chore: 🤖 update changelog (#1170)

* chore: 🤖 update changelog and bump up the binary version to 0.9.1

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Anyone attached to this rule will always been assigned to a pull request
+* @hashicorp/boundary-ui

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+:tickets: [Jira ticket](https://hashicorp.atlassian.net/browse/JIRA_TICKET_NUMBER)
+
+## Description
+
+<!--
+Replace PATH_TO_FEATURE with Vercel link
+-->
+
+:technologist: [Admin preview](PATH_TO_FEATURE)
+
+:rose: [Rose preview](PATH_TO_FEATURE)
+
+:desktop_computer: [Desktop preview](PATH_TO_FEATURE)
+
+<!-- Add a brief description of changes here. Include any other necessary relevant links -->
+
+### Screenshots (if appropriate):

.github/workflows/build-admin-ui.yaml

@@ -0,0 +1,76 @@
+name: Build Admin UI
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  dependencies:
+    name: Install dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '16.x'
+      - run: yarn install
+  build-admin-ui-oss:
+    name: Build Admin UI OSS
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - name: Build
+        uses: actions/setup-node@v3
+        with:
+          node-version: '16.x'
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
+      - run: yarn run build:ui:admin:oss
+      - name: Upload artifact admin-ui
+        uses: actions/upload-artifact@v3
+        with:
+          name: admin-ui
+          path: ./ui/admin/dist/
+      - name: Upload artifact Admin UI OSS
+        uses: actions/upload-artifact@v3
+        with:
+          name: admin-ui-oss
+          path: ./ui/admin/dist/
+  build-admin-ui-enterprise:
+    name: Build Admin UI Enterprise
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - name: Build
+        uses: actions/setup-node@v3
+        with:
+          node-version: '16.x'
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
+      - run: yarn run build:ui:admin:enterprise
+      - name: Upload artifact Admin UI Enterprise
+        uses: actions/upload-artifact@v3
+        with:
+          name: admin-ui-ent
+          path: ./ui/admin/dist/

.github/workflows/monorepo-validate.yaml

@@ -2,55 +2,76 @@ name: Validate Monorepo
 on: pull_request
 jobs:
 
-  compliance:
-    name: License Compliance
+  dependencies:
+    name: Install dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@v3
         with:
-          node-version: '12.x'
+          node-version: '16.x'
       - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+
+  compliance:
+    name: License Compliance
+    needs: [dependencies]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
+        with:
+          path: '**/node_modules'
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '16.x'
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
       - run: yarn run compliance:licenses
 
   lint:
     name: Lint
+    needs: [dependencies, compliance]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            node-modules-
+      - uses: actions/setup-node@v3
         with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+          node-version: '16.x'
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
       - run: yarn lint
 
   test:
     name: Test
+    needs: [lint]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: cache
+      - uses: actions/checkout@v3
+      - uses: actions/cache@v3
+        id: node-modules-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@v1
+          key: node-modules-${{ hashFiles('**/yarn.lock') }}
+      - uses: actions/setup-node@v3
         with:
-          node-version: '12.x'
-      - run: yarn install
-        if: steps.cache.outputs.cache-hit != 'true'
+          node-version: '16.x'
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
       - run: yarn test

.gitignore

@@ -23,8 +23,3 @@ yarn-error.log
 storybook-static
 **/.storybook/*.html
 .watchman-cookie*
-
-# ember-try
-.node_modules.ember-try
-bower.json.ember-try
-package.json.ember-try

.husky/pre-commit

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+yarn compliance:licenses
+npx lint-staged
+yarn test

.husky/prepare-commit-msg

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+# This is to allow interaction with the terminal for commitizen
+exec < /dev/tty && npx git-cz --hook || true

.release/release-metadata.hcl

@@ -0,0 +1,3 @@
+url_license = "https://github.com/hashicorp/boundary-ui/blob/main/LICENSE"
+url_project_website = "https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app"
+url_source_repository = "https://github.com/hashicorp/boundary-ui"

README.md

@@ -38,9 +38,9 @@ You will need the following things properly installed on your computer.
 
 * [Git][git]
 * [Node.js][node]
-  * v10–v15
+  * Supported versions:`v12`, `v14` and `v16`.
   * **Apple Silicon Users**:  if you experience problems building or running
-    Boundary UIs, try Node v15.
+    Boundary UIs, try Node v14.
 * [Yarn][yarn] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]
@@ -66,7 +66,6 @@ List of available project commands.  `yarn run <command-name>`
 |---------------------|---|
 | build               | Builds Admin UI. |
 | test                | Runs tests in CI mode. |
-| commit              | Replaces `git commit`, ensures compliance, audit, lint, and test checks pass before commit is allowed and normalizes commit messages across authors. |
 | lint                | Runs ember-template-lint on all of the hbs, js, and sass files. |
 | compliance:audit    | Checks for issues using `yarn audit` with moderate and above criticality.|
 | compliance:licenses | Checks that all dependencies have OSS-compatible licenses. |
@@ -164,11 +163,12 @@ Enter the origin of your Boundary dev instance, by default is: `http://localhost
 
 ### Committing
 
-Instead of the default `git commit`, we prescribe a custom command that ensures
-linting and other checks pass before a commit may be completed.  It also ensures
-that all contributors author consistent commit messages.  To get started with a
-commit, stage your files as usual.  Then run `yarn commit` and follow the
-on-screen instructions to author your message.
+We use `husky` and `lint-staged` to ensure linting and other checks pass before a
+commit is completed. Simply do a `yarn install` to make sure the hooks are installed.
+
+Use a normal `git commit` to go through the checks, if you need to skip these checks,
+use `git commit --no-verify` to bypass them. However, a consistent commit message will
+still be enforced even if you use `--no-verify`.
 
 #### License Checking
 

addons/api/.editorconfig

@@ -12,8 +12,5 @@ insert_final_newline = true
 indent_style = space
 indent_size = 2
 
-[*.hbs]
-insert_final_newline = false
-
 [*.{diff,md}]
 trim_trailing_whitespace = false

addons/api/.eslintignore

@@ -15,7 +15,3 @@
 !.*
 .eslintcache
 
-# ember-try
-/.node_modules.ember-try/
-/bower.json.ember-try
-/package.json.ember-try

addons/api/.eslintrc.js

@@ -2,20 +2,19 @@
 
 module.exports = {
   root: true,
-  parser: 'babel-eslint',
+  parser: '@babel/eslint-parser',
   parserOptions: {
     ecmaVersion: 2018,
     sourceType: 'module',
-    ecmaFeatures: {
-      legacyDecorators: true,
+    // This is specific babel-config. If grows consider creating a babel config file
+    requireConfigFile: false,
+    babelOptions: {
+      plugins: [['@babel/plugin-proposal-decorators', { legacy: true }]],
     },
+    // end of babel-config
   },
   plugins: ['ember'],
-  extends: [
-    'eslint:recommended',
-    'plugin:ember/recommended',
-    'plugin:prettier/recommended',
-  ],
+  extends: ['eslint:recommended', 'plugin:ember/recommended', 'prettier'],
   env: {
     browser: true,
   },
@@ -56,5 +55,10 @@ module.exports = {
       plugins: ['node'],
       extends: ['plugin:node/recommended'],
     },
+    {
+      // Test files:
+      files: ['tests/**/*-test.{js,ts}'],
+      extends: ['plugin:qunit/recommended'],
+    },
   ],
 };

addons/api/.npmignore

@@ -19,15 +19,9 @@
 /.travis.yml
 /.watchmanconfig
 /bower.json
-/config/ember-try.js
 /CONTRIBUTING.md
 /ember-cli-build.js
 /testem.js
 /tests/
 /yarn.lock
 .gitkeep
-
-# ember-try
-/.node_modules.ember-try/
-/bower.json.ember-try
-/package.json.ember-try

addons/api/.prettierignore

@@ -14,8 +14,3 @@
 /coverage/
 !.*
 .eslintcache
-
-# ember-try
-/.node_modules.ember-try/
-/bower.json.ember-try
-/package.json.ember-try

addons/api/README.md

@@ -47,21 +47,28 @@ List of available project commands.  `yarn run <command-name>`
 | build:development | Builds the dummy app in development mode. |
 | build | Builds the dummy app for production. |
 | lint | Runs all lint commands. |
+| lint:fix | Runs automatic lint fixes for all type of file. |
+| lint:hbs | Runs lint for `hbs` template files. |
+| lint:hbs:fix | Runs automatic lint fixes for `hbs` template files. |
 | lint:js | Lints `js` files. |
+| lint:js:fix | Runs automatic lint fixes for `js` files. |
 | format | Runs all auto-formatters. |
 | format:js | Auto-formats `js` files using Prettier. |
 | start | Runs the dummy app local server. |
 | test | Runs all tests. |
-| test:all | Runs tests across multiple Ember versions with ember-try. |
+| test:ember-compatibility | Runs tests across multiple Ember versions with ember-try. |
+| precommit | Runs all lint and format. |
 | doc:toc | Automatically generates a table of contents for this README file. |
 
 Additional commands in the monorepo package may affect this projects.
 
