Merge pull request #604 from hashicorp/chore-windows-container-build

Chore windows container build

.github/workflows/monorepo-validate.yaml

@@ -1,5 +1,5 @@
 name: Validate Monorepo
-on: [push]
+on: pull_request
 jobs:
 
   compliance:
@@ -19,26 +19,10 @@ jobs:
         if: steps.cache.outputs.cache-hit != 'true'
       - run: yarn run compliance:licenses
 
-  audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
-        with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
-      - run: yarn run compliance:audit
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v2
       - uses: actions/cache@v2
@@ -56,6 +40,7 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v2
       - uses: actions/cache@v2

.github/workflows/test-release-trigger.yml

@@ -0,0 +1,23 @@
+name: "Trigger Test Boundary UI release"
+
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
+        required: true
+
+jobs:
+  trigger-circleci-release:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Trigger Release job
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
+
+          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
+          -d '{ "branch": "main", "parameters": {"TAG": "'${{ github.event.inputs.branch }}'" }}' \
+          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

.github/workflows/ui-release-trigger.yml

@@ -9,12 +9,11 @@ jobs:
   trigger-circleci-release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@master
+      - uses: actions/checkout@v2
       - name: Trigger Release job
-        env:
-          TAG: ${{ github.event.release.tag_name }}
         run: |
+          echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
+
           curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "${TAG}" }}' \
+          -d '{ "branch": "main", "parameters": {"TAG": "'${GITHUB_REF#refs/tags/}'" }}' \
           https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

CONTRIBUTING.md

@@ -0,0 +1,6 @@
+# Contributing to Boundary
+
+Thank you for contributing to Boundary! Here you can find common questions around reporting issues and opening
+pull requests to our project.
+
+When contributing in any way to the Boundary project (new issue, PR, etc), please be aware that our team identifies with many gender pronouns and to use non-binary pronouns when addressing our team. For more reading on our code of conduct, please see the [HashiCorp community guidelines](https://www.hashicorp.com/community-guidelines). 

README.md

@@ -24,6 +24,9 @@ subproject, e.g. running or testing.
   - [Building Admin UI for Production](#building-admin-ui-for-production)
     - [Building with a Container](#building-with-a-container)
   - [Building Desktop UI for Production](#building-desktop-ui-for-production)
+  - [Connect Boundary UI to Boundary local instance](#connect-boundary-ui-to-boundary-local-instance)
+    - [For admin](#for-admin)
+    - [For desktop](#for-desktop)
   - [Committing](#committing)
     - [License Checking](#license-checking)
 
@@ -35,6 +38,9 @@ You will need the following things properly installed on your computer.
 
