Update changelog and cli version (#2280)

* Update changelog and cli version

.github/labeler.yml

@@ -2,22 +2,29 @@
 # SPDX-License-Identifier: MPL-2.0
 
 addons:
-  - addons/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/**/*"
 
 api-addon:
-  - addons/api/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/api/**/*"
 
 auth-addon:
-  - addons/auth/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/auth/**/*"
 
 styles-addon:
-  - addons/rose/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/rose/**/*"
 
 ui:
-  - ui/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/**/*"
 
 admin:
-  - ui/admin/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/admin/**/*"
 
 desktop:
-  - ui/desktop/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/desktop/**/*"

.github/workflows/build-admin-ui.yaml

@@ -3,21 +3,23 @@ on:
   push:
     branches:
       - main
+      - "release/**"
+  workflow_dispatch:
 
 jobs:
   dependencies:
     name: Install dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
-          path: '**/node_modules'
+          path: "**/node_modules"
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn install
@@ -26,26 +28,26 @@ jobs:
     needs: [dependencies]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
-          path: '**/node_modules'
+          path: "**/node_modules"
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn run build:ui:admin:oss
       - name: Upload artifact admin-ui
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: admin-ui
           path: ./ui/admin/dist/
       - name: Upload artifact OSS admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: admin-ui-oss
           path: ./ui/admin/dist/
@@ -54,21 +56,21 @@ jobs:
     needs: [dependencies]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
-          path: '**/node_modules'
+          path: "**/node_modules"
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn run build:ui:admin:enterprise
       - name: Upload artifact enterprise admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: admin-ui-ent
           path: ./ui/admin/dist/
@@ -77,21 +79,21 @@ jobs:
     needs: [dependencies]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
-          path: '**/node_modules'
+          path: "**/node_modules"
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn run build:ui:admin:hcp
       - name: Upload artifact HCP admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: admin-ui-hcp
           path: ./ui/admin/dist/

.github/workflows/build-artifacts-for-testing-trigger.yml

@@ -0,0 +1,34 @@
+name: "Trigger Build Artifacts for Testing"
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
+        required: true
+      product_version:
+        required: true
+        type: string
+        description: The version number belonging to the oss binary to be used
+      commit:
+        required: true
+        type: string
+        description: The git SHA of the oss artifacts to be used
+
+jobs:
+  trigger-gha-build-artifacts-for-testing:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Release description
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Triggering Build Artifacts for Testing using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
+      - name: Trigger Build Artifacts for Testing in boundary-ui-releases
+        run: |
+          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
+          gh workflow run build-artifacts-for-testing.yml \
+          --repo hashicorp/boundary-ui-releases \
+          --ref main \
+          -f TAG="${{ inputs.branch }}" \
+          -f PRODUCT_VERSION="${{ inputs.product_version }}" \
+          -f COMMIT="${{ inputs.commit }}" \

.github/workflows/codeql-analysis.yml

@@ -30,11 +30,11 @@ jobs:
     
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # codeql-bundle-v2.14.6
+      uses: github/codeql-action/init@423a04bb2cb7cd2643007122588f1387778f14d0 # codeql-bundle-v2.16.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,4 +54,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # codeql-bundle-v2.14.6
+      uses: github/codeql-action/analyze@423a04bb2cb7cd2643007122588f1387778f14d0 # codeql-bundle-v2.16.5

.github/workflows/labeler.yml

@@ -6,6 +6,6 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/monorepo-validate.yaml

@@ -6,15 +6,15 @@ jobs:
     name: Install dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
           path: '**/node_modules'
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn install
@@ -24,15 +24,15 @@ jobs:
     needs: [dependencies]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
           path: '**/node_modules'
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn run compliance:licenses
@@ -43,15 +43,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
           path: '**/node_modules'
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn lint
@@ -62,13 +62,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         id: node-modules-cache
         with:
           path: '**/node_modules'
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 16
       - run: yarn test

.github/workflows/oss-merge.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       - run: |

.github/workflows/ui-release-trigger.yml

@@ -9,7 +9,7 @@ jobs:
   trigger-gha-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Release description
         run: |
           echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"

.husky/prepare-commit-msg

@@ -6,11 +6,22 @@ COMMIT_SOURCE=$2
 SHA1=$3
 # Gets the current branch name but if we're in a detached head state, return "HEAD"
 BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
+# Regex to match the ICU-#### branch name pattern we use
+ISSUE_REGEX="^(ICU-[0-9]+)"
 
 # Don't run commitizen for merge or squash commits, as well as when rebasing
 if [ "${COMMIT_SOURCE}" = merge ] || [ "${COMMIT_SOURCE}" = squash ] || [ "${COMMIT_SOURCE}" = "message" -a "${BRANCH_NAME}" = "HEAD" ];then
     exit 0
 fi
 
-# This is to allow interaction with the terminal for commitizen
-exec < /dev/tty && npx git-cz --hook || true
+# If the branch name matches, set the JIRA link automatically
+if [[ $BRANCH_NAME =~ $ISSUE_REGEX ]]
+then
+  issue="${BASH_REMATCH[1]}"
+  url="https://hashicorp.atlassian.net/browse/${issue}"
+  exec < /dev/tty && npx git-cz --issues="$url" --hook || true
+else
+  # This is to allow interaction with the terminal for commitizen
+  exec < /dev/tty && npx git-cz --hook || true
+fi
+

addons/api/.eslintrc.js

@@ -38,7 +38,6 @@ module.exports = {
       files: [
         './.eslintrc.js',
         './.prettierrc.js',
-        './.stylelintrc.js',
         './.template-lintrc.js',
         './ember-cli-build.js',
         './index.js',
@@ -60,6 +59,9 @@ module.exports = {
       // Test files:
       files: ['tests/**/*-test.{js,ts}'],
       extends: ['plugin:qunit/recommended'],
+      rules: {
+        'qunit/require-expect': [2, 'except-simple'],
+      },
     },
   ],
 };

