-16' @size='medium' />
+              {{t 'resources.group.title_plural'}}
+            </nav.link>
+          {{/if}}
+          {{#if (can 'navigate collection' @model collection='roles')}}
+            <nav.link @route='scopes.scope.roles'>
+              <Rose::Icon
+                @name='flight-icons/identity-user-16'
+                @size='medium'
+              />
+              {{t 'resources.role.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.auth-methods'>
-            <Rose::Icon @name='app-icons/auth-method' @size='medium' />
+            <Rose::Icon @name='flight-icons/lock-16' @size='medium' />
             {{t 'resources.auth-method.title_plural'}}
           </nav.link>
         </Rose::Nav::Sidebar>

ui/admin/app/templates/scopes/scope/-header-nav.hbs

@@ -2,8 +2,8 @@
   @text={{this.scopes.selectedOrg.displayName}}
   @icon={{if
     this.scopes.selectedOrg.isGlobal
-    'app-icons/global'
-    'app-icons/org'
+    'flight-icons/globe-16'
+    'flight-icons/org-16'
   }}
   as |dropdown|
 >
@@ -23,7 +23,7 @@
 {{#if this.scopes.selectedProject}}
   <Rose::Dropdown
     @text={{this.scopes.selectedProject.displayName}}
-    @icon='app-icons/project'
+    @icon='flight-icons/grid-16'
     as |dropdown|
   >
     {{#each this.scopes.projects as |scope|}}

ui/admin/app/templates/scopes/scope/-sidebar.hbs

@@ -1,18 +1,18 @@
 <Rose::Nav::Sidebar @title={{t 'titles.iam'}} as |nav|>
   <nav.link @route='scopes.scope.users'>
-    <Rose::Icon @name='app-icons/users' @size='medium' />
+    <Rose::Icon @name='flight-icons/users-16' @size='medium' />
     {{t 'resources.user.title_plural'}}
   </nav.link>
   <nav.link @route='scopes.scope.groups'>
-    <Rose::Icon @name='app-icons/group' @size='medium' />
+    <Rose::Icon @name='flight-icons/folder-users-16' @size='medium' />
     {{t 'resources.group.title_plural'}}
   </nav.link>
   <nav.link @route='scopes.scope.roles'>
-    <Rose::Icon @name='app-icons/roles' @size='medium' />
+    <Rose::Icon @name='flight-icons/identity-user-16' @size='medium' />
     {{t 'resources.role.title_plural'}}
   </nav.link>
   <nav.link @route='scopes.scope.auth-methods'>
-    <Rose::Icon @name='app-icons/auth-method' @size='medium' />
+    <Rose::Icon @name='flight-icons/lock-16' @size='medium' />
     {{t 'resources.auth-method.title_plural'}}
   </nav.link>
 </Rose::Nav::Sidebar>

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-actions.hbs

@@ -3,8 +3,10 @@
     @text={{t (concat 'states.' @model.attributes.state)}}
     @icon={{if
       @model.isInactive
-      'disabled'
-      (if @model.isPrivate 'lock-closed-outline' 'check-circle-outline')
+      'flight-icons/x-circle-16'
+      (if
+        @model.isPrivate 'flight-icons/lock-16' 'flight-icons/check-circle-16'
+      )
     }}
     @dropdownRight={{true}}
     as |dropdown|

ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/index.hbs

@@ -115,7 +115,7 @@
         {{t 'resources.account.messages.welcome.description'}}
       </message.description>
       <message.link @route='scopes.scope.auth-methods.auth-method.accounts.new'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.account.actions.create'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/auth-methods/index.hbs