 ## Linting
 
+* `yarn lint:fix`
 * `yarn lint:hbs`
+* `yarn lint:hbs:fix`
 * `yarn lint:js`
-* `yarn lint:js --fix`
+* `yarn lint:js:fix`
 
 ## Formatting
 

addons/api/addon/abilities/account.js

@@ -0,0 +1,15 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for accounts.
+ */
+export default class AccountAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetPassword() {
+    return this.hasAuthorizedAction('set-password');
+  }
+}

addons/api/addon/abilities/collection.js

@@ -1,37 +0,0 @@
-import { Ability } from 'ember-can';
-
-/**
- * Generic ability provides abilities common to all models in the API.
- */
-export default class CollectionAbility extends Ability {
-  // =permissions
-
-  /**
-   * @type {boolean}
-   */
-  get canList() {
-    return this.hasAuthorizedCollectionAction('list');
-  }
-
-  /**
-   * @type {boolean}
-   */
-  get canCreate() {
-    return this.hasAuthorizedCollectionAction('create');
-  }
-
-  // =methods
-
-  /**
-   * Returns true if the given action is contained in the ability model's
-   * `authorized_collection_actions` array.
-   * @param {string} action
-   * @return {boolean}
-   */
-  hasAuthorizedCollectionAction(action) {
-    const authorized_collection_actions =
-      (this.model || {}).authorized_collection_actions || {};
-    const collection = this.collection || {};
-    return authorized_collection_actions[collection]?.includes(action);
-  }
-}

addons/api/addon/abilities/credential-store.js

@@ -0,0 +1,16 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for credential store.
+ */
+export default class CredentialStoreAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" credential store types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isStatic && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/group.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for groups.
+ */
+export default class GroupAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddMembers() {
+    return this.hasAuthorizedAction('add-members');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveMembers() {
+    return this.hasAuthorizedAction('remove-members');
+  }
+}

addons/api/addon/abilities/host-catalog.js

@@ -0,0 +1,16 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for host catalogs.
+ */
+export default class HostCatalogAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * Only "known" host catalog types may be read.
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
+}

addons/api/addon/abilities/host-set.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for host sets.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHosts() {
+    return this.hasAuthorizedAction('add-hosts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHosts() {
+    return this.hasAuthorizedAction('remove-hosts');
+  }
+}

addons/api/addon/abilities/model.js

@@ -45,6 +45,20 @@ export default class ModelAbility extends Ability {
     return false;
   }
 
+  /**
+   * @type {boolean}
+   */
+  get canList() {
+    return this.hasAuthorizedCollectionAction('list');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canCreate() {
+    return this.hasAuthorizedCollectionAction('create');
+  }
+
   // =methods
 
   /**
@@ -56,4 +70,17 @@ export default class ModelAbility extends Ability {
   hasAuthorizedAction(action) {
     return this.model.authorized_actions?.includes(action);
   }
+
+  /**
+   * Returns true if the given action is contained in the ability model's
+   * `authorized_collection_actions` array.
+   * @param {string} action
+   * @return {boolean}
+   */
+  hasAuthorizedCollectionAction(action) {
+    const authorized_collection_actions =
+      (this.model || {}).authorized_collection_actions || {};
+    const collection = this.collection || {};
+    return authorized_collection_actions[collection]?.includes(action);
+  }
 }

addons/api/addon/abilities/role.js

@@ -0,0 +1,29 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for roles.
+ */
+export default class RoleAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetGrants() {
+    return this.hasAuthorizedAction('set-grants');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddPrincipals() {
+    return this.hasAuthorizedAction('add-principals');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemovePrincipals() {
+    return this.hasAuthorizedAction('remove-principals');
+  }
+}

addons/api/addon/abilities/target.js

@@ -0,0 +1,43 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for targets.
+ */
+export default class TargetAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canConnect() {
+    return this.hasAuthorizedAction('authorize-session');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddHostSources() {
+    return this.hasAuthorizedAction('add-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHostSources() {
+    return this.hasAuthorizedAction('remove-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canAddCredentialSources() {
+    return this.hasAuthorizedAction('add-credential-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveCredentialSources() {
+    return this.hasAuthorizedAction('remove-credential-sources');
+  }
+}

addons/api/addon/abilities/user.js

@@ -0,0 +1,22 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for users.
+ */
+export default class UserAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canAddAccounts() {
+    return this.hasAuthorizedAction('add-accounts');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveAccounts() {
+    return this.hasAuthorizedAction('remove-accounts');
+  }
+}

addons/api/addon/adapters/application.js

@@ -2,7 +2,7 @@ import RESTAdapter from '@ember-data/adapter/rest';
 import { serializeIntoHash } from '@ember-data/adapter/-private';
 /* eslint-disable-next-line ember/no-mixins */
 import AdapterBuildURLMixin from '../mixins/adapter-build-url';
-import config from 'ember-get-config';
+import { getOwner } from '@ember/application';
 import { get } from '@ember/object';
 import { InvalidError } from '@ember-data/adapter/error';
 import { dasherize } from '@ember/string';
@@ -44,19 +44,36 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
 ) {
   // =attributes
 
+  #host;
+  #namespace;
+
   /**
    * Sets host to the `api.host` string in the application's config,
    * if set.
    * @type {string}
    */
-  host = get(config, 'api.host');
+  get host() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#host || get(config, 'api.host');
+  }
+  set host(value) {
+    // Setting this value is useful for testing purposes.
+    this.#host = value;
+  }
 
   /**
    * Sets namespace to the `api.namespace` string in the application's config,
    * if set.
    * @type {string}
    */
-  namespace = get(config, 'api.namespace');
+  get namespace() {
+    const config = getOwner(this).resolveRegistration('config:environment');
+    return this.#namespace || get(config, 'api.namespace');
+  }
+  set namespace(value) {
+    // Setting this value is useful for testing purposes.
+    this.#namespace = value;
+  }
 
   // =methods
 
@@ -246,14 +263,36 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
       source: { pointer: '/data' },
     };
     // Normalize field-specific errors, if any.
-    const errors = fieldErrors.map((error) => ({
-      detail: error.description,
-      // Ember Data cannot handle errors on nested attributes, so these are
-      // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
-      // To capture these errors, add read-only fields on the model
-      // corresponding to the underscored field name.
-      source: { pointer: `/data/attributes/${error.name.replace('.', '_')}` },
-    }));
+    const errors = fieldErrors.flatMap((error) => {
+      const newValue = [
+        {
+          detail: error.description,
+          // Ember Data cannot handle errors on nested attributes, so these are
+          // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
+          // To capture these errors, add read-only fields on the model
+          // corresponding to the underscored field name.
+          source: {
+            pointer: `/data/attributes/${error.name.replace('.', '_')}`,
+          },
+        },
+      ];
+      if (error.name.includes('attributes.')) {
+        newValue.push({
+          detail: error.description,
+          // Going forward, nested attributes will be hoisted.  Thus "attributes."
+          // must be stripped from the error name key.  Until all models are
+          // transitioned away from model fragments, however, both this and the
+          // prior error key mappings are necessary.
+          source: {
+            pointer: `/data/attributes/${error.name.replace(
+              'attributes.',
+              ''
+            )}`,
+          },
+        });
+      }
+      return newValue;
+    });
     // Return a list of JSON API errors rooted under the `errors` key.
     return {
       errors: [baseError, ...errors],

addons/api/addon/adapters/host-catalog.js

@@ -0,0 +1,23 @@
+import ApplicationAdapter from './application';
+
+export default class HostCatalogAdapter extends ApplicationAdapter {
+  /**
+   * Overrides the default `buildURL` such that on _create_, URLs for records of
+   * type `plugin` get an extra query parameter `?plugin_name`.  All other
+   * request types behave as normal.
+   *
+   * @override
+   * @param {string} modelName
+   * @param {string} id
+   * @return {string} url
+   * @return {string} requestType
+   */
+  buildURL(modelName, id, snapshot, requestType) {
+    let url = super.buildURL(...arguments);
+    if (requestType === 'createRecord') {
+      const pluginName = snapshot.attr('plugin')?.name;
+      if (pluginName) url = `${url}?plugin_name=${pluginName}`;
+    }
+    return url;
+  }
+}

addons/api/addon/generated/models/account.js

@@ -43,4 +43,20 @@ export default class GeneratedAccountModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  // =attributes (password)
+  @attr('string', {
+    for: 'password',
+    isNestedAttribute: true,
+    description: 'The account login name',
+  })
+  login_name;
+
+  // =attributes (OIDC)
+  @attr('string', { for: 'oidc', isNestedAttribute: true }) subject;
+  @attr('string', { for: 'oidc', isNestedAttribute: true }) issuer;
+  @attr('string', { for: 'oidc', isNestedAttribute: true, readOnly: true })
+  email;
+  @attr('string', { for: 'oidc', isNestedAttribute: true, readOnly: true })
+  full_name;
 }

addons/api/addon/generated/models/credential-library.js

@@ -44,4 +44,27 @@ export default class GeneratedCredentialLibraryModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  //= attributes (vault)
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description:
+      'The HTTP method the library uses when requesting credentials from Vault.',
+    defaultValue: () => 'GET',
+  })
+  http_method;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description:
+      'The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.',
+  })
+  http_request_body;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The path in Vault to request credentials from.',
+  })
+  path;
 }

addons/api/addon/generated/models/credential-store.js

@@ -39,4 +39,82 @@ export default class GeneratedCredentialStoreModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  // =attributes (vault)
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'",
+  })
+  address;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The namespace within Vault to use.',
+  })
+  namespace;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "A PEM-encoded CA certificate to verify the Vault server's TLS certificate.",
+  })
+  ca_cert;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'Name to use as the SNI host when connecting to Vault via TLS.',
+  })
+  tls_server_name;
+
+  @attr('boolean', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'Whether or not to skip TLS verification.',
+  })
+  tls_skip_verify;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'A token used for accessing Vault.',
+  })
+  token;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The Vault token hmac.',
+    readOnly: true,
+  })
+  token_hmac;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'A PEM-encoded client certificate to use for TLS authentication to the Vault server.',
+  })
+  client_certificate;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      "A PEM-encoded private key matching the client certificate from 'client_certificate'.",
+  })
+  client_certificate_key;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description: 'The Vault client certificate key hmac.',
+    readOnly: true,
+  })
+  client_certificate_key_hmac;
 }

addons/api/addon/generated/models/host-catalog.js

@@ -39,13 +39,74 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   })
   disabled;
 