addons/api/addon-test-support/handlers/client-daemon-search.js

@@ -0,0 +1,110 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import sinon from 'sinon';
+import { typeOf } from '@ember/utils';
+import { resourceNames } from 'api/handlers/client-daemon-handler';
+import { singularize } from 'ember-inflector';
+
+/**
+ * This test helper can be used to help setup your sinon stubs in your tests.
+ * Must be called after setupMirage.
+ *
+ * ```js
+ * import setupStubs from 'api/test-support/handlers/client-daemon-search';
+ *
+ * module('Acceptance | my test', function(hooks) {
+ *  setupApplicationTest(hooks);
+ *  setupMirage(hooks);
+ *  setupStubs(hooks);
+ *
+ *   // add your actual tests here
+ * });
+ * ```
+ *
+ * This will setup a stub for the IPC service and include helper methods to
+ * help setup what the client daemon search command returns.
+ *
+ * @module Test Helpers
+ * @public
+ */
+export default function setupStubs(hooks) {
+  let stubTypes = [];
+
+  hooks.beforeEach(function () {
+    const ipcService = this.owner.lookup('service:ipc');
+    this.ipcStub = sinon.stub(ipcService, 'invoke');
+
+    /**
+     * We aim to still use mirage data when stubbing out the client daemon
+     * search. However, the handler expects the search data to be raw JSON from
+     * the API which will get serialized. We add back the scope object for it to
+     * get correctly normalized and other fields such as "attributes" from the
+     * API will already be hoisted and will not be re-normalized from mirage data.
+     *
+     * This convenience method can take in multiple types,
+     * e.g. this.stubClientDaemonSearch('targets', 'sessions').
+     * This will have sinon stub out each call so the first call to search will
+     * provide all the models from the first parameter you specify,
+     * the second call will provide all the models from the second argument, etc.
+     * @param types
+     */
+    this.stubClientDaemonSearch = (...types) => {
+      stubTypes = types;
+
+      types.forEach((type, i) => {
+        let models;
+        let resourceName;
+        if (typeOf(type) === 'object') {
+          models = type.func();
+          resourceName = type.resource;
+        } else {
+          models = this.server.schema[type].all().models;
+          resourceName = type;
+        }
+
+        this.ipcStub
+          .withArgs('searchClientDaemon')
+          .onCall(i)
+          .returns({
+            [resourceName]: models.map((model) => {
+              // Use internal serializer to serialize the model correctly
+              // according to our mirage serializers
+              const modelData =
+                this.server.serializerOrRegistry.serialize(model);
+
+              // Serialize the data properly to standard JSON as that is what
+              // we're expecting from the client daemon response
+              return JSON.parse(JSON.stringify(modelData));
+            }),
+          });
+      });
+    };
+  });
+
+  hooks.afterEach(function () {
+    // Verify the number of mocks we set up match with how
+    // many times the client daemon was called with
+    sinon.assert.callCount(
+      this.ipcStub.withArgs('searchClientDaemon'),
+      stubTypes.length,
+    );
+
+    stubTypes.forEach((type, i) => {
+      // Assert that the stub was called with the resource we're trying to mock
+      // so we don't mistakenly mock the wrong resource
+      const ipcCall = this.ipcStub.withArgs('searchClientDaemon').getCall(i);
+      let resource = type;
+      if (typeOf(type) === 'object') {
+        resource = type.resource;
+      }
+
+      const mappedResourceName = resourceNames[singularize(resource)];
+      sinon.assert.match(ipcCall.args[1], { resource: mappedResourceName });
+    });
+
+    sinon.restore();
+  });
+}

addons/api/addon-test-support/helpers/indexed-db.js

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * This test helper can help set up and cleanup the database in your tests.
+ *
+ * ```js
+ * import { setupIndexedDb } from 'api/test-support/helpers/indexed-db';
+ *
+ * module('Acceptance | my test', function(hooks) {
+ *  setupApplicationTest(hooks);
+ *  setupIndexedDb(hooks);
+ *
+ *   // add your actual tests here
+ * });
+ * ```
+ *
+ * @param hooks
+ */
+export function setupIndexedDb(hooks) {
+  hooks.beforeEach(function () {
+    const indexedDb = this.owner.lookup('service:indexed-db');
+    indexedDb.setup(`test-indexed-db-${Date.now()}`);
+  });
+
+  hooks.afterEach(async function () {
+    const indexedDb = this.owner.lookup('service:indexed-db');
+
+    await indexedDb.db.delete();
+  });
+}
+
+export default setupIndexedDb;

addons/api/addon/abilities/channel-recording.js

@@ -18,7 +18,7 @@ export default class ChannelRecordingAbility extends ModelAbility {
     const sessionRecording = this.model.connection_recording.session_recording;
     const sessionRecordingAbility = this.abilities.abilityFor(
       'session-recording',
-      sessionRecording
+      sessionRecording,
     );
 
     return this.model.isAsciicast && sessionRecordingAbility.canDownload;

addons/api/addon/abilities/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+import { service } from '@ember/service';
+
+/**
+ * Provides abilities for storage policies.
+ */
+export default class PolicyAbility extends ModelAbility {
+  // =services
+  @service features;
+  // =permissions
+
+  /**
+   * This ensures that storage policies may be read only if the
+   * session-recording feature flag is enabled.
+   */
+  get canRead() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canRead
+      : false;
+  }
+
+  /**
+   * This ensures that storage policies may be updated only if the
+   * session-recording feature flag is enabled.
+   */
+  get canUpdate() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canUpdate
+      : false;
+  }
+
+  /**
+   * This ensures that storage policies may be deleted only if the
+   * session-recording feature flag is enabled.
+   */
+  get canDelete() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canDelete
+      : false;
+  }
+}

