chore: 🤖 Update changelog and version for desktop client (#1625)

Upgrade CLI version for desktop client to 0.12.0

.github/workflows/oss-ent-merge-trigger.yml

@@ -0,0 +1,25 @@
+name: Trigger OSS to Enterprise Merge
+on:
+  pull_request_target:
+    types:
+      - closed
+    branches:
+      - main
+
+jobs:
+  trigger-oss-merge:
+    # Run this only on merge events in OSS repo
+    if: ${{ github.event.pull_request.merged && github.repository == 'hashicorp/boundary-ui' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Merge
+        env:
+          GIT_REF: ${{ github.ref_name }}
+          GIT_SHA: ${{ github.sha }}
+          GH_PAT: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          GIT_ACTOR: ${{ github.actor }}
+        run: |
+          curl -H "Authorization: token $GH_PAT" \
+            -H 'Accept: application/json' \
+            -d "{\"event_type\": \"oss-merge\", \"client_payload\": {\"git-ref\": \"${GIT_REF}\", \"git-sha\": \"${GIT_SHA}\", \"git-actor\": \"${GIT_ACTOR}\" }}" \
+            "https://api.github.com/repos/hashicorp/boundary-ui-enterprise/dispatches"

.github/workflows/test-release-trigger.yml

@@ -1,6 +1,5 @@
 name: "Trigger Test Boundary UI release"
 
-
 on:
   workflow_dispatch:
     inputs:
@@ -9,15 +8,18 @@ on:
         required: true
 
 jobs:
-  trigger-circleci-release:
+  trigger-gha-release:
     runs-on: ubuntu-latest
     steps:
-
-      - name: Trigger Release job
+      - name: Release description
         if: github.event_name == 'workflow_dispatch'
         run: |
           echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
+      - name: Trigger Release workflow in boundary-ui-releases
+        run: |
+          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
+          gh workflow run release.yml \
+          --repo hashicorp/boundary-ui-releases \
+          --ref main \
+          -f TAG="${{ github.event.inputs.branch }}"
 
-          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "'${{ github.event.inputs.branch }}'" }}' \
-          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

.github/workflows/ui-release-trigger.yml

@@ -6,14 +6,17 @@ on:
       - '*'
 
 jobs:
-  trigger-circleci-release:
+  trigger-gha-release:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Trigger Release job
+      - name: Release description
         run: |
           echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
-
-          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
-          -d '{ "branch": "main", "parameters": {"TAG": "'${GITHUB_REF#refs/tags/}'" }}' \
-          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline
+      - name: Trigger Release workflow in boundary-ui-releases
+        run: |
+          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
+          gh workflow run release.yml \
+          --repo hashicorp/boundary-ui-releases \
+          --ref main \
+          -f TAG="${GITHUB_REF#refs/tags/}"

.husky/pre-commit

@@ -3,4 +3,3 @@
 
 yarn compliance:licenses
 npx lint-staged
-yarn test

LICENSE

@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License, version 2.0
 
 1. Definitions

addons/api/.editorconfig

@@ -14,3 +14,6 @@ indent_size = 2
 
 [*.{diff,md}]
 trim_trailing_whitespace = false
+
+[*.hbs]
+insert_final_newline = false

addons/api/.ember-cli

@@ -5,5 +5,11 @@
 
     Setting `disableAnalytics` to true will prevent any data from being sent.
   */
-  "disableAnalytics": false
+  "disableAnalytics": false,
+
+  /**
+  Setting `isTypeScriptProject` to true will force the blueprint generators to generate TypeScript
+  rather than JavaScript by default, when a TypeScript version of a given blueprint is available.
+  */
+  "isTypeScriptProject": false
 }

addons/api/.eslintignore

@@ -13,5 +13,13 @@
 # misc
 /coverage/
 !.*
+.*/
 .eslintcache
 
+# ember-try
+/.node_modules.ember-try/
+/bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
+/package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.eslintrc.js

@@ -29,21 +29,15 @@ module.exports = {
     // node files
     {
       files: [
-        '.eslintrc.js',
-        '.prettierrc.js',
-        '.template-lintrc.js',
-        'ember-cli-build.js',
-        'index.js',
-        'testem.js',
-        'blueprints/*/index.js',
-        'config/**/*.js',
-        'tests/dummy/config/**/*.js',
-      ],
-      excludedFiles: [
-        'addon/**',
-        'addon-test-support/**',
-        'app/**',
-        'tests/dummy/app/**',
+        './.eslintrc.js',
+        './.prettierrc.js',
+        './.template-lintrc.js',
+        './ember-cli-build.js',
+        './index.js',
+        './testem.js',
+        './blueprints/*/index.js',
+        './config/**/*.js',
+        './tests/dummy/config/**/*.js',
       ],
       parserOptions: {
         sourceType: 'script',

addons/api/.npmignore

@@ -14,14 +14,27 @@
 /.eslintignore
 /.eslintrc.js
 /.git/
+/.github/
 /.gitignore
+/.prettierignore
+/.prettierrc.js
 /.template-lintrc.js
 /.travis.yml
 /.watchmanconfig
 /bower.json
+/config/ember-try.js
 /CONTRIBUTING.md
 /ember-cli-build.js
 /testem.js
 /tests/
+/yarn-error.log
 /yarn.lock
 .gitkeep
+
+# ember-try
+/.node_modules.ember-try/
+/bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
+/package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.prettierignore

@@ -14,3 +14,12 @@
 /coverage/
 !.*
 .eslintcache
+.lint-todo/
+
+# ember-try
+/.node_modules.ember-try/
+/bower.json.ember-try
+/npm-shrinkwrap.json.ember-try
+/package.json.ember-try
+/package-lock.json.ember-try
+/yarn.lock.ember-try

addons/api/.prettierrc

@@ -1,4 +0,0 @@
-{
-  "singleQuote": true,
-  "printWidth": 80
-}

addons/api/.prettierrc.js

@@ -1,5 +1,3 @@
-'use strict';
-
 module.exports = {
   singleQuote: true,
 };

addons/api/addon/abilities/credential-library.js

@@ -2,11 +2,11 @@ import ModelAbility from './model';
 /**
  * Provides abilities for credential.
  */
-export default class CredentialLibaryAbility extends ModelAbility {
+export default class CredentialLibraryAbility extends ModelAbility {
   // =permissions
 
   /**
-   * Only "known" credential libary types may be read.
+   * Only "known" credential library types may be read.
    * @type {boolean}
    */
   get canRead() {

addons/api/addon/abilities/credential.js

@@ -1,4 +1,4 @@
-import ModelAbility from "./model";
+import ModelAbility from './model';
 /**
  * Provides abilities for credential.
  */
@@ -12,4 +12,4 @@ export default class CredentialAbility extends ModelAbility {
   get canRead() {
     return !this.model.isUnknown && this.hasAuthorizedAction('read');
   }
-}
+}

addons/api/addon/abilities/host-set.js

@@ -3,7 +3,7 @@ import ModelAbility from './model';
 /**
  * Provides abilities for host sets.
  */
-export default class UserAbility extends ModelAbility {
+export default class HostSetAbility extends ModelAbility {
   // =permissions
 
