chore: 🤖 Update changelog and version for desktop (#1712)

* fix: 🐛 Show done only when a worker is registered successfully, otherwise show cancel and navigate to the workers list

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Anyone attached to this rule will always been assigned to a pull request
+* @hashicorp/boundary-ui

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 contact_links:
   - name: Ask a question
     url: https://discuss.hashicorp.com/c/boundary

.github/labeler.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 addons:
   - addons/**/*
 

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+:tickets: [Jira ticket](https://hashicorp.atlassian.net/browse/JIRA_TICKET_NUMBER)
+
+## Description
+
+<!--
+Replace PATH_TO_FEATURE with Vercel link
+-->
+
+:technologist: [Admin preview](PATH_TO_FEATURE)
+
+:rose: [Rose preview](PATH_TO_FEATURE)
+
+:desktop_computer: [Desktop preview](PATH_TO_FEATURE)
+
+<!-- Add a brief description of changes here. Include any other necessary relevant links -->
+
+### Screenshots (if appropriate):

.github/workflows/build-admin-ui.yaml

@@ -0,0 +1,97 @@
+name: Build Admin UI
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  dependencies:
+    name: Install dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          node-version: 16
+      - run: yarn install
+  build-admin-ui-oss:
+    name: Build Admin UI OSS
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - name: Build
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          node-version: 16
+      - run: yarn run build:ui:admin:oss
+      - name: Upload artifact admin-ui
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: admin-ui
+          path: ./ui/admin/dist/
+      - name: Upload artifact OSS admin UI
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: admin-ui-oss
+          path: ./ui/admin/dist/
+  build-admin-ui-enterprise:
+    name: Build Admin UI Enterprise
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - name: Build
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          node-version: 16
+      - run: yarn run build:ui:admin:enterprise
+      - name: Upload artifact enterprise admin UI
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: admin-ui-ent
+          path: ./ui/admin/dist/
+  build-admin-ui-hcp:
+    name: Build Admin UI HCP
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - name: Build
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          node-version: 16
+      - run: yarn run build:ui:admin:hcp
+      - name: Upload artifact HCP admin UI
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: admin-ui-hcp
+          path: ./ui/admin/dist/

.github/workflows/codeql-analysis.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
@@ -43,7 +43,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@9a866ed4524fc3422c3af1e446dab8efa3503411 # codeql-bundle-20230418
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@9a866ed4524fc3422c3af1e446dab8efa3503411 # codeql-bundle-20230418
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@9a866ed4524fc3422c3af1e446dab8efa3503411 # codeql-bundle-20230418

.github/workflows/jira.yml

@@ -30,7 +30,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
 
     - name: Login
-      uses: atlassian/gajira-login@v2.0.0
+      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
       env:
         JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
         JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
@@ -48,7 +48,7 @@ jobs:
 
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@v0.1.0
+      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
       with:
         project: ICU
         issuetype: "GH Issue"
@@ -61,28 +61,28 @@ jobs:
     - name: Search
       if: github.event.action != 'opened'
       id: search
-      uses: tomhjp/gh-action-jira-search@v0.2.1
+      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
       with:
         # cf[10089] is Issue Link custom field
         jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
 
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: atlassian/gajira-comment@v2.0.2
+      uses: atlassian/gajira-comment@v2.0.2 # TSCCR: no entry for repository "atlassian/gajira-comment"
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
 
     - name: Close ticket
       if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.1
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: Done
 
     - name: Reopen ticket
       if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.1
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: "To Do"

.github/workflows/labeler.yml

@@ -6,6 +6,6 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@main
+    - uses: actions/labeler@ba790c862c380240c6d5e7427be5ace9a05c754b # v4.0.3
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/monorepo-validate.yaml

@@ -2,55 +2,73 @@ name: Validate Monorepo
 on: pull_request
 jobs:
 
-  compliance:
-    name: License Compliance
+  dependencies:
+    name: Install dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
         with:
-          node-version: '12.x'
+          node-version: 16
       - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+
+  compliance:
+    name: License Compliance
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          node-version: 16
       - run: yarn run compliance:licenses
 
   lint:
     name: Lint
+    needs: [dependencies, compliance]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
         with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+          node-version: 16
       - run: yarn lint
 
   test:
     name: Test
+    needs: [lint]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
         with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+          node-version: 16
       - run: yarn test

.github/workflows/oss-ent-merge-trigger.yml

@@ -0,0 +1,25 @@
+name: Trigger OSS to Enterprise Merge
+on:
+  pull_request_target:
+    types:
+      - closed
+    branches:
+      - main
+
+jobs:
+  trigger-oss-merge:
+    # Run this only on merge events in OSS repo
+    if: ${{ github.event.pull_request.merged && github.repository == 'hashicorp/boundary-ui' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Merge
+        env:
+          GIT_REF: ${{ github.ref_name }}
+          GIT_SHA: ${{ github.sha }}
+          GH_PAT: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          GIT_ACTOR: ${{ github.actor }}
+        run: |
+          curl -H "Authorization: token $GH_PAT" \
+            -H 'Accept: application/json' \
+            -d "{\"event_type\": \"oss-merge\", \"client_payload\": {\"git-ref\": \"${GIT_REF}\", \"git-sha\": \"${GIT_SHA}\", \"git-actor\": \"${GIT_ACTOR}\" }}" \
+            "https://api.github.com/repos/hashicorp/boundary-ui-enterprise/dispatches"

.github/workflows/test-release-trigger.yml

@@ -1,6 +1,5 @@
 name: "Trigger Test Boundary UI release"
 
-
 on:
   workflow_dispatch:
     inputs:
@@ -9,15 +8,18 @@ on:
         required: true
 
 jobs:
-  trigger-circleci-release:
+  trigger-gha-release:
     runs-on: ubuntu-latest
     steps:
-
-      - name: Trigger Release job
+      - name: Release description
         if: github.event_name == 'workflow_dispatch'
         run: |
           echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
+      - name: Trigger Release workflow in boundary-ui-releases
+        run: |
+          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
+          gh workflow run release.yml \
+          --repo hashicorp/boundary-ui-releases \
+          --ref main \
+          -f TAG="${{ github.event.inputs.branch }}"
 
-          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "'${{ github.event.inputs.branch }}'" }}' \
-          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

.github/workflows/ui-release-trigger.yml

@@ -6,14 +6,17 @@ on:
       - '*'
 
 jobs:
-  trigger-circleci-release:
+  trigger-gha-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Trigger Release job
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - name: Release description
         run: |
           echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
-
-          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "'${GITHUB_REF#refs/tags/}'" }}' \
-          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline
+      - name: Trigger Release workflow in boundary-ui-releases
+        run: |
+          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
+          gh workflow run release.yml \
+          --repo hashicorp/boundary-ui-releases \
+          --ref main \
+          -f TAG="${GITHUB_REF#refs/tags/}"

.gitignore

@@ -22,8 +22,4 @@ testem.log
 yarn-error.log
 storybook-static
 **/.storybook/*.html
-
-# ember-try
-.node_modules.ember-try
-bower.json.ember-try
-package.json.ember-try
+.watchman-cookie*

.husky/pre-commit

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+yarn compliance:licenses
+npx lint-staged

.husky/prepare-commit-msg

@@ -0,0 +1,14 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+COMMIT_MSG_FILE=$1
+COMMIT_SOURCE=$2
+SHA1=$3
+
+# Don't run commitizen for merge or squash commits
+if [ "${COMMIT_SOURCE}" = merge ] || [ "${COMMIT_SOURCE}" = squash ];then
+    exit 0
+fi
+
+# This is to allow interaction with the terminal for commitizen
+exec < /dev/tty && npx git-cz --hook || true

.release/release-metadata.hcl

@@ -0,0 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+url_license = "https://github.com/hashicorp/boundary-ui/blob/main/LICENSE"
+url_project_website = "https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app"
+url_source_repository = "https://github.com/hashicorp/boundary-ui"

LICENSE

@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License, version 2.0
 
 1. Definitions

README.md

@@ -38,9 +38,9 @@ You will need the following things properly installed on your computer.
 
 * [Git][git]
 * [Node.js][node]
-  * v10–v15
+  * Supported versions:`v12`, `v14` and `v16`.
   * **Apple Silicon Users**:  if you experience problems building or running
-    Boundary UIs, try Node v15.
+    Boundary UIs, try Node v14.
 * [Yarn][yarn] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]
@@ -66,7 +66,6 @@ List of available project commands.  `yarn run <command-name>`
 |---------------------|---|
 | build               | Builds Admin UI. |
 | test                | Runs tests in CI mode. |
-| commit              | Replaces `git commit`, ensures compliance, audit, lint, and test checks pass before commit is allowed and normalizes commit messages across authors. |
 | lint                | Runs ember-template-lint on all of the hbs, js, and sass files. |
 | compliance:audit    | Checks for issues using `yarn audit` with moderate and above criticality.|
 | compliance:licenses | Checks that all dependencies have OSS-compatible licenses. |
@@ -160,15 +159,16 @@ You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false yarn start
 
 In login screen, authenticate using generated admin login name and password.
 
-Enter the origin of your Boundary dev instance, by default is: `http://localhost:9200`.
+Enter the cluster URL of your Boundary dev instance, by default is: `http://localhost:9200`.
 
 ### Committing
 
-Instead of the default `git commit`, we prescribe a custom command that ensures
-linting and other checks pass before a commit may be completed.  It also ensures
-that all contributors author consistent commit messages.  To get started with a
-commit, stage your files as usual.  Then run `yarn commit` and follow the
-on-screen instructions to author your message.
+We use `husky` and `lint-staged` to ensure linting and other checks pass before a
+commit is completed. Simply do a `yarn install` to make sure the hooks are installed.
+
+Use a normal `git commit` to go through the checks, if you need to skip these checks,
+use `git commit --no-verify` to bypass them. However, a consistent commit message will
+still be enforced even if you use `--no-verify`.
 