addons/api/addon/abilities/role.js

@@ -54,7 +54,7 @@ export default class RoleAbility extends ModelAbility {
       type === 'user' || type === 'group' || type === 'managed-group';
     if (!typeIsValid)
       throw new InvalidRolePrincipalTypeError(
-        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`
+        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`,
       );
     return this.can.can(`read ${type}`, this.model);
   }

addons/api/addon/abilities/scope.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for scopes.
+ */
+export default class ScopeAbility extends ModelAbility {
+  // =permissions
+  /**
+   * Permission that checks whether a policy can be attached to a scope
+   * @type {boolean}
+   */
+  get canAttachStoragePolicy() {
+    return this.hasAuthorizedAction('attach-storage-policy');
+  }
+
+  /**
+   * Permission that checks whether a policy can be detached to a scope
+   * @type {boolean}
+   */
+  get canDetachStoragePolicy() {
+    return this.hasAuthorizedAction('detach-storage-policy');
+  }
+}

addons/api/addon/abilities/session-recording.js

@@ -21,7 +21,22 @@ export default class SessionRecordingAbility extends ModelAbility {
     return !this.model.isUnknown && super.canRead;
   }
 
+  /**
+   * Only "known" session recording types may be deleted.
+   * @type {boolean}
+   */
+  get canDelete() {
+    return !this.model.isUnknown && super.canDelete && this.model.isAvailable;
+  }
+
   get canDownload() {
     return this.hasAuthorizedAction('download');
   }
+
+  /* Permission that checks whether a policy can be reapplied to a session recording
+   * @type {boolean}
+   */
+  get canReapplyStoragePolicy() {
+    return this.hasAuthorizedAction('reapply-storage-policy');
+  }
 }

addons/api/addon/abilities/session.js

@@ -14,10 +14,25 @@ export default class SessionAbility extends ModelAbility {
   // =permissions
 
   /**
-   * Only "active" or "pending" sessions may be read.
+   * Only available sessions may be read.
    * @type {boolean}
    */
   get canRead() {
-    return (this.model.isActive || this.model.isPending) && super.canRead;
+    return (
+      this.model.isAvailable &&
+      (this.hasAuthorizedAction('read:self') || super.canRead)
+    );
+  }
+
+  /**
+   * Only available sessions may be canceled.
+   * @type {boolean}
+   */
+  get canCancel() {
+    return (
+      this.model.isAvailable &&
+      (this.hasAuthorizedAction('cancel:self') ||
+        this.hasAuthorizedAction('cancel'))
+    );
   }
 }

addons/api/addon/adapters/application.js

@@ -45,7 +45,7 @@ function prenormalizeArrayResponse(response) {
 }
 
 export default class ApplicationAdapter extends RESTAdapter.extend(
-  AdapterBuildURLMixin
+  AdapterBuildURLMixin,
 ) {
   // =attributes
 
@@ -108,22 +108,38 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
 
   /**
    * Intercepts "empty" responses and adds an empty `items` array.
-   * @override
-   * @method findAll
-   * @return {Promise} promise
-   */
-  findAll() {
-    return super.findAll(...arguments).then(prenormalizeArrayResponse);
-  }
-
-  /**
-   * Intercepts "empty" responses and adds an empty `items` array.
+   * This query method now supports pagination by checking the responseType and
+   * passing in the list token if the responseType indicates more data
    * @override
    * @method query
    * @return {Promise} promise
    */
-  query() {
-    return super.query(...arguments).then(prenormalizeArrayResponse);
+  async query(store, schema, query) {
+    const queryObject = structuredClone(query);
+    let result;
+    let data = [];
+
+    // If the query has a page_size, we skip the pagination logic
+    // and return the initial result. This is being used to determine
+    // if the controller supports pagination
+    if (query.page_size) {
+      result = await super.query(store, schema, query);
+      return prenormalizeArrayResponse(result);
+    }
+    // Run this loop as long as the response_type is delta,
+    // which indicates that there are more items in the list
+    do {
+      result = await super.query(store, schema, queryObject);
+      //add the result items to a data array
+      if (result && result.items) {
+        data.push(...result.items);
+        //pass in the list token for subsequent calls to fetch the remaining list items
+        queryObject.list_token = result.list_token;
+      }
+    } while (result && result.response_type === 'delta');
+
+    result.items = data;
+    return prenormalizeArrayResponse(result);
   }
 
   /**
@@ -196,7 +212,10 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
   handleResponse(status, headers, payload, requestData) {
     if (this.isInvalid(status, headers, payload)) {
       const detailedMessage = this.generatedDetailedMessage(...arguments);
-      const transformedPayload = this.transformValidationErrors(payload);
+      const transformedPayload = this.transformValidationErrors(
+        payload,
+        status,
+      );
       return new InvalidError(transformedPayload.errors, detailedMessage);
     }
     return super.handleResponse(status, headers, payload, requestData);
@@ -254,17 +273,18 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * error format.
    *
    * @param {object} payload
+   * @param status
    * @return {object}
    */
-  transformValidationErrors(payload) {
+  transformValidationErrors(payload, status) {
     const fieldErrors = get(payload, 'details.request_fields') || [];
     // Normalize the primary error message into "base", which is an error
     // that applies to the whole model instance
     const baseError = {
       isInvalid: true,
-      status: payload.source,
-      code: payload.code,
-      detail: payload.message,
+      status,
+      code: payload?.kind,
+      detail: payload?.message,
       source: { pointer: '/data' },
     };
     // Normalize field-specific errors, if any.
@@ -299,6 +319,6 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @return {String} detailed error message
    */
   generatedDetailedMessage(status, headers, payload /*, requestData*/) {
-    return payload.message;
+    return payload?.message;
   }
 }