 * [Git][git]
 * [Node.js][node]
+  * v10–v15
+  * **Apple Silicon Users**:  if you experience problems building or running
+    Boundary UIs, try Node v15.
 * [Yarn][yarn] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]
@@ -116,11 +122,45 @@ yarn install
 yarn build:ui:desktop
 ```
 
+In windows, UI is generated using docker to provide a stable UI across platforms.
+
+```cmd
+yarn install
+docker-compose -f docker-compose-embedding.yml run build-desktop-production 
+yarn build:ui:desktop:app
+```
+
 To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY`
-environment variable to set signing certificate name (e.g Developer ID Application: * (*)).
+environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `yarn build:ui:desktop:app`.
 
 Assets are saved to `ui/desktop/electron-app/out/make/`.
-DMG packaged desktop UI is available at asset location as `Boundary Desktop.dmg`.
+DMG packaged desktop UI is available at asset location as `boundary.dmg`.
+EXE archived desktop UI is available at asset location under `zip` folder.
+
+### Connect Boundary UI to Boundary local instance
+
+This describes how to connect local Boundary UI to your local instance of Boundary.
+
+This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://learn.hashicorp.com/tutorials/boundary/getting-started-dev?in=boundary/getting-started#start-a-dev-environment).
+#### For admin
+
+This assumes you are within `boundary-ui/ui/admin`.
+
+You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 yarn start`.
+
+Following terminal instructions, open in your browser: `http://localhost:4200/`.
+
+Once you open the UI you will see the login screen, authenticate using generated admin login name and password.
+
+#### For desktop
+
+This assumes you are within `boundary-ui/ui/desktop`.
+
+You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false yarn start:desktop`.
+
+In login screen, authenticate using generated admin login name and password.
+
+Enter the origin of your Boundary dev instance, by default is: `http://localhost:9200`.
 
 ### Committing
 

addons/api/.eslintignore

@@ -13,6 +13,7 @@
 # misc
 /coverage/
 !.*
+.eslintcache
 
 # ember-try
 /.node_modules.ember-try/

addons/api/.eslintrc.js

@@ -7,48 +7,54 @@ module.exports = {
     ecmaVersion: 2018,
     sourceType: 'module',
     ecmaFeatures: {
-      legacyDecorators: true
-    }
+      legacyDecorators: true,
+    },
   },
-  plugins: [
-    'ember'
-  ],
+  plugins: ['ember'],
   extends: [
     'eslint:recommended',
-    'plugin:ember/recommended'
+    'plugin:ember/recommended',
+    'plugin:prettier/recommended',
   ],
   env: {
-    browser: true
+    browser: true,
+  },
+  rules: {
+    'ember/no-get': 'off',
+    'ember/no-get-with-default': 'off',
+    'ember/no-computed-properties-in-native-classes': 'off',
+    'ember/no-assignment-of-untracked-properties-used-in-tracking-contexts':
+      'off',
   },
-  rules: {},
   overrides: [
     // node files
     {
       files: [
         '.eslintrc.js',
+        '.prettierrc.js',
         '.template-lintrc.js',
         'ember-cli-build.js',
         'index.js',
         'testem.js',
         'blueprints/*/index.js',
         'config/**/*.js',
-        'tests/dummy/config/**/*.js'
+        'tests/dummy/config/**/*.js',
       ],
       excludedFiles: [
         'addon/**',
         'addon-test-support/**',
         'app/**',
-        'tests/dummy/app/**'
+        'tests/dummy/app/**',
       ],
       parserOptions: {
-        sourceType: 'script'
+        sourceType: 'script',
       },
       env: {
         browser: false,
-        node: true
+        node: true,
       },
       plugins: ['node'],
-      extends: ['plugin:node/recommended']
-    }
-  ]
+      extends: ['plugin:node/recommended'],
+    },
+  ],
 };

addons/api/.npmignore

@@ -10,6 +10,7 @@
 /.editorconfig
 /.ember-cli
 /.env*
+/.eslintcache
 /.eslintignore
 /.eslintrc.js
 /.git/

addons/api/.prettierignore

@@ -1,4 +1,6 @@
-# See https://help.github.com/ignore-files/ for more about ignoring files.
+# unconventional js
+/blueprints/*/files/
+/vendor/
 
 # compiled output
 /dist/
@@ -9,15 +11,9 @@
 /node_modules/
 
 # misc
-/.env*
-/.pnp*
-/.sass-cache
-/connect.lock
 /coverage/
-/libpeerconnection.log
-/npm-debug.log*
-/testem.log
-/yarn-error.log
+!.*
+.eslintcache
 
 # ember-try
 /.node_modules.ember-try/

addons/api/.prettierrc.js

@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = {
+  singleQuote: true,
+};

addons/api/.template-lintrc.js

@@ -1,5 +1,5 @@
 'use strict';
 
 module.exports = {
-  extends: 'octane'
+  extends: 'octane',
 };

addons/api/addon/adapters/application.js

@@ -3,7 +3,7 @@ import { serializeIntoHash } from '@ember-data/adapter/-private';
 /* eslint-disable-next-line ember/no-mixins */
 import AdapterBuildURLMixin from '../mixins/adapter-build-url';
 import config from 'ember-get-config';
-import { get, getWithDefault } from '@ember/object';
+import { get } from '@ember/object';
 import { InvalidError } from '@ember-data/adapter/error';
 import { dasherize } from '@ember/string';
 import { pluralize } from 'ember-inflector';
@@ -69,7 +69,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @return {string}
    */
   urlSuffix(modelName, id, snapshot = {}) {
-    const method = getWithDefault(snapshot, 'adapterOptions.method', '');
+    const method = get(snapshot, 'adapterOptions.method') || '';
     return method ? `:${method}` : '';
   }
 
@@ -248,7 +248,11 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
     // Normalize field-specific errors, if any.
     const errors = fieldErrors.map((error) => ({
       detail: error.description,
-      source: { pointer: `/data/attributes/${error.name}` },
+      // Ember Data cannot handle errors on nested attributes, so these are
+      // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
+      // To capture these errors, add read-only fields on the model
+      // corresponding to the underscored field name.
+      source: { pointer: `/data/attributes/${error.name.replace('.', '_')}` },
     }));
     // Return a list of JSON API errors rooted under the `errors` key.
     return {

addons/api/addon/generated/models/auth-method.js

@@ -7,6 +7,12 @@ import { attr } from '@ember-data/model';
 export default class GeneratedAuthMethodModel extends BaseModel {
   // =attributes
 
+  @attr('boolean', {
+    description: 'Specifies if this is the primary auth method for its scope.',
+    readOnly: true,
+  })
+  is_primary;
+
   @attr('string', {
     description: 'The type of the resource, to help differentiate schemas',
   })

addons/api/addon/generated/models/role.js

@@ -18,7 +18,8 @@ export default class GeneratedRoleModel extends BaseModel {
   description;
 
   @attr('string', {
-    description: 'The scope to which this role applies.  Defaults to the role\'s scope.',
+    description:
+      "The scope to which this role applies.  Defaults to the role's scope.",
   })
   grant_scope_id;
 

addons/api/addon/generated/models/scope.js

@@ -7,6 +7,12 @@ import { attr } from '@ember-data/model';
 export default class GeneratedScopeModel extends BaseModel {
   // =attributes
 
+  @attr('string', {
+    description:
+      'The ID of the primary auth method for this scope.  A primary auth method\nis allowed to vivify users when new accounts are created and is the source for the users account info.',
+  })
+  primary_auth_method_id;
+
   @attr('string', {
     description: 'The type of the resource',
   })

addons/api/addon/generated/models/session.js

@@ -2,7 +2,6 @@ import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
 export default class GeneratedSessionModel extends BaseModel {
-
   // =attributes
 
   @attr('string') user_id;
@@ -32,5 +31,4 @@ export default class GeneratedSessionModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
-
 }

addons/api/addon/generated/models/target.js

@@ -24,13 +24,13 @@ export default class GeneratedTargetModel extends BaseModel {
 
   @attr('number', {
     description: '',
-    defaultValue: 28800
+    defaultValue: 28800,
   })
   session_max_seconds;
 
   @attr('number', {
     description: '',
-    defaultValue: 1
+    defaultValue: 1,
   })
   session_connection_limit;
 

addons/api/addon/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -0,0 +1,15 @@
+// app/initializers/fragment-serializer.js
+import FragmentAuthMethodAttributesAccountClaimMapSerializer from '../serializers/fragment-auth-method-attributes-account-claim-map';
+
+export function initialize(application) {
+  application.register(
+    'serializer:fragment-auth-method-attributes-account-claim-map',
+    FragmentAuthMethodAttributesAccountClaimMapSerializer
+  );
+}
+
+// Fragment serializers must be manually registered
+export default {
+  name: 'fragment-auth-method-attributes-account-claim-map',
+  initialize: initialize,
+};

addons/api/addon/initializers/fragment-string.js

@@ -0,0 +1,12 @@
+// app/initializers/fragment-serializer.js
+import FragmentStringSerializer from '../serializers/fragment-string';
+
+export function initialize(application) {
+  application.register('serializer:fragment-string', FragmentStringSerializer);
+}
+
+// Fragment serializers must be manually registered
+export default {
+  name: 'fragment-string',
+  initialize: initialize,
+};

addons/api/addon/models/account.js

@@ -4,7 +4,6 @@ import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 
 export default class AccountModel extends GeneratedAccountModel {
-
   // =attributes
 
   /**
@@ -18,6 +17,11 @@ export default class AccountModel extends GeneratedAccountModel {
    */
   @equal('type', 'password') isPassword;
 
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'oidc') isOIDC;
+
   /**
    * Convenience for getting username in account.
    * @type {string}

addons/api/addon/models/auth-method.js

@@ -1,3 +1,123 @@
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
+import { attr } from '@ember-data/model';
+import { fragment } from 'ember-data-model-fragments/attributes';
+import { equal } from '@ember/object/computed';
 
-export default class AuthMethodModel extends GeneratedAuthMethodModel {}
+/**
+ * Enum options per auth method type and field.
+ */
+export const options = {
+  oidc: {
+    signing_algorithms: [
+      'RS256',
+      'RS384',
+      'RS512',
+      'ES256',
+      'ES384',
+      'ES512',
+      'PS256',
+      'PS384',
+      'PS512',
+      'EdDSA',
+    ],
+    state: ['inactive', 'active-private', 'active-public'],
+    account_claim_maps: {
+      to: ['sub', 'name', 'email'],
+    },
+  },
+};
+
+export default class AuthMethodModel extends GeneratedAuthMethodModel {
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_state;
+  @attr('string', { readOnly: true }) attributes_issuer;
+  @attr('string', { readOnly: true }) attributes_client_id;
+  @attr('string', { readOnly: true }) attributes_client_secret;
+  @attr('string', { readOnly: true }) attributes_max_age;
+  @attr('string', { readOnly: true }) attributes_api_url_prefix;
+  @attr('string', { readOnly: true })