 #### License Checking
 

addons/api/.editorconfig

@@ -12,8 +12,8 @@ insert_final_newline = true
 indent_style = space
 indent_size = 2
 
-[*.hbs]
-insert_final_newline = false
-
 [*.{diff,md}]
 trim_trailing_whitespace = false
+
+[*.hbs]
+insert_final_newline = false

addons/api/.ember-cli

@@ -5,5 +5,11 @@
 
     Setting `disableAnalytics` to true will prevent any data from being sent.
   */
-  "disableAnalytics": false
+  "disableAnalytics": false,
+
+  /**
+  Setting `isTypeScriptProject` to true will force the blueprint generators to generate TypeScript
+  rather than JavaScript by default, when a TypeScript version of a given blueprint is available.
+  */
+  "isTypeScriptProject": false
 }

addons/api/.eslintignore

@@ -13,9 +13,13 @@
 # misc
 /coverage/
 !.*
+.*/
 .eslintcache
 
 # ember-try
 /.node_modules.ember-try/
 /bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
 /package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.eslintrc.js

@@ -1,21 +1,25 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 'use strict';
 
 module.exports = {
   root: true,
-  parser: 'babel-eslint',
+  parser: '@babel/eslint-parser',
   parserOptions: {
     ecmaVersion: 2018,
     sourceType: 'module',
-    ecmaFeatures: {
-      legacyDecorators: true,
+    // This is specific babel-config. If grows consider creating a babel config file
+    requireConfigFile: false,
+    babelOptions: {
+      plugins: [['@babel/plugin-proposal-decorators', { legacy: true }]],
     },
+    // end of babel-config
   },
   plugins: ['ember'],
-  extends: [
-    'eslint:recommended',
-    'plugin:ember/recommended',
-    'plugin:prettier/recommended',
-  ],
+  extends: ['eslint:recommended', 'plugin:ember/recommended', 'prettier'],
   env: {
     browser: true,
   },
@@ -30,21 +34,15 @@ module.exports = {
     // node files
     {
       files: [
-        '.eslintrc.js',
-        '.prettierrc.js',
-        '.template-lintrc.js',
-        'ember-cli-build.js',
-        'index.js',
-        'testem.js',
-        'blueprints/*/index.js',
-        'config/**/*.js',
-        'tests/dummy/config/**/*.js',
-      ],
-      excludedFiles: [
-        'addon/**',
-        'addon-test-support/**',
-        'app/**',
-        'tests/dummy/app/**',
+        './.eslintrc.js',
+        './.prettierrc.js',
+        './.template-lintrc.js',
+        './ember-cli-build.js',
+        './index.js',
+        './testem.js',
+        './blueprints/*/index.js',
+        './config/**/*.js',
+        './tests/dummy/config/**/*.js',
       ],
       parserOptions: {
         sourceType: 'script',
@@ -56,5 +54,10 @@ module.exports = {
       plugins: ['node'],
       extends: ['plugin:node/recommended'],
     },
+    {
+      // Test files:
+      files: ['tests/**/*-test.{js,ts}'],
+      extends: ['plugin:qunit/recommended'],
+    },
   ],
 };

addons/api/.npmignore

@@ -14,7 +14,10 @@
 /.eslintignore
 /.eslintrc.js
 /.git/
+/.github/
 /.gitignore
+/.prettierignore
+/.prettierrc.js
 /.template-lintrc.js
 /.travis.yml
 /.watchmanconfig
@@ -24,10 +27,14 @@
 /ember-cli-build.js
 /testem.js
 /tests/
+/yarn-error.log
 /yarn.lock
 .gitkeep
 
 # ember-try
 /.node_modules.ember-try/
 /bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
 /package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.prettierignore

@@ -14,8 +14,12 @@
 /coverage/
 !.*
 .eslintcache
+.lint-todo/
 
 # ember-try
 /.node_modules.ember-try/
 /bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
 /package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.prettierrc

@@ -1,4 +0,0 @@
-{
-  "singleQuote": true,
-  "printWidth": 80
-}

addons/api/.prettierrc.js

@@ -1,4 +1,7 @@
-'use strict';
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
 
 module.exports = {
   singleQuote: true,

addons/api/.template-lintrc.js

@@ -1,5 +1,10 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 'use strict';
 
 module.exports = {
-  extends: 'octane',
+  extends: ['recommended', 'stylistic'],
 };

addons/api/README.md

@@ -47,21 +47,28 @@ List of available project commands.  `yarn run <command-name>`
 | build:development | Builds the dummy app in development mode. |
 | build | Builds the dummy app for production. |
 | lint | Runs all lint commands. |
+| lint:fix | Runs automatic lint fixes for all type of file. |
+| lint:hbs | Runs lint for `hbs` template files. |
+| lint:hbs:fix | Runs automatic lint fixes for `hbs` template files. |
 | lint:js | Lints `js` files. |
+| lint:js:fix | Runs automatic lint fixes for `js` files. |
 | format | Runs all auto-formatters. |
 | format:js | Auto-formats `js` files using Prettier. |
 | start | Runs the dummy app local server. |
 | test | Runs all tests. |
-| test:all | Runs tests across multiple Ember versions with ember-try. |
+| test:ember-compatibility | Runs tests across multiple Ember versions with ember-try. |
+| precommit | Runs all lint and format. |
 | doc:toc | Automatically generates a table of contents for this README file. |
 
 Additional commands in the monorepo package may affect this projects.
 
 ## Linting
 
+* `yarn lint:fix`
 * `yarn lint:hbs`
+* `yarn lint:hbs:fix`
 * `yarn lint:js`
-* `yarn lint:js --fix`
+* `yarn lint:js:fix`
 
 ## Formatting
 

addons/api/addon/abilities/account.js

@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for accounts.
+ */
+export default class AccountAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" account types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+
+  /**
+   * Only "known" account types may be updated.
+   * @type {boolean}
+   */
+  get canUpdate() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('update');
+  }
+
+  /**
+   * Only "known" account types may be deleted.
+   * @type {boolean}
+   */
+  get canDelete() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('delete');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canSetPassword() {
+    return this.hasAuthorizedAction('set-password');
+  }
+}

addons/api/addon/abilities/auth-method.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+/**
+ * Provides abilities for auth method.
+ */
+export default class AuthMethodAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" auth method types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+
+  /**
+   * Only "known" auth method types may be updated.
+   */
+  get canUpdate() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('update');
+  }
+
+  /**
+   * Only "known" auth method types may be deleted.
+   */
+  get canDelete() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('delete');
+  }
+}

addons/api/addon/abilities/credential-library.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+/**
+ * Provides abilities for credential.
+ */
+export default class CredentialLibraryAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" credential library types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/credential-store.js

@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+import { inject as service } from '@ember/service';
+/**
+ * Provides abilities for credential store.
+ */
+export default class CredentialStoreAbility extends ModelAbility {
+  // =services
+
+  @service features;
+
+  // =permissions
+
+  /**
+   * Only "known" credential store types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return this.features.isEnabled('static-credentials')
+      ? this.hasAuthorizedAction('read')
+      : !this.model.isStatic && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/credential.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+/**
+ * Provides abilities for credential.
+ */
+export default class CredentialAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" credential types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/group.js

@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for groups.
+ */
+export default class GroupAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddMembers() {
+    return this.hasAuthorizedAction('add-members');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveMembers() {
+    return this.hasAuthorizedAction('remove-members');
+  }
+}

addons/api/addon/abilities/host-catalog.js

@@ -0,0 +1,21 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for host catalogs.
+ */
+export default class HostCatalogAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" host catalog types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/host-set.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for host sets.
+ */
+export default class HostSetAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHosts() {
+    return this.hasAuthorizedAction('add-hosts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHosts() {
+    return this.hasAuthorizedAction('remove-hosts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/managed-group.js

@@ -0,0 +1,13 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for managed groups.
+ */
+export default class ManagedGroupAbility extends ModelAbility {
+  // no op
+}

addons/api/addon/abilities/model.js

@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { Ability } from 'ember-can';
+
+/**
+ * Generic ability provides abilities common to all models in the API.
+ */
+export default class ModelAbility extends Ability {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canRead() {
+    return this.hasAuthorizedAction('read');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canUpdate() {
+    return this.hasAuthorizedAction('update');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canDelete() {
+    return this.hasAuthorizedAction('delete');
+  }
+
+  /**
+   * To save an existing model (already persisted to the API), it must contain
+   * the the `update` authorized action.
+   *
+   * For now, new models _always_ have this ability.  The reason is because the
+   * `create` action is authorized on collections, not individual records.  So
+   * this function can't actually tell from a model instance if create
+   * is allowed.
+   *
+   * @type {boolean}
+   */
+  get canSave() {
+    if (this.model.isNew || (!this.model.isNew && this.canUpdate)) {
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canList() {
+    return this.hasAuthorizedCollectionAction('list');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canCreate() {
+    return this.hasAuthorizedCollectionAction('create');
+  }
+
+  // =methods
+
+  /**
+   * Returns true if the given action is contained in the ability model's
+   * `authorized_actions` array.
+   * @param {string} action
+   * @return {boolean}
+   */
+  hasAuthorizedAction(action) {
+    return this.model.authorized_actions?.includes(action);
+  }
+
+  /**
+   * Returns true if the given action is contained in the ability model's
+   * `authorized_collection_actions` array.
+   * @param {string} action
+   * @return {boolean}
+   */
+  hasAuthorizedCollectionAction(action) {
+    const authorized_collection_actions =
+      (this.model || {}).authorized_collection_actions || {};
+    const collection = this.collection || {};
+    return authorized_collection_actions[collection]?.includes(action);
+  }
+}

addons/api/addon/abilities/role.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+import { inject as service } from '@ember/service';
+
+class InvalidRolePrincipalTypeError extends Error {
+  name = 'InvalidRolePrincipalTypeError';
+}
+
+/**
+ * Provides abilities for roles.
+ */
+export default class RoleAbility extends ModelAbility {
+  // =services
+
+  @service can;
+
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetGrants() {
+    return this.hasAuthorizedAction('set-grants');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
+
+  /**
+   * Returns the ability check for a principal model instance.
+   * Valid role principal models are: User, Group, and ManagedGroup.
+   * Throws an error if the principal type is invalid.
+   * @type {boolean}
+   * @throws {InvalidRolePrincipalTypeError}
+   */
+  get canReadPrincipal() {
+    const type = this.model.constructor.modelName;
+    const typeIsValid =
+      type === 'user' || type === 'group' || type === 'managed-group';
+    if (!typeIsValid)
+      throw new InvalidRolePrincipalTypeError(
+        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`
+      );
+    return this.can.can(`read ${type}`, this.model);
+  }
+}

addons/api/addon/abilities/target.js

@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for targets.
+ */
+export default class TargetAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canConnect() {
+    return this.hasAuthorizedAction('authorize-session');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHostSources() {
+    return this.hasAuthorizedAction('add-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHostSources() {
+    return this.hasAuthorizedAction('remove-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddBrokeredCredentialSources() {
+    return this.hasAuthorizedAction('add-credential-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddInjectedApplicationCredentialSources() {
+    return (
+      this.model.isSSH && this.hasAuthorizedAction('add-credential-sources')
+    );
+  }
+  /**
+   * @type {boolean}
+   */
+  get canRemoveCredentialSources() {
+    return this.hasAuthorizedAction('remove-credential-sources');
+  }
+}

addons/api/addon/abilities/user.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for users.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddAccounts() {
+    return this.hasAuthorizedAction('add-accounts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveAccounts() {
+    return this.hasAuthorizedAction('remove-accounts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddAccount() {
+    const { account, canAddAccounts } = this;
+    return canAddAccounts && !account.isUnknown;
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveAccount() {
+    const { account, canRemoveAccounts } = this;
+    return canRemoveAccounts && !account.isUnknown;
+  }
+}

addons/api/addon/abilities/worker.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for workers.
+ */
+export default class WorkerAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canCreateWorkerLed() {
+    return this.hasAuthorizedCollectionAction('create:worker-led');
+  }
+}

addons/api/addon/adapters/application.js

@@ -1,8 +1,13 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import RESTAdapter from '@ember-data/adapter/rest';
 import { serializeIntoHash } from '@ember-data/adapter/-private';
 /* eslint-disable-next-line ember/no-mixins */
 import AdapterBuildURLMixin from '../mixins/adapter-build-url';
-import config from 'ember-get-config';
+import { getOwner } from '@ember/application';
 import { get } from '@ember/object';
 import { InvalidError } from '@ember-data/adapter/error';
 import { dasherize } from '@ember/string';
@@ -44,19 +49,36 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
 ) {
   // =attributes
 