-  @attr({
-    description: 'Attributes specific to the catalog type',
-  })
-  attributes;
-
   @attr('number', {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr({
+    description: 'Plugin information for this resource.',
+    readOnly: true,
+  })
+  plugin;
+
+  // AWS & Azure
+
+  @attr('boolean', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  disable_credential_rotation;
+
+  // AWS specific
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  region;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  access_key_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_access_key;
+
+  // Azure specific
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  tenant_id;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  client_id;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: '',
+  })
+  subscription_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_id;
+
+  @attr('string', {
+    isNestedSecret: true,
+    description: '',
+  })
+  secret_value;
 }

addons/api/addon/generated/models/host-set.js

@@ -50,4 +50,23 @@ export default class GeneratedHostSetModel extends BaseModel {
     readOnly: true,
   })
   size;
+
+  @attr({
+    description: 'Plugin information for this resource',
+    readOnly: true,
+  })
+  plugin;
+
+  @attr('number', {
+    description:
+      "The number of seconds between the time boundary syncs the hosts in this set using this host set's plugin. If not provided a system determined default is used",
+  })
+  sync_interval_seconds;
+
+  // Azure specific
+  @attr('string', {
+    description: '',
+    isNestedAttribute: true,
+  })
+  filter;
 }

addons/api/addon/generated/models/host.js

@@ -43,4 +43,10 @@ export default class GeneratedHostModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr({
+    description: 'Plugin information for this resource.',
+    readOnly: true,
+  })
+  plugin;
 }

addons/api/addon/generated/models/managed-group.js

@@ -0,0 +1,56 @@
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * A managed group is a resource that represents a collection of accounts.
+ */
+export default class GeneratedManagedGroupModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description: 'The type of this ManagedGroup.',
+  })
+  type;
+
+  @attr('string', {
+    description:
+      'The ID of the Auth Method that is associated with this ManagedGroup',
+  })
+  auth_method_id;
+
+  // =attributes (OIDC)
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description:
+      'The boolean expression filter to use to determine membership.',
+  })
+  filter;
+}

addons/api/addon/generated/models/target.js

@@ -34,6 +34,12 @@ export default class GeneratedTargetModel extends BaseModel {
   })
   session_connection_limit;
 
+  @attr('string', {
+    description:
+      'Optional boolean expression to filter the workers that are allowed to satisfy this request.',
+  })
+  worker_filter;
+
   @attr('date', {
     description: 'The time this resource was created\nOutput only.',
     readOnly: true,

addons/api/addon/models/account.js

@@ -1,17 +1,10 @@
 import GeneratedAccountModel from '../generated/models/account';
-import { fragment } from 'ember-data-model-fragments/attributes';
 import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 
 export default class AccountModel extends GeneratedAccountModel {
   // =attributes
 
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentAccountAttributesModel}
-   */
-  @fragment('fragment-account-attributes', { defaultValue: {} }) attributes;
-
   /**
    * @type {boolean}
    */
@@ -26,9 +19,9 @@ export default class AccountModel extends GeneratedAccountModel {
    * Convenience for getting username in account.
    * @type {string}
    */
-  @computed('attributes.{email,full_name,login_name}')
+  @computed('{email,full_name,login_name}')
   get accountName() {
-    const { email, full_name, login_name } = this.attributes;
+    const { email, full_name, login_name } = this;
     return email || full_name || login_name;
   }
 

addons/api/addon/models/auth-method.js

@@ -61,6 +61,8 @@ export default class AuthMethodModel extends GeneratedAuthMethodModel {
    */
   @equal('is_primary', true) isPrimary;
 
+  options = options;
+
   /**
    * @type {boolean}
    */

addons/api/addon/models/base.js

@@ -47,6 +47,10 @@ export default class BaseModel extends Model {
   })
   authorized_collection_actions;
 
+  get scopeModel() {
+    const id = this.scopeID;
+    return this.store.peekRecord('scope', id);
+  }
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();

addons/api/addon/models/credential-library.js

@@ -1,6 +1,4 @@
 import GeneratedCredentialLibraryModel from '../generated/models/credential-library';
-import { attr } from '@ember-data/model';
-import { fragment } from 'ember-data-model-fragments/attributes';
 
 /**
  * Enum options for credential library.
@@ -9,22 +7,4 @@ export const options = {
   http_method: ['GET', 'POST'],
 };
 
-export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {
-  // =error attributes
-  // These attributes exist solely to capture errors on nested fields.
-  // See the application adapter's error normalization method for
-  // more information.
-
-  @attr('string', { readOnly: true }) attributes_http_method;
-  @attr('string', { readOnly: true }) attributes_http_request_body;
-  @attr('string', { readOnly: true }) attributes_path;
-
-  // =attributes
-
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentCredentialLibraryAttributesModel}
-   */
-  @fragment('fragment-credential-library-attributes', { defaultValue: {} })
-  attributes;
-}
+export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {}

addons/api/addon/models/credential-store.js

@@ -1,34 +1,16 @@
 import GeneratedCredentialStoreModel from '../generated/models/credential-store';
-import { attr } from '@ember-data/model';
-import { fragment } from 'ember-data-model-fragments/attributes';
 import { equal } from '@ember/object/computed';
 
 export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
-  // =error attributes
-  // These attributes exist solely to capture errors on nested fields.
-  // See the application adapter's error normalization method for
-  // more information.
-
-  @attr('string', { readOnly: true }) attributes_address;
-  @attr('string', { readOnly: true }) attributes_namespace;
-  @attr('string', { readOnly: true }) attributes_ca_cert;
-  @attr('string', { readOnly: true }) attributes_tls_server_name;
-  @attr('string', { readOnly: true }) attributes_tls_skip_verify;
-  @attr('string', { readOnly: true }) attributes_token;
-  @attr('string', { readOnly: true }) attributes_client_certificate;
-  @attr('string', { readOnly: true }) attributes_client_certificate_key;
-
   // =attributes
 
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentAuthMethodAttributesModel}
-   */
-  @fragment('fragment-credential-store-attributes', { defaultValue: {} })
-  attributes;
-
   /**
    * @type {boolean}
    */
   @equal('type', 'vault') isVault;
+
+  /**
+   * @type {boolean}
+   */
+  @equal('type', 'static') isStatic;
 }

addons/api/addon/models/fragment-account-attributes.js

@@ -1,17 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentAccountAttributesModel extends Fragment {
-  // =attributes (password)
-  @attr('string', {
-    for: 'password',
-    description: 'The account login name',
-  })
-  login_name;
-
-  // =attributes (OIDC)
-  @attr('string', { for: 'oidc' }) subject;
-  @attr('string', { for: 'oidc' }) issuer;
-  @attr('string', { for: 'oidc', readOnly: true }) email;
-  @attr('string', { for: 'oidc', readOnly: true }) full_name;
-}

addons/api/addon/models/fragment-credential-library-attributes.js

@@ -1,25 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-import { options } from './credential-library';
-
-export default class FragmentCredentialLibraryAttributesModel extends Fragment {
-  //= attributes (vault)
-
-  @attr('string', {
-    description:
-      'The HTTP method the library uses when requesting credentials from Vault.',
-    defaultValue: () => options.http_method[0],
-  })
-  http_method;
-
-  @attr('string', {
-    description:
-      'The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.',
-  })
-  http_request_body;
-
-  @attr('string', {
-    description: 'The path in Vault to request credentials from.',
-  })
-  path;
-}

addons/api/addon/models/fragment-credential-store-attributes.js

@@ -1,72 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentCredentialStoreAttributesModel extends Fragment {
-  // =attributes (vault)
-  @attr('string', {
-    for: 'vault',
-    description:
-      "The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'",
-  })
-  address;
-
-  @attr('string', {
-    for: 'vault',
-    description: 'The namespace within Vault to use.',
-  })
-  namespace;
-
-  @attr('string', {
-    for: 'vault',
-    description:
-      "A PEM-encoded CA certificate to verify the Vault server's TLS certificate.",
-  })
-  ca_cert;
-
-  @attr('string', {
-    for: 'vault',
-    description:
-      'Name to use as the SNI host when connecting to Vault via TLS.',
-  })
-  tls_server_name;
-
-  @attr('boolean', {
-    for: 'vault',
-    description: 'Whether or not to skip TLS verification.',
-  })
-  tls_skip_verify;
-
-  @attr('string', {
-    for: 'vault',
-    description: 'A token used for accessing Vault.',
-  })
-  token;
-
-  @attr('string', {
-    for: 'vault',
-    description: 'The Vault token hmac.',
-    readOnly: true,
-  })
-  token_hmac;
-
-  @attr('string', {
-    for: 'vault',
-    description:
-      'A PEM-encoded client certificate to use for TLS authentication to the Vault server.',
-  })
-  client_certificate;
-
-  @attr('string', {
-    for: 'vault',
-    description:
-      "A PEM-encoded private key matching the client certificate from 'client_certificate'.",
-  })
-  client_certificate_key;
-
-  @attr('string', {
-    for: 'vault',
-    description: 'The Vault client certificate key hmac.',
-    readOnly: true,
-  })
-  client_certificate_key_hmac;
-}

addons/api/addon/models/fragment-host-attributes.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentHostAttributesModel extends Fragment {
-  @attr('string', {
-    description: 'The address (DNS or IP name) used to reach the host',
-  })
-  address;
-}

addons/api/addon/models/fragment-host-source.js

@@ -1,13 +1,13 @@
 import Fragment from 'ember-data-model-fragments/fragment';
 import { attr } from '@ember-data/model';
 
-export default class FragmentHostSetModel extends Fragment {
+export default class FragmentHostSourceModel extends Fragment {
   // =attributes
 