+  attributes_disable_discovered_config_validation;
+  @attr('string', { readOnly: true }) attributes_dry_run;
+  @attr('string', { readOnly: true }) attributes_account_claim_maps;
+  @attr('string', { readOnly: true }) attributes_claims_scopes;
+  @attr('string', { readOnly: true }) attributes_signing_algorithms;
+  @attr('string', { readOnly: true }) attributes_allowed_audiences;
+  @attr('string', { readOnly: true }) attributes_idp_ca_certs;
+
+  // =attributes
+
+  /**
+   * Attributes of this resource, if any, represented as a JSON fragment.
+   * @type {FragmentAuthMethodAttributesModel}
+   */
+  @fragment('fragment-auth-method-attributes', { defaultValue: {} }) attributes;
+
+  /**
+   * @type {boolean}
+   */
+  @equal('is_primary', true) isPrimary;
+
+  /**
+   * @type {boolean}
+   */
+  get isPassword() {
+    return this.type === 'password';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isOIDC() {
+    return this.type === 'oidc';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isInactive() {
+    return this.attributes.state === 'inactive';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isPrivate() {
+    return this.attributes.state === 'active-private';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isPublic() {
+    return this.attributes.state === 'active-public';
+  }
+
+  // =methods
+
+  /**
+   * Change the active and visibility state of an OIDC auth method
+   * given its ID.
+   * For OIDC auth methods only.
+   * @param {[string]} state
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  changeState(state, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'change-state',
+      state,
+    };
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+}

addons/api/addon/models/base.js

@@ -25,7 +25,6 @@ import { computed } from '@ember/object';
  *   2) Or as an ID:  `record.scopeID`.
  */
 export default class BaseModel extends Model {
-
   // =relationships
 
   /**

addons/api/addon/models/fragment-account-attributes.js

@@ -2,8 +2,16 @@ import Fragment from 'ember-data-model-fragments/fragment';
 import { attr } from '@ember-data/model';
 
 export default class FragmentAccountAttributesModel extends Fragment {
+  // =attributes (password)
   @attr('string', {
+    for: 'password',
     description: 'The account login name',
   })
   login_name;
+
+  // =attributes (OIDC)
+  @attr('string', { for: 'oidc' }) subject;
+  @attr('string', { for: 'oidc' }) issuer;
+  @attr('string', { for: 'oidc', readOnly: true }) email;
+  @attr('string', { for: 'oidc', readOnly: true }) full_name;
 }

addons/api/addon/models/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1,9 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+
+export default class FragmentAuthMethodAttributesAccountClaimMapModel extends Fragment {
+  // =attributes (OIDC)
+
+  @attr('string') from;
+  @attr('string') to;
+}

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -0,0 +1,40 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+import { fragmentArray } from 'ember-data-model-fragments/attributes';
+
+export default class FragmentAuthMethodAttributesModel extends Fragment {
+  // =attributes (OIDC)
+
+  @attr('string', { readOnly: true }) state;
+  @attr('string') issuer;
+  @attr('string') client_id;
+  @attr('string') client_secret;
+  @attr('string', { readOnly: true }) client_secret_hmac;
+  @attr('number') max_age;
+  @attr('string') api_url_prefix;
+  @attr('string', { readOnly: true }) callback_url;
+  @attr('boolean') disable_discovered_config_validation;
+  @attr('boolean') dry_run;
+
+  @fragmentArray('fragment-auth-method-attributes-account-claim-map', {
+    emptyArrayIfMissing: true,
+  })
+  account_claim_maps;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  claims_scopes;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  signing_algorithms;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  allowed_audiences;
+
+  @fragmentArray('fragment-string', { emptyArrayIfMissing: true }) idp_ca_certs;
+}

addons/api/addon/models/host-set.js

@@ -2,7 +2,6 @@ import GeneratedHostSetModel from '../generated/models/host-set';
 import { fragmentArray } from 'ember-data-model-fragments/attributes';
 
 export default class HostSetModel extends GeneratedHostSetModel {
-
   // =attributes
 
   /**

addons/api/addon/models/host.js

@@ -2,11 +2,9 @@ import GeneratedHostModel from '../generated/models/host';
 import { fragment } from 'ember-data-model-fragments/attributes';
 
 export default class HostModel extends GeneratedHostModel {
-
   /**
    * Attributes of this resource, if any, represented as a JSON fragment.
    * @type {FragmentHostAttributesModel}
    */
   @fragment('fragment-host-attributes', { defaultValue: {} }) attributes;
-
 }

addons/api/addon/models/role.js

@@ -35,7 +35,7 @@ export default class RoleModel extends GeneratedRoleModel {
     return this.save({
       adapterOptions: {
         method: 'set-grants',
-        grantStrings
+        grantStrings,
       },
     });
   }

addons/api/addon/models/session.js

@@ -4,7 +4,6 @@ import { equal } from '@ember/object/computed';
 import { attr } from '@ember-data/model';
 
 export default class SessionModel extends GeneratedSessionModel {
-
   // =attributes
 
   @attr('string', { readOnly: true }) proxy_address;
@@ -61,5 +60,4 @@ export default class SessionModel extends GeneratedSessionModel {
       },
     });
   }
-
 }

addons/api/addon/models/target.js

@@ -41,8 +41,9 @@ export default class TargetModel extends GeneratedTargetModel {
    * @type {SessionModel[]}
    */
   get sessions() {
-    return this.store.peekAll('session')
-      .filter(s => s && (s.target_id === this.id));
+    return this.store
+      .peekAll('session')
+      .filter((s) => s && s.target_id === this.id);
   }
 
   /**
@@ -58,8 +59,9 @@ export default class TargetModel extends GeneratedTargetModel {
    * @type {boolean}
    */
   get isActive() {
-    const pendingOrActiveSessions =
-      this.sessions.filter(s => s.isActive || s.isPending);
+    const pendingOrActiveSessions = this.sessions.filter(
+      (s) => s.isActive || s.isPending
+    );
     return Boolean(pendingOrActiveSessions.length);
   }
 

addons/api/addon/models/user.js

@@ -3,7 +3,6 @@ import { attr } from '@ember-data/model';
 import { A } from '@ember/array';
 
 export default class UserModel extends GeneratedUserModel {
-
   // =attributes
 
   /**
@@ -74,5 +73,4 @@ export default class UserModel extends GeneratedUserModel {
   removeAccount(accountID, options) {
     return this.removeAccounts([accountID], options);
   }
-
 }

addons/api/addon/serializers/account.js

@@ -1,7 +1,6 @@
 import ApplicationSerializer from './application';
 
 export default class AccountSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
@@ -21,13 +20,36 @@ export default class AccountSerializer extends ApplicationSerializer {
    * @return {object}
    */
   serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'password':
+        return this.serializePassword(...arguments);
+    }
+  }
+
+  /**
+   * Password serialization omits `attributes` and handles password-related
+   * custom methods.
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serializePassword(snapshot) {
     const password = snapshot?.adapterOptions?.password;
     let serialized = super.serialize(...arguments);
+    // Only login_name is serialized into password attributes.
+    const { login_name } = serialized.attributes;
+    if (login_name) {
+      serialized.attributes = { login_name };
+    } else {
+      serialized.attributes = {};
+    }
+    // New record case
     if (password && snapshot?.record?.isNew)
       serialized.attributes.password = password;
+    // Set password custom method
     if (snapshot?.adapterOptions?.method === 'set-password') {
       serialized = this.serializeForSetPassword(snapshot, password);
     }
+    // Change password custom method
     if (snapshot?.adapterOptions?.method === 'change-password') {
       const { currentPassword, newPassword } = snapshot?.adapterOptions;
       serialized = this.serializeForChangePassword(

addons/api/addon/serializers/application.js

@@ -7,7 +7,6 @@ import { copy } from 'ember-copy';
  * Manages serialization/normalization of data to/from the API.
  */
 export default class ApplicationSerializer extends RESTSerializer {
-
   // =properties
 
   /**
@@ -82,7 +81,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     // Delete `scope` field
     delete serialized.scope;
     // And serialize `scope_id`
-    if(this.serializeScopeID) {
+    if (this.serializeScopeID) {
       const scope_id = snapshot?.attr('scope')?.attr('scope_id');
       if (scope_id) serialized.scope_id = scope_id;
     }

addons/api/addon/serializers/auth-method.js

@@ -0,0 +1,102 @@
+import ApplicationSerializer from './application';
+import { copy } from 'ember-copy';
+
+export default class AuthMethodSerializer extends ApplicationSerializer {
+  // =methods
+
+  /**
+   * Delegates to a type-specific serialization, or default.
+   * @override
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'oidc':
+        return this.serializeOIDC(...arguments);
+      default:
+        return this.serializeDefault(...arguments);
+    }
+  }
+
+  /**
+   * Default serialization omits `attributes`.
+   * @return {object}
+   */
+  serializeDefault() {
+    let serialized = super.serialize(...arguments);
+    delete serialized.attributes;
+    return serialized;
+  }
+
+  /**
+   * If `adapterOptions.state` is set, the serialization should
+   * include **only state** and version.  Normally, this is not serialized.
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serializeOIDC(snapshot) {
+    let serialized = super.serialize(...arguments);
+    const state = snapshot?.adapterOptions?.state;
+    if (state) {
+      serialized = this.serializeOIDCWithState(snapshot, state);
+    } else {
+      delete serialized.attributes.state;
+    }
+    return serialized;
+  }
+
+  /**
+   * Returns a payload containing only state and version.
+   * @param {Snapshot} snapshot
+   * @param {string} state
+   * @return {object}
+   */
+  serializeOIDCWithState(snapshot, state) {
+    return {
+      version: snapshot.attr('version'),
+      attributes: { state },
+    };
+  }
+
+  /**
+   * Sorts the array in order of "is_primary" such that the primary method
+   * appears first.  The "natural" order of auth methods places primary first.
+   *
+   * @override
+   * @return {object}
+   */
+  normalizeArrayResponse() {
+    const normalized = super.normalizeArrayResponse(...arguments);
+    normalized.data = normalized.data.sort((a) =>
+      a.attributes.is_primary ? -1 : 1
+    );
+    return normalized;
+  }
+
+  /**
+   * Sets `is_primary` to `false` if it is missing in the response.  The API
+   * omits "zero" values per:
+   * https://developers.google.com/protocol-buffers/docs/proto3#default
+   *
+   * TODO:  generalize this so that all zero values are reified.
+   * @override
+   * @see FragmentScope