   /**
@@ -19,4 +19,11 @@ export default class UserAbility extends ModelAbility {
   get canRemoveHosts() {
     return this.hasAuthorizedAction('remove-hosts');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canRead() {
+    return !this.model.isUnknown && this.hasAuthorizedAction('read');
+  }
 }

addons/api/addon/abilities/managed-group.js

@@ -0,0 +1,8 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for managed groups.
+ */
+export default class ManagedGroupAbility extends ModelAbility {
+  // no op
+}

addons/api/addon/abilities/role.js

@@ -1,9 +1,18 @@
 import ModelAbility from './model';
+import { inject as service } from '@ember/service';
+
+class InvalidRolePrincipalTypeError extends Error {
+  name = 'InvalidRolePrincipalTypeError';
+}
 
 /**
  * Provides abilities for roles.
  */
 export default class RoleAbility extends ModelAbility {
+  // =services
+
+  @service can;
+
   // =permissions
 
   /**
@@ -26,4 +35,22 @@ export default class RoleAbility extends ModelAbility {
   get canRemovePrincipals() {
     return this.hasAuthorizedAction('remove-principals');
   }
+
+  /**
+   * Returns the ability check for a principal model instance.
+   * Valid role principal models are: User, Group, and ManagedGroup.
+   * Throws an error if the principal type is invalid.
+   * @type {boolean}
+   * @throws {InvalidRolePrincipalTypeError}
+   */
+  get canReadPrincipal() {
+    const type = this.model.constructor.modelName;
+    const typeIsValid =
+      type === 'user' || type === 'group' || type === 'managed-group';
+    if (!typeIsValid)
+      throw new InvalidRolePrincipalTypeError(
+        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`
+      );
+    return this.can.can(`read ${type}`, this.model);
+  }
 }

addons/api/addon/adapters/application.js

@@ -263,36 +263,17 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
       source: { pointer: '/data' },
     };
     // Normalize field-specific errors, if any.
-    const errors = fieldErrors.flatMap((error) => {
-      const newValue = [
-        {
-          detail: error.description,
-          // Ember Data cannot handle errors on nested attributes, so these are
-          // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
-          // To capture these errors, add read-only fields on the model
-          // corresponding to the underscored field name.
-          source: {
-            pointer: `/data/attributes/${error.name.replace('.', '_')}`,
-          },
-        },
-      ];
-      if (error.name.includes('attributes.')) {
-        newValue.push({
-          detail: error.description,
-          // Going forward, nested attributes will be hoisted.  Thus "attributes."
-          // must be stripped from the error name key.  Until all models are
-          // transitioned away from model fragments, however, both this and the
-          // prior error key mappings are necessary.
-          source: {
-            pointer: `/data/attributes/${error.name.replace(
-              'attributes.',
-              ''
-            )}`,
-          },
-        });
-      }
-      return newValue;
-    });
+    const errors = fieldErrors.map((error) => ({
+      detail: error.description,
+      // Going forward, nested attributes will be hoisted.  Thus "attributes."
+      // must be stripped from the error name key.  Until all models are
+      // transitioned away from model fragments, however, both this and the
+      // prior error key mappings are necessary.
+      source: {
+        pointer: `/data/attributes/${error.name.replace('attributes.', '')}`,
+      },
+    }));
+
     // Return a list of JSON API errors rooted under the `errors` key.
     return {
       errors: [baseError, ...errors],

addons/api/addon/generated/models/auth-method.js

@@ -49,4 +49,56 @@ export default class GeneratedAuthMethodModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true }) state;
+
+  @attr('string', { isNestedAttribute: true }) issuer;
+
+  @attr('string', { isNestedAttribute: true }) client_id;
+
+  @attr('string', { isNestedAttribute: true }) client_secret;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true })
+  client_secret_hmac;
+
+  @attr('number', { isNestedAttribute: true }) max_age;
+
+  @attr('string', { isNestedAttribute: true }) api_url_prefix;
+
+  @attr('string', { readOnly: true, isNestedAttribute: true }) callback_url;
+
+  @attr('boolean', { isNestedAttribute: true })
+  disable_discovered_config_validation;
+
+  @attr('boolean', { isNestedAttribute: true }) dry_run;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  claims_scopes;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  signing_algorithms;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  allowed_audiences;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  idp_ca_certs;
+
+  @attr('account-claim-map-array', {
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  account_claim_maps;
 }

addons/api/addon/generated/models/credential-library.js

@@ -67,4 +67,50 @@ export default class GeneratedCredentialLibraryModel extends BaseModel {
     description: 'The path in Vault to request credentials from.',
   })
   path;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The username to use when making an SSH connection.',
+  })
+  username;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The desired key type to use when generating a private key.',
+  })
+  key_type;
+
+  @attr('number', {
+    isNestedAttribute: true,
+    description:
+      'Specifies the number of bits used when generating the private key. Not used if key type is ed25519',
+  })
+  key_bits;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'Specifies the requested time to live for the certificate.',
+  })
+  ttl;
+
+  @attr('string', {
+    isNestedAttribute: true,
+    description:
+      'Specifies the key id that the created certificate should have.',
+  })
+  key_id;
+
+  @attr('object-as-array', {
+    isNestedAttribute: true,
+    description:
+      'Specifies a map of the critical options that the certificate should be signed for.',
+  })
+  critical_options;
+
+  @attr('object-as-array', {
+    isNestedAttribute: true,
+    description:
+      'Specifies a map of the extensions that the certificate should be signed for.',
+  })
+  extensions;
 }

addons/api/addon/generated/models/credential-store.js

@@ -82,6 +82,7 @@ export default class GeneratedCredentialStoreModel extends BaseModel {
   @attr('string', {
     for: 'vault',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'A token used for accessing Vault.',
   })
   token;

addons/api/addon/generated/models/credential.js

@@ -58,6 +58,7 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'username_password',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The password for credential.',
   })
   password;
@@ -66,6 +67,7 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'ssh_private_key',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The private key for credential.',
   })
   private_key;
@@ -73,7 +75,16 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'ssh_private_key',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The private key passphrase for credential.',
   })
   private_key_passphrase;
+
+  @attr('string', {
+    for: 'json',
+    isNestedAttribute: true,
+    isSecret: true,
+    description: 'The secret associated with credential.',
+  })
+  json_object;
 }

addons/api/addon/generated/models/host-set.js

@@ -63,10 +63,32 @@ export default class GeneratedHostSetModel extends BaseModel {
   })
   sync_interval_seconds;
 
-  // Azure specific
+  /**
+   * Host IDs are read-only under normal circumstances.  But these can
+   * be persisted via a dedicated call to `addHosts()`.
+   */
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  })
+  host_ids;
+
+  @attr('string-array', {
+    emptyArrayIfMissing: true,
+  })
+  preferred_endpoints;
+
+  // AWS specific
+  @attr('string-array', {
+    isNestedAttribute: true,
+    emptyArrayIfMissing: true,
+  })
+  filters;
+
+  // Azure specific, comes in from API as "filter". This is to avoid collisions with filter
   @attr('string', {
     description: '',
     isNestedAttribute: true,
   })
-  filter;
+  filter_string;
 }

addons/api/addon/generated/models/managed-group.js

@@ -50,7 +50,7 @@ export default class GeneratedManagedGroupModel extends BaseModel {
   @attr('string', {
     isNestedAttribute: true,
     description:
-      'The boolean expression filter to use to determine membership.',
+      'The boolean expression filter to use to determine membership. Comes in from API as "filter".',
   })
-  filter;
+  filter_string;
 }

addons/api/addon/generated/models/target.js

@@ -39,6 +39,18 @@ export default class GeneratedTargetModel extends BaseModel {
   })
   worker_filter;
 
