Merge pull request #884 from hashicorp/chore-bump-binary-version

Chore bump binary version

.github/workflows/monorepo-validate.yaml

@@ -1,5 +1,5 @@
 name: Validate Monorepo
-on: [push]
+on: pull_request
 jobs:
 
   compliance:
@@ -19,26 +19,10 @@ jobs:
         if: steps.cache.outputs.cache-hit != 'true'
       - run: yarn run compliance:licenses
 
-  audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
-        with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
-      - run: yarn run compliance:audit
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v2
       - uses: actions/cache@v2
@@ -56,6 +40,7 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v2
       - uses: actions/cache@v2

.github/workflows/test-release-trigger.yml

@@ -0,0 +1,23 @@
+name: "Trigger Test Boundary UI release"
+
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
+        required: true
+
+jobs:
+  trigger-circleci-release:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Trigger Release job
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
+
+          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
+          -d '{ "branch": "main", "parameters": {"TAG": "'${{ github.event.inputs.branch }}'" }}' \
+          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

.github/workflows/ui-release-trigger.yml

@@ -9,12 +9,11 @@ jobs:
   trigger-circleci-release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@master
+      - uses: actions/checkout@v2
       - name: Trigger Release job
-        env:
-          TAG: ${{ github.event.release.tag_name }}
         run: |
+          echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
+
           curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "${TAG}" }}' \
+          -d '{ "branch": "main", "parameters": {"TAG": "'${GITHUB_REF#refs/tags/}'" }}' \
           https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

.gitignore

@@ -22,6 +22,7 @@ testem.log
 yarn-error.log
 storybook-static
 **/.storybook/*.html
+.watchman-cookie*
 
 # ember-try
 .node_modules.ember-try

CONTRIBUTING.md

@@ -0,0 +1,6 @@
+# Contributing to Boundary
+
+Thank you for contributing to Boundary! Here you can find common questions around reporting issues and opening
+pull requests to our project.
+
+When contributing in any way to the Boundary project (new issue, PR, etc), please be aware that our team identifies with many gender pronouns and to use non-binary pronouns when addressing our team. For more reading on our code of conduct, please see the [HashiCorp community guidelines](https://www.hashicorp.com/community-guidelines). 

README.md

@@ -24,6 +24,9 @@ subproject, e.g. running or testing.
   - [Building Admin UI for Production](#building-admin-ui-for-production)
     - [Building with a Container](#building-with-a-container)
   - [Building Desktop UI for Production](#building-desktop-ui-for-production)
+  - [Connect Boundary UI to Boundary local instance](#connect-boundary-ui-to-boundary-local-instance)
+    - [For admin](#for-admin)
+    - [For desktop](#for-desktop)
   - [Committing](#committing)
     - [License Checking](#license-checking)
 
@@ -35,6 +38,9 @@ You will need the following things properly installed on your computer.
 