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalize(typeClass, hash, ...rest) {
+    let normalizedHash = copy(hash, true);
+    // switch (normalizedHash.type) {
+    //   case 'oidc':
+    //     normalizedHash = this.normalizeOIDC(normalizedHash);
+    //     break;
+    // }
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    if (!normalized.data.attributes.is_primary) {
+      normalized.data.attributes.is_primary = false;
+    }
+    return normalized;
+  }
+}

addons/api/addon/serializers/fragment-account-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAccountAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1,30 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentHostSetSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Serializes an account claim to string.
+   * @param {Snapshot} snapshot
+   * @return {string}
+   */
+  serialize(snapshot) {
+    const from = snapshot.attr('from');
+    const to = snapshot.attr('to');
+    return `${from}=${to}`;
+  }
+
+  /**
+   * Normalizes account claim strings into JSON API objects.
+   * @param {Model} typeClass
+   * @param {string} value
+   * @return {object}
+   */
+  normalize(typeClass, value) {
+    const normalizedHash = {
+      from: value.split('=')[0],
+      to: value.split('=')[1],
+    };
+    return super.normalize(typeClass, normalizedHash);
+  }
+}

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-string.js

@@ -0,0 +1,24 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentStringSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Serializes a to string.
+   * @param {Snapshot} snapshot
+   * @return {string}
+   */
+  serialize(snapshot) {
+    return snapshot.attr('value');
+  }
+
+  /**
+   * Normalizes from strings.
+   * @param {Model} typeClass
+   * @param {string} value
+   * @return {object}
+   */
+  normalize(typeClass, value) {
+    return super.normalize(typeClass, { value });
+  }
+}

addons/api/addon/serializers/host-set.js

@@ -1,7 +1,6 @@
 import ApplicationSerializer from './application';
 
 export default class HostSetSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
@@ -38,21 +37,4 @@ export default class HostSetSerializer extends ApplicationSerializer {
       host_ids: hostIDs,
     };
   }
-
-  /**
-   * Converts string arrays to object arrays for use with `fragment-string`.
-   * E.g. `"foo"` -> `{value: "foo"}`
-   * @override
-   * @param {Model} modelClass
-   * @param {Object} resourceHash
-   * @return {Object}
-   */
-  normalize(modelClass, resourceHash) {
-    // TODO:  can fragment string normalization be handled generically?
-    // TODO: host_ids might actually be attributes.host_ids
-    if (resourceHash.host_ids) {
-      resourceHash.host_ids = resourceHash.host_ids.map((value) => ({ value }));
-    }
-    return super.normalize(modelClass, resourceHash);
-  }
 }

addons/api/addon/serializers/host.js

@@ -1,12 +1,10 @@
 import ApplicationSerializer from './application';
 
 export default class HostSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
    * @type {boolean}
    */
   serializeScopeID = false;
-
 }

addons/api/addon/serializers/role.js

@@ -17,8 +17,8 @@ export default class RoleSerializer extends ApplicationSerializer {
   serialize(snapshot) {
     const grantStrings = get(snapshot, 'adapterOptions.grantStrings');
     let serialized = super.serialize(...arguments);
-    if (grantStrings) serialized =
-      this.serializeWithGrantStrings(snapshot, grantStrings);
+    if (grantStrings)
+      serialized = this.serializeWithGrantStrings(snapshot, grantStrings);
     const principalIDs = snapshot?.adapterOptions?.principalIDs;
     if (principalIDs)
       serialized = this.serializewithPrincipals(snapshot, principalIDs);
@@ -34,7 +34,7 @@ export default class RoleSerializer extends ApplicationSerializer {
   serializeWithGrantStrings(snapshot, grantStrings) {
     return {
       version: snapshot.attr('version'),
-      grant_strings: grantStrings
+      grant_strings: grantStrings,
     };
   }
 

addons/api/addon/serializers/user.js

@@ -13,8 +13,8 @@ export default class UserSerializer extends ApplicationSerializer {
   serialize(snapshot) {
     let serialized = super.serialize(...arguments);
     const accountIDs = snapshot?.adapterOptions?.accountIDs;
-    if (accountIDs) serialized =
-      this.serializewithAccounts(snapshot, accountIDs);
+    if (accountIDs)
+      serialized = this.serializewithAccounts(snapshot, accountIDs);
     return serialized;
   }
 

addons/api/addon/services/storage.js

@@ -76,8 +76,9 @@ export default class StorageService extends Service {
     const inMemory = get(config, 'storage.memory');
     // Get the global context object (window) via service lookup,
     // because just reaching for a global is icky
-    const globalContext = getOwner(this).lookup('service:-document')
-      .documentElement.parentNode.defaultView;
+    const globalContext =
+      getOwner(this).lookup('service:-document').documentElement.parentNode
+        .defaultView;
     // If memory storage enabled, return the memory storage instance,
     // otherwise return localStorage.
     return inMemory ? this.#memoryStorage : globalContext.localStorage;

addons/api/app/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -0,0 +1,4 @@
+export {
+  default,
+  initialize,
+} from 'api/initializers/fragment-auth-method-attributes-account-claim-map-serializer';

addons/api/app/initializers/fragment-string.js

@@ -0,0 +1 @@
+export { default, initialize } from 'api/initializers/fragment-string';

addons/api/app/models/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-auth-method-attributes-account-claim-map';

addons/api/app/models/fragment-auth-method-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-auth-method-attributes';

addons/api/app/serializers/auth-method.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/auth-method';

addons/api/app/serializers/fragment-account-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-account-attributes';

addons/api/app/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-auth-method-attributes';

addons/api/app/serializers/fragment-string.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-string';

addons/api/config/ember-try.js

@@ -25,9 +25,9 @@ module.exports = async function () {
         name: 'ember-lts-3.20',
         npm: {
           devDependencies: {
-            'ember-source': '~3.20.5'
-          }
-        }
+            'ember-source': '~3.20.5',
+          },
+        },
       },
       {
         name: 'ember-release',
@@ -62,9 +62,9 @@ module.exports = async function () {
         },
         npm: {
           devDependencies: {
-            '@ember/jquery': '^1.1.0'
-          }
-        }
+            '@ember/jquery': '^1.1.0',
+          },
+        },
       },
       {
         name: 'ember-classic',

addons/api/mirage/config.js

@@ -5,8 +5,7 @@ import { pickRandomStatusString } from './factories/session';
 import { Response } from 'miragejs';
 import initializeMockIPC from './scenarios/ipc';
 
-export default function() {
-
+export default function () {
   initializeMockIPC(this);
 
   // make this `http://localhost:8080`, for example, if your API is on a different server
@@ -23,17 +22,20 @@ export default function() {
 
   // Scope resources
 
-  this.get('/scopes', ({ scopes }, { queryParams: { scope_id, recursive } }) => {
-    // Default parent scope is global
-    if (!scope_id) scope_id = 'global';
-    if (recursive && scope_id === 'global') {
-      return scopes.all();
-    } else {
-      return scopes.where(scope => {
-        return scope.scope ? scope.scope.id === scope_id : false
-      });
+  this.get(
+    '/scopes',
+    ({ scopes }, { queryParams: { scope_id, recursive } }) => {
+      // Default parent scope is global
+      if (!scope_id) scope_id = 'global';
+      if (recursive && scope_id === 'global') {
+        return scopes.all();
+      } else {
+        return scopes.where((scope) => {
+          return scope.scope ? scope.scope.id === scope_id : false;
+        });
+      }
     }
-  });
+  );
   this.post('/scopes', function ({ scopes }) {
     // Parent scope comes through the payload via `scope_id`, but this needs
     // to be expanded to a scope object `scope: {id:..., type:...}` before
@@ -49,44 +51,64 @@ export default function() {
 
   // Auth & IAM resources
 
-  this.get('/auth-methods', ({ authMethods }, { queryParams: { scope_id: scopeId } }) => {
-    return authMethods.where({ scopeId });
-  });
+  this.get(
+    '/auth-methods',
+    ({ authMethods }, { queryParams: { scope_id: scopeId } }) => {
+      return authMethods.where({ scopeId });
+    }
+  );
   this.post('/auth-methods');
   this.get('/auth-methods/:id');
   this.patch('/auth-methods/:id');
-  this.del('/auth-methods/:id');
+  this.del('/auth-methods/:id', ({ authMethods }, { params: { id } }) => {
+    const authMethod = authMethods.find(id);
+    const scope = authMethod.scope;
+    authMethod.destroy();
+    // If the primary auth method is deleted, the associated scope's
+    // primary_auth_method_id field should be set to null.
+    if (scope.primaryAuthMethodId === id) {
+      scope.update({ primaryAuthMethodId: null });
+    }
+    return new Response(202);
+  });
 
   // Auth Method Accounts
-  this.get('/accounts', ({ accounts }, { queryParams: { auth_method_id: authMethodId } }) => {
-    return accounts.where({ authMethodId });
-  });
+  this.get(
+    '/accounts',
+    ({ accounts }, { queryParams: { auth_method_id: authMethodId } }) => {
+      return accounts.where({ authMethodId });
+    }
+  );
   this.post('/accounts');
   this.get('/accounts/:id');
   this.patch('/accounts/:id');
   this.del('/accounts/:id');
-  this.post('/accounts/:idMethod', function ({ accounts }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const account = accounts.find(id);
-    const updatedAttrs = {
-      version: attrs.version,
-      attributes: account.attributes
-    };
-    // Set new password
-    if (method === 'set-password') {
-      updatedAttrs.attributes.password = attrs.password;
+  this.post(
+    '/accounts/:idMethod',
+    function ({ accounts }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const account = accounts.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+        attributes: account.attributes,
+      };
+      // Set new password
+      if (method === 'set-password') {
+        updatedAttrs.attributes.password = attrs.password;
+      }
+      // Set new password
+      if (method === 'change-password') {
+        updatedAttrs.attributes.password = attrs.new_password;
+      }
+      return account.update(updatedAttrs);
     }
-    // Set new password
-    if (method === 'change-password') {
-      updatedAttrs.attributes.password = attrs.new_password;
-    }
-    return account.update(updatedAttrs);
-  });
+  );
 
-  // Authenticate/deauthenticate routes
+  // Authenticate + auth methods custom routes
   this.post('/auth-methods/:id_method', authHandler);
+  // Deauthenticate route