+  #host;
+  #namespace;
+
   /**
    * Sets host to the `api.host` string in the application's config,
    * if set.
    * @type {string}
    */
-  host = get(config, 'api.host');
+  get host() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#host || get(config, 'api.host');
+  }
+  set host(value) {
+    // Setting this value is useful for testing purposes.
+    this.#host = value;
+  }
 
   /**
    * Sets namespace to the `api.namespace` string in the application's config,
    * if set.
    * @type {string}
    */
-  namespace = get(config, 'api.namespace');
+  get namespace() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#namespace || get(config, 'api.namespace');
+  }
+  set namespace(value) {
+    // Setting this value is useful for testing purposes.
+    this.#namespace = value;
+  }
 
   // =methods
 
@@ -248,12 +270,15 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
     // Normalize field-specific errors, if any.
     const errors = fieldErrors.map((error) => ({
       detail: error.description,
-      // Ember Data cannot handle errors on nested attributes, so these are
-      // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
-      // To capture these errors, add read-only fields on the model
-      // corresponding to the underscored field name.
-      source: { pointer: `/data/attributes/${error.name.replace('.', '_')}` },
+      // Going forward, nested attributes will be hoisted.  Thus "attributes."
+      // must be stripped from the error name key.  Until all models are
+      // transitioned away from model fragments, however, both this and the
+      // prior error key mappings are necessary.
+      source: {
+        pointer: `/data/attributes/${error.name.replace('attributes.', '')}`,
+      },
     }));
+
     // Return a list of JSON API errors rooted under the `errors` key.
     return {
       errors: [baseError, ...errors],

addons/api/addon/adapters/host-catalog.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationAdapter from './application';
+
+export default class HostCatalogAdapter extends ApplicationAdapter {
+  /**
+   * Overrides the default `buildURL` such that on _create_, URLs for records of
+   * type `plugin` get an extra query parameter `?plugin_name`.  All other
+   * request types behave as normal.
+   *
+   * @override
+   * @param {string} modelName
+   * @param {string} id
+   * @return {string} url
+   * @return {string} requestType
+   */
+  buildURL(modelName, id, snapshot, requestType) {
+    let url = super.buildURL(...arguments);
+    if (requestType === 'createRecord') {
+      const pluginName = snapshot.attr('plugin')?.name;
+      if (pluginName) url = `${url}?plugin_name=${pluginName}`;
+    }
+    return url;
+  }
+}

addons/api/addon/generated/models/account.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -43,4 +48,20 @@ export default class GeneratedAccountModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  // =attributes (password)
+  @attr('string', {
+    for: 'password',
+    isNestedAttribute: true,
+    description: 'The account login name',
+  })
+  login_name;
+
+  // =attributes (OIDC)
+  @attr('string', { for: 'oidc', isNestedAttribute: true }) subject;
+  @attr('string', { for: 'oidc', isNestedAttribute: true }) issuer;
+  @attr('string', { for: 'oidc', isNestedAttribute: true, readOnly: true })
+  email;
+  @attr('string', { for: 'oidc', isNestedAttribute: true, readOnly: true })
+  full_name;
 }

addons/api/addon/generated/models/auth-method.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -49,4 +54,56 @@ export default class GeneratedAuthMethodModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true }) state;
+
+  @attr('string', { isNestedAttribute: true }) issuer;
+
+  @attr('string', { isNestedAttribute: true }) client_id;
+
+  @attr('string', { isNestedAttribute: true, isSecret: true }) client_secret;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true })
+  client_secret_hmac;
+
+  @attr('number', { isNestedAttribute: true }) max_age;
+
+  @attr('string', { isNestedAttribute: true }) api_url_prefix;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true }) callback_url;
+
+  @attr('boolean', { isNestedAttribute: true })
+  disable_discovered_config_validation;
+
+  @attr('boolean', { isNestedAttribute: true }) dry_run;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  claims_scopes;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  signing_algorithms;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  allowed_audiences;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  idp_ca_certs;
+
+  @attr('account-claim-map-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  account_claim_maps;
 }

addons/api/addon/generated/models/auth-token.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 
 /**

addons/api/addon/generated/models/credential-library.js

@@ -0,0 +1,130 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A credential library is a resource that can generate and retrieve
+ * credentials.
+ */
+export default class GeneratedCredentialLibraryModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'The owning credential store ID.',
+  })
+  credential_store_id;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  //= attributes (vault)
+
+  @attr('string', {
+    for: 'vault-generic',
+    isNestedAttribute: true,
+    description:
+      'The HTTP method the library uses when requesting credentials from Vault.',
+    defaultValue: () => 'GET',
+  })
+  http_method;
+
+  @attr('string', {
+    for: 'vault-generic',
+    isNestedAttribute: true,
+    description:
+      'The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.',
+  })
+  http_request_body;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The path in Vault to request credentials from.',
+  })
+  path;
+
+  @attr('string', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description: 'The username to use when making an SSH connection.',
+  })
+  username;
+
+  @attr('string', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description: 'The desired key type to use when generating a private key.',
+  })
+  key_type;
+
+  @attr('number', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description:
+      'Specifies the number of bits used when generating the private key. Not used if key type is ed25519',
+  })
+  key_bits;
+
+  @attr('string', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description: 'Specifies the requested time to live for the certificate.',
+  })
+  ttl;
+
+  @attr('string', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description:
+      'Specifies the key id that the created certificate should have.',
+  })
+  key_id;
+
+  @attr('object-as-array', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description:
+      'Specifies a map of the critical options that the certificate should be signed for.',
+  })
+  critical_options;
+
+  @attr('object-as-array', {
+    for: 'vault-ssh-certificate',
+    isNestedAttribute: true,
+    description:
+      'Specifies a map of the extensions that the certificate should be signed for.',
+  })
+  extensions;
+}

addons/api/addon/generated/models/credential-store.js

@@ -0,0 +1,134 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A credential store is a resource that can retrieve, store, and potentially
+ * generate credentials.
+ */
+export default class GeneratedCredentialStoreModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  // =attributes (vault)
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'",
+  })
+  address;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The namespace within Vault to use.',
+  })
+  namespace;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "A PEM-encoded CA certificate to verify the Vault server's TLS certificate.",
+  })
+  ca_cert;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'Name to use as the SNI host when connecting to Vault via TLS.',
+  })
+  tls_server_name;
+
+  @attr('boolean', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'Whether or not to skip TLS verification.',
+  })
+  tls_skip_verify;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'A token used for accessing Vault.',
+  })
+  token;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The Vault token hmac.',
+    readOnly: true,
+  })
+  token_hmac;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'A PEM-encoded client certificate to use for TLS authentication to the Vault server.',
+  })
+  client_certificate;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "A PEM-encoded private key matching the client certificate from 'client_certificate'.",
+  })
+  client_certificate_key;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The Vault client certificate key hmac.',
+    readOnly: true,
+  })
+  client_certificate_key_hmac;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'Filters to the worker(s) who can handle Vault requests for this cred store.',
+  })
+  worker_filter;
+}

addons/api/addon/generated/models/credential.js

@@ -0,0 +1,95 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A credential is a data structure containing one or more secrets that binds an
+ * identity to a set of permissions or capabilities on a host for a session.
+ */
+export default class GeneratedCredentialModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description:
+      'The ID of the Credential Store of which this Credential is a part.',
+  })
+  credential_store_id;
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  // =attributes (username_password, ssh_private_key)
+  @attr('string', {
+    for: ['username_password', 'ssh_private_key'],
+    isNestedAttribute: true,
+    description: 'The username for credential.',
+  })
+  username;
+
+  // =attributes (username_password)
+  @attr('string', {
+    for: 'username_password',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'The password for credential.',
+  })
+  password;
+
+  // =attributes (ssh_private_key)
+  @attr('string', {
+    for: 'ssh_private_key',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'The private key for credential.',
+  })
+  private_key;
+
+  @attr('string', {
+    for: 'ssh_private_key',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'The private key passphrase for credential.',
+  })
+  private_key_passphrase;
+
+  @attr('string', {
+    for: 'json',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'The secret associated with credential.',
+  })
+  json_object;
+}

addons/api/addon/generated/models/group.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 

addons/api/addon/generated/models/host-catalog.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -39,13 +44,74 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   })
   disabled;
 
-  @attr({
-    description: 'Attributes specific to the catalog type',
-  })
-  attributes;
-
   @attr('number', {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr({
+    description: 'Plugin information for this resource.',
+    readOnly: true,
+  })
+  plugin;
+
+  // AWS & Azure
+
+  @attr('boolean', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  disable_credential_rotation;
+
+  // AWS specific
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  region;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  access_key_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_access_key;
+
+  // Azure specific
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  tenant_id;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  client_id;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  subscription_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_value;
 }

addons/api/addon/generated/models/host-set.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -50,4 +55,45 @@ export default class GeneratedHostSetModel extends BaseModel {
     readOnly: true,
   })
   size;
+
+  @attr({
+    description: 'Plugin information for this resource',
+    readOnly: true,
+  })
+  plugin;
+
+  @attr('number', {
+    description:
+      "The number of seconds between the time boundary syncs the hosts in this set using this host set's plugin. If not provided a system determined default is used",
+  })
+  sync_interval_seconds;
+
+  /**
+   * Host IDs are read-only under normal circumstances.  But these can
+   * be persisted via a dedicated call to `addHosts()`.
+   */
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  host_ids;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+  })
+  preferred_endpoints;
+
+  // AWS specific
+  @attr('string-array', {
+    isNestedAttribute: true,
+    emptyArrayIfMissing: true,
+  })
+  filters;
+
+  // Azure specific, comes in from API as "filter". This is to avoid collisions with filter
+  @attr('string', {
+    description: '',
+    isNestedAttribute: true,
+  })
+  filter_string;
 }

addons/api/addon/generated/models/host.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -43,4 +48,10 @@ export default class GeneratedHostModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr({
+    description: 'Plugin information for this resource.',
+    readOnly: true,
+  })
+  plugin;
 }

addons/api/addon/generated/models/managed-group.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A managed group is a resource that represents a collection of accounts.
+ */
+export default class GeneratedManagedGroupModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description: 'The type of this ManagedGroup.',
+  })
+  type;
+
+  @attr('string', {
+    description:
+      'The ID of the Auth Method that is associated with this ManagedGroup',
+  })
+  auth_method_id;
+
+  // =attributes (OIDC)
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description:
+      'The boolean expression filter to use to determine membership. Comes in from API as "filter".',
+  })
+  filter_string;
+}

addons/api/addon/generated/models/role.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 

addons/api/addon/generated/models/scope.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 

addons/api/addon/generated/models/session.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 

addons/api/addon/generated/models/target.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 
@@ -30,10 +35,27 @@ export default class GeneratedTargetModel extends BaseModel {
 