+  @attr('string', {
+    description:
+      'Optional boolean expressions to filter the egress workers that are allowed to satisfy this request.',
+  })
+  egress_worker_filter;
+
+  @attr('string', {
+    description:
+      'Optional boolean expressions to filter the ingress workers that are allowed to satisfy this request.',
+  })
+  ingress_worker_filter;
+
   @attr('date', {
     description: 'The time this resource was created\nOutput only.',
     readOnly: true,
@@ -60,4 +72,10 @@ export default class GeneratedTargetModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', {
+    description:
+      'An IP address or DNS name for the session to connect to. Cannot be used in conjunction with host sources.',
+  })
+  address;
 }

addons/api/addon/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -1,15 +0,0 @@
-// app/initializers/fragment-serializer.js
-import FragmentAuthMethodAttributesAccountClaimMapSerializer from '../serializers/fragment-auth-method-attributes-account-claim-map';
-
-export function initialize(application) {
-  application.register(
-    'serializer:fragment-auth-method-attributes-account-claim-map',
-    FragmentAuthMethodAttributesAccountClaimMapSerializer
-  );
-}
-
-// Fragment serializers must be manually registered
-export default {
-  name: 'fragment-auth-method-attributes-account-claim-map',
-  initialize: initialize,
-};

addons/api/addon/initializers/fragment-string.js

@@ -1,12 +0,0 @@
-// app/initializers/fragment-serializer.js
-import FragmentStringSerializer from '../serializers/fragment-string';
-
-export function initialize(application) {
-  application.register('serializer:fragment-string', FragmentStringSerializer);
-}
-
-// Fragment serializers must be manually registered
-export default {
-  name: 'fragment-string',
-  initialize: initialize,
-};

addons/api/addon/models/auth-method.js

@@ -1,6 +1,4 @@
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
-import { attr } from '@ember-data/model';
-import { fragment } from 'ember-data-model-fragments/attributes';
 import { equal } from '@ember/object/computed';
 
 /**
@@ -28,34 +26,8 @@ export const options = {
 };
 
 export default class AuthMethodModel extends GeneratedAuthMethodModel {
-  // =error attributes
-  // These attributes exist solely to capture errors on nested fields.
-  // See the application adapter's error normalization method for
-  // more information.
-
-  @attr('string', { readOnly: true }) attributes_state;
-  @attr('string', { readOnly: true }) attributes_issuer;
-  @attr('string', { readOnly: true }) attributes_client_id;
-  @attr('string', { readOnly: true }) attributes_client_secret;
-  @attr('string', { readOnly: true }) attributes_max_age;
-  @attr('string', { readOnly: true }) attributes_api_url_prefix;
-  @attr('string', { readOnly: true })
-  attributes_disable_discovered_config_validation;
-  @attr('string', { readOnly: true }) attributes_dry_run;
-  @attr('string', { readOnly: true }) attributes_account_claim_maps;
-  @attr('string', { readOnly: true }) attributes_claims_scopes;
-  @attr('string', { readOnly: true }) attributes_signing_algorithms;
-  @attr('string', { readOnly: true }) attributes_allowed_audiences;
-  @attr('string', { readOnly: true }) attributes_idp_ca_certs;
-
   // =attributes
 
-  /**
-   * Attributes of this resource, if any, represented as a JSON fragment.
-   * @type {FragmentAuthMethodAttributesModel}
-   */
-  @fragment('fragment-auth-method-attributes', { defaultValue: {} }) attributes;
-
   /**
    * @type {boolean}
    */
@@ -81,21 +53,21 @@ export default class AuthMethodModel extends GeneratedAuthMethodModel {
    * @type {boolean}
    */
   get isInactive() {
-    return this.attributes.state === 'inactive';
+    return this.state === 'inactive';
   }
 
   /**
    * @type {boolean}
    */
   get isPrivate() {
-    return this.attributes.state === 'active-private';
+    return this.state === 'active-private';
   }
 
   /**
    * @type {boolean}
    */
   get isPublic() {
-    return this.attributes.state === 'active-public';
+    return this.state === 'active-public';
   }
 
   // =methods

addons/api/addon/models/base.js

@@ -1,6 +1,7 @@
 import Model from '@ember-data/model';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
+import { inject as service } from '@ember/service';
 
 /**
  * Base model class provides common functionality for all models.
@@ -25,6 +26,10 @@ import { computed } from '@ember/object';
  *   2) Or as an ID:  `record.scopeID`.
  */
 export default class BaseModel extends Model {
+  // =services
+
+  @service store;
+
   // =relationships
 
   /**
@@ -49,6 +54,10 @@ export default class BaseModel extends Model {
     const id = this.scopeID;
     return this.store.peekRecord('scope', id);
   }
+
+  // Ember seems to have a bug with its internals and can't correctly set
+  // the `scopeModel` when passed in as part of the `inputProperties`
+  // of a `createRecord` call
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();
@@ -87,7 +96,6 @@ export default class BaseModel extends Model {
   /**
    * @type {boolean}
    */
-  @computed('hasDirtyAttributes', 'isSaving')
   get canSave() {
     return this.hasDirtyAttributes && !this.isSaving;
   }
@@ -95,7 +103,6 @@ export default class BaseModel extends Model {
   /**
    * @type {boolean}
    */
-  @computed('canSave')
   get cannotSave() {
     return !this.canSave;
   }

addons/api/addon/models/credential-library.js

@@ -5,12 +5,20 @@ import GeneratedCredentialLibraryModel from '../generated/models/credential-libr
  */
 export const options = {
   http_method: ['GET', 'POST'],
+  key_type: ['ed25519', 'ecdsa', 'rsa'],
 };
 
+export const TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC = 'vault-generic';
+export const TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE =
+  'vault-ssh-certificate';
+
 /**
  * Supported Credential Library types.
  */
-export const types = ['vault'];
+export const TYPES_CREDENTIAL_LIBRARY = Object.freeze([
+  TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
+  TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+]);
 
 export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {
   // =attributes
@@ -20,7 +28,7 @@ export default class CredentialLibraryModel extends GeneratedCredentialLibraryMo
    * @type {boolean}
    */
   get isUnknown() {
-    return !types.includes(this.type);
+    return !TYPES_CREDENTIAL_LIBRARY.includes(this.type);
   }
 
   /**
@@ -28,6 +36,25 @@ export default class CredentialLibraryModel extends GeneratedCredentialLibraryMo
    * @type {boolean}
    */
   get isVault() {
-    return this.type === 'vault';
+    return (
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC ||
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE
+    );
+  }
+
+  /**
+   * True if credential is a generic vault type.
+   * @type {boolean}
+   */
+  get isVaultGeneric() {
+    return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC;
+  }
+
+  /**
+   * True if credential is a vault ssh cert type.
+   * @type {boolean}
+   */
+  get isVaultSSHCertificate() {
+    return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE;
   }
 }

addons/api/addon/models/credential-store.js

@@ -1,6 +1,8 @@
 import GeneratedCredentialStoreModel from '../generated/models/credential-store';
 import { equal } from '@ember/object/computed';
 