 * [Git][git]
 * [Node.js][node]
+  * v10–v15
+  * **Apple Silicon Users**:  if you experience problems building or running
+    Boundary UIs, try Node v15.
 * [Yarn][yarn] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]
@@ -116,11 +122,45 @@ yarn install
 yarn build:ui:desktop
 ```
 
+In windows, UI is generated using docker to provide a stable UI across platforms.
+
+```cmd
+yarn install
+docker-compose -f docker-compose-embedding.yml run build-desktop-production 
+yarn build:ui:desktop:app
+```
+
 To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY`
-environment variable to set signing certificate name (e.g Developer ID Application: * (*)).
+environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `yarn build:ui:desktop:app`.
 
 Assets are saved to `ui/desktop/electron-app/out/make/`.
-DMG packaged desktop UI is available at asset location as `Boundary Desktop.dmg`.
+DMG packaged desktop UI is available at asset location as `boundary.dmg`.
+EXE archived desktop UI is available at asset location under `zip` folder.
+
+### Connect Boundary UI to Boundary local instance
+
+This describes how to connect local Boundary UI to your local instance of Boundary.
+
+This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://learn.hashicorp.com/tutorials/boundary/getting-started-dev?in=boundary/getting-started#start-a-dev-environment).
+#### For admin
+
+This assumes you are within `boundary-ui/ui/admin`.
+
+You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 yarn start`.
+
+Following terminal instructions, open in your browser: `http://localhost:4200/`.
+
+Once you open the UI you will see the login screen, authenticate using generated admin login name and password.
+
+#### For desktop
+
+This assumes you are within `boundary-ui/ui/desktop`.
+
+You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false yarn start:desktop`.
+
+In login screen, authenticate using generated admin login name and password.
+
+Enter the origin of your Boundary dev instance, by default is: `http://localhost:9200`.
 
 ### Committing
 

addons/api/.editorconfig

@@ -12,8 +12,5 @@ insert_final_newline = true
 indent_style = space
 indent_size = 2
 
-[*.hbs]
-insert_final_newline = false
-
 [*.{diff,md}]
 trim_trailing_whitespace = false

addons/api/.eslintignore

@@ -13,6 +13,7 @@
 # misc
 /coverage/
 !.*
+.eslintcache
 
 # ember-try
 /.node_modules.ember-try/

addons/api/.eslintrc.js

@@ -7,48 +7,59 @@ module.exports = {
     ecmaVersion: 2018,
     sourceType: 'module',
     ecmaFeatures: {
-      legacyDecorators: true
-    }
+      legacyDecorators: true,
+    },
   },
-  plugins: [
-    'ember'
-  ],
+  plugins: ['ember'],
   extends: [
     'eslint:recommended',
-    'plugin:ember/recommended'
+    'plugin:ember/recommended',
+    'plugin:prettier/recommended',
   ],
   env: {
-    browser: true
+    browser: true,
+  },
+  rules: {
+    'ember/no-get': 'off',
+    'ember/no-get-with-default': 'off',
+    'ember/no-computed-properties-in-native-classes': 'off',
+    'ember/no-assignment-of-untracked-properties-used-in-tracking-contexts':
+      'off',
   },
-  rules: {},
   overrides: [
     // node files
     {
       files: [
         '.eslintrc.js',
+        '.prettierrc.js',
         '.template-lintrc.js',
         'ember-cli-build.js',
         'index.js',
         'testem.js',
         'blueprints/*/index.js',
         'config/**/*.js',
-        'tests/dummy/config/**/*.js'
+        'tests/dummy/config/**/*.js',
       ],
       excludedFiles: [
         'addon/**',
         'addon-test-support/**',
         'app/**',
-        'tests/dummy/app/**'
+        'tests/dummy/app/**',
       ],
       parserOptions: {
-        sourceType: 'script'
+        sourceType: 'script',
       },
       env: {
         browser: false,
-        node: true
+        node: true,
       },
       plugins: ['node'],
-      extends: ['plugin:node/recommended']
-    }
-  ]
+      extends: ['plugin:node/recommended'],
+    },
+    {
+      // Test files:
+      files: ['tests/**/*-test.{js,ts}'],
+      extends: ['plugin:qunit/recommended'],
+    },
+  ],
 };

addons/api/.npmignore

@@ -10,6 +10,7 @@
 /.editorconfig
 /.ember-cli
 /.env*
+/.eslintcache
 /.eslintignore
 /.eslintrc.js
 /.git/

addons/api/.prettierignore

@@ -1,4 +1,6 @@
-# See https://help.github.com/ignore-files/ for more about ignoring files.
+# unconventional js
+/blueprints/*/files/
+/vendor/
 
 # compiled output
 /dist/
@@ -9,15 +11,9 @@
 /node_modules/
 
 # misc
-/.env*
-/.pnp*
-/.sass-cache
-/connect.lock
 /coverage/
-/libpeerconnection.log
-/npm-debug.log*
-/testem.log
-/yarn-error.log
+!.*
+.eslintcache
 
 # ember-try
 /.node_modules.ember-try/

addons/api/.prettierrc.js

@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = {
+  singleQuote: true,
+};

addons/api/.template-lintrc.js

@@ -1,5 +1,5 @@
 'use strict';
 
 module.exports = {
-  extends: 'octane'
+  extends: 'octane',
 };

addons/api/addon/abilities/account.js

@@ -0,0 +1,15 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for accounts.
+ */
+export default class AccountAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetPassword() {
+    return this.hasAuthorizedAction('set-password');
+  }
+}

addons/api/addon/abilities/collection.js

@@ -0,0 +1,37 @@
+import { Ability } from 'ember-can';
+
+/**
+ * Generic ability provides abilities common to all models in the API.
+ */
+export default class CollectionAbility extends Ability {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canList() {
+    return this.hasAuthorizedCollectionAction('list');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canCreate() {
+    return this.hasAuthorizedCollectionAction('create');
+  }
+
+  // =methods
+
+  /**
+   * Returns true if the given action is contained in the ability model's
+   * `authorized_collection_actions` array.
+   * @param {string} action
+   * @return {boolean}
+   */
+  hasAuthorizedCollectionAction(action) {
+    const authorized_collection_actions =
+      (this.model || {}).authorized_collection_actions || {};
+    const collection = this.collection || {};
+    return authorized_collection_actions[collection]?.includes(action);
+  }
+}

addons/api/addon/abilities/group.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for groups.
+ */
+export default class GroupAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddMembers() {
+    return this.hasAuthorizedAction('add-members');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveMembers() {
+    return this.hasAuthorizedAction('remove-members');
+  }
+}

addons/api/addon/abilities/host-set.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for host sets.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHosts() {
+    return this.hasAuthorizedAction('add-hosts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHosts() {
+    return this.hasAuthorizedAction('remove-hosts');
+  }
+}

addons/api/addon/abilities/model.js

@@ -0,0 +1,59 @@
+import { Ability } from 'ember-can';
+
+/**
+ * Generic ability provides abilities common to all models in the API.
+ */
+export default class ModelAbility extends Ability {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canRead() {
+    return this.hasAuthorizedAction('read');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canUpdate() {
+    return this.hasAuthorizedAction('update');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canDelete() {
+    return this.hasAuthorizedAction('delete');
+  }
+
+  /**
+   * To save an existing model (already persisted to the API), it must contain
+   * the the `update` authorized action.
+   *
+   * For now, new models _always_ have this ability.  The reason is because the
+   * `create` action is authorized on collections, not individual records.  So
+   * this function can't actually tell from a model instance if create
+   * is allowed.
+   *
+   * @type {boolean}
+   */
+  get canSave() {
+    if (this.model.isNew || (!this.model.isNew && this.canUpdate)) {
+      return true;
+    }
+    return false;
+  }
+
+  // =methods
+
+  /**
+   * Returns true if the given action is contained in the ability model's
+   * `authorized_actions` array.
+   * @param {string} action
+   * @return {boolean}
+   */
+  hasAuthorizedAction(action) {
+    return this.model.authorized_actions?.includes(action);
+  }
+}

addons/api/addon/abilities/role.js

@@ -0,0 +1,29 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for roles.
+ */
+export default class RoleAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetGrants() {
+    return this.hasAuthorizedAction('set-grants');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
+}

addons/api/addon/abilities/target.js

@@ -0,0 +1,43 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for targets.
+ */
+export default class TargetAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canConnect() {
+    return this.hasAuthorizedAction('authorize-session');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHostSources() {
+    return this.hasAuthorizedAction('add-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHostSources() {
+    return this.hasAuthorizedAction('remove-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddCredentialSources() {