   @attr('number', {
     description: '',
-    defaultValue: 1,
   })
   session_connection_limit;
 
+  @attr('string', {
+    description:
+      'Optional boolean expression to filter the workers that are allowed to satisfy this request.',
+  })
+  worker_filter;
+
+  @attr('string', {
+    description:
+      'Optional boolean expressions to filter the egress workers that are allowed to satisfy this request.',
+  })
+  egress_worker_filter;
+
+  @attr('string', {
+    description:
+      'Optional boolean expressions to filter the ingress workers that are allowed to satisfy this request.',
+  })
+  ingress_worker_filter;
+
   @attr('date', {
     description: 'The time this resource was created\nOutput only.',
     readOnly: true,
@@ -55,4 +77,23 @@ export default class GeneratedTargetModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', {
+    description:
+      'An IP address or DNS name for the session to connect to. Cannot be used in conjunction with host sources.',
+  })
+  address;
+
+  @attr('number', {
+    isNestedAttribute: true,
+    description: 'The default port a target should use if present.',
+  })
+  default_port;
+
+  @attr('number', {
+    isNestedAttribute: true,
+    description:
+      "The default port that will be listened on by the client's local proxy.",
+  })
+  default_client_port;
 }

addons/api/addon/generated/models/user.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import BaseModel from '../../models/base';
 import { attr } from '@ember-data/model';
 

addons/api/addon/generated/models/worker.js

@@ -0,0 +1,75 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * Worker contains all fields related to a worker resource
+ */
+export default class GeneratedWorkerModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description: 'The address that this worker is reachable at.\nOutput only.',
+    readOnly: true,
+  })
+  address;
+
+  @attr('date', {
+    description:
+      'The time this worker was last reported its status.\nOutput only.',
+    readOnly: true,
+  })
+  last_status_time;
+
+  @attr('string', {
+    description:
+      'The version of the Boundary binary the worker is running.\nOutput only.',
+    readOnly: true,
+  })
+  release_version;
+
+  @attr('number', {
+    description:
+      'The number of connections that this worker is currently handling.\nOutput only.',
+    readOnly: true,
+  })
+  active_connection_count;
+
+  @attr('string', {
+    description:
+      'The type of the worker, denoted by how it authenticates: pki or kms.\nOutput only.',
+    readOnly: true,
+  })
+  type;
+}

addons/api/addon/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -1,15 +0,0 @@
-// app/initializers/fragment-serializer.js
-import FragmentAuthMethodAttributesAccountClaimMapSerializer from '../serializers/fragment-auth-method-attributes-account-claim-map';
-
-export function initialize(application) {
-  application.register(
-    'serializer:fragment-auth-method-attributes-account-claim-map',
-    FragmentAuthMethodAttributesAccountClaimMapSerializer
-  );
-}
-
-// Fragment serializers must be manually registered
-export default {
-  name: 'fragment-auth-method-attributes-account-claim-map',
-  initialize: initialize,
-};

addons/api/addon/initializers/fragment-string.js

@@ -1,12 +0,0 @@
-// app/initializers/fragment-serializer.js
-import FragmentStringSerializer from '../serializers/fragment-string';
-
-export function initialize(application) {
-  application.register('serializer:fragment-string', FragmentStringSerializer);
-}
-
-// Fragment serializers must be manually registered
-export default {
-  name: 'fragment-string',
-  initialize: initialize,
-};

addons/api/addon/mixins/adapter-build-url.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import Mixin from '@ember/object/mixin';
 
 /**

addons/api/addon/models/account.js

@@ -1,40 +1,54 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedAccountModel from '../generated/models/account';
-import { fragment } from 'ember-data-model-fragments/attributes';
-import { computed } from '@ember/object';
-import { equal } from '@ember/object/computed';
+import {
+  TYPE_AUTH_METHOD_PASSWORD,
+  TYPE_AUTH_METHOD_OIDC,
+  TYPE_AUTH_METHOD_LDAP,
+  TYPES_AUTH_METHOD,
+} from './auth-method';
 
 export default class AccountModel extends GeneratedAccountModel {
   // =attributes
 
   /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentAccountAttributesModel}
+   * @type {boolean}
    */
-  @fragment('fragment-account-attributes', { defaultValue: {} }) attributes;
+  get isPassword() {
+    return this.type === TYPE_AUTH_METHOD_PASSWORD;
+  }
 
   /**
    * @type {boolean}
    */
-  @equal('type', 'password') isPassword;
+  get isOIDC() {
+    return this.type === TYPE_AUTH_METHOD_OIDC;
+  }
 
   /**
    * @type {boolean}
    */
-  @equal('type', 'oidc') isOIDC;
+  get isLDAP() {
+    return this.type === TYPE_AUTH_METHOD_LDAP;
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return !TYPES_AUTH_METHOD.includes(this.type);
+  }
 
   /**
    * Convenience for getting username in account.
    * @type {string}
    */
-  @computed('type', 'attributes.login_name')
-  get username() {
-    let username = '';
-    switch (this.type) {
-      case 'password':
-        username = this.attributes.login_name;
-        break;
-    }
-    return username;
+  get accountName() {
+    const { email, full_name, login_name } = this;
+    return email || full_name || login_name;
   }
 
   // =methods

addons/api/addon/models/auth-method.js

@@ -1,8 +1,21 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
-import { attr } from '@ember-data/model';
-import { fragment } from 'ember-data-model-fragments/attributes';
 import { equal } from '@ember/object/computed';
 
+export const TYPE_AUTH_METHOD_PASSWORD = 'password';
+export const TYPE_AUTH_METHOD_OIDC = 'oidc';
+export const TYPE_AUTH_METHOD_LDAP = 'ldap';
+
+export const TYPES_AUTH_METHOD = Object.freeze([
+  TYPE_AUTH_METHOD_PASSWORD,
+  TYPE_AUTH_METHOD_OIDC,
+  TYPE_AUTH_METHOD_LDAP,
+]);
+
 /**
  * Enum options per auth method type and field.
  */
@@ -28,72 +41,62 @@ export const options = {
 };
 
 export default class AuthMethodModel extends GeneratedAuthMethodModel {
-  // =error attributes
-  // These attributes exist solely to capture errors on nested fields.
-  // See the application adapter's error normalization method for
-  // more information.
-
-  @attr('string', { readOnly: true }) attributes_state;
-  @attr('string', { readOnly: true }) attributes_issuer;
-  @attr('string', { readOnly: true }) attributes_client_id;
-  @attr('string', { readOnly: true }) attributes_client_secret;
-  @attr('string', { readOnly: true }) attributes_max_age;
-  @attr('string', { readOnly: true }) attributes_api_url_prefix;
-  @attr('string', { readOnly: true })
-  attributes_disable_discovered_config_validation;
-  @attr('string', { readOnly: true }) attributes_dry_run;
-  @attr('string', { readOnly: true }) attributes_account_claim_maps;
-  @attr('string', { readOnly: true }) attributes_claims_scopes;
-  @attr('string', { readOnly: true }) attributes_signing_algorithms;
-  @attr('string', { readOnly: true }) attributes_allowed_audiences;
-  @attr('string', { readOnly: true }) attributes_idp_ca_certs;
-
   // =attributes
 
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentAuthMethodAttributesModel}
-   */
-  @fragment('fragment-auth-method-attributes', { defaultValue: {} }) attributes;
-
   /**
    * @type {boolean}
    */
   @equal('is_primary', true) isPrimary;
 
+  options = options;
+
   /**
    * @type {boolean}
    */
   get isPassword() {
-    return this.type === 'password';
+    return this.type === TYPE_AUTH_METHOD_PASSWORD;
   }
 
   /**
    * @type {boolean}
    */
   get isOIDC() {
-    return this.type === 'oidc';
+    return this.type === TYPE_AUTH_METHOD_OIDC;
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isLDAP() {
+    return this.type === TYPE_AUTH_METHOD_LDAP;
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return !TYPES_AUTH_METHOD.includes(this.type);
   }
 
   /**
    * @type {boolean}
    */
   get isInactive() {
-    return this.attributes.state === 'inactive';
+    return this.state === 'inactive';
   }
 
   /**
    * @type {boolean}
    */
   get isPrivate() {
-    return this.attributes.state === 'active-private';
+    return this.state === 'active-private';
   }
 
   /**
    * @type {boolean}
    */
   get isPublic() {
-    return this.attributes.state === 'active-public';
+    return this.state === 'active-public';
   }
 
   // =methods

addons/api/addon/models/auth-token.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedAuthTokenModel from '../generated/models/auth-token';
 
 export default class AuthTokenModel extends GeneratedAuthTokenModel {}

addons/api/addon/models/base.js

@@ -1,6 +1,12 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import Model from '@ember-data/model';
-import { fragment } from 'ember-data-model-fragments/attributes';
+import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
+import { inject as service } from '@ember/service';
 
 /**
  * Base model class provides common functionality for all models.
@@ -25,27 +31,53 @@ import { computed } from '@ember/object';
  *   2) Or as an ID:  `record.scopeID`.
  */
 export default class BaseModel extends Model {
+  // =services
+
+  @service store;
+
   // =relationships
 
   /**
    * Scope of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentScope}
    */
-  @fragment('fragment-scope') scope;
+  @attr() scope;
 
   // =attributes
 
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  authorized_actions;
+
+  @attr({
+    readOnly: true,
+  })
+  authorized_collection_actions;
+
+  get scopeModel() {
+    const id = this.scopeID;
+    return this.store.peekRecord('scope', id);
+  }
+
+  // Ember seems to have a bug with its internals and can't correctly set
+  // the `scopeModel` when passed in as part of the `inputProperties`
+  // of a `createRecord` call
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();
       json.scope_id = model.id;
+      json.type = model.type;
+      json.isGlobal = model.isGlobal;
+      json.isOrg = model.isOrg;
+      json.isProject = model.isProject;
       this.scope = json;
     }
   }
 