   @attr('string', {
-    description: 'ID of the related host set',
+    description: 'ID of the related host source',
   })
-  host_set_id;
+  host_source_id;
 
   @attr('string', {
     description: 'ID of the catalog to which the host set belongs',

addons/api/addon/models/fragment-target-attributes.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentTargetAttributesModel extends Fragment {
-  @attr('number', {
-    description: 'The  default port a target should use if present.',
-  })
-  default_port;
-}

addons/api/addon/models/host-catalog.js

@@ -1,3 +1,71 @@
 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
 
-export default class HostCatalogModel extends GeneratedHostCatalogModel {}
+export const types = ['aws', 'azure'];
+
+export default class HostCatalogModel extends GeneratedHostCatalogModel {
+  // =attributes
+
+  /**
+   * True if the host catalog is static.
+   * @type {boolean}
+   */
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * True if the host catalog is a plugin.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host catalog is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return this.isPlugin && !types.includes(this.plugin?.name);
+  }
+
+  /**
+   * True if host catalog plugin type is AWS.
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * True if host catalog plugin type is Azure.
+   * @type {boolean}
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If host catalog is a plugin return `plugin.name`,
+   * otherwise return the host catalog type.
+   * @type {string}
+   */
+  get compositeType() {
+    if (this.isUnknown) return 'unknown';
+    if (this.isPlugin) return this.plugin.name;
+    return 'static';
+  }
+
+  /**
+   * Sets `type`.  If type is different than `static`, sets `type` to `plugin`
+   * and `plugin.name` to the specified type.
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
+}

addons/api/addon/models/host-set.js

@@ -1,9 +1,72 @@
 import GeneratedHostSetModel from '../generated/models/host-set';
 import { fragmentArray } from 'ember-data-model-fragments/attributes';
+import { types } from './host-catalog';
 
 export default class HostSetModel extends GeneratedHostSetModel {
   // =attributes
 
+  /**
+   * Returns if the host-set is static or not.
+   * @type {boolean}
+   */
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * Returns if the host-set is plugin or not.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host set is an unknown type.
+   * @type {boolean}
+   */
+  get isUnknown() {
+    return this.isPlugin && !types.includes(this.plugin?.name);
+  }
+
+  /**
+   * Returns if a host-set plugin is AWS or not
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * Return if a host-set plugin is Azure or not.
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If a host-set is a plugin return its name,
+   * otherwise returns the host-set type
+   * @type {string}
+   */
+  get compositeType() {
+    if (this.isUnknown) return 'unknown';
+    if (this.isPlugin) return this.plugin.name;
+    return 'static';
+  }
+
+  /**
+   * Sets type, if type is different than static, set plugin name to type
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
+
   /**
    * Host IDs are read-only under normal circumstances.  But these can
    * be persisted via a dedicated call to `addHosts()`.
@@ -14,6 +77,18 @@ export default class HostSetModel extends GeneratedHostSetModel {
   })
   host_ids;
 
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+  })
+  preferred_endpoints;
+
+  // AWS specific
+  @fragmentArray('fragment-string', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  filters;
+
   // =methods
 
   /**

addons/api/addon/models/host.js

@@ -1,10 +1,87 @@
 import GeneratedHostModel from '../generated/models/host';
-import { fragment } from 'ember-data-model-fragments/attributes';
+import { attr } from '@ember-data/model';
 
 export default class HostModel extends GeneratedHostModel {
+  // =attributes
+
+  // Static specific fields
+  @attr('string', {
+    description: 'The address (DNS or IP name) used to reach the host',
+    isNestedAttribute: true,
+  })
+  address;
+
+  // Plugin specific fields
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  ip_addresses;
+
+  @attr('string', {
+    description: '',
+    readOnly: true,
+  })
+  external_id;
+
+  // Aws specific
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  dns_names;
+
   /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentHostAttributesModel}
+   * True if the host is static.
+   * @type {boolean}
    */
-  @fragment('fragment-host-attributes', { defaultValue: {} }) attributes;
+  get isStatic() {
+    return this.type === 'static';
+  }
+
+  /**
+   * True if the host is plugin.
+   * @type {boolean}
+   */
+  get isPlugin() {
+    return this.type === 'plugin';
+  }
+
+  /**
+   * True if the host plugin type is AWS.
+   * @type {boolean}
+   */
+  get isAWS() {
+    return this.compositeType === 'aws';
+  }
+
+  /**
+   * True if the host plugin type is Azure.
+   * @type {boolean}
+   */
+  get isAzure() {
+    return this.compositeType === 'azure';
+  }
+
+  /**
+   * If host is a plugin return `plugin.name`,
+   * otherwise return the host type.
+   * @type {string}
+   */
+  get compositeType() {
+    return this.isPlugin ? this.plugin.name : this.type;
+  }
+
+  /**
+   * Sets `type`. If type is different than `static`, sets `type` to `plugin`
+   * and `plugin.name` to the specified type.
+   */
+  set compositeType(type) {
+    if (type === 'static') {
+      this.type = 'static';
+    } else {
+      this.type = 'plugin';
+      this.plugin = { name: type };
+    }
+  }
 }

addons/api/addon/models/managed-group.js

@@ -0,0 +1,18 @@
+import GeneratedManagedGroupModel from '../generated/models/managed-group';
+import { attr } from '@ember-data/model';
+import { A } from '@ember/array';
+
+export default class ManagedGroupModel extends GeneratedManagedGroupModel {
+  // =attributes
+
+  /**
+   * Members is read-only under normal circumstances.  But members can
+   * be persisted via calls to `addMembers()` or `removeMembers()`.
+   */
+  @attr({
+    readOnly: true,
+    defaultValue: () => A(),
+    emptyArrayIfMissing: true,
+  })
+  member_ids;
+}

addons/api/addon/models/role.js

@@ -23,6 +23,13 @@ export default class RoleModel extends GeneratedRoleModel {
    */
   @array('string', { readOnly: true }) grant_strings;
 
+  /**
+   * Convenience for looking up the grant scope, if loaded.
+   */
+  get grantScope() {
+    return this.store.peekRecord('scope', this.grant_scope_id);
+  }
+
   // =methods
 
   /**

addons/api/addon/models/session.js

@@ -13,7 +13,7 @@ class SessionCredential {
   /**
    *
    */
-  static Library = class Library {
+  static Source = class Source {
     id;
     name;
     description;
@@ -42,7 +42,7 @@ class SessionCredential {
 
   // =attributes
   rawCredential;
-  library;
+  source;
   #payloadSecret;
 
   /**
@@ -72,8 +72,8 @@ class SessionCredential {
   // =methods
 
   constructor(cred) {
-    const { id, name, description, type } = cred.credential_library;
-    this.library = new SessionCredential.Library(id, name, description, type);
+    const { id, name, description, type } = cred.credential_source;
+    this.source = new SessionCredential.Source(id, name, description, type);
     this.#payloadSecret = cred.secret;
     this.rawCredential = cred;
   }

addons/api/addon/models/target.js

@@ -1,34 +1,35 @@
 import GeneratedTargetModel from '../generated/models/target';
-import { fragment, fragmentArray } from 'ember-data-model-fragments/attributes';
+import { attr } from '@ember-data/model';
+import { fragmentArray } from 'ember-data-model-fragments/attributes';
 import { computed } from '@ember/object';
 
 export default class TargetModel extends GeneratedTargetModel {
   // =attributes
 
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentTargetAttributesModel}
-   */
-  @fragment('fragment-target-attributes', { defaultValue: {} }) attributes;
+  @attr('number', {
+    isNestedAttribute: true,
+    description: 'The  default port a target should use if present.',
+  })
+  default_port;
 
   /**
-   * @type {[FragmentHostSetModel]}
+   * @type {[FragmentHostSourceModel]}
    */
-  @fragmentArray('fragment-host-set', {
+  @fragmentArray('fragment-host-source', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
-  host_sets;
+  host_sources;
 
   /**
-   * Credential library ids are read only and can be
-   * persisted via a dedicated call to `addCredentialLibraries()`.
+   * Credential source ids are read only and can be
+   * persisted via a dedicated call to `addCredentialSources()`.
    */
   @fragmentArray('fragment-string', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
-  application_credential_library_ids;
+  application_credential_source_ids;
 
   /**
    * An array of resolved host set and host catalog instances.  Model instances
@@ -36,11 +37,11 @@ export default class TargetModel extends GeneratedTargetModel {
    * instances).  Unresolvable instances are excluded from the array.
    * @type {[{model: HostSetModel, hostCatalog: HostCatalogModel}]}
    */
-  @computed('host_sets.[]', 'store')
+  @computed('host_sources.[]', 'store')
   get hostSets() {
-    return this.host_sets
-      .map(({ host_set_id, host_catalog_id }) => ({
-        model: this.store.peekRecord('host-set', host_set_id),
+    return this.host_sources
+      .map(({ host_source_id, host_catalog_id }) => ({
+        model: this.store.peekRecord('host-set', host_source_id),
         hostCatalog: this.store.peekRecord('host-catalog', host_catalog_id),
       }))
       .filter((hostSetRef) => hostSetRef.model !== null);
@@ -52,14 +53,11 @@ export default class TargetModel extends GeneratedTargetModel {
    * instances).  Unresolvable instances are excluded from the array.
    * @type {[CredentialLibraryModel]}
    */
-  @computed('application_credential_library_ids.[]', 'store')
+  @computed('application_credential_source_ids.[]', 'store')
   get credentialLibraries() {
-    return this.application_credential_library_ids
-      .map((credential_library_fragment) =>
-        this.store.peekRecord(
-          'credential-library',
-          credential_library_fragment.value
-        )
+    return this.application_credential_source_ids
+      .map((source) =>
+        this.store.peekRecord('credential-library', source.value)
       )
       .filter(Boolean);
   }
@@ -96,16 +94,16 @@ export default class TargetModel extends GeneratedTargetModel {
   // =methods
 