+export const types = ['static', 'vault'];
+
 export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
   // =attributes
 

addons/api/addon/models/credential.js

@@ -3,14 +3,14 @@ import GeneratedCredentialModel from '../generated/models/credential';
 /**
  * Supported Credential types.
  */
-export const types = ['username_password', 'ssh_private_key'];
+export const types = ['username_password', 'ssh_private_key', 'json'];
 
 export default class CredentialModel extends GeneratedCredentialModel {
   // =attributes
   /**
    * All Credentials are prefixed with "cred" and are considered
    * static due to their relation with Static Credential Stores.
-   * 
+   *
    * True if credential starts with the "cred" prefix.
    * @type {boolean}
    */
@@ -18,6 +18,14 @@ export default class CredentialModel extends GeneratedCredentialModel {
     return this.id.startsWith('cred');
   }
 
+  /**
+   * True if type is `json`.
+   * @type {boolean}
+   */
+  get isJSON() {
+    return this.type === 'json';
+  }
+
   /**
    * True if credential is an unknown type.
    * @type {boolean}

addons/api/addon/models/fragment-auth-method-attributes-account-claim-map.js

@@ -1,9 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-export default class FragmentAuthMethodAttributesAccountClaimMapModel extends Fragment {
-  // =attributes (OIDC)
-
-  @attr('string') from;
-  @attr('string') to;
-}

addons/api/addon/models/fragment-auth-method-attributes.js

@@ -1,40 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-import { fragmentArray } from 'ember-data-model-fragments/attributes';
-
-export default class FragmentAuthMethodAttributesModel extends Fragment {
-  // =attributes (OIDC)
-
-  @attr('string', { readOnly: true }) state;
-  @attr('string') issuer;
-  @attr('string') client_id;
-  @attr('string') client_secret;
-  @attr('string', { readOnly: true }) client_secret_hmac;
-  @attr('number') max_age;
-  @attr('string') api_url_prefix;
-  @attr('string', { readOnly: true }) callback_url;
-  @attr('boolean') disable_discovered_config_validation;
-  @attr('boolean') dry_run;
-
-  @fragmentArray('fragment-auth-method-attributes-account-claim-map', {
-    emptyArrayIfMissing: true,
-  })
-  account_claim_maps;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  claims_scopes;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  signing_algorithms;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  allowed_audiences;
-
-  @fragmentArray('fragment-string', { emptyArrayIfMissing: true }) idp_ca_certs;
-}

addons/api/addon/models/fragment-string.js

@@ -1,14 +0,0 @@
-import Fragment from 'ember-data-model-fragments/fragment';
-import { attr } from '@ember-data/model';
-
-/**
- * Represents an item in an array of strings.
- */
-export default class FragmentStringModel extends Fragment {
-  // =attributes
-
-  @attr('string', {
-    description: 'The value of the string.',
-  })
-  value;
-}

addons/api/addon/models/group.js

@@ -2,8 +2,13 @@ import GeneratedGroupModel from '../generated/models/group';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
 import { A } from '@ember/array';
+import { inject as service } from '@ember/service';
 
 export default class GroupModel extends GeneratedGroupModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
   /**

addons/api/addon/models/host-catalog.js

@@ -1,6 +1,7 @@
 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
 
-export const types = ['aws', 'azure'];
+export const types = ['static', 'plugin'];
+export const pluginTypes = ['aws', 'azure'];
 
 export default class HostCatalogModel extends GeneratedHostCatalogModel {
   // =attributes
@@ -26,7 +27,7 @@ export default class HostCatalogModel extends GeneratedHostCatalogModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return this.isPlugin && !types.includes(this.plugin?.name);
+    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
   }
 
   /**

addons/api/addon/models/host-set.js

@@ -1,6 +1,5 @@
 import GeneratedHostSetModel from '../generated/models/host-set';
-import { fragmentArray } from 'ember-data-model-fragments/attributes';
-import { types } from './host-catalog';
+import { pluginTypes } from './host-catalog';
 
 export default class HostSetModel extends GeneratedHostSetModel {
   // =attributes
@@ -26,7 +25,7 @@ export default class HostSetModel extends GeneratedHostSetModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return this.isPlugin && !types.includes(this.plugin?.name);
+    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
   }
 
   /**
@@ -67,28 +66,6 @@ export default class HostSetModel extends GeneratedHostSetModel {
     }
   }
 
-  /**
-   * Host IDs are read-only under normal circumstances.  But these can
-   * be persisted via a dedicated call to `addHosts()`.
-   */
-  @fragmentArray('fragment-string', {
-    readOnly: true,
-    emptyArrayIfMissing: true,
-  })
-  host_ids;
-
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-  })
-  preferred_endpoints;
-
-  // AWS specific
-  @fragmentArray('fragment-string', {
-    emptyArrayIfMissing: true,
-    isNestedAttribute: true,
-  })
-  filters;
-
   // =methods
 
   /**

addons/api/addon/models/managed-group.js

@@ -5,8 +5,6 @@ import { A } from '@ember/array';
 export default class ManagedGroupModel extends GeneratedManagedGroupModel {
   // =attributes
 
-  @attr('string', { readOnly: true }) attributes_filter;
-
   /**
    * Members is read-only under normal circumstances.  But members can
    * be persisted via calls to `addMembers()` or `removeMembers()`.

addons/api/addon/models/role.js

@@ -1,7 +1,14 @@
 import GeneratedRoleModel from '../generated/models/role';
 import { attr } from '@ember-data/model';
+import { inject as service } from '@ember/service';
+import { all, resolve } from 'rsvp';
 
 export default class RoleModel extends GeneratedRoleModel {
+  // =services
+
+  @service store;
+  @service resourceFilterStore;
+
   // =attributes
 
   /**
@@ -32,6 +39,122 @@ export default class RoleModel extends GeneratedRoleModel {
       : null;
   }
 
+  /**
+   * A list of IDs for principals of type `user`.
+   * @type {string[]}
+   */
+  get userIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'user')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A list of IDs for principals of type `group`.
+   * @type {string[]}
+   */
+  get groupIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'group')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A list of IDs for principals of type `managed group`.
+   * @type {string[]}
+   */
+  get managedGroupIDs() {
+    return this.principals
+      .filter(({ type }) => type === 'managed group')
+      .map(({ principal_id }) => principal_id);
+  }
+
+  /**
+   * A promise that resolves to an array of User instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[UserModel]}
+   */
+  get users() {
+    const ids = this.userIDs;
+
+    // Role has prinicipal IDs,
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      return this.resourceFilterStore
+        .queryBy('user', { id: ids }, { scope_id: 'global', recursive: true })
+        .then((models) => models.map((model) => model));
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
+
+  /**
+   * A promise that resolves to an array of Group instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[GroupModel]}
+   */
+  get groups() {
+    const ids = this.groupIDs;
+
+    // Role has prinicipal IDs,
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      return this.resourceFilterStore
+        .queryBy('group', { id: ids }, { scope_id: 'global', recursive: true })
+        .then((models) => models.map((model) => model));
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
+
+  /**
+   * A promise that resolves to an array of ManagedGroup instances.
+   * When calling this getter, be sure to await resolution
+   * before interacting with the results.
+   * @type {Promise[ManagedGroupModel]}
+   */
+  get managedGroups() {
+    const ids = this.managedGroupIDs;
+
+    // Role has prinicipal IDs
+    // return a promise which resolves model instances for those IDs
+    if (ids?.length) {
+      // Collect all auth methods.
+      const authMethods = this.resourceFilterStore.queryBy(
+        'auth-method',
+        { type: 'oidc' },
+        { scope_id: 'global', recursive: true }
+      );
+
+      // For each auth method, query all managed groups with IDs
+      // that match the role's manage group principal IDs.
+      const managedGroups = authMethods
+        .then((methods) =>
+          all(
+            methods.map(({ id: auth_method_id }) =>
+              this.resourceFilterStore
+                .queryBy('managed-group', { id: ids }, { auth_method_id })
+                .then((models) => models.map((model) => model))
+            )
+          )
+        )
+        // The result is an array of arrays of model instances (grouped by
+        // auth methods), so these must be flattened.
+        .then((grouped) => grouped.flat());
+
+      return managedGroups;
+    }
+
+    // No principal IDs,
+    // return a promise resolving to an empty array
+    return resolve([]);
+  }
   // =methods
 