   /**
    * Convenience for getting and setting the parent scope ID.
-   * @type {string
+   * @type {string}
    */
   @computed('scope.scope_id')
   get scopeID() {
@@ -69,7 +101,6 @@ export default class BaseModel extends Model {
   /**
    * @type {boolean}
    */
-  @computed('hasDirtyAttributes', 'isSaving')
   get canSave() {
     return this.hasDirtyAttributes && !this.isSaving;
   }
@@ -77,7 +108,6 @@ export default class BaseModel extends Model {
   /**
    * @type {boolean}
    */
-  @computed('canSave')
   get cannotSave() {
     return !this.canSave;
   }

addons/api/addon/models/credential-library.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedCredentialLibraryModel from '../generated/models/credential-library';
+
+/**
+ * Enum options for credential library.
+ */
+export const options = {
+  http_method: ['GET', 'POST'],
+  key_type: ['ed25519', 'ecdsa', 'rsa'],
+};
+
+export const TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC = 'vault-generic';
+export const TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE =
+  'vault-ssh-certificate';
+
+/**
+ * Supported Credential Library types.
+ */
+export const TYPES_CREDENTIAL_LIBRARY = Object.freeze([
+  TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
+  TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+]);
+
+export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {
+  // =attributes
+
+  /**
+   * True if credential is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return !TYPES_CREDENTIAL_LIBRARY.includes(this.type);
+  }
+
+  /**
+   * True if credential is a vault type.
+   * @type {boolean}
+   */
+  get isVault() {
+    return (
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC ||
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE
+    );
+  }
+
+  /**
+   * True if credential is a generic vault type.
+   * @type {boolean}
+   */
+  get isVaultGeneric() {
+    return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
+  }
+
+  /**
+   * True if credential is a vault ssh cert type.
+   * @type {boolean}
+   */
+  get isVaultSSHCertificate() {
+    return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE;
+  }
+}

addons/api/addon/models/credential-store.js

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedCredentialStoreModel from '../generated/models/credential-store';
+import { equal } from '@ember/object/computed';
+
+export const types = ['static', 'vault'];
+
+export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
+  // =attributes
+
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'vault') isVault;
+
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'static') isStatic;
+}

addons/api/addon/models/credential.js

@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedCredentialModel from '../generated/models/credential';
+
+/**
+ * Supported Credential types.
+ */
+export const types = ['username_password', 'ssh_private_key', 'json'];
+
+export default class CredentialModel extends GeneratedCredentialModel {
+  // =attributes
+  /**
+   * All Credentials are prefixed with "cred" and are considered
+   * static due to their relation with Static Credential Stores.
+   *
+   * True if credential starts with the "cred" prefix.
+   * @type {boolean}
+   */
+  get isStatic() {
+    return this.id.startsWith('cred');
+  }
+
+  /**
+   * True if type is `json`.
+   * @type {boolean}
+   */
+  get isJSON() {
+    return this.type === 'json';
+  }
+
+  /**
+   * True if credential is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return !types.includes(this.type);
+  }
+}

addons/api/addon/models/fragment-account-attributes.js

@@ -1,17 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentAccountAttributesModel extends Fragment {
-  // =attributes (password)
-  @attr('string', {
-    for: 'password',
-    description: 'The account login name',
-  })
-  login_name;
-
-  // =attributes (OIDC)
-  @attr('string', { for: 'oidc' }) subject;
-  @attr('string', { for: 'oidc' }) issuer;
-  @attr('string', { for: 'oidc', readOnly: true }) email;
-  @attr('string', { for: 'oidc', readOnly: true }) full_name;
-}

addons/api/addon/models/fragment-auth-method-attributes-account-claim-map.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentAuthMethodAttributesAccountClaimMapModel extends Fragment {
-  // =attributes (OIDC)
-
-  @attr('string') from;
-  @attr('string') to;
-}

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -1,40 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-import { fragmentArray } from 'ember-data-model-fragments/attributes';
-
-export default class FragmentAuthMethodAttributesModel extends Fragment {
-  // =attributes (OIDC)
-
-  @attr('string', { readOnly: true }) state;
-  @attr('string') issuer;
-  @attr('string') client_id;
-  @attr('string') client_secret;
-  @attr('string', { readOnly: true }) client_secret_hmac;
-  @attr('number') max_age;
-  @attr('string') api_url_prefix;
-  @attr('string', { readOnly: true }) callback_url;
-  @attr('boolean') disable_discovered_config_validation;
-  @attr('boolean') dry_run;
-
-  @fragmentArray('fragment-auth-method-attributes-account-claim-map', {
-    emptyArrayIfMissing: true,
-  })
-  account_claim_maps;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  claims_scopes;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  signing_algorithms;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  allowed_audiences;
-
-  @fragmentArray('fragment-string', { emptyArrayIfMissing: true }) idp_ca_certs;
-}

addons/api/addon/models/fragment-host-attributes.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentHostAttributesModel extends Fragment {
-  @attr('string', {
-    description: 'The address (DNS or IP name) used to reach the host',
-  })
-  address;
-}

addons/api/addon/models/fragment-host-set.js

@@ -1,16 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentHostSetModel extends Fragment {
-  // =attributes
-
-  @attr('string', {
-    description: 'ID of the related host set',
-  })
-  host_set_id;
-
-  @attr('string', {
-    description: 'ID of the catalog to which the host set belongs',
-  })
-  host_catalog_id;
-}

addons/api/addon/models/fragment-principal.js

@@ -1,21 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentPrincipal extends Fragment {
-  // =attributes
-
-  @attr('string', {
-    description: 'ID of the related scope',
-  })
-  scope_id;
-
-  @attr('string', {
-    description: 'ID of the related principal (user or group)',
-  })
-  principal_id;
-
-  @attr('string', {
-    description: 'Type of the related principal (user or group)',
-  })
-  type;
-}

addons/api/addon/models/fragment-scope.js

@@ -1,42 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { computed } from '@ember/object';
-import { attr } from '@ember-data/model';
-import { scopeTypes } from './scope';
-
-export default class FragmentScope extends Fragment {
-  // =attributes
-
-  @attr('string', {
-    description: 'ID of the related scope',
-  })
-  scope_id;
-
-  @attr('string', {
-    description: 'The type of the resource',
-  })
-  type;
-
-  /**
-   * @type {boolean}
-   */
-  @computed('type')
-  get isGlobal() {
-    return this.type === scopeTypes.global;
-  }
-
-  /**
-   * @type {boolean}
-   */
-  @computed('type')
-  get isOrg() {
-    return this.type === scopeTypes.org;
-  }
-
-  /**
-   * @type {boolean}
-   */
-  @computed('type')
-  get isProject() {
-    return this.type === scopeTypes.project;
-  }
-}

addons/api/addon/models/fragment-string.js

@@ -1,14 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-/**
- * Represents an item in an array of strings.
- */
-export default class FragmentStringModel extends Fragment {
-  // =attributes
-
-  @attr('string', {
-    description: 'The value of the string.',
-  })
-  value;
-}

addons/api/addon/models/fragment-target-attributes.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentTargetAttributesModel extends Fragment {
-  @attr('number', {
-    description: 'The  default port a target should use if present.',
-  })
-  default_port;
-}

addons/api/addon/models/group.js

@@ -1,9 +1,19 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedGroupModel from '../generated/models/group';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
 import { A } from '@ember/array';
+import { inject as service } from '@ember/service';
 
 export default class GroupModel extends GeneratedGroupModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
   /**

addons/api/addon/models/host-catalog.js

@@ -1,3 +1,77 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
 
-export default class HostCatalogModel extends GeneratedHostCatalogModel {}
+export const types = ['static', 'plugin'];
+export const pluginTypes = ['aws', 'azure'];
+
+export default class HostCatalogModel extends GeneratedHostCatalogModel {
+  // =attributes
+
+  /**
+   * True if the host catalog is static.
+   * @type {boolean}
+   */
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * True if the host catalog is a plugin.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host catalog is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
+  }
+
+  /**
+   * True if host catalog plugin type is AWS.
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * True if host catalog plugin type is Azure.
+   * @type {boolean}
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If host catalog is a plugin return `plugin.name`,
+   * otherwise return the host catalog type.
+   * @type {string}
+   */
+  get compositeType() {
+    if (this.isUnknown) return 'unknown';
+    if (this.isPlugin) return this.plugin.name;
+    return 'static';
+  }
+
+  /**
+   * Sets `type`.  If type is different than `static`, sets `type` to `plugin`
+   * and `plugin.name` to the specified type.
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
+}

addons/api/addon/models/host-set.js

@@ -1,18 +1,75 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedHostSetModel from '../generated/models/host-set';
-import { fragmentArray } from 'ember-data-model-fragments/attributes';
+import { pluginTypes } from './host-catalog';
 
 export default class HostSetModel extends GeneratedHostSetModel {
   // =attributes
 
   /**
-   * Host IDs are read-only under normal circumstances.  But these can
-   * be persisted via a dedicated call to `addHosts()`.
+   * Returns if the host-set is static or not.
+   * @type {boolean}
    */
-  @fragmentArray('fragment-string', {
-    readOnly: true,
-    emptyArrayIfMissing: true,
-  })
-  host_ids;
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * Returns if the host-set is plugin or not.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host set is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
+  }
+
+  /**
+   * Returns if a host-set plugin is AWS or not
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * Return if a host-set plugin is Azure or not.
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If a host-set is a plugin return its name,
+   * otherwise returns the host-set type
+   * @type {string}
+   */
+  get compositeType() {
+    if (this.isUnknown) return 'unknown';
+    if (this.isPlugin) return this.plugin.name;
+    return 'static';
+  }
+
+  /**
+   * Sets type, if type is different than static, set plugin name to type
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
 
   // =methods
 

addons/api/addon/models/host.js

@@ -1,10 +1,103 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedHostModel from '../generated/models/host';
-import { fragment } from 'ember-data-model-fragments/attributes';
+import { attr } from '@ember-data/model';
 
 export default class HostModel extends GeneratedHostModel {
+  // =attributes
+
+  // Static specific fields
+  @attr('string', {
+    description: 'The address (DNS or IP name) used to reach the host',
+    isNestedAttribute: true,
+  })
+  address;
+
+  // Plugin specific fields
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  ip_addresses;
+
+  @attr('string', {
+    description: '',
+    readOnly: true,
+  })
+  external_id;
+
+  @attr('string', {
+    description: 'The external facing name for the plugin based host.',
+    readOnly: true,
+  })
+  external_name;
+
+  // Aws specific
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  dns_names;
+
   /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentHostAttributesModel}
+   * True if the host is static.
+   * @type {boolean}
    */
-  @fragment('fragment-host-attributes', { defaultValue: {} }) attributes;
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * True if the host is plugin.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host plugin type is AWS.
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * True if the host plugin type is Azure.
+   * @type {boolean}
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If host is a plugin return `plugin.name`,
+   * otherwise return the host type.
+   * @type {string}
+   */
+  get compositeType() {
+    return this.isPlugin ? this.plugin.name : this.type;
+  }
+
+  /**
+   * Sets `type`. If type is different than `static`, sets `type` to `plugin`
+   * and `plugin.name` to the specified type.
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
+
+  // Plugin hosts can support an external name
+  get displayName() {
+    return this.name || this.external_name || this.id;
+  }
 }

addons/api/addon/models/managed-group.js

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedManagedGroupModel from '../generated/models/managed-group';
+import { attr } from '@ember-data/model';
+import { A } from '@ember/array';
+
+export default class ManagedGroupModel extends GeneratedManagedGroupModel {
+  // =attributes
+
+  /**
+   * Members is read-only under normal circumstances.  But members can
+   * be persisted via calls to `addMembers()` or `removeMembers()`.
+   */
+  @attr({
+    readOnly: true,
+    defaultValue: () => A(),
+    emptyArrayIfMissing: true,
+  })
+  member_ids;
+}

addons/api/addon/models/role.js

@@ -1,7 +1,20 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedRoleModel from '../generated/models/role';
-import { fragmentArray, array } from 'ember-data-model-fragments/attributes';
+import { attr } from '@ember-data/model';
+import { inject as service } from '@ember/service';
+import { all, resolve } from 'rsvp';
+import { TYPE_AUTH_METHOD_OIDC } from 'api/models/auth-method';
 
 export default class RoleModel extends GeneratedRoleModel {
+  // =services
+
+  @service store;
+  @service resourceFilterStore;
+
   // =attributes
 