@@ -129,7 +129,7 @@
                     @dropdownRight={{true}}
                     @iconOnly={{true}}
                     @showCaret={{false}}
-                    @icon='more-horizontal'
+                    @icon='flight-icons/more-horizontal-16'
                     as |dropdown|
                   >
                     {{#unless authMethod.isPrimary}}
@@ -171,7 +171,7 @@
             @route='scopes.scope.auth-methods.new'
             @query={{hash type='password'}}
           >
-            <Rose::Icon @name='plus-circle-outline' />
+            <Rose::Icon @name='flight-icons/plus-circle-16' />
             {{t 'titles.new'}}
           </message.link>
         </Rose::Message>

ui/admin/app/templates/scopes/scope/authenticate.hbs

@@ -16,7 +16,7 @@
             }}</p>
           <Rose::Dropdown
             @text={{t 'actions.choose-different-org'}}
-            @icon='user-organization'
+            @icon='flight-icons/org-16'
             as |dropdown|
           >
             <dropdown.link @route='scopes.scope.authenticate' @model='global'>
@@ -79,7 +79,7 @@
             <Rose::Layout::Centered>
               <Rose::Message
                 @title={{t 'resources.auth-method.messages.none.title'}}
-                @icon='alert-circle-outline'
+                @icon='flight-icons/alert-circle-16'
                 as |message|
               >
                 <message.description>

ui/admin/app/templates/scopes/scope/authenticate/index.hbs

@@ -2,7 +2,7 @@
   <Rose::Layout::Centered>
     <Rose::Message
       @title={{t 'resources.auth-method.messages.none.title'}}
-      @icon='alert-circle-outline'
+      @icon='flight-icons/alert-circle-16'
       as |message|
     >
       <message.description>

ui/admin/app/templates/scopes/scope/credential-stores/credential-store/credential-libraries/index.hbs

@@ -58,7 +58,7 @@
       <message.link
         @route='scopes.scope.credential-stores.credential-store.credential-libraries.new'
       >
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'titles.new'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/credential-stores/index.hbs

@@ -82,7 +82,7 @@
             {{t 'resources.credential-store.description'}}
           </message.description>
           <message.link @route='scopes.scope.credential-stores.new'>
-            <Rose::Icon @name='plus-circle-outline' />
+            <Rose::Icon @name='flight-icons/plus-circle-16' />
             {{t 'titles.new'}}
           </message.link>
         </Rose::Message>

ui/admin/app/templates/scopes/scope/groups/group/members.hbs

@@ -27,7 +27,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -58,7 +58,7 @@
         {{t 'resources.group.messages.members.description'}}
       </message.description>
       <message.link @route='scopes.scope.groups.group.add-members'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.group.actions.add-members'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/groups/index.hbs

@@ -13,10 +13,12 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.groups.new' @style='primary'>{{t
-          'titles.new'
-        }}</Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='groups')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.groups.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -70,11 +72,29 @@
         >
           <message.description>
             {{t 'resources.group.description'}}
+            {{#if (can 'list collection' this.scope collection='groups')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.group.description'}}
+            {{else if (can 'create collection' this.scope collection='groups')}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.group.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.group.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.groups.new'>
-            <Rose::Icon @name='plus-circle-outline' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if (can 'create collection' this.scope collection='groups')}}
+            <message.link @route='scopes.scope.groups.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/host-set/hosts.hbs

@@ -37,7 +37,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -70,7 +70,7 @@
       </message.description>
       {{!--
       <message.link @route="scopes.scope.host-catalogs.host-catalog.host-sets.host-set.create-and-add-host">
-        <Rose::Icon @name="plus-circle-outline" />
+        <Rose::Icon @name="flight-icons/plus-circle-16" />
         {{t "resources.host-set.actions.create-and-add-host"}}
       </message.link>
       --}}

ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/index.hbs

@@ -56,7 +56,7 @@
       <message.link
         @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
       >
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'titles.new'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/hosts/index.hbs

@@ -58,7 +58,7 @@
         {{t 'resources.host.description'}}
       </message.description>
       <message.link @route='scopes.scope.host-catalogs.host-catalog.hosts.new'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'titles.new'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/host-catalogs/index.hbs