   this.post('/scopes/:id_method', deauthHandler);
 
   // IAM : Users
@@ -104,11 +126,11 @@ export default function() {
     const user = users.find(id);
     const updatedAttrs = {
       version: attrs.version,
-      accountIds: user.accountIds
+      accountIds: user.accountIds,
     };
     // If adding accounts, push them into the array
     if (method === 'add-accounts') {
-      attrs.accountIds.forEach(id => {
+      attrs.accountIds.forEach((id) => {
         if (!updatedAttrs.accountIds.includes(id)) {
           updatedAttrs.accountIds.push(id);
         }
@@ -116,7 +138,7 @@ export default function() {
     }
     // If deleting accounts, filter them out of the array
     if (method === 'remove-accounts') {
-      updatedAttrs.accountIds = updatedAttrs.accountIds.filter(id => {
+      updatedAttrs.accountIds = updatedAttrs.accountIds.filter((id) => {
         return !attrs.accountIds.includes(id);
       });
     }
@@ -131,31 +153,34 @@ export default function() {
   this.get('/groups/:id');
   this.patch('/groups/:id');
   this.del('/groups/:id');
-  this.post('/groups/:idMethod', function ({ groups }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const group = groups.find(id);
-    const updatedAttrs = {
-      version: attrs.version,
-      memberIds: group.memberIds
-    };
-    // If adding members, push them into the array
-    if (method === 'add-members') {
-      attrs.memberIds.forEach(id => {
-        if (!updatedAttrs.memberIds.includes(id)) {
-          updatedAttrs.memberIds.push(id);
-        }
-      });
+  this.post(
+    '/groups/:idMethod',
+    function ({ groups }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const group = groups.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+        memberIds: group.memberIds,
+      };
+      // If adding members, push them into the array
+      if (method === 'add-members') {
+        attrs.memberIds.forEach((id) => {
+          if (!updatedAttrs.memberIds.includes(id)) {
+            updatedAttrs.memberIds.push(id);
+          }
+        });
+      }
+      // If deleting members, filter them out of the array
+      if (method === 'remove-members') {
+        updatedAttrs.memberIds = updatedAttrs.memberIds.filter((id) => {
+          return !attrs.memberIds.includes(id);
+        });
+      }
+      return group.update(updatedAttrs);
     }
-    // If deleting members, filter them out of the array
-    if (method === 'remove-members') {
-      updatedAttrs.memberIds = updatedAttrs.memberIds.filter(id => {
-        return !attrs.memberIds.includes(id);
-      });
-    }
-    return group.update(updatedAttrs);
-  });
+  );
 
   // IAM: Roles
   this.get('/roles', ({ roles }, { queryParams: { scope_id: scopeId } }) => {
@@ -165,66 +190,72 @@ export default function() {
   this.get('/roles/:id');
   this.patch('/roles/:id');
   this.del('/roles/:id');
-  this.post('/roles/:idMethod', function ({ roles, users, groups }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const role = roles.find(id);
-    let updatedAttrs = {};
+  this.post(
+    '/roles/:idMethod',
+    function ({ roles, users, groups }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const role = roles.find(id);
+      let updatedAttrs = {};
 
-    // Principals is a combined list of users and groups, but in Mirage we've
-    // internally modelled them as separate lists.  Therefore we must check
-    // the type by looking up the user or group first, then determine which
-    // list to add the principal to.
-    if (method === 'add-principals') {
-      updatedAttrs = {
-        version: attrs.version,
-        userIds: role.userIds,
-        groupIds: role.groupIds
-      };
-      attrs.principalIds.forEach(id => {
-        const isUser = users.find(id);
-        const isGroup = groups.find(id);
-        if (isUser && !updatedAttrs.userIds.includes(id)) {
-          updatedAttrs.userIds.push(id);
-        }
-        if (isGroup && !updatedAttrs.groupIds.includes(id)) {
-          updatedAttrs.groupIds.push(id);
-        }
-      });
-    }
-    // If deleting principals, filter them out of both users and groups,
-    // and in this case don't care about the type
-    if (method === 'remove-principals') {
-      updatedAttrs = {
-        version: attrs.version,
-        userIds: role.userIds,
-        groupIds: role.groupIds
-      };
-      updatedAttrs.userIds = updatedAttrs.userIds.filter(id => {
-        return !attrs.principalIds.includes(id);
-      });
-      updatedAttrs.groupIds = updatedAttrs.groupIds.filter(id => {
-        return !attrs.principalIds.includes(id);
-      });
-    }
+      // Principals is a combined list of users and groups, but in Mirage we've
+      // internally modelled them as separate lists.  Therefore we must check
+      // the type by looking up the user or group first, then determine which
+      // list to add the principal to.
+      if (method === 'add-principals') {
+        updatedAttrs = {
+          version: attrs.version,
+          userIds: role.userIds,
+          groupIds: role.groupIds,
+        };
+        attrs.principalIds.forEach((id) => {
+          const isUser = users.find(id);
+          const isGroup = groups.find(id);
+          if (isUser && !updatedAttrs.userIds.includes(id)) {
+            updatedAttrs.userIds.push(id);
+          }
+          if (isGroup && !updatedAttrs.groupIds.includes(id)) {
+            updatedAttrs.groupIds.push(id);
+          }
+        });
+      }
+      // If deleting principals, filter them out of both users and groups,
+      // and in this case don't care about the type
+      if (method === 'remove-principals') {
+        updatedAttrs = {
+          version: attrs.version,
+          userIds: role.userIds,
+          groupIds: role.groupIds,
+        };
+        updatedAttrs.userIds = updatedAttrs.userIds.filter((id) => {
+          return !attrs.principalIds.includes(id);
+        });
+        updatedAttrs.groupIds = updatedAttrs.groupIds.filter((id) => {
+          return !attrs.principalIds.includes(id);
+        });
+      }
 
-    if (method === 'set-grants') {
-      updatedAttrs = {
-        version: attrs.version,
-        grantStrings: attrs.grantStrings
-      };
-    }
+      if (method === 'set-grants') {
+        updatedAttrs = {
+          version: attrs.version,
+          grantStrings: attrs.grantStrings,
+        };
+      }
 
-    return role.update(updatedAttrs);
-  });
+      return role.update(updatedAttrs);
+    }
+  );
 
   // Other resources
   // host-catalog
 
-  this.get('/host-catalogs', ({ hostCatalogs }, { queryParams: { scope_id: scopeId } }) => {
-    return hostCatalogs.where({ scopeId });
-  });
+  this.get(
+    '/host-catalogs',
+    ({ hostCatalogs }, { queryParams: { scope_id: scopeId } }) => {
+      return hostCatalogs.where({ scopeId });
+    }
+  );
   this.post('/host-catalogs');
   this.get('/host-catalogs/:id');
   this.patch('/host-catalogs/:id');
@@ -232,9 +263,12 @@ export default function() {
 
   // host
 
-  this.get('/hosts', function ({ hosts }, { queryParams: { host_catalog_id: hostCatalogId } }) {
-    return hosts.where({ hostCatalogId });
-  });
+  this.get(
+    '/hosts',
+    function ({ hosts }, { queryParams: { host_catalog_id: hostCatalogId } }) {
+      return hosts.where({ hostCatalogId });
+    }
+  );
   this.post('/hosts', function ({ hostCatalogs, hosts }) {
     const attrs = this.normalizedRequestAttrs();
     const hostCatalog = hostCatalogs.find(attrs.hostCatalogId);
@@ -247,9 +281,15 @@ export default function() {
 
   // host-set
 
-  this.get('/host-sets', function ({ hostSets }, { queryParams: { host_catalog_id: hostCatalogId } }) {
-    return hostSets.where({ hostCatalogId });
-  });
+  this.get(
+    '/host-sets',
+    function (
+      { hostSets },
+      { queryParams: { host_catalog_id: hostCatalogId } }
+    ) {
+      return hostSets.where({ hostCatalogId });
+    }
+  );
   this.post('/host-sets', function ({ hostCatalogs, hostSets }) {
     const attrs = this.normalizedRequestAttrs();
     const hostCatalog = hostCatalogs.find(attrs.hostCatalogId);
@@ -259,49 +299,57 @@ export default function() {
   this.get('/host-sets/:id');
   this.patch('/host-sets/:id');
   this.del('/host-sets/:id');
-  this.post('/host-sets/:idMethod', function ({ hostSets }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const hostSet = hostSets.find(id);
-    const updatedAttrs = {
-      version: attrs.version,
-      hostIds: hostSet.hostIds
-    }
+  this.post(
+    '/host-sets/:idMethod',
+    function ({ hostSets }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const hostSet = hostSets.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+        hostIds: hostSet.hostIds,
+      };
 
-    // If adding hosts, push them into the array
-    if(method === 'add-hosts') {
-      attrs.hostIds.forEach(id => {
-        if(!updatedAttrs.hostIds.includes(id)) {
-          updatedAttrs.hostIds.push(id);
-        }
-      })
-    }
+      // If adding hosts, push them into the array
+      if (method === 'add-hosts') {
+        attrs.hostIds.forEach((id) => {
+          if (!updatedAttrs.hostIds.includes(id)) {
+            updatedAttrs.hostIds.push(id);
+          }
+        });
+      }
 
-    // If deleting hosts, filter them out of the array
-    if (method === 'remove-hosts') {
-      updatedAttrs.hostIds = updatedAttrs.hostIds.filter(id => {
-        return !attrs.hostIds.includes(id);
-      });
-    }
+      // If deleting hosts, filter them out of the array
+      if (method === 'remove-hosts') {
+        updatedAttrs.hostIds = updatedAttrs.hostIds.filter((id) => {
+          return !attrs.hostIds.includes(id);
+        });
+      }
 
-    return hostSet.update(updatedAttrs);
-  });
+      return hostSet.update(updatedAttrs);
+    }
+  );
 
   // target
 
-  this.get('/targets', function ({ targets }, { queryParams: { scope_id, recursive } }) {
-    if (recursive && scope_id === 'global') {
-      return targets.all();
-    } else if (recursive) {
-      return targets.where(target => {
-        const targetModel = targets.find(target.id);
-        return (target.scopeId === scope_id)
-          || (targetModel?.scope?.scope?.id === scope_id)
-      });
+  this.get(
+    '/targets',
+    function ({ targets }, { queryParams: { scope_id, recursive } }) {
+      if (recursive && scope_id === 'global') {
+        return targets.all();
+      } else if (recursive) {
+        return targets.where((target) => {
+          const targetModel = targets.find(target.id);
+          return (
+            target.scopeId === scope_id ||
+            targetModel?.scope?.scope?.id === scope_id
+          );
+        });
+      }
+      return targets.where((target) => target.scopeId === scope_id);
     }
-    return targets.where(target => target.scopeId === scope_id);
-  });
+  );
   this.post('/targets', function ({ targets }) {
     const attrs = this.normalizedRequestAttrs();
     return targets.create(attrs);
@@ -309,83 +357,96 @@ export default function() {