   /**
@@ -11,7 +24,7 @@ export default class RoleModel extends GeneratedRoleModel {
    * see obvious.  Instead, the application layer is expected to load referenced
    * users and groups as needed.
    */
-  @fragmentArray('fragment-principal', {
+  @attr('principal-array', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
@@ -21,8 +34,133 @@ export default class RoleModel extends GeneratedRoleModel {
    * Grant strings are read-only.  But grants can be persisted via a dedicated
    * call to `saveGrantStrings(grants)`.
    */
-  @array('string', { readOnly: true }) grant_strings;
+  @attr({ readOnly: true, emptyArrayIfMissing: true }) grant_strings;
 
+  /**
+   * Convenience for looking up the grant scope, if loaded.
+   */
+  get grantScope() {
+    return this.grant_scope_id
+      ? this.store.peekRecord('scope', this.grant_scope_id)
+      : null;
+  }
+
+  /**
+   * A list of IDs for principals of type `user`.
+   * @type {string[]}
+   */
+  get userIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'user')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A list of IDs for principals of type `group`.
+   * @type {string[]}
+   */
+  get groupIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'group')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A list of IDs for principals of type `managed group`.
+   * @type {string[]}
+   */
+  get managedGroupIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'managed group')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A promise that resolves to an array of User instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[UserModel]}
+   */
+  get users() {
+    const ids = this.userIDs;
+
+    // Role has prinicipal IDs,
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      return this.resourceFilterStore
+        .queryBy('user', { id: ids }, { scope_id: 'global', recursive: true })
+        .then((models) => models.map((model) => model));
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
+
+  /**
+   * A promise that resolves to an array of Group instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[GroupModel]}
+   */
+  get groups() {
+    const ids = this.groupIDs;
+
+    // Role has prinicipal IDs,
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      return this.resourceFilterStore
+        .queryBy('group', { id: ids }, { scope_id: 'global', recursive: true })
+        .then((models) => models.map((model) => model));
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
+
+  /**
+   * A promise that resolves to an array of ManagedGroup instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[ManagedGroupModel]}
+   */
+  get managedGroups() {
+    const ids = this.managedGroupIDs;
+
+    // Role has prinicipal IDs
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      // Collect all auth methods.
+      const authMethods = this.resourceFilterStore.queryBy(
+        'auth-method',
+        { type: TYPE_AUTH_METHOD_OIDC },
+        { scope_id: 'global', recursive: true }
+      );
+
+      // For each auth method, query all managed groups with IDs
+      // that match the role's manage group principal IDs.
+      const managedGroups = authMethods
+        .then((methods) =>
+          all(
+            methods.map(({ id: auth_method_id }) =>
+              this.resourceFilterStore
+                .queryBy('managed-group', { id: ids }, { auth_method_id })
+                .then((models) => models.map((model) => model))
+            )
+          )
+        )
+        // The result is an array of arrays of model instances (grouped by
+        // auth methods), so these must be flattened.
+        .then((grouped) => grouped.flat());
+
+      return managedGroups;
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
   // =methods
 
   /**

addons/api/addon/models/scope.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedScopeModel from '../generated/models/scope';
 import { computed } from '@ember/object';
 

addons/api/addon/models/session.js

@@ -1,17 +1,119 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedSessionModel from '../generated/models/session';
 import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
-import { attr } from '@ember-data/model';
+import { tracked } from '@glimmer/tracking';
+import { A } from '@ember/array';
+import { inject as service } from '@ember/service';
+
+export const statusTypes = ['active', 'pending', 'canceling', 'terminated'];
+
+/**
+ *
+ */
+class SessionCredential {
+  // =classes
+
+  /**
+   *
+   */
+  static Source = class Source {
+    id;
+    name;
+    description;
+    type;
+
+    constructor(id, name, description, type) {
+      this.id = id;
+      this.name = name;
+      this.description = description;
+      this.type = type;
+    }
+  };
+
+  /**
+   *
+   */
+  static SecretItem = class SecretItem {
+    key;
+    value;
+
+    constructor(key, value) {
+      this.key = key;
+      this.value = value;
+    }
+  };
+
+  // =attributes
+  rawCredential;
+  source;
+  #payloadSecret;
+
+  /**
+   * The incoming payload may contain a JSON object under the `decoded` key only
+   * if it can be JSON-decoded.  Some credential stores may not provide JSON,
+   * however, in which case we may have only the raw base64-encoded secret
+   * string.  In the former case, we convert the key/value pairs of the JSON to
+   * an array of `SecretItem` instances.  In the latter case, we return an
+   * array containing a single `SecretItem` instance with key `secret` and a
+   * string value equal to the base64-decoded raw secret.
+   * The credential secret as an array of key/value objects.
+   * @type {SessionCredential.SecretItem[]}
+   */
+  get secrets() {
+    if (this.#payloadSecret?.decoded) {
+      const secretJSON = this.#payloadSecret.decoded;
+      return Object.keys(secretJSON).map(
+        (key) => new SessionCredential.SecretItem(key, secretJSON[key])
+      );
+    } else {
+      // decode from base64
+      const decodedString = atob(this.#payloadSecret.raw);
+      return [new SessionCredential.SecretItem('secret', decodedString)];
+    }
+  }
+
+  // =methods
+
+  constructor(cred) {
+    const { id, name, description, type } = cred.credential_source;
+    this.source = new SessionCredential.Source(id, name, description, type);
+    this.#payloadSecret = cred.secret;
+    this.rawCredential = cred;
+  }
+}
 
 export default class SessionModel extends GeneratedSessionModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
-  @attr('string', { readOnly: true }) proxy_address;
-  @attr('number', { readOnly: true }) proxy_port;
+  // These transient attributes are used for values that come from the CLI
+  // `connect` command as triggered by Desktop.  These attributes represent
+  // transient read-only values.
+  @tracked acknowledged;
+  @tracked started_desktop_client;
+  @tracked proxy_address;
+  @tracked proxy_port;
+  credentials = A();
 
   @equal('status', 'active') isActive;
   @equal('status', 'pending') isPending;
 
+  /**
+   * True if status is an unknown string.
+   * @type {boolean}
+   */
+  get isUnknownStatus() {
+    return !statusTypes.includes(this.status);
+  }
+
   /**
    * @type {boolean}
    */
@@ -41,6 +143,13 @@ export default class SessionModel extends GeneratedSessionModel {
 
   // =methods
 
+  /**
+   *
+   */
+  addCredential(cred) {
+    this.credentials.pushObject(new SessionCredential(cred));
+  }
+
   /**
    * Cancels the session via the `cancel` method.
    * See serializer and adapter for more information.

addons/api/addon/models/target.js

@@ -1,24 +1,51 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedTargetModel from '../generated/models/target';
-import { fragment, fragmentArray } from 'ember-data-model-fragments/attributes';
-import { computed } from '@ember/object';
+import { attr } from '@ember-data/model';
+import { inject as service } from '@ember/service';
+
+export const TYPE_TARGET_TCP = 'tcp';
+export const TYPE_TARGET_SSH = 'ssh';
+export const TYPES_TARGET = Object.freeze([TYPE_TARGET_TCP, TYPE_TARGET_SSH]);
 
 export default class TargetModel extends GeneratedTargetModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
   /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentTargetAttributesModel}
+   * @type Array
    */
-  @fragment('fragment-target-attributes', { defaultValue: {} }) attributes;
-
-  /**
-   * @type {[FragmentHostSetModel]}
-   */
-  @fragmentArray('fragment-host-set', {
+  @attr('host-source-id-array', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
-  host_sets;
+  host_sources;
+
+  /**
+   * Brokered Credential source ids are read only and can be
+   * persisted via a dedicated call to `addBrokeredCredentialSources()`.
+   */
+  @attr('string-array', {
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  brokered_credential_source_ids;
+
+  /**
+   * Injected Application Credential source ids are read only and can be
+   * persisted via a dedicated call to `addInjectedApplicationCredentialSources()`.
+   */
+  @attr('string-array', {
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  injected_application_credential_source_ids;
 
   /**
    * An array of resolved host set and host catalog instances.  Model instances
@@ -26,16 +53,51 @@ export default class TargetModel extends GeneratedTargetModel {
    * instances).  Unresolvable instances are excluded from the array.
    * @type {[{model: HostSetModel, hostCatalog: HostCatalogModel}]}
    */
-  @computed('host_sets.[]', 'store')
   get hostSets() {
-    return this.host_sets
-      .map(({ host_set_id, host_catalog_id }) => ({
-        model: this.store.peekRecord('host-set', host_set_id),
+    return this.host_sources
+      .map(({ host_source_id, host_catalog_id }) => ({
+        model: this.store.peekRecord('host-set', host_source_id),
         hostCatalog: this.store.peekRecord('host-catalog', host_catalog_id),
       }))
       .filter((hostSetRef) => hostSetRef.model !== null);
   }
 
+  /**
+   * An array of resolved credential library and credential instances.  Model instances
+   * must already be loaded into the store (this method will not load unloaded
+   * instances).  Unresolvable instances are excluded from the array.
+   * @type {[CredentialLibraryModel, CredentialModel]}
+   */
+  get brokeredCredentialSources() {
+    return this.brokered_credential_source_ids
+      .map((source) => {
+        if (source.value.startsWith('cred')) {
+          return this.store.peekRecord('credential', source.value);
+        } else {
+          return this.store.peekRecord('credential-library', source.value);
+        }
+      })
+      .filter(Boolean);
+  }
+
+  /**
+   * An array of resolved credential library and credential instances.  Model instances
+   * must already be loaded into the store (this method will not load unloaded
+   * instances).  Unresolvable instances are excluded from the array.
+   * @type {[CredentialLibraryModel, CredentialModel]}
+   */
+  get injectedApplicationCredentialSources() {
+    return this.injected_application_credential_source_ids
+      .map((source) => {
+        if (source.value.startsWith('cred')) {
+          return this.store.peekRecord('credential', source.value);
+        } else {
+          return this.store.peekRecord('credential-library', source.value);
+        }
+      })
+      .filter(Boolean);
+  }
+
   /**
    * Sessions associated with this target (but only already loaded sessions).
    * @type {SessionModel[]}
@@ -68,16 +130,16 @@ export default class TargetModel extends GeneratedTargetModel {
   // =methods
 