addons/api/addon/adapters/session-recording.js

@@ -55,7 +55,7 @@ export default class SessionRecordingAdapter extends ApplicationAdapter {
       throw this.handleResponse(
         response.status,
         response.headers,
-        await response.text()
+        await response.text(),
       );
     }
   }

addons/api/addon/generated/models/alias.js

@@ -0,0 +1,64 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * Alias contains all fields related to an Alias resource
+ */
+export default class GeneratedAliasModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description:
+      'This is the value referenced by the user that is resolved to the destination id.',
+  })
+  value;
+
+  @attr('string', {
+    description: 'This is the id of the resource that this Alias points to.',
+  })
+  destination_id;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'This contains a host_id which is the id of the host that the session will be authorized for.',
+  })
+  authorize_session_arguments;
+}

addons/api/addon/generated/models/auth-method.js

@@ -158,6 +158,13 @@ export default class GeneratedAuthMethodModel extends BaseModel {
   })
   account_claim_maps;
 
+  @attr('string-array', {
+    for: 'oidc',
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  prompts;
+
   // =attributes(ldap)
 
   @attr('boolean', {

addons/api/addon/generated/models/channel-recording.js

@@ -31,7 +31,7 @@ export default class GeneratedChannelRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of this Channel.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Channel started.',

addons/api/addon/generated/models/connection-recording.js

@@ -38,7 +38,7 @@ export default class GeneratedConnectionRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of this Connection.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Connection started.',

addons/api/addon/generated/models/credential-library.js

@@ -75,6 +75,18 @@ export default class GeneratedCredentialLibraryModel extends BaseModel {
   })
   path;
 
+  @attr('string', {
+    for: 'vault-generic',
+    description: 'It indicates the type of credential the library returns.',
+  })
+  credential_type;
+
+  @attr('object', {
+    for: 'vault-generic',
+    description: 'It indicates the credential mapping overrides.',
+  })
+  credential_mapping_overrides;
+
   @attr('string', {
     for: 'vault-ssh-certificate',
     isNestedAttribute: true,

addons/api/addon/generated/models/host.js

@@ -54,4 +54,10 @@ export default class GeneratedHostModel extends BaseModel {
     readOnly: true,
   })
   plugin;
+
+  @attr({
+    emptyArrayIfMissing: true,
+    readOnly: true,
+  })
+  host_set_ids;
 }

addons/api/addon/generated/models/policy.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * Storage Policy is a resource that manages the lifecycle of Session Recordings,
+ * particularly to meet compliance frameworks.
+ */
+export default class GeneratedPolicyModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'Days is the number of days for which a session recording will be retained.',
+  })
+  retain_for;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'Days is the number of days for which a session recording will be automatically deleted.',
+  })
+  delete_after;
+}

addons/api/addon/generated/models/scope.js

@@ -49,4 +49,9 @@ export default class GeneratedScopeModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', {
+    description: 'The ID of the associated storage policy',
+  })
+  storage_policy_id;
 }

addons/api/addon/generated/models/session-recording.js

@@ -70,7 +70,7 @@ export default class GeneratedSessionRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of the Session.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Session started.',
@@ -109,4 +109,17 @@ export default class GeneratedSessionRecordingModel extends BaseModel {
     readOnly: true,
   })
   error_details;
+
+  @attr('date', {
+    description: 'The time until a session recording is required to be stored.',
+    readOnly: true,
+  })
+  retain_until;
+
+  @attr('date', {
+    description:
+      'The time a session recording is scheduled to be automatically deleted.',
+    readOnly: true,
+  })
+  delete_after;
 }

addons/api/addon/generated/models/session.js

@@ -32,6 +32,13 @@ export default class GeneratedSessionModel extends BaseModel {
   })
   updated_time;
 
+  @attr('date', {
+    description:
+      'After this time the connection will be expired, e.g. forcefully terminated.\nOutput only.',
+    readOnly: true,
+  })
+  expiration_time;
+
   @attr('number', {
     description: 'Current version number of this resource.',
   })

addons/api/addon/generated/models/storage-bucket.js

@@ -73,6 +73,12 @@ export default class GeneratedStorageBucketModel extends BaseModel {
   })
   region;
 
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The MinIO location server.',
+  })
+  endpoint_url;
+
   //this field is not used in the UI, but this is kept here to replicate the API
   @attr('string', {
     readOnly: true,

addons/api/addon/generated/models/target.js

@@ -108,4 +108,17 @@ export default class GeneratedTargetModel extends BaseModel {
     isNestedAttribute: true,
   })
   enable_session_recording;
+
+  @attr('array', {
+    description:
+      'with_aliases specify the aliases that should be created when the target is created. ',
+  })
+  with_aliases;
+
+  @attr('array', {
+    readOnly: true,
+    description:
+      'with_aliases specify the aliases that should be created when the target is created. ',
+  })
+  aliases;
 }