   /**

addons/api/addon/models/session.js

@@ -3,6 +3,9 @@ import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 import { tracked } from '@glimmer/tracking';
 import { A } from '@ember/array';
+import { inject as service } from '@ember/service';
+
+export const statusTypes = ['active', 'pending', 'canceling', 'terminated'];
 
 /**
  *
@@ -80,6 +83,10 @@ class SessionCredential {
 }
 
 export default class SessionModel extends GeneratedSessionModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
   // These transient attributes are used for values that come from the CLI
@@ -94,6 +101,14 @@ export default class SessionModel extends GeneratedSessionModel {
   @equal('status', 'active') isActive;
   @equal('status', 'pending') isPending;
 
+  /**
+   * True if status is an unknown string.
+   * @type {boolean}
+   */
+  get isUnknownStatus() {
+    return !statusTypes.includes(this.status);
+  }
+
   /**
    * @type {boolean}
    */

addons/api/addon/models/target.js

@@ -1,7 +1,16 @@
 import GeneratedTargetModel from '../generated/models/target';
 import { attr } from '@ember-data/model';
+import { inject as service } from '@ember/service';
+
+export const TYPE_TARGET_TCP = 'tcp';
+export const TYPE_TARGET_SSH = 'ssh';
+export const TYPES_TARGET = Object.freeze([TYPE_TARGET_TCP, TYPE_TARGET_SSH]);
 
 export default class TargetModel extends GeneratedTargetModel {
+  // =services
+
+  @service store;
+
   // =attributes
 
   @attr('number', {
@@ -314,7 +323,7 @@ export default class TargetModel extends GeneratedTargetModel {
    * @type {boolean}
    */
   get isTCP() {
-    return this.type === 'tcp';
+    return this.type === TYPE_TARGET_TCP;
   }
 
   /**
@@ -322,6 +331,6 @@ export default class TargetModel extends GeneratedTargetModel {
    * @type {boolean}
    */
   get isSSH() {
-    return this.type === 'ssh';
+    return this.type === TYPE_TARGET_SSH;
   }
 }

addons/api/addon/serializers/application.js

@@ -39,6 +39,10 @@ export default class ApplicationSerializer extends RESTSerializer {
   serializeAttribute(snapshot, json, key, attribute) {
     const { type, options } = attribute;
     let value = super.serializeAttribute(...arguments);
+    // Remove secret attributes that are null or empty
+    if (options.isSecret) {
+      if (type === 'string' && !json[key]) delete json[key];
+    }
     // Convert empty strings to null.
     if (type === 'string' && json[key] === '') json[key] = null;
     // Do not serialize read-only attributes.

addons/api/addon/serializers/credential-library.js

@@ -1,4 +1,5 @@
 import ApplicationSerializer from './application';
+import { TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC } from '../models/credential-library';
 
 export default class CredentialLibrarySerializer extends ApplicationSerializer {
   // =properties
@@ -16,6 +17,10 @@ export default class CredentialLibrarySerializer extends ApplicationSerializer {
   serialize() {
     const serialized = super.serialize(...arguments);
     if (serialized.attributes) {
+      if (serialized.type !== TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC) {
+        delete serialized.attributes.http_method;
+      }
+
       // Serialize `http_request_body` only if `http_method` is POST
       if (!serialized.attributes?.http_method?.match(/post/i))
         delete serialized.attributes.http_request_body;

addons/api/addon/serializers/credential-store.js

@@ -20,8 +20,6 @@ export default class CredentialStoreSerializer extends ApplicationSerializer {
   serializeVault() {
     const serialized = super.serialize(...arguments);
     if (serialized.attributes) {
-      // Token cannot be unset.  If it's falsy, it must be removed.
-      if (!serialized.attributes?.token) delete serialized.attributes.token;
       // Client certificate key cannot be unset when certificate is set.
       // If it's falsy, it must be removed.
       if (

addons/api/addon/serializers/credential.js

@@ -13,44 +13,22 @@ export default class CredentialSerializer extends ApplicationSerializer {
    */
   serializeScopeID = false;
 
-  serialize(snapshot) {
-    switch (snapshot.record.type) {
-      case 'username_password':
-        return this.serializeUsernamePassword(...arguments);
-      case 'ssh_private_key':
-      default:
-        return this.serializeSSHPrivateKey(...arguments);
+  serialize() {
+    const serialized = super.serialize(...arguments);
+
+    if (serialized.type === 'json') {
+      delete serialized.attributes.username;
+
+      if (serialized?.attributes?.json_object) {
+        serialized.attributes.object = JSON.parse(
+          serialized.attributes.json_object
+        );
+        delete serialized.attributes.json_object;
+      }
+    } else {
+      delete serialized.attributes.json_object;
     }
-  }
 
-  serializeUsernamePassword() {
-    const serialized = super.serialize(...arguments);
-    // Remove non-username_password type attributes
-    delete serialized.attributes.private_key;
-    delete serialized.attributes.private_key_passphrase;
-    // Remove password from the payload if null
-    // or empty string. This allows the user to only update
-    // the username without providing the password again.
-    // Users cannot unset the password, they would have
-    // to delete the credential entirely.
-    if (!serialized?.attributes?.password)
-      delete serialized.attributes.password;
-    return serialized;
-  }
-
-  serializeSSHPrivateKey() {
-    const serialized = super.serialize(...arguments);
-    // Remove non-ssh_private_key type attributes
-    delete serialized.attributes.password;
-    // Remove private_key and/or private_key_passphrase from the payload
-    // if null or empty string. This allows the user to only update
-    // the username without providing the private key and passphrase again.
-    // Users cannot unset the private key or passphrase, they would have
-    // to delete the credential entirely.
-    if (!serialized?.attributes?.private_key_passphrase)
-      delete serialized.attributes.private_key_passphrase;
-    if (!serialized?.attributes?.private_key)
-      delete serialized.attributes.private_key;
     return serialized;
   }
 
@@ -61,6 +39,7 @@ export default class CredentialSerializer extends ApplicationSerializer {
     normalized.data.attributes.password = '';
     normalized.data.attributes.private_key = '';
     normalized.data.attributes.private_key_passphrase = '';
+    normalized.data.attributes.json_object = '';
     return normalized;
   }
 }

addons/api/addon/serializers/fragment-auth-method-attributes-account-claim-map.js