+    return this.hasAuthorizedAction('add-credential-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveCredentialSources() {
+    return this.hasAuthorizedAction('remove-credential-sources');
+  }
+}

addons/api/addon/abilities/user.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for users.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddAccounts() {
+    return this.hasAuthorizedAction('add-accounts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveAccounts() {
+    return this.hasAuthorizedAction('remove-accounts');
+  }
+}

addons/api/addon/adapters/application.js

@@ -2,8 +2,8 @@ import RESTAdapter from '@ember-data/adapter/rest';
 import { serializeIntoHash } from '@ember-data/adapter/-private';
 /* eslint-disable-next-line ember/no-mixins */
 import AdapterBuildURLMixin from '../mixins/adapter-build-url';
-import config from 'ember-get-config';
-import { get, getWithDefault } from '@ember/object';
+import { getOwner } from '@ember/application';
+import { get } from '@ember/object';
 import { InvalidError } from '@ember-data/adapter/error';
 import { dasherize } from '@ember/string';
 import { pluralize } from 'ember-inflector';
@@ -44,19 +44,36 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
 ) {
   // =attributes
 
+  #host;
+  #namespace;
+
   /**
    * Sets host to the `api.host` string in the application's config,
    * if set.
    * @type {string}
    */
-  host = get(config, 'api.host');
+  get host() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#host || get(config, 'api.host');
+  }
+  set host(value) {
+    // Setting this value is useful for testing purposes.
+    this.#host = value;
+  }
 
   /**
    * Sets namespace to the `api.namespace` string in the application's config,
    * if set.
    * @type {string}
    */
-  namespace = get(config, 'api.namespace');
+  get namespace() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#namespace || get(config, 'api.namespace');
+  }
+  set namespace(value) {
+    // Setting this value is useful for testing purposes.
+    this.#namespace = value;
+  }
 
   // =methods
 
@@ -69,7 +86,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @return {string}
    */
   urlSuffix(modelName, id, snapshot = {}) {
-    const method = getWithDefault(snapshot, 'adapterOptions.method', '');
+    const method = get(snapshot, 'adapterOptions.method') || '';
     return method ? `:${method}` : '';
   }
 
@@ -248,7 +265,11 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
     // Normalize field-specific errors, if any.
     const errors = fieldErrors.map((error) => ({
       detail: error.description,
-      source: { pointer: `/data/attributes/${error.name}` },
+      // Ember Data cannot handle errors on nested attributes, so these are
+      // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
+      // To capture these errors, add read-only fields on the model
+      // corresponding to the underscored field name.
+      source: { pointer: `/data/attributes/${error.name.replace('.', '_')}` },
     }));
     // Return a list of JSON API errors rooted under the `errors` key.
     return {

addons/api/addon/generated/models/auth-method.js

@@ -7,6 +7,12 @@ import { attr } from '@ember-data/model';
 export default class GeneratedAuthMethodModel extends BaseModel {
   // =attributes
 
+  @attr('boolean', {
+    description: 'Specifies if this is the primary auth method for its scope.',
+    readOnly: true,
+  })
+  is_primary;
+
   @attr('string', {
     description: 'The type of the resource, to help differentiate schemas',
   })

addons/api/addon/generated/models/credential-library.js

@@ -0,0 +1,47 @@
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A credential library is a resource that can generate and retrieve
+ * credentials.
+ */
+export default class GeneratedCredentialLibraryModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'The owning credential store ID.',
+  })
+  credential_store_id;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+}

addons/api/addon/generated/models/credential-store.js

@@ -0,0 +1,42 @@
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A credential store is a resource that can retrieve, store, and potentially
+ * generate credentials.
+ */
+export default class GeneratedCredentialStoreModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+}

addons/api/addon/generated/models/managed-group.js

@@ -0,0 +1,47 @@
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A managed group is a resource that represents a collection of accounts.
+ */
+export default class GeneratedManagedGroupModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description: 'The type of this ManagedGroup.',
+  })
+  type;
+
+  @attr('string', {
+    description:
+      'The ID of the Auth Method that is associated with this ManagedGroup',
+  })
+  auth_method_id;
+}

addons/api/addon/generated/models/role.js

@@ -18,7 +18,8 @@ export default class GeneratedRoleModel extends BaseModel {
   description;
 
   @attr('string', {
-    description: 'The scope to which this role applies.  Defaults to the role\'s scope.',
+    description:
+      "The scope to which this role applies.  Defaults to the role's scope.",
   })
   grant_scope_id;
 

addons/api/addon/generated/models/scope.js

@@ -7,6 +7,12 @@ import { attr } from '@ember-data/model';
 export default class GeneratedScopeModel extends BaseModel {
   // =attributes
 
+  @attr('string', {
+    description:
+      'The ID of the primary auth method for this scope.  A primary auth method\nis allowed to vivify users when new accounts are created and is the source for the users account info.',
+  })
+  primary_auth_method_id;
+
   @attr('string', {
     description: 'The type of the resource',
   })

addons/api/addon/generated/models/session.js

@@ -2,7 +2,6 @@ import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
 export default class GeneratedSessionModel extends BaseModel {
-
   // =attributes
 
   @attr('string') user_id;
@@ -32,5 +31,4 @@ export default class GeneratedSessionModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
-
 }

addons/api/addon/generated/models/target.js

@@ -24,13 +24,13 @@ export default class GeneratedTargetModel extends BaseModel {
 
   @attr('number', {
     description: '',
-    defaultValue: 28800
+    defaultValue: 28800,
   })
   session_max_seconds;
 
   @attr('number', {
     description: '',
-    defaultValue: 1
+    defaultValue: 1,
   })
   session_connection_limit;
 

addons/api/addon/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -0,0 +1,15 @@
+// app/initializers/fragment-serializer.js
+import FragmentAuthMethodAttributesAccountClaimMapSerializer from '../serializers/fragment-auth-method-attributes-account-claim-map';
+
+export function initialize(application) {
+  application.register(
+    'serializer:fragment-auth-method-attributes-account-claim-map',
+    FragmentAuthMethodAttributesAccountClaimMapSerializer
+  );
+}
+
+// Fragment serializers must be manually registered
+export default {
+  name: 'fragment-auth-method-attributes-account-claim-map',
+  initialize: initialize,
+};

addons/api/addon/initializers/fragment-string.js

@@ -0,0 +1,12 @@
+// app/initializers/fragment-serializer.js
+import FragmentStringSerializer from '../serializers/fragment-string';
+
+export function initialize(application) {
+  application.register('serializer:fragment-string', FragmentStringSerializer);
+}
+
+// Fragment serializers must be manually registered
+export default {
+  name: 'fragment-string',
+  initialize: initialize,
+};

addons/api/addon/models/account.js

@@ -4,7 +4,6 @@ import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 
 export default class AccountModel extends GeneratedAccountModel {
-
   // =attributes
 
   /**
@@ -18,19 +17,19 @@ export default class AccountModel extends GeneratedAccountModel {
    */
   @equal('type', 'password') isPassword;
 
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'oidc') isOIDC;
+
   /**
    * Convenience for getting username in account.
    * @type {string}
    */
-  @computed('type', 'attributes.login_name')
-  get username() {
-    let username = '';
-    switch (this.type) {
-      case 'password':
-        username = this.attributes.login_name;
-        break;
-    }
-    return username;
+  @computed('attributes.{email,full_name,login_name}')
+  get accountName() {
+    const { email, full_name, login_name } = this.attributes;
+    return email || full_name || login_name;
   }
 
   // =methods

addons/api/addon/models/auth-method.js

@@ -1,3 +1,123 @@
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
+import { attr } from '@ember-data/model';
+import { fragment } from 'ember-data-model-fragments/attributes';
+import { equal } from '@ember/object/computed';
 
-export default class AuthMethodModel extends GeneratedAuthMethodModel {}
+/**
+ * Enum options per auth method type and field.
+ */
+export const options = {
+  oidc: {
+    signing_algorithms: [
+      'RS256',
+      'RS384',
+      'RS512',
+      'ES256',
+      'ES384',
+      'ES512',
+      'PS256',
+      'PS384',
+      'PS512',
+      'EdDSA',
+    ],
+    state: ['inactive', 'active-private', 'active-public'],
+    account_claim_maps: {
+      to: ['sub', 'name', 'email'],
+    },
+  },
+};
+