addons/api/addon/handlers/client-daemon-handler.js

@@ -0,0 +1,167 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { inject as service } from '@ember/service';
+import { getOwner, setOwner } from '@ember/application';
+import { generateMQLExpression } from '../utils/mql-query';
+import { paginateResults } from '../utils/paginate-results';
+
+/**
+ * Not all types are yet supported by the client daemon so we'll
+ * just whitelist the ones we need to start with. Keys are the resource
+ * types and the values are the fields that are searchable by the client.
+ * @type {{session: string[], alias: string[], target: string[]}}
+ */
+const supportedTypes = {
+  target: ['id', 'name', 'description', 'address', 'scope_id'],
+  session: ['id', 'type', 'status', 'endpoint', 'scope_id', 'target_id'],
+  alias: ['id', 'type', 'value', 'destination_id'],
+};
+
+/**
+ * Map the model resource name to the client daemon resource name
+ * @type {{session: string, alias: string, target: string}}
+ */
+export const resourceNames = {
+  target: 'targets',
+  session: 'sessions',
+  alias: 'resolvable-aliases',
+};
+
+const fetchControllerData = async (context, next) => {
+  const { data } = context.request;
+  const { query: originalQuery } = data;
+  // remove client daemon specific query params
+  // eslint-disable-next-line no-unused-vars
+  const { query, page, pageSize, ...remainingQuery } = originalQuery;
+
+  // If we get an error or client daemon is unavailable, fall back to calling the API
+  context.request.data.query = remainingQuery;
+  const results = await next(context.request);
+  const models = results.content.toArray();
+
+  const paginatedResult = paginateResults(models, page, pageSize);
+  paginatedResult.meta = { totalItems: models.length };
+  return paginatedResult;
+};
+
+/**
+ * Handler to sit in front of the API request layer
+ * so we can request from the daemon first
+ */
+export default class ClientDaemonHandler {
+  @service session;
+  @service ipc;
+
+  constructor(context) {
+    setOwner(this, getOwner(context));
+  }
+
+  async request(context, next) {
+    switch (context.request.op) {
+      case 'query': {
+        const { store, data } = context.request;
+        const { type, query, options: { pushToStore = true } = {} } = data;
+        const isClientDaemonRunning = await this.ipc.invoke(
+          'isClientDaemonRunning',
+        );
+
+        // eslint-disable-next-line no-unused-vars
+        let { recursive, scope_id, page, pageSize, ...remainingQuery } = query;
+        let searchQuery = '';
+
+        if (
+          !Object.keys(supportedTypes).includes(type) ||
+          !isClientDaemonRunning
+        ) {
+          return fetchControllerData(context, next);
+        }
+
+        if (remainingQuery.query) {
+          const { search, filters } = remainingQuery.query;
+
+          searchQuery = generateMQLExpression({
+            search: {
+              text: search,
+              fields: supportedTypes[type],
+            },
+            filters,
+          });
+        }
+        const sessionData = this.session.data?.authenticated;
+        const auth_token_id = sessionData?.id;
+        const token = sessionData?.token;
+        remainingQuery = {
+          ...remainingQuery,
+          query: searchQuery,
+          auth_token_id,
+          token,
+          resource: resourceNames[type],
+        };
+
+        let clientDaemonResults = {};
+        try {
+          clientDaemonResults = await this.ipc.invoke(
+            'searchClientDaemon',
+            remainingQuery,
+          );
+        } catch (e) {
+          // If we got a 403, most likely the client daemon was restarted and our token is no longer valid
+          // I'm not sure if we can get a 401 since we always send a token but we'll handle it in the same way
+          if (e.statusCode === 403 || e.statusCode === 401) {
+            try {
+              await this.ipc.invoke('addTokenToClientDaemon', {
+                tokenId: auth_token_id,
+                token,
+              });
+              clientDaemonResults = await this.ipc.invoke(
+                'searchClientDaemon',
+                remainingQuery,
+              );
+            } catch {
+              // If it fails again just fall back to fetching controller data
+            }
+          }
+
+          return fetchControllerData(context, next);
+        }
+
+        // Currently returns with a singular top level field with resource name
+        // e.g. { targets: [...] } or { sessions: [..] }
+        // So this just unwraps to the array, or undefined
+        const [results] = Object.values(clientDaemonResults);
+        const payload = { items: paginateResults(results, page, pageSize) };
+
+        const schema = store.modelFor(type);
+        const serializer = store.serializerFor(type);
+        const normalizedPayload = serializer.normalizeResponse(
+          store,
+          schema,
+          payload,
+          null,
+          'query',
+        );
+
+        // Return the raw data if we don't push to the store.
+        let records = normalizedPayload.data.map((record) => ({
+          ...record.attributes,
+          id: record.id,
+        }));
+        if (pushToStore) {
+          records = store.push(normalizedPayload);
+        }
+
+        // Set a meta property on the array to store the total items of the results.
+        // This isn't conventional but is better than returning an ArrayProxy
+        // or EmberArray since the ember store query method asserts it has to be an array
+        // so we can't just return an object.
+        records.meta = { totalItems: results?.length ?? 0 };
+        return records;
+      }
+      default:
+        return next(context.request);
+    }
+  }
+}