@@ -1,30 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentHostSourceSerializer extends JSONSerializer {
-  // =methods
-
-  /**
-   * Serializes an account claim to string.
-   * @param {Snapshot} snapshot
-   * @return {string}
-   */
-  serialize(snapshot) {
-    const from = snapshot.attr('from');
-    const to = snapshot.attr('to');
-    return `${from}=${to}`;
-  }
-
-  /**
-   * Normalizes account claim strings into JSON API objects.
-   * @param {Model} typeClass
-   * @param {string} value
-   * @return {object}
-   */
-  normalize(typeClass, value) {
-    const normalizedHash = {
-      from: value.split('=')[0],
-      to: value.split('=')[1],
-    };
-    return super.normalize(typeClass, normalizedHash);
-  }
-}

addons/api/addon/serializers/fragment-auth-method-attributes.js

@@ -1,26 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer {
-  /**
-   * If an attribute is annotated as readOnly in the model, don't serialize it.
-   * Otherwise delegate to default attribute serializer.
-   *
-   * @override
-   * @method serializeAttribute
-   * @param {Snapshot} snapshot
-   * @param {Object} json
-   * @param {String} key
-   * @param {Object} attribute
-   */
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type, options } = attribute;
-    let value = super.serializeAttribute(...arguments);
-    // Convert empty strings to null.
-    if (type === 'string' && json[key] === '') json[key] = null;
-    // Do not serialize read-only attributes.
-    if (options.readOnly) delete json[key];
-    // Client secret cannot be unset.  If it's falsy, it must be removed.
-    if (key === 'client_secret' && !json[key]) delete json[key];
-    return value;
-  }
-}

addons/api/addon/serializers/fragment-string.js

@@ -1,24 +0,0 @@
-import JSONSerializer from '@ember-data/serializer/json';
-
-export default class FragmentStringSerializer extends JSONSerializer {
-  // =methods
-
-  /**
-   * Serializes a to string.
-   * @param {Snapshot} snapshot
-   * @return {string}
-   */
-  serialize(snapshot) {
-    return snapshot.attr('value');
-  }
-
-  /**
-   * Normalizes from strings.
-   * @param {Model} typeClass
-   * @param {string} value
-   * @return {object}
-   */
-  normalize(typeClass, value) {
-    return super.normalize(typeClass, { value });
-  }
-}

addons/api/addon/serializers/host-set.js

@@ -3,7 +3,7 @@ import { copy } from 'ember-copy';
 
 const fieldByType = {
   aws: ['preferred_endpoints', 'filters', 'sync_interval_seconds'],
-  azure: ['preferred_endpoints', 'filter', 'sync_interval_seconds'],
+  azure: ['preferred_endpoints', 'filter_string', 'sync_interval_seconds'],
 };
 export default class HostSetSerializer extends ApplicationSerializer {
   // =properties
@@ -69,6 +69,15 @@ export default class HostSetSerializer extends ApplicationSerializer {
         delete json.attributes[key];
       }
     }
+
+    if (key === 'filter_string') {
+      const { filter_string } = json.attributes;
+      if (filter_string) {
+        json.attributes.filter = json.attributes.filter_string;
+      }
+      delete json.attributes.filter_string;
+    }
+
     return value;
   }
 
@@ -80,10 +89,18 @@ export default class HostSetSerializer extends ApplicationSerializer {
    */
   normalize(typeClass, hash, ...rest) {
     const normalizedHash = copy(hash, true);
+
     if (typeof normalizedHash?.attributes?.filters === 'string') {
       normalizedHash.attributes.filters = [normalizedHash.attributes.filters];
     }
-    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
-    return normalized;
+
+    // Change name from filter to filter_string
+    if (normalizedHash?.attributes?.filter) {
+      normalizedHash.attributes.filter_string =
+        normalizedHash.attributes.filter;
+      delete normalizedHash.attributes.filter;
+    }
+
+    return super.normalize(typeClass, normalizedHash, ...rest);
   }
 }

addons/api/addon/serializers/managed-group.js

@@ -1,4 +1,5 @@
 import ApplicationSerializer from './application';
+import { copy } from 'ember-copy';
 
 export default class ManagedGroupSerializer extends ApplicationSerializer {
   // =properties
@@ -7,4 +8,27 @@ export default class ManagedGroupSerializer extends ApplicationSerializer {
    * @type {boolean}
    */
   serializeScopeID = false;
+
+  serialize() {
+    const serialized = super.serialize(...arguments);
+
+    if (serialized.attributes.filter_string !== undefined) {
+      serialized.attributes.filter = serialized.attributes.filter_string;
+    }
+    delete serialized.attributes.filter_string;
+
+    return serialized;
+  }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = copy(hash, true);
+
+    if (normalizedHash?.attributes?.filter) {
+      normalizedHash.attributes.filter_string =
+        normalizedHash.attributes.filter;
+      delete normalizedHash.attributes.filter;
+    }
+
+    return super.normalize(typeClass, normalizedHash, ...rest);
+  }
 }

addons/api/addon/transforms/account-claim-map-array.js

@@ -0,0 +1,16 @@
+import Transform from '@ember-data/serializer/transform';
+
+export default class AccountClaimMapArrayTransform extends Transform {
+  deserialize(serialized) {
+    const accountClaims = serialized || [];
+    return accountClaims.map((accountClaimString) => ({
+      from: accountClaimString.split('=')[0],
+      to: accountClaimString.split('=')[1],
+    }));
+  }
+
+  serialize(deserialized) {
+    const accountClaims = deserialized || [];
+    return accountClaims.map(({ from, to }) => `${from}=${to}`);
+  }
+}

addons/api/addon/transforms/object-as-array.js

@@ -0,0 +1,22 @@
+import Transform from '@ember-data/serializer/transform';
+
+export default class ObjectAsArrayTransform extends Transform {
+  deserialize(serialized) {
+    const obj = serialized || {};
+    return Object.entries(obj).map(([key, value]) => ({ key, value }));
+  }
+  serialize(deserialized) {
+    const array = deserialized || [];
+
+    if (!array.length) {
+      return null;
+    }
+
+    return array.reduce((result, currentValue) => {
+      const { key, value } = currentValue;
+      result[key] = value;
+
+      return result;
+    }, {});
+  }
+}

addons/api/app/abilities/credential.js

@@ -1 +1 @@
-export { default } from 'api/abilities/credential';
+export { default } from 'api/abilities/credential';

addons/api/app/abilities/managed-group.js

@@ -0,0 +1 @@
+export { default } from 'api/abilities/managed-group';

addons/api/app/initializers/fragment-auth-method-attributes-account-claim-map-serializer.js