   /**
-   * Adds host sets via the `add-host-sets` method.
+   * Adds host sets via the `add-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  addHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  addHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'add-host-sets',
+      method: 'add-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -119,16 +117,16 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete host sets via the `remove-host-sets` method.
+   * Delete host sets via the `remove-host-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} hostSetIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  removeHostSets(hostSetIDs, options = { adapterOptions: {} }) {
+  removeHostSources(hostSetIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'remove-host-sets',
+      method: 'remove-host-sources',
       hostSetIDs,
     };
     // There is no "deep merge" in ES.
@@ -142,29 +140,26 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete a single host set via the `remove-host-sets` method.
+   * Delete a single host set via the `remove-host-sources` method.
    * @param {number} hostSetID
    * @param {object} options
    * @return {Promise}
    */
-  removeHostSet(hostSetID, options) {
-    return this.removeHostSets([hostSetID], options);
+  removeHostSource(hostSetID, options) {
+    return this.removeHostSources([hostSetID], options);
   }
 
   /**
-   * Adds credential libraries via the `add-credential-libraries` method.
+   * Adds credential libraries via the `add-credential-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} credentialLibraryIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  addCredentialLibraries(
-    credentialLibraryIDs,
-    options = { adapterOptions: {} }
-  ) {
+  addCredentialSources(credentialLibraryIDs, options = { adapterOptions: {} }) {
     const defaultAdapterOptions = {
-      method: 'add-credential-libraries',
+      method: 'add-credential-sources',
       credentialLibraryIDs,
     };
     // There is no "deep merge" in ES.
@@ -178,19 +173,19 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete credential libraries via the `remove-credential-libraries` method.
+   * Delete credential libraries via the `remove-credential-sources` method.
    * See serializer and adapter for more information.
    * @param {[string]} credentialLibraryIDs
    * @param {object} options
    * @param {object} options.adapterOptions
    * @return {Promise}
    */
-  removeCredentialLibraries(
+  removeCredentialSources(
     credentialLibraryIDs,
     options = { adapterOptions: {} }
   ) {
     const defaultAdapterOptions = {
-      method: 'remove-credential-libraries',
+      method: 'remove-credential-sources',
       credentialLibraryIDs,
     };
     // There is no "deep merge" in ES.
@@ -204,12 +199,28 @@ export default class TargetModel extends GeneratedTargetModel {
   }
 
   /**
-   * Delete a single credential library set via the `remove-credential-libraries` method.
+   * Delete a single credential library set via the `remove-credential-sources` method.
    * @param {number} credentialLibraryID
    * @param {object} options
    * @return {Promise}
    */
-  removeCredentialLibrary(credentialLibraryID, options) {
-    return this.removeCredentialLibraries([credentialLibraryID], options);
+  removeCredentialSource(credentialLibraryID, options) {
+    return this.removeCredentialSources([credentialLibraryID], options);
+  }
+
+  /**
+   * True if the target type is tcp.
+   * @type {boolean}
+   */
+  get isTCP() {
+    return this.type === 'tcp';
+  }
+
+  /**
+   * True if the target type is ssh.
+   * @type {boolean}
+   */
+  get isSSH() {
+    return this.type === 'ssh';
   }
 }

addons/api/addon/models/user.js

@@ -1,5 +1,6 @@
 import GeneratedUserModel from '../generated/models/user';
 import { attr } from '@ember-data/model';
+import { computed } from '@ember/object';
 import { A } from '@ember/array';
 
 export default class UserModel extends GeneratedUserModel {
@@ -16,6 +17,35 @@ export default class UserModel extends GeneratedUserModel {
   })
   account_ids;
 
+  /**
+   * Represents the user's primary account email, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) email;
+
+  /**
+   * Represents the user's primary account full_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) full_name;
+
+  /**
+   * Represents the user's primary account login_name, if any.
+   * @type {string}
+   */
+  @attr('string', { readOnly: true }) login_name;
+
+  /**
+   * Convenience for getting a reasonable string that names the account.
+   * There are many options, so we fallback in order of precedence.
+   * @type {string}
+   */
+  @computed('email', 'full_name', 'login_name')
+  get accountName() {
+    const { email, full_name, login_name } = this;
+    return email || full_name || login_name;
+  }
+
   // =methods
 
   /**

addons/api/addon/serializers/account.js

@@ -33,12 +33,12 @@ export default class AccountSerializer extends ApplicationSerializer {
    * `attributes` entirely on update.
    */
   serializeOIDC(snapshot) {
-    const { isNew } = snapshot?.record;
+    const { isNew } = snapshot?.record || {};
     let serialized = super.serialize(...arguments);
     delete serialized.attributes;
     if (isNew) {
       serialized.attributes = {};
-      const { issuer, subject } = snapshot.attr('attributes').record;
+      const { issuer, subject } = snapshot.record;
       if (issuer) serialized.attributes.issuer = issuer;
       if (subject) serialized.attributes.subject = subject;
     }
@@ -70,7 +70,7 @@ export default class AccountSerializer extends ApplicationSerializer {
     }
     // Change password custom method
     if (snapshot?.adapterOptions?.method === 'change-password') {
-      const { currentPassword, newPassword } = snapshot?.adapterOptions;
+      const { currentPassword, newPassword } = snapshot?.adapterOptions || {};
       serialized = this.serializeForChangePassword(
         snapshot,
         currentPassword,

addons/api/addon/serializers/application.js

@@ -50,6 +50,20 @@ export default class ApplicationSerializer extends RESTSerializer {
     // Do not serialize `disabled` fields.
     // TODO:  disabled is temporarily disabled
     if (key === 'disabled') delete json[key];
+    // Push nested attributes down into the attributes key
+    if (options.isNestedAttribute && json[key] !== undefined) {
+      if (!json.attributes) json.attributes = {};
+      json.attributes[key] = json[key];
+      delete json[key];
+    }
+    // Push nested secrets down into the secrets key
+    if (options.isNestedSecret) {
+      if (json[key]) {
+        if (!json.secrets) json.secrets = {};
+        json.secrets[key] = json[key];
+      }
+      delete json[key];
+    }
     return value;
   }
 
@@ -123,7 +137,7 @@ export default class ApplicationSerializer extends RESTSerializer {
   }
 
   /**
-   * In our API, singluar resources are _unrooted_, whereas Ember Data expects
+   * In our API, singular resources are _unrooted_, whereas Ember Data expects
    * them to be rooted under their model name, e.g. `{modelName: {…}}`.
    * This method makes this transformation to accommodate Ember Data.
    *
@@ -195,9 +209,107 @@ export default class ApplicationSerializer extends RESTSerializer {
    * @return {Object}
    */
   normalize(typeClass, hash) {
-    const normalizedHash = copy(hash, true);
+    let normalizedHash = copy(hash, true);
     const scopeID = get(normalizedHash, 'scope.id');
     if (scopeID) normalizedHash.scope.scope_id = scopeID;
+    normalizedHash = this.normalizeNestedAttributes(typeClass, normalizedHash);
+    normalizedHash = this.normalizeNestedSecrets(typeClass, normalizedHash);
     return super.normalize(typeClass, normalizedHash);
   }
+
+  /**
+   * Certain typed resources in the API have type-specific fields nested under
+   * an `attributes` key in the payload
+   * (e.g. `attributes: { fieldName: '123' }`).  Since Ember Data lacks
+   * first-class support for nested attributes, these fields must be hoisted up
+   * into the main body of the payload.
+   *
+   * In order to annotate a field as being a nested attribute, add the key name
+   * to the `nestedAttributes` field on the serializer:
+   *   `@attr('string', { isNestedAttribute: true }) fieldName;`
+   *
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalizeNestedAttributes(typeClass, hash) {
+    typeClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { isNestedAttribute },
+      } = attribute;
+      const value = hash.attributes?.[name];
+      const isUndefined = value === undefined;
+      if (isNestedAttribute && !isUndefined) hash[name] = value;
+    });
+    return hash;
+  }
+
+  /**
+   * If an attribute is declared with the `isNestedSecret` option, it will
+   * be explicitly unset in the incoming payload to `null`.  This helps ensure
+   * secret values do not linger in the UI.
+   *
+   * For example:
+   *   `@attr('string', { isNestedSecret: true }) superSecretShhh;`
+   *
+   * @param {Model} typeClass
+   * @param {Object} hash
+   * @return {Object}
+   */
+  normalizeNestedSecrets(typeClass, hash) {
+    typeClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { isNestedSecret },
+      } = attribute;
+      const value = hash.secrets?.[name];
+      if (isNestedSecret) hash[name] = value || null;
+    });
+    return hash;
+  }
+
+  /**
+   * If the API returns an updated response with removed fields, we need to
+   * explicitly set any read only field that is on the model but wasn't
+   * returned in the response to `null`.
+   * This will let ember data know the field was removed, otherwise
+   * it won't touch the removed field and will use the old value.
+   *
+   * @override
+   * @param {object} store
+   * @param {object} primaryModelClass
+   * @param {object} payload
+   * @param {?string} id
+   * @param {string} requestType
+   * @return {object}
+   */
+  normalizeUpdateRecordResponse(
+    store,
+    primaryModelClass,
+    payload,
+    id,
+    requestType
+  ) {
+    const newPayload = copy(payload, true);
+
+    primaryModelClass.attributes.forEach((attribute) => {
+      const {
+        name,
+        options: { readOnly },
+      } = attribute;
+
+      if (readOnly && !Object.prototype.hasOwnProperty.call(newPayload, name)) {
+        newPayload[name] = null;
+      }
+    });
+
+    return super.normalizeUpdateRecordResponse(
+      store,
+      primaryModelClass,
+      newPayload,
+      id,
+      requestType
+    );
+  }
 }

addons/api/addon/serializers/credential-library.js

@@ -1,3 +1,18 @@
 import ApplicationSerializer from './application';
 