@@ -85,7 +85,7 @@
             {{t 'resources.host-catalog.description'}}
           </message.description>
           <message.link @route='scopes.scope.host-catalogs.new'>
-            <Rose::Icon @name='plus-circle-outline' />
+            <Rose::Icon @name='flight-icons/plus-circle-16' />
             {{t 'titles.new'}}
           </message.link>
         </Rose::Message>

ui/admin/app/templates/scopes/scope/roles/index.hbs

@@ -15,10 +15,12 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.roles.new' @style='primary'>{{t
-          'titles.new'
-        }}</Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='roles')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.roles.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -68,12 +70,29 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.role.description'}}
+            {{#if (can 'list collection' this.scope collection='roles')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.roles.description'}}
+            {{else if (can 'create collection' this.scope collection='roles')}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.role.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.role.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.roles.new'>
-            <Rose::Icon @name='plus-circle-outline' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if (can 'create collection' this.scope collection='roles')}}
+            <message.link @route='scopes.scope.roles.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 

ui/admin/app/templates/scopes/scope/roles/role/principals.hbs

@@ -31,7 +31,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -62,7 +62,7 @@
         {{t 'resources.role.principal.messages.welcome.description'}}
       </message.description>
       <message.link @route='scopes.scope.roles.role.add-principals'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.role.principal.actions.add-principals'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/scopes/index.hbs

@@ -43,7 +43,11 @@
             @title={{scope.name}}
             @description={{scope.description}}
             @id={{scope.id}}
-            @icon={{if scope.isOrg 'app-icons/org' 'app-icons/project'}}
+            @icon={{if
+              scope.isOrg
+              'flight-icons/org-16'
+              'flight-icons/grid-16'
+            }}
             @route='scopes.scope'
             @model={{scope.id}}
           />
@@ -62,7 +66,7 @@
               {{t 'resources.org.description'}}
             </message.description>
             <message.link @route='scopes.scope.new'>
-              <Rose::Icon @name='plus-circle-outline' />
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
               {{t 'titles.new'}}
             </message.link>
           </Rose::Message>
@@ -79,7 +83,7 @@
               {{t 'resources.project.description'}}
             </message.description>
             <message.link @route='scopes.scope.new'>
-              <Rose::Icon @name='plus-circle-outline' />
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
               {{t 'titles.new'}}
             </message.link>
           </Rose::Message>

ui/admin/app/templates/scopes/scope/sessions/index.hbs

@@ -36,7 +36,7 @@
                     'session-status-'
                     sessionAggregate.session.status
                   }}
-                  @name='app-icons/action-session'
+                  @name='flight-icons/entry-point-16'
                   @size='medium'
                 />
                 <Copyable

ui/admin/app/templates/scopes/scope/targets/index.hbs

@@ -104,7 +104,7 @@
 
           {{#if (can 'create collection' this.scope collection='targets')}}
             <message.link @route='scopes.scope.targets.new'>
-              <Rose::Icon @name='plus-circle-outline' />
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
               {{t 'titles.new'}}
             </message.link>
           {{/if}}

ui/admin/app/templates/scopes/scope/targets/target/add-credential-libraries.hbs

@@ -19,7 +19,7 @@
         {{t 'resources.target.credential-library.messages.none.description'}}
       </message.description>
       <message.link @route='scopes.scope.targets.target.credential-libraries'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/targets/target/add-host-sets.hbs

@@ -20,7 +20,7 @@
         {{t 'resources.target.host-set.messages.none.description'}}
       </message.description>
       <message.link @route='scopes.scope.targets.target.host-sets'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/targets/target/credential-libraries.hbs

@@ -44,7 +44,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -82,7 +82,7 @@
       <message.link
         @route='scopes.scope.targets.target.add-credential-libraries'
       >
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.target.actions.add-credential-libraries'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/targets/target/host-sets.hbs

@@ -34,7 +34,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -68,7 +68,7 @@
         {{t 'resources.target.host-set.messages.welcome.description'}}
       </message.description>
       <message.link @route='scopes.scope.targets.target.add-host-sets'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.target.actions.add-host-sets'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/users/index.hbs