addons/api/addon/handlers/indexed-db-handler.js

@@ -0,0 +1,172 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { modelIndexes } from 'api/services/indexed-db';
+import { inject as service } from '@ember/service';
+import { getOwner, setOwner } from '@ember/application';
+import { queryIndexedDb } from '../utils/indexed-db-query';
+import { paginateResults } from '../utils/paginate-results';
+import { hashCode } from '../utils/hash-code';
+
+/**
+ * Handler to sit in front of the API request layer
+ * so we can handle any caching with indexedDb first
+ */
+export default class IndexedDbHandler {
+  @service indexedDb;
+
+  constructor(context) {
+    setOwner(this, getOwner(context));
+  }
+
+  async request(context, next) {
+    switch (context.request.op) {
+      case 'query': {
+        const { store, data } = context.request;
+        // TODO: Remove storeToken option as this is a temporary fix for auth-methods.
+        const {
+          type,
+          query,
+          options: {
+            pushToStore = true,
+            peekIndexedDB = false,
+            storeToken = true,
+          } = {},
+        } = data;
+        const supportedModels = Object.keys(modelIndexes);
+        const { db: indexedDb } = this.indexedDb ?? {};
+
+        // Go through normal flow if we don't yet support the model
+        // or if we don't have an indexedDb instance
+        if (!supportedModels.includes(type) || !indexedDb) {
+          return next(context.request);
+        }
+
+        let { page, pageSize, query: queryObj, ...remainingQuery } = query;
+
+        const adapter = store.adapterFor(type);
+        const schema = store.modelFor(type);
+        const serializer = store.serializerFor(type);
+
+        if (!peekIndexedDB) {
+          const tokenKey = `${type}-${hashCode(remainingQuery)}`;
+
+          let listToken;
+          if (storeToken) {
+            listToken = await indexedDb.token.get(tokenKey);
+          }
+
+          let payload;
+          try {
+            payload = await adapter.query(store, schema, {
+              ...remainingQuery,
+              list_token: listToken?.token,
+            });
+          } catch (e) {
+            // If we get an invalid list token, we'll delete the token and
+            // clear the DB and try again without a token.
+            if (
+              e?.errors[0].status === 400 &&
+              e?.errors[0].code === 'invalid list token'
+            ) {
+              await indexedDb[type].clear();
+              // Delete all tokens of the same resource type so we don't keep clearing the DB.
+              // Even if other tokens may still be valid, we might have cleared data that they
+              // depended on so we should clear all tokens of the same type when clearing the DB.
+              const tokenKeys = await indexedDb.token
+                .where(':id')
+                .startsWith(type)
+                .primaryKeys();
+
+              await indexedDb.token.bulkDelete(tokenKeys);
+
+              payload = await adapter.query(store, schema, {
+                ...remainingQuery,
+              });
+            } else {
+              throw e;
+            }
+          }
+
+          // Store the token we just got back from the payload if it exists
+          if (payload.list_token && storeToken) {
+            await indexedDb.token.put({
+              id: tokenKey,
+              token: payload.list_token,
+            });
+          }
+
+          // Remove any records from the DB if the API indicates they've been deleted
+          if (payload.removed_ids?.length > 0) {
+            await indexedDb[type].bulkDelete(payload.removed_ids);
+          }
+          // This is a temporary fix of clearing the DB (specifically for auth-methods)
+          // since we are not storing the token we do not get back a list of removed_ids
+          // from the API call and we do not want deleted items from showing in list view.
+          if (!storeToken) {
+            await indexedDb[type].clear();
+          }
+
+          const normalizedPayload = serializer.normalizeResponse(
+            store,
+            schema,
+            payload,
+            null,
+            'query',
+          );
+
+          const { data: payloadData } = normalizedPayload;
+
+          // Store the new data we just got back from the API refresh
+          const items = payloadData.map((datum) =>
+            this.indexedDb.normalizeData({
+              data: datum,
+              cleanData: true,
+              schema,
+              serializer,
+            }),
+          );
+
+          await indexedDb[type].bulkPut(items);
+        }
+
+        const indexedDbResults = await queryIndexedDb(
+          indexedDb,
+          type,
+          queryObj,
+        );
+
+        const dbRecords = paginateResults(indexedDbResults, page, pageSize).map(
+          (item) =>
+            this.indexedDb.normalizeData({
+              data: item,
+              cleanData: false,
+              schema,
+              serializer,
+            }),
+        );
+
+        // Return the raw data if we don't push to the store.
+        let records = dbRecords.map((record) => ({
+          ...record.attributes,
+          id: record.id,
+        }));
+
+        if (pushToStore) {
+          records = store.push({ data: dbRecords });
+        }
+
+        // Set a meta property on the array to store the total items of the results.
+        // This isn't conventional but is better than returning an ArrayProxy
+        // or EmberArray since the ember store query method asserts it has to be an array
+        // so we can't just return an object.
+        records.meta = { totalItems: indexedDbResults.length };
+        return records;
+      }
+      default:
+        return next(context.request);
+    }
+  }
+}

addons/api/addon/initializers/deprecations.js

@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { registerDeprecationHandler } from '@ember/debug';
+
+const deprecationList = ['ember-data:deprecate-early-static'];
+
+export function initialize() {
+  registerDeprecationHandler((message, options, next) => {
+    // TODO: Remove deprecation handling for `deprecate-early-static` warning
+    // once we upgrade to ember-cli-mirage v3.0.0 which fixes this issue.
+    // More info about this issue here: https://github.com/miragejs/ember-cli-mirage/issues/2441
+    if (options?.id && deprecationList.includes(options.id)) {
+      return;
+    }
+    if (options?.url) {
+      message += options.url;
+    }
+    next(message, options);
+  });
+}
+
+export default {
+  initialize,
+};

addons/api/addon/models/account.js

@@ -87,7 +87,7 @@ export default class AccountModel extends GeneratedAccountModel {
   changePassword(
     currentPassword,
     newPassword,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'change-password',

addons/api/addon/models/alias.js

@@ -0,0 +1,10 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedAliasModel from '../generated/models/alias';
+
+export const TYPE_ALIAS_TARGET = 'target';
+export const TYPES_ALIAS = Object.freeze([TYPE_ALIAS_TARGET]);
+export default class AliasModel extends GeneratedAliasModel {}

addons/api/addon/models/auth-method.js

@@ -37,6 +37,7 @@ export const options = {
     account_claim_maps: {
       to: ['sub', 'name', 'email'],
     },
+    prompts: ['consent', 'select_account', 'login'],
   },
   ldap: {
     account_attribute_maps: {

addons/api/addon/models/credential-library.js

@@ -11,6 +11,18 @@ import GeneratedCredentialLibraryModel from '../generated/models/credential-libr
 export const options = {
   http_method: ['GET', 'POST'],
   key_type: ['ed25519', 'ecdsa', 'rsa'],
+  credential_types: ['ssh_private_key', 'username_password'],
+  mapping_overrides: {
+    username_password: {
+      username_attribute: 'Username',
+      password_attribute: 'Password',
+    },
+    ssh_private_key: {
+      private_key_attribute: 'Private Key',
+      private_key_passphrase_attribute: 'Private Key Passphrase',
+      username_attribute: 'Username',
+    },
+  },
 };
 
 export const TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC = 'vault-generic';

addons/api/addon/models/credential-store.js

@@ -6,7 +6,13 @@
 import GeneratedCredentialStoreModel from '../generated/models/credential-store';
 import { equal } from '@ember/object/computed';
 