-export default class CredentialLibrarySerializer extends ApplicationSerializer {}
+export default class CredentialLibrarySerializer extends ApplicationSerializer {
+  /**
+   * @override
+   * @method serialize
+   * @param {Snapshot} snapshot
+   */
+  serialize() {
+    const serialized = super.serialize(...arguments);
+    if (serialized.attributes) {
+      // Serialize `http_request_body` only if `http_method` is POST
+      if (!serialized.attributes?.http_method?.match(/post/i))
+        delete serialized.attributes.http_request_body;
+    }
+    return serialized;
+  }
+}

addons/api/addon/serializers/credential-store.js

@@ -1,3 +1,24 @@
 import ApplicationSerializer from './application';
 
-export default class CredentialStoreSerializer extends ApplicationSerializer {}
+export default class CredentialStoreSerializer extends ApplicationSerializer {
+  /**
+   * @override
+   * @method serialize
+   * @param {Snapshot} snapshot
+   */
+  serialize() {
+    const serialized = super.serialize(...arguments);
+    if (serialized.attributes) {
+      // Token cannot be unset.  If it's falsy, it must be removed.
+      if (!serialized.attributes?.token) delete serialized.attributes.token;
+      // Client certificate key cannot be unset when certificate is set.
+      // If it's falsy, it must be removed.
+      if (
+        !serialized.attributes?.client_certificate_key &&
+        serialized.attributes?.client_certificate
+      )
+        delete serialized.attributes.client_certificate_key;
+    }
+    return serialized;
+  }
+}

addons/api/addon/serializers/fragment-account-attributes.js

@@ -1,26 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentAccountAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   *
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Client secret cannot be unset.  If it's falsy, it must be removed.
-    if (key === 'client_secret' && !json[key]) delete json[key];
-    return value;
-  }
-}

addons/api/addon/serializers/fragment-auth-method-attributes-account-claim-map.js

@@ -1,6 +1,6 @@
 import JSONSerializer from '@ember-data/serializer/json';
 
-export default class FragmentHostSetSerializer extends JSONSerializer {
+export default class FragmentHostSourceSerializer extends JSONSerializer {
   // =methods
 
   /**

addons/api/addon/serializers/fragment-credential-library-attributes.js

@@ -1,27 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentCredentialLibraryAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   * Only serialize http_request_body when `http_method` is set to `POST`.
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Do not serialize http_request_body unless http_method is POST
-    if (key === 'http_request_body' && !json['http_method']?.match(/post/i))
-      delete json[key];
-    return value;
-  }
-}

addons/api/addon/serializers/fragment-credential-store-attributes.js

@@ -1,34 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentCredentialStoreAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   *
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Token cannot be unset.  If it's falsy, it must be removed.
-    if (key === 'token' && !json[key]) delete json[key];
-    // Client certificate key cannot be unset when certificate is set.
-    // If it's falsy, it must be removed.
-    if (
-      key === 'client_certificate_key' &&
-      !json[key] &&
-      json['client_certificate']
-    )
-      delete json[key];
-    return value;
-  }
-}

addons/api/addon/serializers/fragment-host-set.js

@@ -1,16 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentHostSetSerializer extends JSONSerializer {
-  // =methods
-
-  /**
-   * Renames `id` to `host_set_id` because fragments may not have IDs.
-   * Otherwise normalizes as normal.
-   * @param {ModelClass} typeClass
-   * @param {object} resourceHash
-   * @return {object}
-   */
-  normalize(typeClass, { id: host_set_id, ...obj }) {
-    return super.normalize(typeClass, { host_set_id, ...obj });
-  }
-}

addons/api/addon/serializers/fragment-host-source.js

@@ -0,0 +1,16 @@
+import JSONSerializer from '@ember-data/serializer/json';
+
+export default class FragmentHostSourceSerializer extends JSONSerializer {
+  // =methods
+
+  /**
+   * Renames `id` to `host_source_id` because fragments may not have IDs.
+   * Otherwise normalizes as normal.
+   * @param {ModelClass} typeClass
+   * @param {object} resourceHash
+   * @return {object}
+   */
+  normalize(typeClass, { id: host_source_id, ...obj }) {
+    return super.normalize(typeClass, { host_source_id, ...obj });
+  }
+}

addons/api/addon/serializers/host-catalog.js

@@ -0,0 +1,59 @@
+import ApplicationSerializer from './application';
+
+const fieldsByType = {
+  aws: [
+    'disable_credential_rotation',
+    'region',
+    'access_key_id',
+    'secret_access_key',
+  ],
+  azure: [
+    'disable_credential_rotation',
+    'tenant_id',
+    'client_id',
+    'subscription_id',
+    'secret_id',
+    'secret_value',
+  ],
+};
+
+export default class HostCatalogSerializer extends ApplicationSerializer {
+  // =methods
+  serialize(snapshot) {
+    const serialized = super.serialize(...arguments);
+    switch (snapshot.record.compositeType) {
+      case 'static':
+        return this.serializeStatic(...arguments);
+      default:
+        return serialized;
+    }
+  }
+
+  serializeAttribute(snapshot, json, key, attribute) {
+    const value = super.serializeAttribute(...arguments);
+    const { isPlugin, compositeType } = snapshot.record;
+    const { options } = attribute;
+    // Nested conditionals for readability
+    // This deletes any fields that don't belong to the record type
+    if (isPlugin && options.isNestedAttribute && json.attributes) {
+      // The key must be included in the fieldsByType list above
+      if (!fieldsByType[compositeType].includes(key))
+        delete json.attributes[key];
+    }
+    // This deletes any fields that don't belong to the record type
+    if (isPlugin && options.isNestedSecret && json.secrets) {
+      if (!fieldsByType[compositeType].includes(key)) delete json.secrets[key];
+    }
+
+    // new one for isNestedSecret
+    return value;
+  }
+
+  serializeStatic() {
+    const serialized = super.serialize(...arguments);
+    // Delete unnecessary fields for static host-catalog
+    delete serialized.attributes;
+    delete serialized.secrets;
+    return serialized;
+  }
+}

addons/api/addon/serializers/host-set.js

@@ -1,5 +1,10 @@
 import ApplicationSerializer from './application';
+import { copy } from 'ember-copy';
 
+const fieldByType = {
+  aws: ['preferred_endpoints', 'filters', 'sync_interval_seconds'],
+  azure: ['preferred_endpoints', 'filter', 'sync_interval_seconds'],
+};
 export default class HostSetSerializer extends ApplicationSerializer {
   // =properties
 
@@ -19,10 +24,17 @@ export default class HostSetSerializer extends ApplicationSerializer {
    * @return {object}
    */
   serialize(snapshot) {
-    let serialized = super.serialize(...arguments);
     const hostIDs = snapshot?.adapterOptions?.hostIDs;
-    if (hostIDs) serialized = this.serializeWithHostIDs(snapshot, hostIDs);
-    return serialized;
+    if (hostIDs) {
+      return this.serializeWithHostIDs(snapshot, hostIDs);
+    } else {
+      switch (snapshot.record.compositeType) {
+        case 'static':
+          return this.serializeStatic(...arguments);
+        default:
+          return super.serialize(...arguments);
+      }
+    }
   }
 
   /**
@@ -37,4 +49,41 @@ export default class HostSetSerializer extends ApplicationSerializer {
       host_ids: hostIDs,
     };
   }
+
+  serializeStatic() {
+    let serialized = super.serialize(...arguments);
+    // Delete unnecessary fields for static type
+    delete serialized.attributes;
+    delete serialized.preferred_endpoints;
+    delete serialized.sync_interval_seconds;
+    return serialized;
+  }
+
+  serializeAttribute(snapshot, json, key, attribute) {
+    const value = super.serializeAttribute(...arguments);
+    const { isPlugin, compositeType } = snapshot.record;
+    const { options } = attribute;
+
+    if (isPlugin && options.isNestedAttribute) {
+      if (!fieldByType[compositeType].includes(key)) {
+        delete json.attributes[key];
+      }
+    }
+    return value;
+  }
+
+  /**
+   * Temporarily converts `filters` to an array if it is a string.  This is a
+   * quirk of the API.
+   *
+   * TODO:  remove once API consistently returns arrays.
+   */
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = copy(hash, true);
+    if (typeof normalizedHash?.filters === 'string') {
+      normalizedHash.filters = [normalizedHash.filters];
+    }
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    return normalized;
+  }
 }

addons/api/addon/serializers/managed-group.js

@@ -0,0 +1,10 @@
+import ApplicationSerializer from './application';
+
+export default class ManagedGroupSerializer extends ApplicationSerializer {
+  // =properties
+
+  /**
+   * @type {boolean}
+   */
+  serializeScopeID = false;
+}

addons/api/addon/serializers/target.js

@@ -17,43 +17,44 @@ export default class TargetSerializer extends ApplicationSerializer {
    */
   serialize(snapshot) {
     let serialized = super.serialize(...arguments);
-    const hostSetIDs = snapshot?.adapterOptions?.hostSetIDs;
-    if (hostSetIDs)
-      serialized = this.serializeWithHostSets(snapshot, hostSetIDs);
-    const credentialLibraryIDs = snapshot?.adapterOptions?.credentialLibraryIDs;
-    if (credentialLibraryIDs)
-      serialized = this.serializeWithCredentialLibraries(
+    const hostSourceIDs = snapshot?.adapterOptions?.hostSetIDs;
+    if (hostSourceIDs) {
+      serialized = this.serializeWithHostSources(snapshot, hostSourceIDs);
+    }
+    const credentialSourceIDs = snapshot?.adapterOptions?.credentialLibraryIDs;
+    if (credentialSourceIDs)
+      serialized = this.serializeWithCredentialSources(
         snapshot,
-        credentialLibraryIDs
+        credentialSourceIDs
       );
     return serialized;
   }
 