@@ -89,7 +89,7 @@
           </message.description>
           {{#if (can 'create collection' this.scope collection='users')}}
             <message.link @route='scopes.scope.users.new'>
-              <Rose::Icon @name='plus-circle-outline' />
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
               {{t 'titles.new'}}
             </message.link>
           {{/if}}

ui/admin/app/templates/scopes/scope/users/user/accounts.hbs

@@ -34,7 +34,7 @@
           </row.cell>
           <row.cell>
             <Rose::Dropdown
-              @icon='more-horizontal'
+              @icon='flight-icons/more-horizontal-16'
               @iconOnly={{true}}
               @showCaret={{false}}
               @dropdownRight={{true}}
@@ -68,7 +68,7 @@
         {{t 'resources.user.messages.accounts.description'}}
       </message.description>
       <message.link @route='scopes.scope.users.user.add-accounts'>
-        <Rose::Icon @name='plus-circle-outline' />
+        <Rose::Icon @name='flight-icons/plus-circle-16' />
         {{t 'resources.user.actions.add-accounts'}}
       </message.link>
     </Rose::Message>

ui/admin/app/templates/scopes/scope/users/user/add-accounts.hbs

@@ -20,7 +20,7 @@
         {{t 'resources.user.messages.no-accounts.description'}}
       </message.description>
       <message.link @route='scopes.scope.users.user.accounts'>
-        <Rose::Icon @name='chevron-left' />
+        <Rose::Icon @name='flight-icons/chevron-left-16' />
         {{t 'actions.back'}}
       </message.link>
     </Rose::Message>

ui/admin/package.json

@@ -50,7 +50,7 @@
     "ember-a11y-testing": "^4.0.7",
     "ember-auto-import": "^1.10.1",
     "ember-breadcrumbs": "^0.2.3",
-    "ember-cli": "~3.27.0",
+    "ember-cli": "~3.28.0",
     "ember-cli-app-version": "^5.0.0",
     "ember-cli-babel": "^7.23.0",
     "ember-cli-code-coverage": "^1.0.2",

ui/admin/tests/acceptance/groups/create-test.js

@@ -10,9 +10,10 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | groups', function (hooks) {
+module('Acceptance | groups | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
+  let orgURL;
 
   const instances = {
     scopes: {
@@ -20,9 +21,9 @@ module('Acceptance | groups', function (hooks) {
       org: null,
     },
     group: null,
+    orgScope: null,
   };
   const urls = {
-    orgScope: null,
     groups: null,
     group: null,
     newGroup: null,
@@ -30,17 +31,21 @@ module('Acceptance | groups', function (hooks) {
 
   hooks.beforeEach(function () {
     authenticateSession({});
-    instances.scopes.global = this.server.create('scope', { id: 'global' });
-    instances.scopes.org = this.server.create('scope', {
-      type: 'org',
-      scope: { id: 'global', type: 'global' },
-    });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
     instances.group = this.server.create('group', {
-      scope: instances.scopes.org,
+      scope: instances.orgScope,
     });
-    urls.groups = `/scopes/${instances.scopes.org.id}/groups`;
+    urls.groups = `/scopes/${instances.orgScope.id}/groups`;
     urls.group = `${urls.groups}/${instances.group.id}`;
     urls.newGroup = `${urls.groups}/new`;
+    orgURL = `/scopes/${instances.orgScope.id}`;
   });
 
   test('can create new group', async function (assert) {
@@ -52,6 +57,24 @@ module('Acceptance | groups', function (hooks) {
     assert.equal(this.server.db.groups.length, groupsCount + 1);
   });
 