   this.get('/targets/:id');
   this.patch('/targets/:id');
   this.del('/targets/:id');
-  this.post('/targets/:idMethod', function ({ targets }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const target = targets.find(id);
-    const updatedAttrs = {
-      version: attrs.version,
-      hostSetIds: target.hostSetIds
-    };
-    // If adding host sets, push them into the array
-    if (method === 'add-host-sets') {
-      attrs.hostSetIds.forEach(id => {
-        if (!updatedAttrs.hostSetIds.includes(id)) {
-          updatedAttrs.hostSetIds.push(id);
-        }
-      });
+  this.post(
+    '/targets/:idMethod',
+    function ({ targets }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const target = targets.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+        hostSetIds: target.hostSetIds,
+      };
+      // If adding host sets, push them into the array
+      if (method === 'add-host-sets') {
+        attrs.hostSetIds.forEach((id) => {
+          if (!updatedAttrs.hostSetIds.includes(id)) {
+            updatedAttrs.hostSetIds.push(id);
+          }
+        });
+      }
+      // If deleting host sets, filter them out of the array
+      if (method === 'remove-host-sets') {
+        updatedAttrs.hostSetIds = updatedAttrs.hostSetIds.filter((id) => {
+          return !attrs.hostSetIds.includes(id);
+        });
+      }
+      return target.update(updatedAttrs);
     }
-    // If deleting host sets, filter them out of the array
-    if (method === 'remove-host-sets') {
-      updatedAttrs.hostSetIds = updatedAttrs.hostSetIds.filter(id => {
-        return !attrs.hostSetIds.includes(id);
-      });
-    }
-    return target.update(updatedAttrs);
-  });
+  );
 
   // session
 
-  this.get('/sessions', function ({ sessions }, { queryParams: { scope_id, recursive } }) {
-    // To simulate changes to `session.status` that may occur in the backend,
-    // we quietly randomize the value of the field on GET.
-    // To populate sessions for logged in user,
-    // update alternate sessions to auth user.
-    // But only if not in testing mode.
-    // In tests, we need deterministic statuses.
-    if (!Ember.testing) {
-      sessions.all()
-        .models
-        .forEach(session => {
+  this.get(
+    '/sessions',
+    function ({ sessions }, { queryParams: { scope_id, recursive } }) {
+      // To simulate changes to `session.status` that may occur in the backend,
+      // we quietly randomize the value of the field on GET.
+      // To populate sessions for logged in user,
+      // update alternate sessions to auth user.
+      // But only if not in testing mode.
+      // In tests, we need deterministic statuses.
+      if (!Ember.testing) {
+        sessions.all().models.forEach((session) => {
           session.update({
-            status: pickRandomStatusString()
-          });
-          if(session.id.split('-').pop() % 2) session.update({
-            userId: 'authenticateduser'
+            status: pickRandomStatusString(),
           });
+          if (session.id.split('-').pop() % 2)
+            session.update({
+              userId: 'authenticateduser',
+            });
         });
+      }
+      if (recursive && scope_id === 'global') {
+        return sessions.all();
+      } else if (recursive) {
+        return sessions.where((session) => {
+          const sessionModel = sessions.find(session.id);
+          return (
+            session.scopeId === scope_id ||
+            sessionModel?.scope?.scope?.id === scope_id
+          );
+        });
+      }
+      return sessions.where((session) => session.scopeId === scope_id);
     }
-    if (recursive && scope_id === 'global') {
-      return sessions.all();
-    } else if (recursive) {
-      return sessions.where(session => {
-        const sessionModel = sessions.find(session.id);
-        return (session.scopeId === scope_id)
-          || (sessionModel?.scope?.scope?.id === scope_id)
-      });
-    }
-    return sessions.where(session => session.scopeId === scope_id);
-  });
+  );
   this.get('/sessions/:id', function ({ sessions }, { params: { id } }) {
     const session = sessions.find(id);
-    return session.update({
-      status: pickRandomStatusString()
-    });
-  });
-  this.post('/sessions/:idMethod', function ({ sessions }, { params: { idMethod } }) {
-    const attrs = this.normalizedRequestAttrs();
-    const id = idMethod.split(':')[0];
-    const method = idMethod.split(':')[1];
-    const session = sessions.find(id);
-    const updatedAttrs = {
-      version: attrs.version
-    };
-    if (method === 'cancel') {
-      updatedAttrs.status = 'canceling';
+    if (!Ember.testing) {
+      session.update({
+        status: pickRandomStatusString(),
+      });
     }
-    return session.update(updatedAttrs);
+    return session;
   });
+  this.post(
+    '/sessions/:idMethod',
+    function ({ sessions }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const session = sessions.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+      };
+      if (method === 'cancel') {
+        updatedAttrs.status = 'canceling';
+      }
+      return session.update(updatedAttrs);
+    }
+  );
 
   // auth-tokens
 

addons/api/mirage/factories/auth-method.js

@@ -1,20 +1,24 @@
 import factory from '../generated/factories/auth-method';
 import { trait } from 'ember-cli-mirage';
 
+const types = ['password', 'oidc'];
+
 export default factory.extend({
   id: (i) => `auth-method-id-${i}`,
 
+  // Cycle through available types
+  type: (i) => types[i % types.length],
+
   /**
    * Adds accounts (with associated users) to auth method.
    */
   withAccountsAndUsers: trait({
     afterCreate(authMethod, server) {
       const { scope } = authMethod;
-      server.createList('user', 5, { scope }).map(user => {
+      server.createList('user', 5, { scope }).map((user) => {
         const { id } = server.create('account', { scope, authMethod });
         user.update({ accountIds: [id] });
       });
-    }
-  })
-
+    },
+  }),
 });

addons/api/mirage/factories/group.js

@@ -13,6 +13,6 @@ export default factory.extend({
       const scope = group.scope;
       const members = server.createList('user', 2, { scope });
       group.update({ members });
-    }
-  })
+    },
+  }),
 });

addons/api/mirage/factories/host-catalog.js

@@ -2,13 +2,11 @@ import factory from '../generated/factories/host-catalog';
 import { trait } from 'ember-cli-mirage';
 
 export default factory.extend({
-
   withChildren: trait({
     afterCreate(hostCatalog, server) {
       const { scope } = hostCatalog;
       const hosts = server.createList('host', 10, { scope, hostCatalog });
       server.createList('host-set', 3, { scope, hostCatalog, hosts });
-    }
-  })
-
+    },
+  }),
 });

addons/api/mirage/factories/host-set.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/host-set';
 
 export default factory.extend({
-  id: (i) => `host-set-id-${i}`
+  id: (i) => `host-set-id-${i}`,
 });

addons/api/mirage/factories/host.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/host';
 
 export default factory.extend({
-  id: (i) => `host-id-${i}`
+  id: (i) => `host-id-${i}`,
 });

addons/api/mirage/factories/role.js

@@ -2,11 +2,10 @@ import factory from '../generated/factories/role';
 import { trait } from 'ember-cli-mirage';
 
 export default factory.extend({
-
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [
     'id=*;action=*',
-    'id=*;type=host-catalog;actions=create,read'
+    'id=*;type=host-catalog;actions=create,read',
   ],
 
   /**
@@ -18,15 +17,16 @@ export default factory.extend({
       const users = server.createList('user', 2, { scope });
       const groups = server.createList('group', 2, { scope });
       role.update({ users, groups });
-    }
+    },
   }),
 
   /**
    * Set the grant scope ID to match the scope ID.
    */
   afterCreate(role) {
-    const { scope: { id } } = role;
+    const {
+      scope: { id },
+    } = role;
     role.update({ grant_scope_id: id });
-  }
-
+  },
 });

addons/api/mirage/factories/scope.js

@@ -2,7 +2,6 @@ import factory from '../generated/factories/scope';
 import { trait } from 'ember-cli-mirage';
 
 export default factory.extend({
-
   type: 'global',
 
   /**
@@ -18,18 +17,22 @@ export default factory.extend({
   withChildren: trait({
     afterCreate(record, server) {
       if (record.type === 'global') {
-        server.createList('scope', 1, {
-          type: 'org',
-          scope: { id: record.id, type: record.type }
-        }, 'withChildren');
+        server.createList(
+          'scope',
+          1,
+          {
+            type: 'org',
+            scope: { id: record.id, type: record.type },
+          },
+          'withChildren'
+        );
       }
       if (record.type === 'org') {
         server.createList('scope', 3, {
           type: 'project',
-          scope: { id: record.id, type: record.type }
+          scope: { id: record.id, type: record.type },
         });
       }
-    }
-  })
-
+    },
+  }),
 });

addons/api/mirage/factories/session.js

@@ -2,17 +2,11 @@ import factory from '../generated/factories/session';
 import { trait } from 'ember-cli-mirage';
 import { random } from 'faker';
 
-const statusStrings = [
-  'pending',
-  'active',
-  'canceling',
-  'terminated'
-];
+const statusStrings = ['pending', 'active', 'canceling', 'terminated'];
 
 export const pickRandomStatusString = () => random.arrayElement(statusStrings);
 
 export default factory.extend({
-
   id: (i) => `session-id-${i}`,
   status: pickRandomStatusString,
 
@@ -26,7 +20,8 @@ export default factory.extend({
       const scopeId = record.scopeId;
       if (record.scope.type === 'project') {
         const orgScopeId = record.scope?.scope.id;
-        const user = server.schema.users.where({ scopeId: orgScopeId }).models[0];
+        const user = server.schema.users.where({ scopeId: orgScopeId })
+          .models[0];
         if (user) record.update({ user });
       }
       const target = server.schema.targets.where({ scopeId }).models[0];
@@ -39,7 +34,6 @@ export default factory.extend({
           if (host) record.update({ host });
         }
       }
-    }
-  })
-
+    },
+  }),
 });

addons/api/mirage/factories/target.js

@@ -1,16 +1,15 @@
 import factory from '../generated/factories/target';
 import { trait } from 'ember-cli-mirage';
-import { random } from 'faker';
+import { random, datatype } from 'faker';
 
 const randomBoolean = (chance = 0.5) => Math.random() < chance;
 const hostSetChance = 0.3;
 
 export default factory.extend({
-
   /**
    * -1 means "unlimited" and we want to generate these on occassion.
    */
-  session_connection_limit: () => random.arrayElement([-1, random.number()]),
+  session_connection_limit: () => random.arrayElement([-1, datatype.number()]),
 
   /**
    * Generates attributes fields by type.
@@ -19,8 +18,8 @@ export default factory.extend({
     if (target.type === 'tcp') {
       target.update({
         attributes: {
-          default_port: random.number()