   /**
-   * Adds host sets via the `add-host-sets` method.
+   * Adds host sets via the `add-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  addHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  addHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'add-host-sets',
+      method: 'add-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -91,16 +153,16 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete host sets via the `remove-host-sets` method.
+   * Delete host sets via the `remove-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  removeHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  removeHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'remove-host-sets',
+      method: 'remove-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -114,12 +176,160 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete a single host set via the `remove-host-sets` method.
+   * Delete a single host set via the `remove-host-sources` method.
    * @param {number} hostSetID
    * @param {object} options
    * @return {Promise}
    */
-  removeHostSet(hostSetID, options) {
-    return this.removeHostSets([hostSetID], options);
+  removeHostSource(hostSetID, options) {
+    return this.removeHostSources([hostSetID], options);
+  }
+
+  /**
+   * Adds credential sources via the `add-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} brokeredCredentialSourceIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  addBrokeredCredentialSources(
+    brokeredCredentialSourceIDs,
+    options = { adapterOptions: {} }
+  ) {
+    const defaultAdapterOptions = {
+      method: 'add-credential-sources',
+      brokeredCredentialSourceIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Adds credential sources via the `add-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} injectedApplicationCredentialSourceIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  addInjectedApplicationCredentialSources(
+    injectedApplicationCredentialSourceIDs,
+    options = { adapterOptions: {} }
+  ) {
+    const defaultAdapterOptions = {
+      method: 'add-credential-sources',
+      injectedApplicationCredentialSourceIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Delete credential libraries and credentials via the `remove-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} brokeredCredentialSourceIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  removeBrokeredCredentialSources(
+    brokeredCredentialSourceIDs,
+    options = { adapterOptions: {} }
+  ) {
+    const defaultAdapterOptions = {
+      method: 'remove-credential-sources',
+      brokeredCredentialSourceIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Delete a single credential library/credential set via the `remove-credential-sources` method.
+   * @param {number} brokeredCredentialSourceID
+   * @param {object} options
+   * @return {Promise}
+   */
+  removeBrokeredCredentialSource(brokeredCredentialSourceID, options) {
+    return this.removeBrokeredCredentialSources(
+      [brokeredCredentialSourceID],
+      options
+    );
+  }
+
+  /**
+   * Delete credential libraries and credentials via the `remove-credential-sources` method.
+   * See serializer and adapter for more information.
+   * @param {[string]} injectedApplicationCredentialSourceIDs
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  removeInjectedApplicationCredentialSources(
+    injectedApplicationCredentialSourceIDs,
+    options = { adapterOptions: {} }
+  ) {
+    const defaultAdapterOptions = {
+      method: 'remove-credential-sources',
+      injectedApplicationCredentialSourceIDs,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Delete a single credential library/credential set via the `remove-credential-sources` method.
+   * @param {number} injectedApplicationCredentialSourceID
+   * @param {object} options
+   * @return {Promise}
+   */
+  removeInjectedApplicationCredentialSource(
+    injectedApplicationCredentialSourceID,
+    options
+  ) {
+    return this.removeInjectedApplicationCredentialSources(
+      [injectedApplicationCredentialSourceID],
+      options
+    );
+  }
+  /**
+   * True if the target type is tcp.
+   * @type {boolean}
+   */
+  get isTCP() {
+    return this.type === TYPE_TARGET_TCP;
+  }
+
+  /**
+   * True if the target type is ssh.
+   * @type {boolean}
+   */
+  get isSSH() {
+    return this.type === TYPE_TARGET_SSH;
   }
 }

addons/api/addon/models/user.js

@@ -1,5 +1,11 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import GeneratedUserModel from '../generated/models/user';
 import { attr } from '@ember-data/model';
+import { computed } from '@ember/object';
 import { A } from '@ember/array';
 
 export default class UserModel extends GeneratedUserModel {
@@ -16,6 +22,35 @@ export default class UserModel extends GeneratedUserModel {
   })
   account_ids;
 
+  /**
+   * Represents the user's primary account email, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) email;
+
+  /**
+   * Represents the user's primary account full_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) full_name;
+
+  /**
+   * Represents the user's primary account login_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) login_name;
+
+  /**
+   * Convenience for getting a reasonable string that names the account.
+   * There are many options, so we fallback in order of precedence.
+   * @type {string}
+   */
+  @computed('email', 'full_name', 'login_name')
+  get accountName() {
+    const { email, full_name, login_name } = this;
+    return email || full_name || login_name;
+  }
+
   // =methods
 
   /**

addons/api/addon/models/worker.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedWorkerModel from '../generated/models/worker';
+import { attr } from '@ember-data/model';
+
+export default class WorkerModel extends GeneratedWorkerModel {
+  // =attributes
+
+  /**
+   * Names are optional on models in our API.  Thus we need to fallback on ID
+   * for display purposes.
+   * @type {string}
+   */
+  get displayName() {
+    return this.name || this.id;
+  }
+
+  /**
+   * Returns whether the worker is a pki worker.
+   * @type {boolean}
+   */
+  get isPki() {
+    return this.type === 'pki';
+  }
+
+  /**
+   * Returns the number of config tags present on the worker.
+   * @type {number}
+   */
+  get tagCount() {
+    if (!this.config_tags) {
+      return 0;
+    }
+
+    return Object.values(this.config_tags).reduce(
+      (previousCount, currentTags) => previousCount + currentTags.length,
+      0
+    );
+  }
+
+  /**
+   * Returns the config tags as an array of key/value pair objects.
+   * @type {[object]}
+   */
+  getConfigTagList() {
+    if (!this.config_tags) {
+      return null;
+    }
+
+    return Object.entries(this.config_tags).flatMap(([key, value]) =>
+      value.map((tag) => ({ key, value: tag }))
+    );
+  }
+
+  @attr({
+    description:
+      'The deduplicated union of the tags reported by the worker ' +
+      'from its configuration and any tags added through other means.\nOutput only.',
+    readOnly: true,
+  })
+  canonical_tags;
+
+  @attr({
+    description:
+      "The tags set in the worker's configuration file.\nOutput only.",
+    readOnly: true,
+  })
+  config_tags;
+
+  /**
+   * Method to modify the adapter to handle custom POST route for creating worker.
+   * @param {string} workerGeneratedAuthToken
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  createWorkerLed(workerGeneratedAuthToken, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'create:worker-led',
+      workerGeneratedAuthToken,
+    };
+    return super.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+}

addons/api/addon/serializers/account.js

@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import ApplicationSerializer from './application';
 
 export default class AccountSerializer extends ApplicationSerializer {
@@ -23,9 +28,28 @@ export default class AccountSerializer extends ApplicationSerializer {
     switch (snapshot.record.type) {
       case 'password':
         return this.serializePassword(...arguments);
+      case 'oidc':
+        return this.serializeOIDC(...arguments);
     }
   }
 
+  /**
+   * OIDC serialization limits the `attributes` posted on create and omits
+   * `attributes` entirely on update.
+   */
+  serializeOIDC(snapshot) {
+    const { isNew } = snapshot?.record || {};
+    let serialized = super.serialize(...arguments);
+    delete serialized.attributes;
+    if (isNew) {
+      serialized.attributes = {};
+      const { issuer, subject } = snapshot.record;
+      if (issuer) serialized.attributes.issuer = issuer;
+      if (subject) serialized.attributes.subject = subject;
+    }
+    return serialized;
+  }
+
   /**
    * Password serialization omits `attributes` and handles password-related
    * custom methods.
@@ -51,7 +75,7 @@ export default class AccountSerializer extends ApplicationSerializer {
     }
     // Change password custom method
     if (snapshot?.adapterOptions?.method === 'change-password') {
-      const { currentPassword, newPassword } = snapshot?.adapterOptions;
+      const { currentPassword, newPassword } = snapshot?.adapterOptions || {};
       serialized = this.serializeForChangePassword(
         snapshot,
         currentPassword,

addons/api/addon/serializers/application.js

@@ -1,7 +1,11 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import RESTSerializer from '@ember-data/serializer/rest';
 import { underscore } from '@ember/string';
 import { get } from '@ember/object';
-import { copy } from 'ember-copy';
 
 /**
  * Manages serialization/normalization of data to/from the API.
@@ -39,6 +43,10 @@ export default class ApplicationSerializer extends RESTSerializer {
   serializeAttribute(snapshot, json, key, attribute) {
     const { type, options } = attribute;
     let value = super.serializeAttribute(...arguments);
+    // Remove secret attributes that are null or empty
+    if (options.isSecret) {
+      if (type === 'string' && !json[key]) delete json[key];
+    }
     // Convert empty strings to null.
     if (type === 'string' && json[key] === '') json[key] = null;
     // Do not serialize read-only attributes.
@@ -50,6 +58,20 @@ export default class ApplicationSerializer extends RESTSerializer {
     // Do not serialize `disabled` fields.
     // TODO:  disabled is temporarily disabled
     if (key === 'disabled') delete json[key];
+    // Push nested attributes down into the attributes key
+    if (options.isNestedAttribute && json[key] !== undefined) {
+      if (!json.attributes) json.attributes = {};
+      json.attributes[key] = json[key];
+      delete json[key];
+    }
+    // Push nested secrets down into the secrets key
+    if (options.isNestedSecret) {
+      if (json[key]) {
+        if (!json.secrets) json.secrets = {};
+        json.secrets[key] = json[key];
+      }
+      delete json[key];
+    }
     return value;
   }
 
@@ -82,7 +104,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     delete serialized.scope;
     // And serialize `scope_id`
     if (this.serializeScopeID) {
-      const scope_id = snapshot?.attr('scope')?.attr('scope_id');
+      const scope_id = snapshot?.attr('scope')?.scope_id;
       if (scope_id) serialized.scope_id = scope_id;
     }
     return serialized;
@@ -111,7 +133,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     );
     // Copy the data rooted under `items` in the existing payload into the new
     // payload under the expected root key name.
-    transformedPayload[payloadKey] = copy(payload.items, true);
+    transformedPayload[payloadKey] = structuredClone(payload.items);
     // Return the result of normalizing the transformed payload.
     return super.normalizeArrayResponse(
       store,
@@ -123,7 +145,7 @@ export default class ApplicationSerializer extends RESTSerializer {
   }
 