+  test('can navigate to new groups route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(orgURL);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.groups.includes('create')
+    );
+    assert.ok(find(`[href="${urls.groups}"]`));
+  });
+
+  test('cannot navigate to new groups route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.groups = [];
+    await visit(orgURL);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.groups.includes('create')
+    );
+    assert.notOk(find(`[href="${urls.groups}"]`));
+  });
   test('can cancel new group creation', async function (assert) {
     assert.expect(2);
     const groupsCount = this.server.db.groups.length;

ui/admin/tests/acceptance/groups/list-test.js

@@ -0,0 +1,76 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | groups | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+  let orgURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    groups: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.group = this.server.create('group', {
+      scope: instances.orgScope,
+    });
+    orgURL = `/scopes/${instances.orgScope.id}`;
+
+    urls.groups = `/scopes/${instances.orgScope.id}/groups`;
+    authenticateSession({});
+  });
+
+  test('can navigate to groups with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(orgURL);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.groups.includes('list')
+    );
+    assert.ok(find(`[href="${urls.groups}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.groups = [];
+    await visit(orgURL);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.groups.includes('list')
+    );
+    assert.notOk(find(`[href="${urls.groups}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.orgScope.authorized_collection_actions.groups = ['create'];
+    await visit(orgURL);
+    assert.ok(find(`[href="${urls.groups}"]`));
+  });
+});

ui/admin/tests/acceptance/roles/create-test.js

@@ -11,7 +11,7 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | roles', function (hooks) {
+module('Acceptance | roles | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -22,38 +22,44 @@ module('Acceptance | roles', function (hooks) {
       project: null,
     },
     role: null,
+    orgScope: null,
   };
   const urls = {
-    orgScope: null,
     roles: null,
     role: null,
     newRole: null,
+    orgScope: null,
   };
 
   hooks.beforeEach(function () {
     authenticateSession({});
-    instances.scopes.global = this.server.create('scope', { id: 'global' });
-    instances.scopes.org = this.server.create('scope', {
-      type: 'org',
-      scope: { id: 'global', type: 'global' },
-    });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+
     // The project scope is not yet used for role tests (though it will be
     // in the future).  This is created simply to test the grant scope loading
     // mechanism.
     instances.scopes.project = this.server.create('scope', {
       type: 'project',
-      scope: { id: instances.scopes.org.id, type: instances.scopes.org.type },
+      scope: { id: instances.orgScope.id, type: instances.orgScope.type },
     });
     instances.role = this.server.create(
       'role',
       {
-        scope: instances.scopes.org,
+        scope: instances.orgScope,
       },
       'withPrincipals'
     );
-    urls.roles = `/scopes/${instances.scopes.org.id}/roles`;
+    urls.roles = `/scopes/${instances.orgScope.id}/roles`;
     urls.role = `${urls.roles}/${instances.role.id}`;
     urls.newRole = `${urls.roles}/new`;
+    urls.orgScope = `/scopes/${instances.orgScope.id}`;
   });
 
   test('can create new role', async function (assert) {
@@ -65,6 +71,25 @@ module('Acceptance | roles', function (hooks) {
     assert.equal(this.server.db.roles.length, rolesCount + 1);
   });
 
+  test('Users can navigate to new roles route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScope);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.roles.includes('create')
+    );
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users cannot navigate to new roles route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.roles = [];
+    await visit(urls.orgScope);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.roles.includes('create')
+    );
+    assert.notOk(find(`[href="${urls.roles}"]`));
+  });
+
   test('can cancel new role creation', async function (assert) {
     assert.expect(2);
     const rolesCount = this.server.db.roles.length;

ui/admin/tests/acceptance/roles/list-test.js

@@ -0,0 +1,75 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | roles | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    roles: null,
+    orgScope: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.role = this.server.create('role', {
+      scope: instances.orgScope,
+    });
+    urls.orgScope = `/scopes/${instances.orgScope.id}`;
+
+    urls.roles = `/scopes/${instances.orgScope.id}/roles`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to roles with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScope);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.roles.includes('list')
+    );
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.roles = [];
+    await visit(urls.orgScope);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.roles.includes('list')
+    );
+    assert.notOk(find(`[href="${urls.roles}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.orgScope.authorized_collection_actions.roles = ['create'];
+    await visit(urls.orgScope);
+    assert.ok(find(`[href="${urls.roles}"]`));
+  });
+});