@@ -1,4 +0,0 @@
-export {
-  default,
-  initialize,
-} from 'api/initializers/fragment-auth-method-attributes-account-claim-map-serializer';

addons/api/app/initializers/fragment-string.js

@@ -1 +0,0 @@
-export { default, initialize } from 'api/initializers/fragment-string';

addons/api/app/models/fragment-auth-method-attributes-account-claim-map.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-auth-method-attributes-account-claim-map';

addons/api/app/models/fragment-auth-method-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-auth-method-attributes';

addons/api/app/models/fragment-string.js

@@ -1 +0,0 @@
-export { default } from 'api/models/fragment-string';

addons/api/app/serializers/fragment-auth-method-attributes.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-auth-method-attributes';

addons/api/app/serializers/fragment-string.js

@@ -1 +0,0 @@
-export { default } from 'api/serializers/fragment-string';

addons/api/app/transforms/account-claim-map-array.js

@@ -0,0 +1 @@
+export { default } from 'api/transforms/account-claim-map-array';

addons/api/app/transforms/object-as-array.js

@@ -0,0 +1 @@
+export { default } from 'api/transforms/object-as-array';

addons/api/config/ember-try.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const getChannelURL = require('ember-source-channel-url');
+const { embroiderSafe, embroiderOptimized } = require('@embroider/test-setup');
+
+module.exports = async function () {
+  return {
+    scenarios: [
+      {
+        name: 'ember-lts-3.28',
+        npm: {
+          devDependencies: {
+            'ember-source': '~3.28.0',
+          },
+        },
+      },
+      {
+        name: 'ember-lts-4.4',
+        npm: {
+          devDependencies: {
+            'ember-source': '~4.4.0',
+          },
+        },
+      },
+      {
+        name: 'ember-release',
+        npm: {
+          devDependencies: {
+            'ember-source': await getChannelURL('release'),
+          },
+        },
+      },
+      {
+        name: 'ember-beta',
+        npm: {
+          devDependencies: {
+            'ember-source': await getChannelURL('beta'),
+          },
+        },
+      },
+      {
+        name: 'ember-canary',
+        npm: {
+          devDependencies: {
+            'ember-source': await getChannelURL('canary'),
+          },
+        },
+      },
+      embroiderSafe(),
+      embroiderOptimized(),
+    ],
+  };
+};

addons/api/ember-cli-build.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const EmberAddon = require('ember-cli/lib/broccoli/ember-addon');
+const { maybeEmbroider } = require('@embroider/test-setup');
 
 module.exports = function (defaults) {
   let app = new EmberAddon(defaults, {
@@ -13,6 +14,11 @@ module.exports = function (defaults) {
     This build file does *not* influence how the addon or the app using it
     behave. You most likely want to be modifying `./index.js` or app's build file
   */
-
-  return app.toTree();
+  return maybeEmbroider(app, {
+    skipBabel: [
+      {
+        package: 'qunit',
+      },
+    ],
+  });
 };

addons/api/mirage/config.js

@@ -1,28 +1,40 @@
-import config from '../config/environment';
+import {
+  discoverEmberDataModels,
+  applyEmberDataSerializers,
+} from 'ember-cli-mirage';
+import { createServer, Response } from 'miragejs';
+import environmentConfig from '../config/environment';
 import { authHandler, deauthHandler } from './route-handlers/auth';
 import { targetHandler } from './route-handlers/target';
 import { pickRandomStatusString } from './factories/session';
-import { Response } from 'miragejs';
 import initializeMockIPC from './scenarios/ipc';
 import makeBooleanFilter from './helpers/bexpr-filter';
 
-const isTesting = config.environment === 'test';
+const isTesting = environmentConfig.environment === 'test';
 
-export default function () {
-  initializeMockIPC(this, config);
+// Main function
+// More info about server configuration https://www.ember-cli-mirage.com/docs/advanced/server-configuration
+export default function (mirageConfig) {
+  let finalConfig = {
+    ...mirageConfig,
+    models: { ...discoverEmberDataModels(), ...mirageConfig.models },
+    serializers: applyEmberDataSerializers(mirageConfig.serializers),
+    routes,
+  };
+  return createServer(finalConfig);
+}
+
+// Only routes are defined here
+function routes() {
+  initializeMockIPC(this, environmentConfig);
 
   // make this `http://localhost:8080`, for example, if your API is on a different server
   // this.urlPrefix = '';
   // make this `/api`, for example, if your API is namespaced
-  this.namespace = config.api.namespace;
+  this.namespace = environmentConfig.api.namespace;
   // delay for each request, automatically set to 0 during testing
   this.timing = 1;
 
-  // Allow any configured API host to passthrough, which is useful in
-  // development for testing against a locally running backend.
-  if (config.api.host) this.passthrough(`${config.api.host}/**`);
-  this.passthrough();
-
   // Scope resources
 
   this.get(
@@ -78,9 +90,25 @@ export default function () {
       return resultSet.filter(makeBooleanFilter(filter));
     }
   );
-  this.post('/auth-methods');
+  this.post('/auth-methods', function ({ authMethods }) {
+    const attrs = this.normalizedRequestAttrs();
+    if (attrs.type === 'oidc') {
+      attrs.attributes.state = 'active-public';
+    }
+    return authMethods.create(attrs);
+  });
   this.get('/auth-methods/:id');
-  this.patch('/auth-methods/:id');
+  this.patch(
+    '/auth-methods/:id',
+    function ({ authMethods }, { params: { id } }) {
+      const attrs = this.normalizedRequestAttrs();
+      if (attrs.type === 'oidc') {
+        attrs.attributes.state = 'active-public';
+      }
+
+      return authMethods.find(id).update(attrs);
+    }
+  );
   this.del('/auth-methods/:id', ({ authMethods }, { params: { id } }) => {
     const authMethod = authMethods.find(id);
     const scope = authMethod.scope;
@@ -256,14 +284,17 @@ export default function () {
   this.del('/roles/:id');
   this.post(
     '/roles/:idMethod',
-    function ({ roles, users, groups }, { params: { idMethod } }) {
+    function (
+      { roles, users, groups, managedGroups },
+      { params: { idMethod } }
+    ) {
       const attrs = this.normalizedRequestAttrs();
       const id = idMethod.split(':')[0];
       const method = idMethod.split(':')[1];
       const role = roles.find(id);
       let updatedAttrs = {};
 
-      // Principals is a combined list of users and groups, but in Mirage we've
+      // Principals is a combined list of users, groups and managed groups, but in Mirage we've
       // internally modelled them as separate lists.  Therefore we must check
       // the type by looking up the user or group first, then determine which
       // list to add the principal to.
@@ -272,25 +303,31 @@ export default function () {
           version: attrs.version,
           userIds: role.userIds,
           groupIds: role.groupIds,
+          managedGroupIds: role.managedGroupIds,
         };
         attrs.principalIds.forEach((id) => {
           const isUser = users.find(id);
           const isGroup = groups.find(id);
+          const isManagedGroup = managedGroups.find(id);
           if (isUser && !updatedAttrs.userIds.includes(id)) {
             updatedAttrs.userIds.push(id);
           }
           if (isGroup && !updatedAttrs.groupIds.includes(id)) {
             updatedAttrs.groupIds.push(id);
           }
+          if (isManagedGroup && !updatedAttrs.managedGroupIds.includes(id)) {
+            updatedAttrs.managedGroupIds.push(id);
+          }
         });
       }
-      // If deleting principals, filter them out of both users and groups,
+      // If deleting principals, filter the ids out of users, groups and managed group lists,
       // and in this case don't care about the type
       if (method === 'remove-principals') {
         updatedAttrs = {
           version: attrs.version,
           userIds: role.userIds,
           groupIds: role.groupIds,
+          managedGroupIds: role.managedGroupIds,
         };
         updatedAttrs.userIds = updatedAttrs.userIds.filter((id) => {
           return !attrs.principalIds.includes(id);
@@ -298,6 +335,11 @@ export default function () {
         updatedAttrs.groupIds = updatedAttrs.groupIds.filter((id) => {
           return !attrs.principalIds.includes(id);
         });
+        updatedAttrs.managedGroupIds = updatedAttrs.managedGroupIds.filter(
+          (id) => {
+            return !attrs.principalIds.includes(id);
+          }
+        );
       }
 