-        }
+          default_port: datatype.number(),
+        },
       });
     }
   },
@@ -37,10 +36,9 @@ export default factory.extend({
         // expect at this level of abstraction, but appears to be a serialized
         // representation of the model instance.  It's very confusing since
         // the result set of `where` _is a collection of model instances_.
-        .where(hostSet => hostSet.scopeId === target.scope.id).models
-        .filter(() => randomBoolean(hostSetChance));
-      target.update({hostSets: randomlySelectedHostSets});
-    }
-  })
-
+        .where((hostSet) => hostSet.scopeId === target.scope.id)
+        .models.filter(() => randomBoolean(hostSetChance));
+      target.update({ hostSets: randomlySelectedHostSets });
+    },
+  }),
 });

addons/api/mirage/factories/user.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/user';
 
 export default factory.extend({
-  id: (i) => `user-${i}`
+  id: (i) => `user-${i}`,
 });

addons/api/mirage/generated/factories/account.js

@@ -1,17 +1,15 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedAccountFactory
  */
 export default Factory.extend({
-
   type: 'password',
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  version: () => random.number(),
+  version: () => datatype.number(),
   attributes: () => ({ login_name: random.words() }),
-
 });

addons/api/mirage/generated/factories/auth-method.js

@@ -1,16 +1,39 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedAuthMethodModelFactory
  */
 export default Factory.extend({
-
   type: 'password',
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
+  disabled: () => datatype.boolean(),
 
+  attributes: function () {
+    let attrs;
+    switch (this.type) {
+      case 'oidc':
+        attrs = {
+          api_url_prefix: 'http://127.0.0.1:9200',
+          callback_url:
+            'http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback',
+          client_id: 'YTwdJBB55LpKnuXb9n65',
+          client_secret_hmac: 'GY7blb4ynM5TEPNi_qnphJ9aDWhW8FpmN3D-eP_L7Zk',
+          issuer: 'http://127.0.0.1:57070',
+          max_age: 1800,
+          disable_discovered_config_validation: false,
+          state: 'active-public',
+          account_claim_maps: ['oid=sub', 'full_name=name'],
+          claims_scopes: ['profile', 'email'],
+          signing_algorithms: ['RS256', 'RS384'],
+          allowed_audiences: ['www.alice.com', 'www.alice.com/admin'],
+          idp_ca_certs: ['certificate-1234', 'certificate-5678'],
+        };
+        break;
+    }
+    return attrs;
+  },
 });

addons/api/mirage/generated/factories/group.js

@@ -1,16 +1,14 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedGroupModelFactory
  * Group contains all fields related to a Group resource
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-
+  disabled: () => datatype.boolean(),
 });

addons/api/mirage/generated/factories/host-catalog.js

@@ -1,16 +1,14 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedHostCatalogModelFactory
  */
 export default Factory.extend({
-
   type: 'static',
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-
+  disabled: () => datatype.boolean(),
 });

addons/api/mirage/generated/factories/host-set.js

@@ -1,17 +1,15 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedHostSetModelFactory
  */
 export default Factory.extend({
-
   type: 'static',
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  version: () => random.number(),
-  size: () => random.number(),
-
+  version: () => datatype.number(),
+  size: () => datatype.number(),
 });

addons/api/mirage/generated/factories/host.js

@@ -1,17 +1,17 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date, internet } from 'faker';
+import { random, date, internet, datatype } from 'faker';
 
 /**
  * GeneratedHostModelFactory
  */
 export default Factory.extend({
-
   type: 'static',
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  version: () => random.number(),
-  attributes: () => { return { address: internet.ipv6() } },
-
+  version: () => datatype.number(),
+  attributes: () => {
+    return { address: internet.ipv6() };
+  },
 });

addons/api/mirage/generated/factories/org.js

@@ -6,10 +6,8 @@ import { random, date } from 'faker';
  *
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-
 });

addons/api/mirage/generated/factories/project.js

@@ -1,16 +1,14 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedProjectModelFactory
  * Project contains all fields related to a Project resource
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-
+  disabled: () => datatype.boolean(),
 });

addons/api/mirage/generated/factories/role.js

@@ -1,17 +1,15 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedRoleModelFactory
  * Role contains all field related to a Role resource
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-  version: () => random.number(),
-
+  disabled: () => datatype.boolean(),
+  version: () => datatype.number(),
 });

addons/api/mirage/generated/factories/scope.js

@@ -1,15 +1,13 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedScopeModelFactory
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-
+  disabled: () => datatype.boolean(),
 });

addons/api/mirage/generated/factories/session.js

@@ -1,14 +1,12 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { date, datatype } from 'faker';
 
 /**
  * GeneratedSessionModelFactory
  */
 export default Factory.extend({
-
   type: 'tcp',
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  version: () => random.number(),
-
+  version: () => datatype.number(),
 });

addons/api/mirage/generated/factories/target.js

@@ -1,19 +1,17 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedTargetModelFactory
  */
 export default Factory.extend({
-
   type: 'tcp',
   name: () => random.words(),
-  session_max_seconds: () => random.number(),
-  session_connection_limit: () => random.number(),
+  session_max_seconds: () => datatype.number(),
+  session_connection_limit: () => datatype.number(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-  version: () => random.number(),
-
+  disabled: () => datatype.boolean(),
+  version: () => datatype.number(),
 });

addons/api/mirage/generated/factories/user.js

@@ -1,16 +1,14 @@
 import { Factory } from 'ember-cli-mirage';
-import { random, date } from 'faker';
+import { random, date, datatype } from 'faker';
 
 /**
  * GeneratedUserModelFactory
  * User contains all fields related to a User resource
  */
 export default Factory.extend({
-
   name: () => random.words(),
   description: () => random.words(),
   created_time: () => date.recent(),
   updated_time: () => date.recent(),
-  disabled: () => random.boolean(),
-
+  disabled: () => datatype.boolean(),
 });

addons/api/mirage/models/account.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  authMethod: belongsTo()
-
+  authMethod: belongsTo(),
 });

addons/api/mirage/models/auth-method.js

@@ -1,7 +1,5 @@
 import { Model, belongsTo } from 'ember-cli-mirage';
 
 export default Model.extend({
-
-  scope: belongsTo()
-
+  scope: belongsTo(),
 });

addons/api/mirage/models/group.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  members: hasMany('user')
-
+  members: hasMany('user'),
 });

addons/api/mirage/models/host-catalog.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  hostSets: hasMany()
-
+  hostSets: hasMany(),
 });

addons/api/mirage/models/host-set.js

@@ -1,10 +1,8 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
   target: belongsTo(),
   hostCatalog: belongsTo(),
-  hosts: hasMany()
-
+  hosts: hasMany(),
 });

addons/api/mirage/models/host.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  hostCatalog: belongsTo()
-
+  hostCatalog: belongsTo(),
 });

addons/api/mirage/models/role.js

@@ -1,9 +1,7 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
   users: hasMany(),
-  groups: hasMany()
-
+  groups: hasMany(),
 });

addons/api/mirage/models/session.js

@@ -1,11 +1,9 @@
 import { Model, belongsTo } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
   user: belongsTo(),
   target: belongsTo(),
   host: belongsTo(),
   hostSet: belongsTo(),
-
 });

addons/api/mirage/models/target.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  hostSets: hasMany()
-
+  hostSets: hasMany(),
 });

addons/api/mirage/models/user.js

@@ -1,8 +1,6 @@
 import { Model, belongsTo, hasMany } from 'ember-cli-mirage';
 
 export default Model.extend({
-
   scope: belongsTo(),
-  accounts: hasMany('account')
-
+  accounts: hasMany('account'),
 });

addons/api/mirage/route-handlers/auth.js

@@ -12,7 +12,7 @@ import { Response } from 'miragejs';
 //  */
 // export default function authenticateHandler(schema, request) {
 //   const payload = JSON.parse(request.requestBody);
-//   if (payload.credentials.login_name === 'error') {
+//   if (payload.attributes.login_name === 'error') {
 //     return new Response(400);
 //   } else {
 //     const cookieName = config.auth.passwordCookieName;
@@ -23,27 +23,116 @@ import { Response } from 'miragejs';
 //   }
 // }
 
+// Quick and dirty counter system to simulate the polling behavior
+// of the API.  If the OIDC flow is pending, the route returns 100.
+// If complete it returns 200 with the token JSON.
+let oidcAttemptCounter = 0;
+const oidcRequiredAttempts = 3;
+
+const commandHandlers = {
+  password: {
+    login: (payload, scopeAttrs) => {
+      if (payload.attributes.login_name === 'error') {
+        return new Response(400);
+      } else {
+        return new Response(
+          200,
+          {},
+          {
+            attributes: {
+              scope: scopeAttrs,
+              id: 'token123',
+              token: 'thetokenstring',
+              account_id: '1',
+              user_id: 'user123',
+              auth_method_id: 'authmethod123',
+              created_time: '',
+              updated_time: '',
+              last_used_time: '',
+              expiration_time: '',
+            },
+          }
+        );
+      }
+    },
+  },
+
+  /**
+   * OIDC authentication is a two-step process:
+   *
+   * 1. `authenticate:start` kicks of authentication by requesting some details
+   *    from the Boundary server about the request, including the third-party
+   *    URL to which to redirect the user.
+   * 2. `authenticate` accepts the token_id and state parameters in
+   *    order to retrieve a Boundary token.  This endpoint may be polled until
+   *    the authentication flow is completed.
+   */
+  oidc: {
+    start: () =>
+      new Response(
+        200,
+        {},
+        {
+          attributes: {
+            auth_url: 'https://www.duckduckgo.com',
+            token_id: 'token_1234',
+          },
+        }
+      ),
+    token: (_, scopeAttrs) => {
+      oidcAttemptCounter++;
+      if (oidcAttemptCounter < oidcRequiredAttempts) {
+        return new Response(202);
+      } else {
+        return new Response(
+          200,
+          {},
+          {
+            attributes: {
+              scope: scopeAttrs,
+              id: 'token123',