+export default class AuthMethodModel extends GeneratedAuthMethodModel {
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_state;
+  @attr('string', { readOnly: true }) attributes_issuer;
+  @attr('string', { readOnly: true }) attributes_client_id;
+  @attr('string', { readOnly: true }) attributes_client_secret;
+  @attr('string', { readOnly: true }) attributes_max_age;
+  @attr('string', { readOnly: true }) attributes_api_url_prefix;
+  @attr('string', { readOnly: true })
+  attributes_disable_discovered_config_validation;
+  @attr('string', { readOnly: true }) attributes_dry_run;
+  @attr('string', { readOnly: true }) attributes_account_claim_maps;
+  @attr('string', { readOnly: true }) attributes_claims_scopes;
+  @attr('string', { readOnly: true }) attributes_signing_algorithms;
+  @attr('string', { readOnly: true }) attributes_allowed_audiences;
+  @attr('string', { readOnly: true }) attributes_idp_ca_certs;
+
+  // =attributes
+
+  /**
+   * Attributes of this resource, if any, represented as a JSON fragment.
+   * @type {FragmentAuthMethodAttributesModel}
+   */
+  @fragment('fragment-auth-method-attributes', { defaultValue: {} }) attributes;
+
+  /**
+   * @type {boolean}
+   */
+  @equal('is_primary', true) isPrimary;
+
+  /**
+   * @type {boolean}
+   */
+  get isPassword() {
+    return this.type === 'password';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isOIDC() {
+    return this.type === 'oidc';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isInactive() {
+    return this.attributes.state === 'inactive';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isPrivate() {
+    return this.attributes.state === 'active-private';
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isPublic() {
+    return this.attributes.state === 'active-public';
+  }
+
+  // =methods
+
+  /**
+   * Change the active and visibility state of an OIDC auth method
+   * given its ID.
+   * For OIDC auth methods only.
+   * @param {[string]} state
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  changeState(state, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'change-state',
+      state,
+    };
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+}

addons/api/addon/models/base.js

@@ -1,4 +1,5 @@
 import Model from '@ember-data/model';
+import { attr } from '@ember-data/model';
 import { fragment } from 'ember-data-model-fragments/attributes';
 import { computed } from '@ember/object';
 
@@ -25,7 +26,6 @@ import { computed } from '@ember/object';
  *   2) Or as an ID:  `record.scopeID`.
  */
 export default class BaseModel extends Model {
-
   // =relationships
 
   /**
@@ -36,6 +36,21 @@ export default class BaseModel extends Model {
 
   // =attributes
 
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  authorized_actions;
+
+  @attr({
+    readOnly: true,
+  })
+  authorized_collection_actions;
+
+  get scopeModel() {
+    const id = this.scopeID;
+    return this.store.peekRecord('scope', id);
+  }
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();
@@ -46,7 +61,7 @@ export default class BaseModel extends Model {
 
   /**
    * Convenience for getting and setting the parent scope ID.
-   * @type {string
+   * @type {string}
    */
   @computed('scope.scope_id')
   get scopeID() {

addons/api/addon/models/credential-library.js

@@ -0,0 +1,30 @@
+import GeneratedCredentialLibraryModel from '../generated/models/credential-library';
+import { attr } from '@ember-data/model';
+import { fragment } from 'ember-data-model-fragments/attributes';
+
+/**
+ * Enum options for credential library.
+ */
+export const options = {
+  http_method: ['GET', 'POST'],
+};
+
+export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_http_method;
+  @attr('string', { readOnly: true }) attributes_http_request_body;
+  @attr('string', { readOnly: true }) attributes_path;
+
+  // =attributes
+
+  /**
+   * Attributes of this resource, if any, represented as a JSON fragment.
+   * @type {FragmentCredentialLibraryAttributesModel}
+   */
+  @fragment('fragment-credential-library-attributes', { defaultValue: {} })
+  attributes;
+}

addons/api/addon/models/credential-store.js

@@ -0,0 +1,34 @@
+import GeneratedCredentialStoreModel from '../generated/models/credential-store';
+import { attr } from '@ember-data/model';
+import { fragment } from 'ember-data-model-fragments/attributes';
+import { equal } from '@ember/object/computed';
+
+export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_address;
+  @attr('string', { readOnly: true }) attributes_namespace;
+  @attr('string', { readOnly: true }) attributes_ca_cert;
+  @attr('string', { readOnly: true }) attributes_tls_server_name;
+  @attr('string', { readOnly: true }) attributes_tls_skip_verify;
+  @attr('string', { readOnly: true }) attributes_token;
+  @attr('string', { readOnly: true }) attributes_client_certificate;
+  @attr('string', { readOnly: true }) attributes_client_certificate_key;
+
+  // =attributes
+
+  /**
+   * Attributes of this resource, if any, represented as a JSON fragment.
+   * @type {FragmentAuthMethodAttributesModel}
+   */
+  @fragment('fragment-credential-store-attributes', { defaultValue: {} })
+  attributes;
+
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'vault') isVault;
+}

addons/api/addon/models/fragment-account-attributes.js

@@ -2,8 +2,16 @@ import Fragment from 'ember-data-model-fragments/fragment';
 import { attr } from '@ember-data/model';
 
 export default class FragmentAccountAttributesModel extends Fragment {
+  // =attributes (password)
   @attr('string', {
+    for: 'password',
     description: 'The account login name',
   })
   login_name;
+
+  // =attributes (OIDC)
+  @attr('string', { for: 'oidc' }) subject;
+  @attr('string', { for: 'oidc' }) issuer;
+  @attr('string', { for: 'oidc', readOnly: true }) email;
+  @attr('string', { for: 'oidc', readOnly: true }) full_name;
 }

addons/api/addon/models/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1,9 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+
+export default class FragmentAuthMethodAttributesAccountClaimMapModel extends Fragment {
+  // =attributes (OIDC)
+
+  @attr('string') from;
+  @attr('string') to;
+}

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -0,0 +1,40 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+import { fragmentArray } from 'ember-data-model-fragments/attributes';
+
+export default class FragmentAuthMethodAttributesModel extends Fragment {
+  // =attributes (OIDC)
+
+  @attr('string', { readOnly: true }) state;
+  @attr('string') issuer;
+  @attr('string') client_id;
+  @attr('string') client_secret;
+  @attr('string', { readOnly: true }) client_secret_hmac;
+  @attr('number') max_age;
+  @attr('string') api_url_prefix;
+  @attr('string', { readOnly: true }) callback_url;
+  @attr('boolean') disable_discovered_config_validation;
+  @attr('boolean') dry_run;
+
+  @fragmentArray('fragment-auth-method-attributes-account-claim-map', {
+    emptyArrayIfMissing: true,
+  })
+  account_claim_maps;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  claims_scopes;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  signing_algorithms;
+
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  allowed_audiences;
+
+  @fragmentArray('fragment-string', { emptyArrayIfMissing: true }) idp_ca_certs;
+}

addons/api/addon/models/fragment-credential-library-attributes.js

@@ -0,0 +1,25 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+import { options } from './credential-library';
+
+export default class FragmentCredentialLibraryAttributesModel extends Fragment {
+  //= attributes (vault)
+
+  @attr('string', {
+    description:
+      'The HTTP method the library uses when requesting credentials from Vault.',
+    defaultValue: () => options.http_method[0],
+  })
+  http_method;
+
+  @attr('string', {
+    description:
+      'The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.',
+  })
+  http_request_body;
+
+  @attr('string', {
+    description: 'The path in Vault to request credentials from.',
+  })
+  path;
+}

addons/api/addon/models/fragment-credential-store-attributes.js

@@ -0,0 +1,72 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+
+export default class FragmentCredentialStoreAttributesModel extends Fragment {
+  // =attributes (vault)
+  @attr('string', {
+    for: 'vault',
+    description:
+      "The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'",
+  })
+  address;
+
+  @attr('string', {
+    for: 'vault',
+    description: 'The namespace within Vault to use.',
+  })
+  namespace;
+
+  @attr('string', {
+    for: 'vault',
+    description:
+      "A PEM-encoded CA certificate to verify the Vault server's TLS certificate.",
+  })
+  ca_cert;
+
+  @attr('string', {
+    for: 'vault',
+    description:
+      'Name to use as the SNI host when connecting to Vault via TLS.',
+  })
+  tls_server_name;
+
+  @attr('boolean', {
+    for: 'vault',
+    description: 'Whether or not to skip TLS verification.',
+  })
+  tls_skip_verify;
+
+  @attr('string', {
+    for: 'vault',
+    description: 'A token used for accessing Vault.',
+  })
+  token;
+
+  @attr('string', {
+    for: 'vault',
+    description: 'The Vault token hmac.',
+    readOnly: true,
+  })
+  token_hmac;
+