       if (method === 'set-grants') {
@@ -569,8 +611,17 @@ export default function () {
   // managed-groups
   this.get(
     '/managed-groups',
-    ({ managedGroups }, { queryParams: { auth_method_id: authMethodId } }) => {
-      return managedGroups.where({ authMethodId });
+    (
+      { managedGroups },
+      { queryParams: { auth_method_id: authMethodId, filter } }
+    ) => {
+      let resultSet;
+      if (authMethodId) {
+        resultSet = managedGroups.where({ authMethodId });
+      } else {
+        resultSet = managedGroups.all();
+      }
+      return resultSet.filter(makeBooleanFilter(filter));
     }
   );
   this.post('/managed-groups');

addons/api/mirage/factories/auth-method.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/auth-method';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 

addons/api/mirage/factories/credential-library.js

@@ -2,12 +2,15 @@ import factory from '../generated/factories/credential-library';
 import { faker } from '@faker-js/faker';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
-
-const types = ['vault'];
+import {
+  TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
+  TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+  TYPES_CREDENTIAL_LIBRARY,
+} from 'api/models/credential-library';
 
 export default factory.extend({
   id: () => generateId('cl_'),
-  type: (i) => types[i % types.length],
+  type: (i) => TYPES_CREDENTIAL_LIBRARY[i % TYPES_CREDENTIAL_LIBRARY.length],
 
   authorized_actions: () =>
     permissions.authorizedActionsFor('credential-library') || [
@@ -19,12 +22,19 @@ export default factory.extend({
 
   attributes() {
     switch (this.type) {
-      case 'vault':
+      case TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC:
         return {
           http_method: 'GET',
           http_request_body: faker.random.word(),
           path: faker.system.directoryPath(),
         };
+      case TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE:
+        return {
+          username: faker.random.word(),
+          key_type: faker.random.word(),
+          key_bits: faker.datatype.number(999),
+          path: faker.system.directoryPath(),
+        };
     }
   },
 });

addons/api/mirage/factories/credential-store.js

@@ -1,6 +1,6 @@
 import factory from '../generated/factories/credential-store';
 import { faker } from '@faker-js/faker';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 

addons/api/mirage/factories/group.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/group';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 

addons/api/mirage/factories/host-catalog.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/host-catalog';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';

addons/api/mirage/factories/role.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/role';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 
@@ -28,9 +28,13 @@ export default factory.extend({
   withPrincipals: trait({
     afterCreate(role, server) {
       const { scope } = role;
+      const { id: scopeId } = scope;
       const users = server.createList('user', 2, { scope });
       const groups = server.createList('group', 2, { scope });
-      role.update({ users, groups });
+      const managedGroups = server.schema.managedGroups.where({
+        scopeId,
+      }).models;
+      role.update({ users, groups, managedGroups });
     },
   }),
 

addons/api/mirage/factories/scope.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/scope';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 

addons/api/mirage/factories/session.js

@@ -1,5 +1,5 @@
 import factory from '../generated/factories/session';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';
 

addons/api/mirage/factories/target.js

@@ -1,12 +1,13 @@
 import factory from '../generated/factories/target';
-import { trait } from 'ember-cli-mirage';
+import { trait } from 'miragejs';
 import { faker } from '@faker-js/faker';
 import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
+import { TYPES_TARGET } from 'api/models/target';
 
 const randomBoolean = (chance = 0.5) => Math.random() < chance;
 const hostSetChance = 0.3;
-const types = ['tcp', 'ssh'];
+const types = [...TYPES_TARGET];
 
 export default factory.extend({
   authorized_actions: () =>
@@ -21,7 +22,6 @@ export default factory.extend({
       'add-credential-sources',
       'remove-credential-sources',
     ],
-
   id: () => generateId('t_'),
 
   /**
@@ -30,19 +30,9 @@ export default factory.extend({
   session_connection_limit: () =>
     faker.helpers.arrayElement([-1, faker.datatype.number()]),
   worker_filter: (i) => (i % 2 === 0 ? faker.random.words() : null),
+  egress_worker_filter: (i) => (i % 2 !== 0 ? faker.random.words() : null),
+  ingress_worker_filter: (i) => (i % 2 !== 0 ? faker.random.words() : null),
   type: (i) => types[i % types.length],
-  /**
-   * Generates attributes fields by type.
-   */
-  afterCreate(target) {
-    if (target.type === 'tcp' || target.type === 'ssh') {
-      target.update({
-        attributes: {
-          default_port: faker.datatype.number(),
-        },
-      });
-    }
-  },
 
   /**
    * Randomly selects existing host sets and credential libraries to assign to target.

addons/api/mirage/generated/factories/account.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/auth-method.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/credential-library.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/credential-store.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/credential.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/group.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/host-catalog.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/host-set.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/host.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/managed-group.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/org.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/project.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/role.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/scope.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/session.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/target.js

@@ -1,18 +1,16 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**
  * GeneratedTargetModelFactory
  */
 export default Factory.extend({
-  type: 'tcp',
   name: () => faker.random.words(),
   session_max_seconds: () => faker.datatype.number(),
-  session_connection_limit: () => faker.datatype.number(),
-  worker_filter: () => faker.random.words(),
   description: () => faker.random.words(),
   created_time: () => faker.date.recent(),
   updated_time: () => faker.date.recent(),
   disabled: () => faker.datatype.boolean(),
+  default_port: () => faker.datatype.number(),
   version: () => faker.datatype.number(),
 });

addons/api/mirage/generated/factories/user.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/generated/factories/worker.js

@@ -1,4 +1,4 @@
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 import { faker } from '@faker-js/faker';
 
 /**

addons/api/mirage/helpers/permissions.js

@@ -11,7 +11,7 @@ import { copy } from 'ember-copy';
  * Within a Mirage factory, pass the actions into the mock:
  *
  * @example
- *   import { Factory } from 'ember-cli-mirage';
+ *   import { Factory } from 'miragejs';
  *   import permissions from '../helpers/permissions';
  *
  *   export default Factory.extend({

addons/api/mirage/models/account.js

@@ -1,4 +1,4 @@
-import { belongsTo } from 'ember-cli-mirage';
+import { belongsTo } from 'miragejs';
 import Model from './base';
 
 export default Model.extend({

addons/api/mirage/models/auth-method.js

@@ -1,4 +1,4 @@
-import { belongsTo } from 'ember-cli-mirage';
+import { belongsTo } from 'miragejs';
 import Model from './base';
 
 export default Model.extend({

addons/api/mirage/models/base.js

@@ -1,4 +1,4 @@
-import { Model } from 'ember-cli-mirage';
+import { Model } from 'miragejs';
 
 export default Model.extend({
   assignDefaults(defaultAttrs, attrs) {

addons/api/mirage/models/credential-library.js

@@ -1,4 +1,4 @@
-import { belongsTo } from 'ember-cli-mirage';
+import { belongsTo } from 'miragejs';
 import Model from './base';
 
 export default Model.extend({