-export const types = ['static', 'vault'];
+export const TYPE_CREDENTIAL_STORE_STATIC = 'static';
+export const TYPE_CREDENTIAL_STORE_VAULT = 'vault';
+
+export const TYPES_CREDENTIAL_STORE = Object.freeze([
+  TYPE_CREDENTIAL_STORE_STATIC,
+  TYPE_CREDENTIAL_STORE_VAULT,
+]);
 
 export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
   // =attributes

addons/api/addon/models/host-catalog.js

@@ -5,8 +5,19 @@
 
 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
 
-export const types = ['static', 'plugin'];
-export const pluginTypes = ['aws', 'azure'];
+export const TYPE_HOST_CATALOG_STATIC = 'static';
+export const TYPE_HOST_CATALOG_DYNAMIC = 'plugin';
+export const TYPES_HOST_CATALOG = Object.freeze([
+  TYPE_HOST_CATALOG_STATIC,
+  TYPE_HOST_CATALOG_DYNAMIC,
+]);
+
+export const TYPE_HOST_CATALOG_PLUGIN_AWS = 'aws';
+export const TYPE_HOST_CATALOG_PLUGIN_AZURE = 'azure';
+export const TYPES_HOST_CATALOG_PLUGIN = [
+  TYPE_HOST_CATALOG_PLUGIN_AWS,
+  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+];
 
 export default class HostCatalogModel extends GeneratedHostCatalogModel {
   // =attributes
@@ -32,7 +43,9 @@ export default class HostCatalogModel extends GeneratedHostCatalogModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
+    return (
+      this.isPlugin && !TYPES_HOST_CATALOG_PLUGIN.includes(this.plugin?.name)
+    );
   }
 
   /**

addons/api/addon/models/host-set.js

@@ -4,7 +4,7 @@
  */
 
 import GeneratedHostSetModel from '../generated/models/host-set';
-import { pluginTypes } from './host-catalog';
+import { TYPES_HOST_CATALOG_PLUGIN } from './host-catalog';
 
 export default class HostSetModel extends GeneratedHostSetModel {
   // =attributes
@@ -30,7 +30,9 @@ export default class HostSetModel extends GeneratedHostSetModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
+    return (
+      this.isPlugin && !TYPES_HOST_CATALOG_PLUGIN.includes(this.plugin?.name)
+    );
   }
 
   /**

addons/api/addon/models/host.js

@@ -5,7 +5,7 @@
 
 import GeneratedHostModel from '../generated/models/host';
 import { attr } from '@ember-data/model';
-import { pluginTypes } from './host-catalog';
+import { TYPES_HOST_CATALOG_PLUGIN } from './host-catalog';
 
 export default class HostModel extends GeneratedHostModel {
   // =attributes
@@ -64,7 +64,9 @@ export default class HostModel extends GeneratedHostModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return this.isPlugin && !pluginTypes.includes(this.plugin?.name);
+    return (
+      this.isPlugin && !TYPES_HOST_CATALOG_PLUGIN.includes(this.plugin?.name)
+    );
   }
 
   /**

addons/api/addon/models/policy.js

@@ -0,0 +1,9 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import GeneratedPolicyModel from '../generated/models/policy';
+
+export const TYPE_POLICY = 'storage';
+export default class PolicyModel extends GeneratedPolicyModel {}

addons/api/addon/models/role.js

@@ -6,17 +6,11 @@
 import GeneratedRoleModel from '../generated/models/role';
 import { attr } from '@ember-data/model';
 import { inject as service } from '@ember/service';
-import { all, resolve } from 'rsvp';
-import {
-  TYPE_AUTH_METHOD_OIDC,
-  TYPE_AUTH_METHOD_LDAP,
-} from 'api/models/auth-method';
 
 export default class RoleModel extends GeneratedRoleModel {
   // =services
 
   @service store;
-  @service resourceFilterStore;
 
   // =attributes
 
@@ -27,7 +21,7 @@ export default class RoleModel extends GeneratedRoleModel {
    * see obvious.  Instead, the application layer is expected to load referenced
    * users and groups as needed.
    */
-  @attr('principal-array', {
+  @attr('array', {
     readOnly: true,
     emptyArrayIfMissing: true,
   })
@@ -55,7 +49,7 @@ export default class RoleModel extends GeneratedRoleModel {
   get userIDs() {
     return this.principals
       .filter(({ type }) => type === 'user')
-      .map(({ principal_id }) => principal_id);
+      .map(({ id }) => id);
   }
 
   /**
@@ -65,7 +59,7 @@ export default class RoleModel extends GeneratedRoleModel {
   get groupIDs() {
     return this.principals
       .filter(({ type }) => type === 'group')
-      .map(({ principal_id }) => principal_id);
+      .map(({ id }) => id);
   }
 
   /**
@@ -75,94 +69,9 @@ export default class RoleModel extends GeneratedRoleModel {
   get managedGroupIDs() {
     return this.principals
       .filter(({ type }) => type === 'managed group')
-      .map(({ principal_id }) => principal_id);
+      .map(({ id }) => id);
   }
 