+  @attr('string', {
+    for: 'vault',
+    description:
+      'A PEM-encoded client certificate to use for TLS authentication to the Vault server.',
+  })
+  client_certificate;
+
+  @attr('string', {
+    for: 'vault',
+    description:
+      "A PEM-encoded private key matching the client certificate from 'client_certificate'.",
+  })
+  client_certificate_key;
+
+  @attr('string', {
+    for: 'vault',
+    description: 'The Vault client certificate key hmac.',
+    readOnly: true,
+  })
+  client_certificate_key_hmac;
+}

addons/api/addon/models/fragment-host-source.js

@@ -1,13 +1,13 @@
 import Fragment from 'ember-data-model-fragments/fragment';
 import { attr } from '@ember-data/model';
 
-export default class FragmentHostSetModel extends Fragment {
+export default class FragmentHostSourceModel extends Fragment {
   // =attributes
 
   @attr('string', {
-    description: 'ID of the related host set',
+    description: 'ID of the related host source',
   })
-  host_set_id;
+  host_source_id;
 
   @attr('string', {
     description: 'ID of the catalog to which the host set belongs',

addons/api/addon/models/fragment-managed-group-attributes.js

@@ -0,0 +1,12 @@
+import Fragment from 'ember-data-model-fragments/fragment';
+import { attr } from '@ember-data/model';
+
+export default class FragmentManagedGroupAttributesModel extends Fragment {
+  // =attributes (OIDC)
+
+  @attr('string', {
+    description:
+      'The boolean expression filter to use to determine membership.',
+  })
+  filter;
+}

addons/api/addon/models/host-catalog.js

@@ -1,3 +1,10 @@
 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
 
-export default class HostCatalogModel extends GeneratedHostCatalogModel {}
+export default class HostCatalogModel extends GeneratedHostCatalogModel {
+  /**
+   * @type {boolean}
+   */
+  get isStatic() {
+    return this.type === 'static';
+  }
+}

addons/api/addon/models/host-set.js

@@ -2,7 +2,6 @@ import GeneratedHostSetModel from '../generated/models/host-set';
 import { fragmentArray } from 'ember-data-model-fragments/attributes';
 
 export default class HostSetModel extends GeneratedHostSetModel {
-
   // =attributes
 
   /**

addons/api/addon/models/host.js

@@ -2,11 +2,9 @@ import GeneratedHostModel from '../generated/models/host';
 import { fragment } from 'ember-data-model-fragments/attributes';
 
 export default class HostModel extends GeneratedHostModel {
-
   /**
    * Attributes of this resource, if any, represented as a JSON fragment.
    * @type {FragmentHostAttributesModel}
    */
   @fragment('fragment-host-attributes', { defaultValue: {} }) attributes;
-
 }

addons/api/addon/models/managed-group.js

@@ -0,0 +1,29 @@
+import GeneratedManagedGroupModel from '../generated/models/managed-group';
+import { attr } from '@ember-data/model';
+import { fragment } from 'ember-data-model-fragments/attributes';
+import { A } from '@ember/array';
+
+export default class ManagedGroupModel extends GeneratedManagedGroupModel {
+  // =attributes
+
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_filter;
+
+  /**
+   * Members is read-only under normal circumstances.  But members can
+   * be persisted via calls to `addMembers()` or `removeMembers()`.
+   */
+  @attr({
+    readOnly: true,
+    defaultValue: () => A(),
+    emptyArrayIfMissing: true,
+  })
+  member_ids;
+
+  @fragment('fragment-managed-group-attributes', { defaultValue: {} })
+  attributes;
+}

addons/api/addon/models/role.js

@@ -35,7 +35,7 @@ export default class RoleModel extends GeneratedRoleModel {
     return this.save({
       adapterOptions: {
         method: 'set-grants',
-        grantStrings
+        grantStrings,
       },
     });
   }

addons/api/addon/models/session.js

@@ -1,14 +1,95 @@
 import GeneratedSessionModel from '../generated/models/session';
 import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
-import { attr } from '@ember-data/model';
+import { tracked } from '@glimmer/tracking';
+import { A } from '@ember/array';
 
-export default class SessionModel extends GeneratedSessionModel {
+/**
+ *
+ */
+class SessionCredential {
+  // =classes
+
+  /**
+   *
+   */
+  static Library = class Library {
+    id;
+    name;
+    description;
+    type;
+
+    constructor(id, name, description, type) {
+      this.id = id;
+      this.name = name;
+      this.description = description;
+      this.type = type;
+    }
+  };
+
+  /**
+   *
+   */
+  static SecretItem = class SecretItem {
+    key;
+    value;
+
+    constructor(key, value) {
+      this.key = key;
+      this.value = value;
+    }
+  };
 
   // =attributes
+  rawCredential;
+  library;
+  #payloadSecret;
 
-  @attr('string', { readOnly: true }) proxy_address;
-  @attr('number', { readOnly: true }) proxy_port;
+  /**
+   * The incoming payload may contain a JSON object under the `decoded` key only
+   * if it can be JSON-decoded.  Some credential stores may not provide JSON,
+   * however, in which case we may have only the raw base64-encoded secret
+   * string.  In the former case, we convert the key/value pairs of the JSON to
+   * an array of `SecretItem` instances.  In the latter case, we return an
+   * array containing a single `SecretItem` instance with key `secret` and a
+   * string value equal to the base64-decoded raw secret.
+   * The credential secret as an array of key/value objects.
+   * @type {SessionCredential.SecretItem[]}
+   */
+  get secrets() {
+    if (this.#payloadSecret?.decoded) {
+      const secretJSON = this.#payloadSecret.decoded;
+      return Object.keys(secretJSON).map(
+        (key) => new SessionCredential.SecretItem(key, secretJSON[key])
+      );
+    } else {
+      // decode from base64
+      const decodedString = atob(this.#payloadSecret.raw);
+      return [new SessionCredential.SecretItem('secret', decodedString)];
+    }
+  }
+
+  // =methods
+
+  constructor(cred) {
+    const { id, name, description, type } = cred.credential_library;
+    this.library = new SessionCredential.Library(id, name, description, type);
+    this.#payloadSecret = cred.secret;
+    this.rawCredential = cred;
+  }
+}
+
+export default class SessionModel extends GeneratedSessionModel {
+  // =attributes
+
+  // These transient attributes are used for values that come from the CLI
+  // `connect` command as triggered by Desktop.  These attributes represent
+  // transient read-only values.
+  @tracked acknowledged;
+  @tracked started_desktop_client;
+  @tracked proxy_address;
+  @tracked proxy_port;
+  credentials = A();
 
   @equal('status', 'active') isActive;
   @equal('status', 'pending') isPending;
@@ -42,6 +123,13 @@ export default class SessionModel extends GeneratedSessionModel {
 
   // =methods
 
+  /**
+   *
+   */
+  addCredential(cred) {
+    this.credentials.pushObject(new SessionCredential(cred));
+  }
+
   /**
    * Cancels the session via the `cancel` method.
    * See serializer and adapter for more information.
@@ -61,5 +149,4 @@ export default class SessionModel extends GeneratedSessionModel {
       },
     });
   }
-
 }

addons/api/addon/models/target.js

@@ -12,13 +12,23 @@ export default class TargetModel extends GeneratedTargetModel {
   @fragment('fragment-target-attributes', { defaultValue: {} }) attributes;
 
   /**
-   * @type {[FragmentHostSetModel]}
+   * @type {[FragmentHostSourceModel]}
    */
-  @fragmentArray('fragment-host-set', {
+  @fragmentArray('fragment-host-source', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
-  host_sets;
+  host_sources;
+
+  /**
+   * Credential source ids are read only and can be
+   * persisted via a dedicated call to `addCredentialSources()`.
+   */
+  @fragmentArray('fragment-string', {
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  application_credential_source_ids;
 
   /**
    * An array of resolved host set and host catalog instances.  Model instances
@@ -26,23 +36,39 @@ export default class TargetModel extends GeneratedTargetModel {
    * instances).  Unresolvable instances are excluded from the array.
    * @type {[{model: HostSetModel, hostCatalog: HostCatalogModel}]}
    */
-  @computed('host_sets.[]', 'store')
+  @computed('host_sources.[]', 'store')
   get hostSets() {
-    return this.host_sets
-      .map(({ host_set_id, host_catalog_id }) => ({
-        model: this.store.peekRecord('host-set', host_set_id),
+    return this.host_sources
+      .map(({ host_source_id, host_catalog_id }) => ({
+        model: this.store.peekRecord('host-set', host_source_id),
         hostCatalog: this.store.peekRecord('host-catalog', host_catalog_id),
       }))
       .filter((hostSetRef) => hostSetRef.model !== null);
   }
 
+  /**
+   * An array of resolved credential library instances.  Model instances
+   * must already be loaded into the store (this method will not load unloaded
+   * instances).  Unresolvable instances are excluded from the array.
+   * @type {[CredentialLibraryModel]}
+   */
+  @computed('application_credential_source_ids.[]', 'store')
+  get credentialLibraries() {
+    return this.application_credential_source_ids
+      .map((source) =>
+        this.store.peekRecord('credential-library', source.value)
+      )
+      .filter(Boolean);
+  }
+
   /**
    * Sessions associated with this target (but only already loaded sessions).