   /**
-   * Returns a payload containing only the host_set_ids array using IDs
-   * passed into the function (rather than existing host sets on the model).
+   * Returns a payload containing only version and an array of passed IDs,
+   * rather than existing instances on the model.
    * @param {Snapshot} snapshot
    * @param {[string]} hostSetIDs
    * @return {object}
    */
-  serializeWithHostSets(snapshot, hostSetIDs) {
+  serializeWithHostSources(snapshot, hostSourceIDs) {
     return {
       version: snapshot.attr('version'),
-      host_set_ids: hostSetIDs,
+      host_source_ids: hostSourceIDs,
     };
   }
 
   /**
-   * Returns a payload containing only the credential_library_ids array using IDs
-   * passed into the function (rather than existing credential libraries on the model).
+   * Returns a payload containing only version and an array of passed IDs,
+   * rather than existing instances on the model.
    * @param {Snapshot} snapshot
-   * @param {[string]} credentialLibraryIDs
+   * @param {[string]} credentialSourceIDs
    * @return {object}
    */
-  serializeWithCredentialLibraries(snapshot, credentialLibraryIDs) {
+  serializeWithCredentialSources(snapshot, credentialSourceIDs) {
     return {
       version: snapshot.attr('version'),
-      application_credential_library_ids: credentialLibraryIDs,
+      application_credential_source_ids: credentialSourceIDs,
     };
   }
 }

addons/api/addon/services/resource-filter-store.js

@@ -0,0 +1,127 @@
+import Service from '@ember/service';
+import { inject as service } from '@ember/service';
+
+/**
+ * Takes a POJO representing a query and converts it to a boolean expression
+ * string which is understood by the API.
+ *
+ * @example
+ *   const filter = new ResourceFilter({
+ *     type: 'oidc',
+ *     status: ['active', 'pending'],
+ *     authorized_actions: [{ contains: 'read' }]
+ *   });
+ *   log(filter.queryExpression);
+ *   // ("/item/type" == "oidc") and ("/item/status" == "active" or "/item/status" == "pending") and ("read" in "/item/authorized_actions")
+ */
+export class ResourceFilter {
+  // =attributes
+
+  /**
+   * @type {?object}
+   */
+  #filterObject;
+
+  /**
+   * @type {string}
+   */
+  get queryExpression() {
+    const clauses = Object.keys(this.#filterObject)
+      .map((key) => {
+        const value = this.#filterObject[key];
+        const valuesArray = Array.isArray(value) ? value : [value];
+        return this.parenthetical(
+          this.or(
+            valuesArray.map((value) => {
+              if (value && value.contains) {
+                return this.in(value.contains, key);
+              }
+              return this.equals(key, value);
+            })
+          )
+        );
+      })
+      .flat()
+      .filter((item) => item);
+    return this.and(clauses);
+  }
+
+  // =methods
+
+  /**
+   * @param {object} filterObject
+   */
+  constructor(filterObject = {}) {
+    this.#filterObject = Object.assign({}, filterObject);
+  }
+
+  /**
+   * @param {string} key
+   * @param value
+   * @return {string}
+   */
+  equals(key, value) {
+    return value !== null ? `"/item/${key}" == "${value}"` : null;
+  }
+
+  /**
+   * @param {string} key
+   * @param value
+   * @return {string}
+   */
+  in(value, key) {
+    return value !== null ? `"${value}" in "/item/${key}"` : null;
+  }
+
+  /**
+   * @param {string[]} clauses
+   * @return {string}
+   */
+  and(clauses) {
+    return clauses.join(' and ');
+  }
+
+  /**
+   * @param {string[]} clauses
+   * @return {string}
+   */
+  or(clauses) {
+    return clauses.join(' or ');
+  }
+
+  /**
+   * @param {string} expression
+   * @return {string}
+   */
+  parenthetical(expression) {
+    return expression ? `(${expression})` : null;
+  }
+}
+
+/**
+ *
+ */
+export default class ResourceFilterStoreService extends Service {
+  // =services
+
+  @service store;
+
+  // =methods
+
+  /**
+   * Similar to Ember's built-in `store.query`, except this method accepts
+   * an additional argument `filterObject` representing a query filter
+   * (see ResourceFilter class above).
+   * @param {string} modelName
+   * @param {object} filterObject
+   * @param {?object} storeQuery
+   * @return {Promise}
+   */
+  queryBy(modelName, filterObject = {}, storeQuery = {}) {
+    const filter = new ResourceFilter(filterObject);
+    const query = Object.assign({}, storeQuery);
+    // Apply filters to store query when available
+    if (filter.queryExpression) query.filter = filter.queryExpression;
+    return this.store.query(modelName, query);
+  }
+}

addons/api/app/abilities/account.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/account';

addons/api/app/abilities/collection.js

@@ -1 +0,0 @@
-export { default } from 'api/abilities/collection';

addons/api/app/abilities/credential-store.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/credential-store';

addons/api/app/abilities/group.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/group';

addons/api/app/abilities/host-catalog.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/host-catalog';

addons/api/app/abilities/host-set.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/host-set';

addons/api/app/abilities/role.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/role';

addons/api/app/abilities/target.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/target';

addons/api/app/abilities/user.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/user';

addons/api/app/adapters/host-catalog.js

@@ -0,0 +1 @@
+export { default } from 'api/adapters/host-catalog';

addons/api/app/models/fragment-account-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-account-attributes';

addons/api/app/models/fragment-credential-library-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-credential-library-attributes';

addons/api/app/models/fragment-credential-store-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-credential-store-attributes';

addons/api/app/models/fragment-host-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-host-attributes';

addons/api/app/models/fragment-host-set.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-host-set';

addons/api/app/models/fragment-host-source.js

@@ -0,0 +1 @@
+export { default } from 'api/models/fragment-host-source';

addons/api/app/models/fragment-target-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-target-attributes';

addons/api/app/models/managed-group.js

@@ -0,0 +1 @@
+export { default } from 'api/models/managed-group';

addons/api/app/serializers/fragment-account-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-account-attributes';

addons/api/app/serializers/fragment-credential-library-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-credential-library-attributes';

addons/api/app/serializers/fragment-credential-store-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-credential-store-attributes';

addons/api/app/serializers/fragment-host-set.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-host-set';

addons/api/app/serializers/fragment-host-source.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/fragment-host-source';

addons/api/app/serializers/host-catalog.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/host-catalog';

addons/api/app/serializers/managed-group.js

@@ -0,0 +1 @@
+export { default } from 'api/serializers/managed-group';

addons/api/app/services/resource-filter-store.js

@@ -0,0 +1 @@
+export { default } from 'api/services/resource-filter-store';

addons/api/config/ember-try.js

@@ -1,86 +0,0 @@
-'use strict';
-
-const getChannelURL = require('ember-source-channel-url');
-
-module.exports = async function () {
-  return {
-    scenarios: [
-      {
-        name: 'ember-lts-3.12',
-        npm: {
-          devDependencies: {
-            'ember-source': '~3.12.0',
-          },
-        },
-      },
-      {
-        name: 'ember-lts-3.16',
-        npm: {
-          devDependencies: {
-            'ember-source': '~3.16.0',
-          },
-        },
-      },
-      {
-        name: 'ember-lts-3.20',
-        npm: {
-          devDependencies: {
-            'ember-source': '~3.20.5',
-          },
-        },
-      },
-      {
-        name: 'ember-release',
-        npm: {
-          devDependencies: {
-            'ember-source': await getChannelURL('release'),
-          },
-        },
-      },
-      {
-        name: 'ember-beta',
-        npm: {
-          devDependencies: {
-            'ember-source': await getChannelURL('beta'),
-          },
-        },
-      },
-      {
-        name: 'ember-canary',
-        npm: {
-          devDependencies: {
-            'ember-source': await getChannelURL('canary'),
-          },
-        },
-      },
-      {
-        name: 'ember-default-with-jquery',
-        env: {
-          EMBER_OPTIONAL_FEATURES: JSON.stringify({
-            'jquery-integration': true,
-          }),
-        },
-        npm: {
-          devDependencies: {
-            '@ember/jquery': '^1.1.0',
-          },
-        },
-      },
-      {
-        name: 'ember-classic',
-        env: {
-          EMBER_OPTIONAL_FEATURES: JSON.stringify({
-            'application-template-wrapper': true,
-            'default-async-observers': false,
-            'template-only-glimmer-components': false,
-          }),
-        },
-        npm: {
-          ember: {
-            edition: 'classic',
-          },
-        },
-      },
-    ],
-  };
-};

addons/api/mirage/config.js

@@ -1,12 +1,14 @@
-import Ember from 'ember';
 import config from '../config/environment';
 import { authHandler, deauthHandler } from './route-handlers/auth';
 import { pickRandomStatusString } from './factories/session';
 import { Response } from 'miragejs';
 import initializeMockIPC from './scenarios/ipc';
+import makeBooleanFilter from './helpers/bexpr-filter';
+
+const isTesting = config.environment === 'test';
 
 export default function () {
-  initializeMockIPC(this);
+  initializeMockIPC(this, config);
 