   /**
-   * In our API, singluar resources are _unrooted_, whereas Ember Data expects
+   * In our API, singular resources are _unrooted_, whereas Ember Data expects
    * them to be rooted under their model name, e.g. `{modelName: {…}}`.
    * This method makes this transformation to accommodate Ember Data.
    *
@@ -138,7 +160,7 @@ export default class ApplicationSerializer extends RESTSerializer {
    */
   normalizeSingleResponse(store, primaryModelClass, payload, id, requestType) {
     // Copy payload (mostly to prevent mocking issues)
-    payload = copy(payload, true);
+    payload = structuredClone(payload);
     // Check for and normalize missing arrays
     payload = this.normalizeMissingArrays(store, primaryModelClass, payload);
     // Setup a new payload data structure.
@@ -185,19 +207,122 @@ export default class ApplicationSerializer extends RESTSerializer {
   }
 
   /**
-   * One consequence of using model fragments to represent the embedded scope
-   * is that they cannot have `id` fields.  We still need to know scope IDs,
-   * so we copy the `scope.id` value into the `scope.scope_id` field.
+   * Hydrates the incoming scope JSON with additional boolean fields and
+   * delegates nested attributes and secrets normalization.
    * @override
-   * @see FragmentScope
    * @param {Model} typeClass
    * @param {Object} hash
    * @return {Object}
    */
   normalize(typeClass, hash) {
-    const normalizedHash = copy(hash, true);
+    let normalizedHash = structuredClone(hash);
     const scopeID = get(normalizedHash, 'scope.id');
+    const scopeType = get(normalizedHash, 'scope.type');
     if (scopeID) normalizedHash.scope.scope_id = scopeID;
+    if (scopeType) {
+      normalizedHash.scope.type = scopeType;
+      normalizedHash.scope.isGlobal = scopeType === 'global';
+      normalizedHash.scope.isOrg = scopeType === 'org';
+      normalizedHash.scope.isProject = scopeType === 'project';
+    }
+    normalizedHash = this.normalizeNestedAttributes(typeClass, normalizedHash);
+    normalizedHash = this.normalizeNestedSecrets(typeClass, normalizedHash);
     return super.normalize(typeClass, normalizedHash);
   }
+
+  /**
+   * Certain typed resources in the API have type-specific fields nested under
+   * an `attributes` key in the payload
+   * (e.g. `attributes: { fieldName: '123' }`).  Since Ember Data lacks
+   * first-class support for nested attributes, these fields must be hoisted up
+   * into the main body of the payload.
+   *
+   * In order to annotate a field as being a nested attribute, add the key name
+   * to the `nestedAttributes` field on the serializer:
+   *   `@attr('string', { isNestedAttribute: true }) fieldName;`
+   *
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalizeNestedAttributes(typeClass, hash) {
+    typeClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { isNestedAttribute },
+      } = attribute;
+      const value = hash.attributes?.[name];
+      const isUndefined = value === undefined;
+      if (isNestedAttribute && !isUndefined) hash[name] = value;
+    });
+    return hash;
+  }
+
+  /**
+   * If an attribute is declared with the `isNestedSecret` option, it will
+   * be explicitly unset in the incoming payload to `null`.  This helps ensure
+   * secret values do not linger in the UI.
+   *
+   * For example:
+   *   `@attr('string', { isNestedSecret: true }) superSecretShhh;`
+   *
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalizeNestedSecrets(typeClass, hash) {
+    typeClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { isNestedSecret },
+      } = attribute;
+      const value = hash.secrets?.[name];
+      if (isNestedSecret) hash[name] = value || null;
+    });
+    return hash;
+  }
+
+  /**
+   * If the API returns an updated response with removed fields, we need to
+   * explicitly set any read only field that is on the model but wasn't
+   * returned in the response to `null`.
+   * This will let ember data know the field was removed, otherwise
+   * it won't touch the removed field and will use the old value.
+   *
+   * @override
+   * @param {object} store
+   * @param {object} primaryModelClass
+   * @param {object} payload
+   * @param {?string} id
+   * @param {string} requestType
+   * @return {object}
+   */
+  normalizeUpdateRecordResponse(
+    store,
+    primaryModelClass,
+    payload,
+    id,
+    requestType
+  ) {
+    const newPayload = structuredClone(payload);
+
+    primaryModelClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { readOnly },
+      } = attribute;
+
+      if (readOnly && !Object.prototype.hasOwnProperty.call(newPayload, name)) {
+        newPayload[name] = null;
+      }
+    });
+
+    return super.normalizeUpdateRecordResponse(
+      store,
+      primaryModelClass,
+      newPayload,
+      id,
+      requestType
+    );
+  }
 }

addons/api/addon/serializers/auth-method.js

@@ -1,5 +1,10 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import ApplicationSerializer from './application';
-import { copy } from 'ember-copy';
+import { TYPE_AUTH_METHOD_OIDC } from 'api/models/auth-method';
 
 export default class AuthMethodSerializer extends ApplicationSerializer {
   // =methods
@@ -12,7 +17,7 @@ export default class AuthMethodSerializer extends ApplicationSerializer {
    */
   serialize(snapshot) {
     switch (snapshot.record.type) {
-      case 'oidc':
+      case TYPE_AUTH_METHOD_OIDC:
         return this.serializeOIDC(...arguments);
       default:
         return this.serializeDefault(...arguments);
@@ -81,13 +86,12 @@ export default class AuthMethodSerializer extends ApplicationSerializer {
    *
    * TODO:  generalize this so that all zero values are reified.
    * @override
-   * @see FragmentScope
    * @param {Model} typeClass
    * @param {Object} hash
    * @return {Object}
    */
   normalize(typeClass, hash, ...rest) {
-    let normalizedHash = copy(hash, true);
+    let normalizedHash = structuredClone(hash);
     // switch (normalizedHash.type) {
     //   case 'oidc':
     //     normalizedHash = this.normalizeOIDC(normalizedHash);

addons/api/addon/serializers/credential-library.js

@@ -0,0 +1,63 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationSerializer from './application';
+import {
+  TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
+  TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+} from '../models/credential-library';
+
+export default class CredentialLibrarySerializer extends ApplicationSerializer {
+  // =properties
+
+  /**
+   * @type {boolean}
+   */
+  serializeScopeID = false;
+
+  /**
+   * @override
+   * @method serialize
+   * @param {Snapshot} snapshot
+   */
+  serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC:
+        return this.serializeVaultGeneric(...arguments);
+      case TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE:
+      default:
+        return super.serialize(...arguments);
+    }
+  }
+
+  serializeAttribute(snapshot, json, key, attribute) {
+    super.serializeAttribute(...arguments);
+    const { options } = attribute;
+    const { type } = snapshot.record;
+
+    // If an attribute has a `for` option, it must match the
+    // record's `type`, else the attribute is excluded
+    // from serialization.
+    if (options?.for && options.for !== type) {
+      if (options.isNestedAttribute) {
+        delete json.attributes[key];
+      } else {
+        delete json[key];
+      }
+    }
+  }
+
+  serializeVaultGeneric() {
+    const serialized = super.serialize(...arguments);
+    if (serialized.attributes) {
+      // Set `http_request_body` only if `http_method` is POST
+      // otherwise set to null to have the field removed
+      if (!serialized.attributes?.http_method?.match(/post/i)) {
+        serialized.attributes.http_request_body = null;
+      }
+    }
+    return serialized;
+  }
+}

addons/api/addon/serializers/credential-store.js

@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationSerializer from './application';
+export default class CredentialStoreSerializer extends ApplicationSerializer {
+  /**
+   * @override
+   * @method serialize
+   * @param {Snapshot} snapshot
+   */
+  serialize(snapshot) {
+    switch (snapshot.record.type) {
+      case 'vault':
+        return this.serializeVault(...arguments);
+      case 'static':
+      default:
+        return this.serializeStatic(...arguments);
+    }
+  }
+
+  serializeVault() {
+    const serialized = super.serialize(...arguments);
+    if (serialized.attributes) {
+      // Client certificate key cannot be unset when certificate is set.
+      // If it's falsy, it must be removed.
+      if (
+        !serialized.attributes?.client_certificate_key &&
+        serialized.attributes?.client_certificate
+      )
+        delete serialized.attributes.client_certificate_key;
+    }
+    return serialized;
+  }
+
+  serializeStatic() {
+    const serialized = super.serialize(...arguments);
+    // Delete attributes for static cred store
+    delete serialized.attributes;
+    return serialized;
+  }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // Remove secret fields as we don't track them after being created/updated
+    normalized.data.attributes.token = '';
+    return normalized;
+  }
+}

addons/api/addon/serializers/credential.js

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationSerializer from './application';
+export default class CredentialSerializer extends ApplicationSerializer {
+  /**
+   * @override
+   * @method serialize
+   * @param {Snapshot} snapshot
+   */
+
+  /**
+   * @type {boolean}
+   */
+  serializeScopeID = false;
+
+  serialize() {
+    const serialized = super.serialize(...arguments);
+
+    if (serialized.type === 'json') {
+      delete serialized.attributes.username;
+
+      if (serialized?.attributes?.json_object) {
+        serialized.attributes.object = JSON.parse(
+          serialized.attributes.json_object
+        );
+        delete serialized.attributes.json_object;
+      }
+    } else {
+      delete serialized.attributes.json_object;
+    }
+
+    return serialized;
+  }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // Remove secret fields as we don't track them after being created/updated
+    normalized.data.attributes.password = '';
+    normalized.data.attributes.private_key = '';
+    normalized.data.attributes.private_key_passphrase = '';
+    normalized.data.attributes.json_object = '';
+    return normalized;
+  }
+}

addons/api/addon/serializers/fragment-account-attributes.js

@@ -1,26 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentAccountAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   *
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Client secret cannot be unset.  If it's falsy, it must be removed.
-    if (key === 'client_secret' && !json[key]) delete json[key];
-    return value;
-  }
-}

addons/api/addon/serializers/fragment-auth-method-attributes-account-claim-map.js

@@ -1,30 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentHostSetSerializer extends JSONSerializer {
-  // =methods
-
-  /**
-   * Serializes an account claim to string.
-   * @param {Snapshot} snapshot
-   * @return {string}
-   */
-  serialize(snapshot) {
-    const from = snapshot.attr('from');
-    const to = snapshot.attr('to');
-    return `${from}=${to}`;
-  }
-
-  /**
-   * Normalizes account claim strings into JSON API objects.
-   * @param {Model} typeClass
-   * @param {string} value
-   * @return {object}
-   */
-  normalize(typeClass, value) {
-    const normalizedHash = {
-      from: value.split('=')[0],
-      to: value.split('=')[1],
-    };
-    return super.normalize(typeClass, normalizedHash);
-  }
-}

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -1,26 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   *
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Client secret cannot be unset.  If it's falsy, it must be removed.
-    if (key === 'client_secret' && !json[key]) delete json[key];
-    return value;
-  }
-}