    * @type {SessionModel[]}
    */
   get sessions() {
-    return this.store.peekAll('session')
-      .filter(s => s && (s.target_id === this.id));
+    return this.store
+      .peekAll('session')
+      .filter((s) => s && s.target_id === this.id);
   }
 
   /**
@@ -58,24 +84,25 @@ export default class TargetModel extends GeneratedTargetModel {
    * @type {boolean}
    */
   get isActive() {
-    const pendingOrActiveSessions =
-      this.sessions.filter(s => s.isActive || s.isPending);
+    const pendingOrActiveSessions = this.sessions.filter(
+      (s) => s.isActive || s.isPending
+    );
     return Boolean(pendingOrActiveSessions.length);
   }
 
   // =methods
 
   /**
-   * Adds host sets via the `add-host-sets` method.
+   * Adds host sets via the `add-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  addHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  addHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'add-host-sets',
+      method: 'add-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -89,16 +116,16 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete host sets via the `remove-host-sets` method.
+   * Delete host sets via the `remove-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  removeHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  removeHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'remove-host-sets',
+      method: 'remove-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -112,12 +139,71 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete a single host set via the `remove-host-sets` method.
+   * Delete a single host set via the `remove-host-sources` method.
    * @param {number} hostSetID
    * @param {object} options
    * @return {Promise}
    */
-  removeHostSet(hostSetID, options) {
-    return this.removeHostSets([hostSetID], options);
+  removeHostSource(hostSetID, options) {
+    return this.removeHostSources([hostSetID], options);
+  }
+
+  /**
+   * Adds credential libraries via the `add-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} credentialLibraryIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  addCredentialSources(credentialLibraryIDs, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'add-credential-sources',
+      credentialLibraryIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Delete credential libraries via the `remove-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} credentialLibraryIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  removeCredentialSources(
+    credentialLibraryIDs,
+    options = { adapterOptions: {} }
+  ) {
+    const defaultAdapterOptions = {
+      method: 'remove-credential-sources',
+      credentialLibraryIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Delete a single credential library set via the `remove-credential-sources` method.
+   * @param {number} credentialLibraryID
+   * @param {object} options
+   * @return {Promise}
+   */
+  removeCredentialSource(credentialLibraryID, options) {
+    return this.removeCredentialSources([credentialLibraryID], options);
   }
 }

addons/api/addon/models/user.js

@@ -1,9 +1,9 @@
 import GeneratedUserModel from '../generated/models/user';
 import { attr } from '@ember-data/model';
+import { computed } from '@ember/object';
 import { A } from '@ember/array';
 
 export default class UserModel extends GeneratedUserModel {
-
   // =attributes
 
   /**
@@ -17,6 +17,35 @@ export default class UserModel extends GeneratedUserModel {
   })
   account_ids;
 
+  /**
+   * Represents the user's primary account email, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) email;
+
+  /**
+   * Represents the user's primary account full_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) full_name;
+
+  /**
+   * Represents the user's primary account login_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) login_name;
+
+  /**
+   * Convenience for getting a reasonable string that names the account.
+   * There are many options, so we fallback in order of precedence.
+   * @type {string}
+   */
+  @computed('email,full_name,login_name,displayName')
+  get accountName() {
+    const { email, full_name, login_name } = this;
+    return email || full_name || login_name;
+  }
+
   // =methods
 
   /**
@@ -74,5 +103,4 @@ export default class UserModel extends GeneratedUserModel {
   removeAccount(accountID, options) {
     return this.removeAccounts([accountID], options);
   }
-
 }

addons/api/addon/serializers/account.js

@@ -1,7 +1,6 @@
 import ApplicationSerializer from './application';
 
 export default class AccountSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
@@ -21,13 +20,55 @@ export default class AccountSerializer extends ApplicationSerializer {
    * @return {object}
    */
   serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'password':
+        return this.serializePassword(...arguments);
+      case 'oidc':
+        return this.serializeOIDC(...arguments);
+    }
+  }
+
+  /**
+   * OIDC serialization limits the `attributes` posted on create and omits
+   * `attributes` entirely on update.
+   */
+  serializeOIDC(snapshot) {
+    const { isNew } = snapshot?.record;
+    let serialized = super.serialize(...arguments);
+    delete serialized.attributes;
+    if (isNew) {
+      serialized.attributes = {};
+      const { issuer, subject } = snapshot.attr('attributes').record;
+      if (issuer) serialized.attributes.issuer = issuer;
+      if (subject) serialized.attributes.subject = subject;
+    }
+    return serialized;
+  }
+
+  /**
+   * Password serialization omits `attributes` and handles password-related
+   * custom methods.
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serializePassword(snapshot) {
     const password = snapshot?.adapterOptions?.password;
     let serialized = super.serialize(...arguments);
+    // Only login_name is serialized into password attributes.
+    const { login_name } = serialized.attributes;
+    if (login_name) {
+      serialized.attributes = { login_name };
+    } else {
+      serialized.attributes = {};
+    }
+    // New record case
     if (password && snapshot?.record?.isNew)
       serialized.attributes.password = password;
+    // Set password custom method
     if (snapshot?.adapterOptions?.method === 'set-password') {
       serialized = this.serializeForSetPassword(snapshot, password);
     }
+    // Change password custom method
     if (snapshot?.adapterOptions?.method === 'change-password') {
       const { currentPassword, newPassword } = snapshot?.adapterOptions;
       serialized = this.serializeForChangePassword(

addons/api/addon/serializers/application.js

@@ -7,7 +7,6 @@ import { copy } from 'ember-copy';
  * Manages serialization/normalization of data to/from the API.
  */
 export default class ApplicationSerializer extends RESTSerializer {
-
   // =properties
 
   /**
@@ -82,7 +81,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     // Delete `scope` field
     delete serialized.scope;
     // And serialize `scope_id`
-    if(this.serializeScopeID) {
+    if (this.serializeScopeID) {
       const scope_id = snapshot?.attr('scope')?.attr('scope_id');
       if (scope_id) serialized.scope_id = scope_id;
     }

addons/api/addon/serializers/auth-method.js

@@ -0,0 +1,102 @@
+import ApplicationSerializer from './application';
+import { copy } from 'ember-copy';
+
+export default class AuthMethodSerializer extends ApplicationSerializer {
+  // =methods
+
+  /**
+   * Delegates to a type-specific serialization, or default.
+   * @override
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'oidc':
+        return this.serializeOIDC(...arguments);
+      default:
+        return this.serializeDefault(...arguments);
+    }
+  }
+
+  /**
+   * Default serialization omits `attributes`.
+   * @return {object}
+   */
+  serializeDefault() {
+    let serialized = super.serialize(...arguments);
+    delete serialized.attributes;
+    return serialized;
+  }
+
+  /**
+   * If `adapterOptions.state` is set, the serialization should
+   * include **only state** and version.  Normally, this is not serialized.
+   * @param {Snapshot} snapshot
+   * @return {object}
+   */
+  serializeOIDC(snapshot) {
+    let serialized = super.serialize(...arguments);
+    const state = snapshot?.adapterOptions?.state;
+    if (state) {
+      serialized = this.serializeOIDCWithState(snapshot, state);
+    } else {
+      delete serialized.attributes.state;
+    }
+    return serialized;
+  }
+
+  /**
+   * Returns a payload containing only state and version.
+   * @param {Snapshot} snapshot
+   * @param {string} state
+   * @return {object}
+   */
+  serializeOIDCWithState(snapshot, state) {
+    return {
+      version: snapshot.attr('version'),
+      attributes: { state },
+    };
+  }
+
+  /**
+   * Sorts the array in order of "is_primary" such that the primary method
+   * appears first.  The "natural" order of auth methods places primary first.
+   *
+   * @override
+   * @return {object}
+   */
+  normalizeArrayResponse() {
+    const normalized = super.normalizeArrayResponse(...arguments);
+    normalized.data = normalized.data.sort((a) =>
+      a.attributes.is_primary ? -1 : 1
+    );
+    return normalized;