   // make this `http://localhost:8080`, for example, if your API is on a different server
   // this.urlPrefix = '';
@@ -24,16 +26,18 @@ export default function () {
 
   this.get(
     '/scopes',
-    ({ scopes }, { queryParams: { scope_id, recursive } }) => {
+    ({ scopes }, { queryParams: { scope_id, recursive, filter } }) => {
+      let resultSet;
       // Default parent scope is global
       if (!scope_id) scope_id = 'global';
       if (recursive && scope_id === 'global') {
-        return scopes.all();
+        resultSet = scopes.all();
       } else {
-        return scopes.where((scope) => {
+        resultSet = scopes.where((scope) => {
           return scope.scope ? scope.scope.id === scope_id : false;
         });
       }
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.post('/scopes', function ({ scopes }) {
@@ -53,8 +57,9 @@ export default function () {
 
   this.get(
     '/auth-methods',
-    ({ authMethods }, { queryParams: { scope_id: scopeId } }) => {
-      return authMethods.where({ scopeId });
+    ({ authMethods }, { queryParams: { scope_id: scopeId, filter } }) => {
+      const resultSet = authMethods.where({ scopeId });
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.post('/auth-methods');
@@ -75,8 +80,17 @@ export default function () {
   // Auth Method Accounts
   this.get(
     '/accounts',
-    ({ accounts }, { queryParams: { auth_method_id: authMethodId } }) => {
-      return accounts.where({ authMethodId });
+    (
+      { accounts },
+      { queryParams: { auth_method_id: authMethodId, filter } }
+    ) => {
+      let resultSet;
+      if (authMethodId) {
+        resultSet = accounts.where({ authMethodId });
+      } else {
+        resultSet = accounts.all();
+      }
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.post('/accounts');
@@ -256,7 +270,19 @@ export default function () {
       return hostCatalogs.where({ scopeId });
     }
   );
-  this.post('/host-catalogs');
+  this.post(
+    '/host-catalogs',
+    function ({ hostCatalogs }, { queryParams: { plugin_name } }) {
+      const attrs = this.normalizedRequestAttrs();
+      if (plugin_name) {
+        attrs.type = 'plugin';
+        attrs.plugin = {
+          name: plugin_name,
+        };
+      }
+      return hostCatalogs.create(attrs);
+    }
+  );
   this.get('/host-catalogs/:id');
   this.patch('/host-catalogs/:id');
   this.del('/host-catalogs/:id');
@@ -335,19 +361,22 @@ export default function () {
 
   this.get(
     '/targets',
-    function ({ targets }, { queryParams: { scope_id, recursive } }) {
+    function ({ targets }, { queryParams: { scope_id, recursive, filter } }) {
+      let resultSet;
       if (recursive && scope_id === 'global') {
-        return targets.all();
+        resultSet = targets.all();
       } else if (recursive) {
-        return targets.where((target) => {
+        resultSet = targets.where((target) => {
           const targetModel = targets.find(target.id);
           return (
             target.scopeId === scope_id ||
             targetModel?.scope?.scope?.id === scope_id
           );
         });
+      } else {
+        resultSet = targets.where((target) => target.scopeId === scope_id);
       }
-      return targets.where((target) => target.scopeId === scope_id);
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.post('/targets', function ({ targets }) {
@@ -367,37 +396,37 @@ export default function () {
       const updatedAttrs = {
         version: attrs.version,
       };
-      // If adding host sets, push them into the array
-      if (method === 'add-host-sets') {
+      // If adding host sources, push them into the array
+      if (method === 'add-host-sources') {
         updatedAttrs.hostSetIds = target.hostSetIds;
-        attrs.hostSetIds.forEach((id) => {
+        attrs.hostSourceIds.forEach((id) => {
           if (!updatedAttrs.hostSetIds.includes(id)) {
             updatedAttrs.hostSetIds.push(id);
           }
         });
       }
-      // If deleting host sets, filter them out of the array
-      if (method === 'remove-host-sets') {
+      // If deleting host sources, filter them out of the array
+      if (method === 'remove-host-sources') {
         updatedAttrs.hostSetIds = target.hostSetIds;
         updatedAttrs.hostSetIds = updatedAttrs.hostSetIds.filter((id) => {
-          return !attrs.hostSetIds.includes(id);
+          return !attrs.hostSourceIds.includes(id);
         });
       }
-      // If adding credential libraries, push them into the array
-      if (method === 'add-credential-libraries') {
+      // If adding credential sources, push them into the array
+      if (method === 'add-credential-sources') {
         updatedAttrs.credentialLibraryIds = target.credentialLibraryIds;
-        attrs.applicationCredentialLibraryIds.forEach((id) => {
+        attrs.applicationCredentialSourceIds.forEach((id) => {
           if (!updatedAttrs.credentialLibraryIds.includes(id)) {
             updatedAttrs.credentialLibraryIds.push(id);
           }
         });
       }
-      // If deleting credential libraries, filter them out of the array
-      if (method === 'remove-credential-libraries') {
+      // If deleting credential sources, filter them out of the array
+      if (method === 'remove-credential-sources') {
         updatedAttrs.credentialLibraryIds = target.credentialLibraryIds;
         updatedAttrs.credentialLibraryIds =
           updatedAttrs.credentialLibraryIds.filter((id) => {
-            return !attrs.applicationCredentialLibraryIds.includes(id);
+            return !attrs.applicationCredentialSourceIds.includes(id);
           });
       }
       return target.update(updatedAttrs);
@@ -408,14 +437,15 @@ export default function () {
 
   this.get(
     '/sessions',
-    function ({ sessions }, { queryParams: { scope_id, recursive } }) {
+    function ({ sessions }, { queryParams: { scope_id, recursive, filter } }) {
+      let resultSet;
       // To simulate changes to `session.status` that may occur in the backend,
       // we quietly randomize the value of the field on GET.
       // To populate sessions for logged in user,
       // update alternate sessions to auth user.
       // But only if not in testing mode.
       // In tests, we need deterministic statuses.
-      if (!Ember.testing) {
+      if (!isTesting) {
         sessions.all().models.forEach((session) => {
           session.update({
             status: pickRandomStatusString(),
@@ -427,22 +457,24 @@ export default function () {
         });
       }
       if (recursive && scope_id === 'global') {
-        return sessions.all();
+        resultSet = sessions.all();
       } else if (recursive) {
-        return sessions.where((session) => {
+        resultSet = sessions.where((session) => {
           const sessionModel = sessions.find(session.id);
           return (
             session.scopeId === scope_id ||
             sessionModel?.scope?.scope?.id === scope_id
           );
         });
+      } else {
+        resultSet = sessions.where((session) => session.scopeId === scope_id);
       }
-      return sessions.where((session) => session.scopeId === scope_id);
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.get('/sessions/:id', function ({ sessions }, { params: { id } }) {
     const session = sessions.find(id);
-    if (!Ember.testing) {
+    if (!isTesting) {
       session.update({
         status: pickRandomStatusString(),
       });
@@ -509,6 +541,18 @@ export default function () {
   this.del('/credential-libraries/:id');
   this.patch('/credential-libraries/:id');
 
+  // managed-groups
+  this.get(
+    '/managed-groups',
+    ({ managedGroups }, { queryParams: { auth_method_id: authMethodId } }) => {
+      return managedGroups.where({ authMethodId });
+    }
+  );
+  this.post('/managed-groups');
+  this.get('/managed-groups/:id');
+  this.patch('/managed-groups/:id');
+  this.del('/managed-groups/:id');
+
   /* Uncomment the following line and the Response import above
    * Then change the response code to simulate error responses.
    * this.get('/scopes', () => new Response(505));

addons/api/mirage/factories/account.js

@@ -1,6 +1,7 @@
 import factory from '../generated/factories/account';
 import { random, internet } from 'faker';
 import permissions from '../helpers/permissions';
+import generateId from '../helpers/id';
 
 export default factory.extend({
   authorized_actions: () =>
@@ -9,7 +10,11 @@ export default factory.extend({
       'read',
       'update',
       'delete',
+      'set-password',
     ],
+
+  id: () => generateId('acct_'),
+
   attributes() {
     switch (this.type) {
       case 'password':

addons/api/mirage/factories/auth-method.js

@@ -1,6 +1,7 @@
 import factory from '../generated/factories/auth-method';
 import { trait } from 'ember-cli-mirage';
 import permissions from '../helpers/permissions';
+import generateId from '../helpers/id';
 
 const types = ['password', 'oidc'];
 
@@ -15,23 +16,40 @@ export default factory.extend({
   authorized_collection_actions: () => {
     return {
       accounts: ['create', 'list'],
+      'managed-groups': ['create', 'list'],
     };
   },
-  id: (i) => `auth-method-id-${i}`,
+
+  id: () => generateId('am_'),
 
   // Cycle through available types
   type: (i) => types[i % types.length],
 
   /**
-   * Adds accounts (with associated users) to auth method.
+   * Adds accounts (with associated users) to auth method and managed groups.
    */
-  withAccountsAndUsers: trait({
+  withAccountsAndUsersAndManagedGroups: trait({
     afterCreate(authMethod, server) {
       const { scope, type } = authMethod;
+
       server.createList('user', 5, { scope }).map((user) => {
         const { id } = server.create('account', { scope, type, authMethod });
         user.update({ accountIds: [id] });
       });
+
+      if (type === 'oidc') {
+        server
+          .createList('managed-group', 2, { scope, authMethod })
+          .map((managedGroup) => {
+            const accounts = server.createList('account', 2, {
+              scope,
+              type,
+              authMethod,
+            });
+            const accountIds = accounts.map((account) => account.id);
+            managedGroup.update({ memberIds: accountIds });
+          });
+      }
     },
   }),
 });

addons/api/mirage/factories/credential-library.js

@@ -1,11 +1,12 @@
 import factory from '../generated/factories/credential-library';
 import { random, system } from 'faker';
 import permissions from '../helpers/permissions';
+import generateId from '../helpers/id';
 
 const types = ['vault'];
 
 export default factory.extend({
-  id: (i) => `credential-library-id-${i}`,
+  id: () => generateId('cl_'),
   type: (i) => types[i % types.length],
 
   authorized_actions: () =>