+              token: 'thetokenstring',
+              account_id: '1',
+              user_id: 'user123',
+              auth_method_id: 'authmethod123',
+              created_time: '',
+              updated_time: '',
+              last_used_time: '',
+              expiration_time: '',
+            },
+          }
+        );
+      }
+    },
+  },
+};
+
+// Handles all custom methods on /auth-methods/:id route
 export function authHandler({ scopes, authMethods }, request) {
-  const payload = JSON.parse(request.requestBody);
-  if (payload.credentials.login_name === 'error') {
-    return new Response(400);
-  } else {
-    const id = request.params.id_method.split(':')[0];
-    const authMethod = authMethods.find(id);
+  const [, id, method] = request.params.id_method.match(
+    /(?<id>.[^:]*):(?<method>(.*))/
+  );
+  const authMethod = authMethods.find(id);
+
+  if (method === 'authenticate') {
+    const payload = JSON.parse(request.requestBody);
+    const { command } = payload;
     const scope = scopes.find(authMethod.scopeId);
-    const scopeAttrs =
-      this.serialize(scopes.find(scope.id));
-    return new Response(200, {}, {
-      scope: scopeAttrs,
-      id: 'token123',
-      token: 'thetokenstring',
-      account_id: '1',
-      user_id: 'authenticateduser',
-      auth_method_id: 'authmethod123',
-      created_time: '',
-      updated_time: '',
-      last_used_time: '',
-      expiration_time: ''
+    const scopeAttrs = this.serialize(scopes.find(scope.id));
+    return commandHandlers[authMethod.type][command](payload, scopeAttrs);
+  }
+
+  // TODO:  this handler doesn't really belong here, but we already route
+  // POST requests on existing auth methods to this route handler file under the
+  // assumption it would be for authentication.  While authentication should
+  // still occur here, we should handle other custom methods in the
+  // mirage config and route here only for auth.
+  if (method === 'change-state') {
+    const attrs = this.normalizedRequestAttrs();
+    return authMethod.update({
+      attributes: {
+        state: attrs.attributes.state,
+      },
     });
   }
 }

addons/api/mirage/scenarios/default.js

@@ -1,23 +1,41 @@
-export default function(server) {
-
+export default function (server) {
   // Scope resources
 
   // creates a global scope
   const globalScope = server.create('scope', {
     id: 'global',
     type: 'global',
-    name: 'Global'
+    name: 'Global',
   });
-  const orgScope = server.createList('scope', 3, {
-    type: 'org',
-    scope: { id: globalScope.id, type: globalScope.type }
-  }, 'withChildren')[0];
+  const orgScope = server.createList(
+    'scope',
+    3,
+    {
+      type: 'org',
+      scope: { id: globalScope.id, type: globalScope.type },
+    },
+    'withChildren'
+  )[0];
 
   server.create('user', { id: 'authenticateduser' });
 
   // Auth
-  server.createList('auth-method', 1, { scope: globalScope }, 'withAccountsAndUsers');
-  server.createList('auth-method', 3, { scope: orgScope }, 'withAccountsAndUsers');
+  const globalAuthMethods = server.createList(
+    'auth-method',
+    1,
+    { scope: globalScope },
+    'withAccountsAndUsers'
+  );
+  const orgAuthMethods = server.createList(
+    'auth-method',
+    3,
+    { scope: orgScope },
+    'withAccountsAndUsers'
+  );
+  // Assign primary auth methods per scope
+  // TODO make this generic
+  globalScope.update({ primaryAuthMethodId: globalAuthMethods[0].id });
+  orgScope.update({ primaryAuthMethodId: orgAuthMethods[1].id });
 
   // Groups and Users
   server.createList('group', 1, { scope: globalScope }, 'withMembers');
@@ -27,7 +45,7 @@ export default function(server) {
   server.createList('role', 5, { scope: orgScope }, 'withPrincipals');
 
   // Other resources
-  server.schema.scopes.where({type: 'project'}).models.forEach(scope => {
+  server.schema.scopes.where({ type: 'project' }).models.forEach((scope) => {
     server.createList('host-catalog', 2, { scope }, 'withChildren');
     server.createList('target', 2, { scope }, 'withRandomHostSets');
     server.createList('session', 4, { scope }, 'withAssociations');

addons/api/mirage/scenarios/ipc.js

@@ -1,8 +1,8 @@
 import Ember from 'ember';
 import config from 'ember-get-config';
-import { random } from 'faker';
+import { datatype } from 'faker';
 
-export default function initializeMockIPC (server) {
+export default function initializeMockIPC(server) {
   /**
    * We strive to make this application runnable in a regular web browser, since
    * it is a convenient environment for development and testing.  But only an
@@ -51,15 +51,37 @@ export default function initializeMockIPC (server) {
         target,
         userId: 'authenticateduser',
         type,
-        created_time: new Date().toISOString()
+        created_time: new Date().toISOString(),
       });
       return {
         address: window.location.hostname,
-        port: random.number(),
+        port: datatype.number(),
         protocol: type,
-        session_id: newSession.id
+        session_id: newSession.id,
       };
     }
+
+    /**
+     * Check for browsers running on mac OS
+     */
+    isMacOS() {
+      return Boolean(window.navigator.userAgent.match(/(macintosh)/i));
+    }
+
+    /**
+     * Check for browsers running on windows OS
+     */
+    isWindowsOS() {
+      return Boolean(window.navigator.userAgent.match(/(windows)/i));
+    }
+
+    /**
+     * Do nothing when attempting to minimize, toggle fullscreen,
+     * and close a browser window
+     */
+    minimizeWindow() {}
+    closeWindow() {}
+    toggleFullScreenWindow() {}
   }
 
   /**
@@ -80,5 +102,4 @@ export default function initializeMockIPC (server) {
       }
     });
   }
-
 }

addons/api/mirage/serializers/account.js

@@ -4,9 +4,12 @@ export default ApplicationSerializer.extend({
   modelName: 'account',
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     json.auth_method_id = model.authMethodId;
     delete json.attributes?.password;
     return json;
-  }
+  },
 });

addons/api/mirage/serializers/application.js

@@ -6,7 +6,6 @@ import { isArray } from '@ember/array';
  * Manages serialization/normalization of data into and out of the mock API.
  */
 export default RestSerializer.extend({
-
   // =attributes
 
   /**
@@ -45,7 +44,7 @@ export default RestSerializer.extend({
   serialize() {
     let json = RestSerializer.prototype.serialize.apply(this, arguments);
     // If array, root it under a standard `items` key
-    if (isArray(json)) json = {items: json};
+    if (isArray(json)) json = { items: json };
     return json;
   },
 
@@ -59,7 +58,7 @@ export default RestSerializer.extend({
     if (model.scope) {
       json.scope = {
         id: model.scope.id,
-        type: model.scope.type
+        type: model.scope.type,
       };
     }
     return json;
@@ -79,6 +78,5 @@ export default RestSerializer.extend({
     }
     const value = RestSerializer.prototype.normalize.apply(this, [newJSON]);
     return value;
-  }
-
+  },
 });

addons/api/mirage/serializers/auth-method.js

@@ -1,5 +1,18 @@
 import ApplicationSerializer from './application';
 
 export default ApplicationSerializer.extend({
-  modelName: 'auth-method'
+  modelName: 'auth-method',
+
+  _hashForModel(model) {
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
+    // If the scope marks this auth method as primary, designate it
+    // as such with a read-only boolean field (this is how the API behaves).
+    const isPrimary =
+      model.scope && model.scope.primaryAuthMethodId === model.id;
+    json.is_primary = isPrimary;
+    return json;
+  },
 });

addons/api/mirage/serializers/group.js

@@ -11,9 +11,11 @@ export default ApplicationSerializer.extend({
   },
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     if (model.memberIds.length) json.member_ids = model.memberIds;
     return json;
-  }
-
+  },
 });

addons/api/mirage/serializers/host-set.js

@@ -11,12 +11,14 @@ export default ApplicationSerializer.extend({
   },
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     json.host_catalog_id = model.hostCatalogId;
     if (model.hostIds?.length) {
       json.host_ids = model.hostIds;
     }
     return json;
-  }
-
+  },
 });

addons/api/mirage/serializers/host.js

@@ -1,5 +1,5 @@
 import ApplicationSerializer from './application';
 
 export default ApplicationSerializer.extend({
-  modelName: 'host'
+  modelName: 'host',
 });

addons/api/mirage/serializers/role.js

@@ -4,23 +4,26 @@ export default ApplicationSerializer.extend({
   modelName: 'role',
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
-    const serializedUsers = model.users.models.map(user => ({
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
+    const serializedUsers = model.users.models.map((user) => ({
       scope_id: model.scope.id,
       id: user.id,
-      type: 'user'
+      type: 'user',
     }));
-    const serializedGroups = model.groups.models.map(group => ({
+    const serializedGroups = model.groups.models.map((group) => ({
       scope_id: model.scope.id,
       id: group.id,
-      type: 'group'
+      type: 'group',
     }));
-    json.principals = [ ...serializedUsers, ...serializedGroups ];
+    json.principals = [...serializedUsers, ...serializedGroups];
     if (!json.principals.length) delete json.principals;
 
     // default grant scope
     if (!json.grant_scope_id) json.grant_scope_id = json.scope.id;
 
     return json;
-  }
+  },
 });

addons/api/mirage/serializers/scope.js

@@ -1,5 +1,5 @@
 import ApplicationSerializer from './application';
 
 export default ApplicationSerializer.extend({
-  modelName: 'scope'
+  modelName: 'scope',
 });

addons/api/mirage/serializers/session.js

@@ -11,12 +11,14 @@ export default ApplicationSerializer.extend({
   },
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     json.user_id = model.userId;
     json.target_id = model.targetId;
     json.host_set_id = model.hostSetId;
     json.host_id = model.hostId;
     return json;
-  }
-
+  },
 });

addons/api/mirage/serializers/target.js

@@ -11,16 +11,18 @@ export default ApplicationSerializer.extend({
   },
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     const { hostSets } = this.schema;
     if (model.hostSetIds?.length) {
-      json.host_sets = model.hostSetIds.map(host_set_id => {
+      json.host_sets = model.hostSetIds.map((host_set_id) => {
         const hostSet = hostSets.find(host_set_id);
         const host_catalog_id = hostSet?.hostCatalog?.id;
         return { id: host_set_id, host_catalog_id };
       });
     }
     return json;
-  }
-
+  },
 });

addons/api/mirage/serializers/user.js

@@ -11,8 +11,11 @@ export default ApplicationSerializer.extend({
   },
 
   _hashForModel(model) {
-    const json = ApplicationSerializer.prototype._hashForModel.apply(this, arguments);
+    const json = ApplicationSerializer.prototype._hashForModel.apply(
+      this,
+      arguments
+    );
     if (model.accountIds.length) json.account_ids = model.accountIds;
     return json;
-  }
+  },
 });