+  }
+
+  /**
+   * Sets `is_primary` to `false` if it is missing in the response.  The API
+   * omits "zero" values per:
+   * https://developers.google.com/protocol-buffers/docs/proto3#default
+   *
+   * TODO:  generalize this so that all zero values are reified.
+   * @override
+   * @see FragmentScope
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalize(typeClass, hash, ...rest) {
+    let normalizedHash = copy(hash, true);
+    // switch (normalizedHash.type) {
+    //   case 'oidc':
+    //     normalizedHash = this.normalizeOIDC(normalizedHash);
+    //     break;
+    // }
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    if (!normalized.data.attributes.is_primary) {
+      normalized.data.attributes.is_primary = false;
+    }
+    return normalized;
+  }
+}

addons/api/addon/serializers/credential-library.js

@@ -0,0 +1,3 @@
+import ApplicationSerializer from './application';
+
+export default class CredentialLibrarySerializer extends ApplicationSerializer {}

addons/api/addon/serializers/credential-store.js

@@ -0,0 +1,3 @@
+import ApplicationSerializer from './application';
+
+export default class CredentialStoreSerializer extends ApplicationSerializer {}

addons/api/addon/serializers/fragment-account-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAccountAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1,30 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentHostSourceSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Serializes an account claim to string.
+   * @param {Snapshot} snapshot
+   * @return {string}
+   */
+  serialize(snapshot) {
+    const from = snapshot.attr('from');
+    const to = snapshot.attr('to');
+    return `${from}=${to}`;
+  }
+
+  /**
+   * Normalizes account claim strings into JSON API objects.
+   * @param {Model} typeClass
+   * @param {string} value
+   * @return {object}
+   */
+  normalize(typeClass, value) {
+    const normalizedHash = {
+      from: value.split('=')[0],
+      to: value.split('=')[1],
+    };
+    return super.normalize(typeClass, normalizedHash);
+  }
+}

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1,26 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Client secret cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'client_secret' && !json[key]) delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-credential-library-attributes.js

@@ -0,0 +1,27 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentCredentialLibraryAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   * Only serialize http_request_body when `http_method` is set to `POST`.
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Do not serialize http_request_body unless http_method is POST
+    if (key === 'http_request_body' && !json['http_method']?.match(/post/i))
+      delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-credential-store-attributes.js

@@ -0,0 +1,34 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentCredentialStoreAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   *
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty strings to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Token cannot be unset.  If it's falsy, it must be removed.
+    if (key === 'token' && !json[key]) delete json[key];
+    // Client certificate key cannot be unset when certificate is set.
+    // If it's falsy, it must be removed.
+    if (
+      key === 'client_certificate_key' &&
+      !json[key] &&
+      json['client_certificate']
+    )
+      delete json[key];
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-host-set.js

@@ -1,16 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentHostSetSerializer extends JSONSerializer {
-  // =methods
-
-  /**
-   * Renames `id` to `host_set_id` because fragments may not have IDs.
-   * Otherwise normalizes as normal.
-   * @param {ModelClass} typeClass
-   * @param {object} resourceHash
-   * @return {object}
-   */
-  normalize(typeClass, { id: host_set_id, ...obj }) {
-    return super.normalize(typeClass, { host_set_id, ...obj });
-  }
-}

addons/api/addon/serializers/fragment-host-source.js

@@ -0,0 +1,16 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentHostSourceSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Renames `id` to `host_source_id` because fragments may not have IDs.
+   * Otherwise normalizes as normal.
+   * @param {ModelClass} typeClass
+   * @param {object} resourceHash
+   * @return {object}
+   */
+  normalize(typeClass, { id: host_source_id, ...obj }) {
+    return super.normalize(typeClass, { host_source_id, ...obj });
+  }
+}

addons/api/addon/serializers/fragment-managed-group-attributes.js

@@ -0,0 +1,27 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentManagedGroupAttributesSerializer extends JSONSerializer {
+  /**
+   * If an attribute is annotated as readOnly in the model, don't serialize it.
+   * Otherwise delegate to default attribute serializer.
+   * @override
+   * @method serializeAttribute
+   * @param {Snapshot} snapshot
+   * @param {Object} json
+   * @param {String} key
+   * @param {Object} attribute
+   */
+  serializeAttribute(snapshot, json, key, attribute) {
+    const { type, options } = attribute;
+    let value = super.serializeAttribute(...arguments);
+    // Convert empty string to null.
+    if (type === 'string' && json[key] === '') json[key] = null;
+    // Do not serialize read-only attributes.
+    if (options.readOnly) delete json[key];
+    // Version is sent only if it has a non-nullish value
+    if (key === 'version') {
+      if (json[key] === null || json[key] === undefined) delete json[key];
+    }
+    return value;
+  }
+}

addons/api/addon/serializers/fragment-string.js

@@ -0,0 +1,24 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentStringSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Serializes a to string.
+   * @param {Snapshot} snapshot
+   * @return {string}
+   */
+  serialize(snapshot) {
+    return snapshot.attr('value');
+  }
+
+  /**
+   * Normalizes from strings.
+   * @param {Model} typeClass
+   * @param {string} value
+   * @return {object}
+   */
+  normalize(typeClass, value) {
+    return super.normalize(typeClass, { value });
+  }
+}

addons/api/addon/serializers/host-set.js

@@ -1,7 +1,6 @@
 import ApplicationSerializer from './application';
 
 export default class HostSetSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
@@ -38,21 +37,4 @@ export default class HostSetSerializer extends ApplicationSerializer {
       host_ids: hostIDs,
     };
   }
-
-  /**
-   * Converts string arrays to object arrays for use with `fragment-string`.
-   * E.g. `"foo"` -> `{value: "foo"}`
-   * @override
-   * @param {Model} modelClass
-   * @param {Object} resourceHash
-   * @return {Object}
-   */
-  normalize(modelClass, resourceHash) {
-    // TODO:  can fragment string normalization be handled generically?
-    // TODO: host_ids might actually be attributes.host_ids
-    if (resourceHash.host_ids) {
-      resourceHash.host_ids = resourceHash.host_ids.map((value) => ({ value }));
-    }
-    return super.normalize(modelClass, resourceHash);
-  }
 }

addons/api/addon/serializers/host.js

@@ -1,12 +1,10 @@
 import ApplicationSerializer from './application';
 
 export default class HostSerializer extends ApplicationSerializer {
-
   // =properties
 
   /**
    * @type {boolean}
    */
   serializeScopeID = false;
-
 }

addons/api/addon/serializers/managed-group.js

@@ -0,0 +1,10 @@
+import ApplicationSerializer from './application';
+
+export default class ManagedGroupSerializer extends ApplicationSerializer {
+  // =properties
+
+  /**
+   * @type {boolean}
+   */
+  serializeScopeID = false;
+}

addons/api/addon/serializers/role.js

@@ -17,8 +17,8 @@ export default class RoleSerializer extends ApplicationSerializer {
   serialize(snapshot) {
     const grantStrings = get(snapshot, 'adapterOptions.grantStrings');
     let serialized = super.serialize(...arguments);
-    if (grantStrings) serialized =
-      this.serializeWithGrantStrings(snapshot, grantStrings);
+    if (grantStrings)
+      serialized = this.serializeWithGrantStrings(snapshot, grantStrings);
     const principalIDs = snapshot?.adapterOptions?.principalIDs;
     if (principalIDs)
       serialized = this.serializewithPrincipals(snapshot, principalIDs);
@@ -34,7 +34,7 @@ export default class RoleSerializer extends ApplicationSerializer {
   serializeWithGrantStrings(snapshot, grantStrings) {
     return {
       version: snapshot.attr('version'),
-      grant_strings: grantStrings
+      grant_strings: grantStrings,
     };
   }
 

addons/api/addon/serializers/target.js

@@ -6,30 +6,55 @@ export default class TargetSerializer extends ApplicationSerializer {
   /**
    * If `adapterOptions.hostSets` is set to an array of host set models,
    * the resulting target serialization should include **only host sets**
-   * and the version.  Normally, host sets are not serialized.
+   * and the version.
+   * If `adapterOptions.credentialLibraries` is set to an array of
+   * credential library models, the resulting target serialization should
+   * include **only credential libraries** and the version.
+   * Normally, neither host sets or credential libraries are not serialized.
    * @override
    * @param {Snapshot} snapshot
    * @return {object}
    */
   serialize(snapshot) {
     let serialized = super.serialize(...arguments);
-    const hostSetIDs = snapshot?.adapterOptions?.hostSetIDs;
-    if (hostSetIDs)
-      serialized = this.serializeWithHostSets(snapshot, hostSetIDs);
+    const hostSourceIDs = snapshot?.adapterOptions?.hostSetIDs;
+    if (hostSourceIDs) {
+      serialized = this.serializeWithHostSources(snapshot, hostSourceIDs);
+    }
+    const credentialSourceIDs = snapshot?.adapterOptions?.credentialLibraryIDs;
+    if (credentialSourceIDs)
+      serialized = this.serializeWithCredentialSources(
+        snapshot,
+        credentialSourceIDs
+      );
     return serialized;
   }
 
   /**
-   * Returns a payload containing only the host_set_ids array using IDs
-   * passed into the function (rather than existing host sets on the model).
+   * Returns a payload containing only version and an array of passed IDs,
+   * rather than existing instances on the model.
    * @param {Snapshot} snapshot
    * @param {[string]} hostSetIDs
    * @return {object}
    */
-  serializeWithHostSets(snapshot, hostSetIDs) {
+  serializeWithHostSources(snapshot, hostSourceIDs) {
     return {
       version: snapshot.attr('version'),
-      host_set_ids: hostSetIDs,
+      host_source_ids: hostSourceIDs,
+    };
+  }
+
+  /**
+   * Returns a payload containing only version and an array of passed IDs,
+   * rather than existing instances on the model.
+   * @param {Snapshot} snapshot
+   * @param {[string]} credentialSourceIDs
+   * @return {object}
+   */
+  serializeWithCredentialSources(snapshot, credentialSourceIDs) {
+    return {
+      version: snapshot.attr('version'),
+      application_credential_source_ids: credentialSourceIDs,
     };
   }
 }

addons/api/addon/serializers/user.js

@@ -13,8 +13,8 @@ export default class UserSerializer extends ApplicationSerializer {
   serialize(snapshot) {
     let serialized = super.serialize(...arguments);
     const accountIDs = snapshot?.adapterOptions?.accountIDs;
-    if (accountIDs) serialized =
-      this.serializewithAccounts(snapshot, accountIDs);
+    if (accountIDs)
+      serialized = this.serializewithAccounts(snapshot, accountIDs);
     return serialized;
   }
 

addons/api/addon/services/resource-filter-store.js

@@ -0,0 +1,127 @@
+import Service from '@ember/service';
+import { inject as service } from '@ember/service';
+
+/**
+ * Takes a POJO representing a query and converts it to a boolean expression
+ * string which is understood by the API.
+ *
+ * @example
+ *   const filter = new ResourceFilter({
+ *     type: 'oidc',
+ *     status: ['active', 'pending'],
+ *     authorized_actions: [{ contains: 'read' }]
+ *   });
+ *   log(filter.queryExpression);
+ *   // ("/item/type" == "oidc") and ("/item/status" == "active" or "/item/status" == "pending") and ("read" in "/item/authorized_actions")
+ */
+export class ResourceFilter {
+  // =attributes
+
+  /**
+   * @type {?object}
+   */
+  #filterObject;
+
+  /**
+   * @type {string}
+   */
+  get queryExpression() {
+    const clauses = Object.keys(this.#filterObject)
+      .map((key) => {
+        const value = this.#filterObject[key];
+        const valuesArray = Array.isArray(value) ? value : [value];
+        return this.parenthetical(
+          this.or(
+            valuesArray.map((value) => {
+              if (value && value.contains) {
+                return this.in(value.contains, key);
+              }
+              return this.equals(key, value);
+            })
+          )
+        );
+      })
+      .flat()
+      .filter((item) => item);
+    return this.and(clauses);
+  }
+
+  // =methods
+
+  /**
+   * @param {object} filterObject
+   */
+  constructor(filterObject = {}) {
+    this.#filterObject = Object.assign({}, filterObject);
+  }
+
+  /**
+   * @param {string} key
+   * @param value
+   * @return {string}
+   */
+  equals(key, value) {
+    return value !== null ? `"/item/${key}" == "${value}"` : null;
+  }
+
+  /**
+   * @param {string} key
+   * @param value
+   * @return {string}
+   */
+  in(value, key) {
+    return value !== null ? `"${value}" in "/item/${key}"` : null;
+  }
+
+  /**
+   * @param {string[]} clauses
+   * @return {string}
+   */
+  and(clauses) {
+    return clauses.join(' and ');
+  }
+
+  /**
+   * @param {string[]} clauses
+   * @return {string}
+   */
+  or(clauses) {
+    return clauses.join(' or ');
+  }
+
+  /**
+   * @param {string} expression
+   * @return {string}
+   */
+  parenthetical(expression) {
+    return expression ? `(${expression})` : null;
+  }
+}
+
+/**
+ *
+ */
+export default class ResourceFilterStoreService extends Service {
+  // =services
+
+  @service store;
+
+  // =methods
+
+  /**
+   * Similar to Ember's built-in `store.query`, except this method accepts
+   * an additional argument `filterObject` representing a query filter
+   * (see ResourceFilter class above).
+   * @param {string} modelName
+   * @param {object} filterObject
+   * @param {?object} storeQuery
+   * @return {Promise}
+   */
+  queryBy(modelName, filterObject = {}, storeQuery = {}) {
+    const filter = new ResourceFilter(filterObject);
+    const query = Object.assign({}, storeQuery);
+    // Apply filters to store query when available
+    if (filter.queryExpression) query.filter = filter.queryExpression;
+    return this.store.query(modelName, query);
+  }
+}

addons/api/addon/services/storage.js

@@ -76,8 +76,9 @@ export default class StorageService extends Service {
     const inMemory = get(config, 'storage.memory');
     // Get the global context object (window) via service lookup,
     // because just reaching for a global is icky
-    const globalContext = getOwner(this).lookup('service:-document')
-      .documentElement.parentNode.defaultView;
+    const globalContext =
+      getOwner(this).lookup('service:-document').documentElement.parentNode
+        .defaultView;
     // If memory storage enabled, return the memory storage instance,
     // otherwise return localStorage.
     return inMemory ? this.#memoryStorage : globalContext.localStorage;

addons/api/app/abilities/account.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/account';

addons/api/app/abilities/collection.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/collection';

addons/api/app/abilities/group.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/group';

addons/api/app/abilities/host-set.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/host-set';

addons/api/app/abilities/model.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/model';

addons/api/app/abilities/role.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/role';

addons/api/app/abilities/target.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/target';

addons/api/app/abilities/user.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/user';

addons/api/app/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -0,0 +1,4 @@
+export {
+  default,
+  initialize,
+} from 'api/initializers/fragment-auth-method-attributes-account-claim-map-serializer';

addons/api/app/initializers/fragment-string.js

@@ -0,0 +1 @@
+export { default, initialize } from 'api/initializers/fragment-string';

addons/api/app/models/credential-library.js

@@ -0,0 +1 @@
+export { default } from 'api/models/credential-library';

addons/api/app/models/credential-store.js

@@ -0,0 +1 @@
+export { default } from 'api/models/credential-store';

addons/api/app/models/fragment-auth-method-attributes-account-claim-map.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-auth-method-attributes-account-claim-map';

addons/api/app/models/fragment-auth-method-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-auth-method-attributes';

addons/api/app/models/fragment-credential-library-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-credential-library-attributes';

addons/api/app/models/fragment-credential-store-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-credential-store-attributes';

addons/api/app/models/fragment-host-set.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-host-set';

addons/api/app/models/fragment-host-source.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-host-source';

addons/api/app/models/fragment-managed-group-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-managed-group-attributes';

addons/api/app/models/managed-group.js

@@ -0,0 +1 @@
+export { default } from 'api/models/managed-group';

addons/api/app/serializers/auth-method.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/auth-method';

addons/api/app/serializers/credential-library.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/credential-library';

addons/api/app/serializers/credential-store.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/credential-store';

addons/api/app/serializers/fragment-account-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-account-attributes';

addons/api/app/serializers/fragment-auth-method-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-auth-method-attributes';

addons/api/app/serializers/fragment-credential-library-attributes.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-credential-library-attributes';