-  /**
-   * A promise that resolves to an array of User instances.
-   * When calling this getter, be sure to await resolution
-   * before interacting with the results.
-   * @type {Promise[UserModel]}
-   */
-  get users() {
-    const ids = this.userIDs;
-
-    // Role has prinicipal IDs,
-    // return a promise which resolves model instances for those IDs
-    if (ids?.length) {
-      return this.resourceFilterStore
-        .queryBy('user', { id: ids }, { scope_id: 'global', recursive: true })
-        .then((models) => models.map((model) => model));
-    }
-
-    // No principal IDs,
-    // return a promise resolving to an empty array
-    return resolve([]);
-  }
-
-  /**
-   * A promise that resolves to an array of Group instances.
-   * When calling this getter, be sure to await resolution
-   * before interacting with the results.
-   * @type {Promise[GroupModel]}
-   */
-  get groups() {
-    const ids = this.groupIDs;
-
-    // Role has prinicipal IDs,
-    // return a promise which resolves model instances for those IDs
-    if (ids?.length) {
-      return this.resourceFilterStore
-        .queryBy('group', { id: ids }, { scope_id: 'global', recursive: true })
-        .then((models) => models.map((model) => model));
-    }
-
-    // No principal IDs,
-    // return a promise resolving to an empty array
-    return resolve([]);
-  }
-
-  /**
-   * A promise that resolves to an array of ManagedGroup instances.
-   * When calling this getter, be sure to await resolution
-   * before interacting with the results.
-   * @type {Promise[ManagedGroupModel]}
-   */
-  get managedGroups() {
-    const ids = this.managedGroupIDs;
-
-    // Role has prinicipal IDs
-    // return a promise which resolves model instances for those IDs
-    if (ids?.length) {
-      // Collect all auth methods.
-      const authMethods = this.resourceFilterStore.queryBy(
-        'auth-method',
-        { type: [TYPE_AUTH_METHOD_OIDC, TYPE_AUTH_METHOD_LDAP] },
-        { scope_id: 'global', recursive: true }
-      );
-
-      // For each auth method, query all managed groups with IDs
-      // that match the role's manage group principal IDs.
-      const managedGroups = authMethods
-        .then((methods) =>
-          all(
-            methods.map(({ id: auth_method_id }) =>
-              this.resourceFilterStore
-                .queryBy('managed-group', { id: ids }, { auth_method_id })
-                .then((models) => models.map((model) => model))
-            )
-          )
-        )
-        // The result is an array of arrays of model instances (grouped by
-        // auth methods), so these must be flattened.
-        .then((grouped) => grouped.flat());
-      return managedGroups;
-    }
-
-    // No principal IDs,
-    // return a promise resolving to an empty array
-    return resolve([]);
-  }
   // =methods
 
   /**

addons/api/addon/models/scope.js

@@ -4,13 +4,15 @@
  */
 
 import GeneratedScopeModel from '../generated/models/scope';
-import { computed } from '@ember/object';
 
-export const scopeTypes = {
-  global: 'global',
-  org: 'org',
-  project: 'project',
-};
+export const TYPE_SCOPE_GLOBAL = 'global';
+export const TYPE_SCOPE_ORG = 'org';
+export const TYPE_SCOPE_PROJECT = 'project';
+export const TYPES_SCOPE = Object.freeze([
+  TYPE_SCOPE_GLOBAL,
+  TYPE_SCOPE_ORG,
+  TYPE_SCOPE_PROJECT,
+]);
 
 export default class ScopeModel extends GeneratedScopeModel {
   // =attributes
@@ -18,9 +20,8 @@ export default class ScopeModel extends GeneratedScopeModel {
   /**
    * @type {boolean}
    */
-  @computed('type')
   get isGlobal() {
-    return this.type === scopeTypes.global;
+    return this.type === TYPE_SCOPE_GLOBAL;
   }
   // There is only one global scope and it cannot be created by clients,
   // thus no set.
@@ -28,22 +29,64 @@ export default class ScopeModel extends GeneratedScopeModel {
   /**
    * @type {boolean}
    */
-  @computed('type')
   get isOrg() {
-    return this.type === scopeTypes.org;
+    return this.type === TYPE_SCOPE_ORG;
   }
   set isOrg(value) {
-    if (value) this.type = scopeTypes.org;
+    if (value) this.type = TYPE_SCOPE_ORG;
   }
 
   /**
    * @type {boolean}
    */
-  @computed('type')
   get isProject() {
-    return this.type === scopeTypes.project;
+    return this.type === TYPE_SCOPE_PROJECT;
   }
   set isProject(value) {
-    if (value) this.type = scopeTypes.project;
+    if (value) this.type = TYPE_SCOPE_PROJECT;
+  }
+
+  /**
+   * Attach policy via the `attach-staorage-policy` method.
+   * @param {[string]} policyId
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  attachStoragePolicy(policyId, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'attach-storage-policy',
+      policyId,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
+
+  /**
+   * Detaches policy via the `detach-storage-policy` method.
+   * @param {[string]} policyId
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  detachStoragePolicy(policyId, options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'detach-storage-policy',
+      policyId,
+    };
+    // There is no "deep merge" in ES.
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
   }
 }

addons/api/addon/models/session-recording.js

@@ -69,4 +69,23 @@ export default class SessionRecordingModel extends GeneratedSessionRecordingMode
       this.create_time_values?.user?.name || this.create_time_values?.user?.id
     );
   }
+
+  /**
+   * Reapply policy dates via the `reapply-staorage-policy` method.
+   * @param {object} options
+   * @param {object} options.adapterOptions
+   * @return {Promise}
+   */
+  reapplyStoragePolicy(options = { adapterOptions: {} }) {
+    const defaultAdapterOptions = {
+      method: 'reapply-storage-policy',
+    };
+    return this.save({
+      ...options,
+      adapterOptions: {
+        ...defaultAdapterOptions,
+        ...options.adapterOptions,
+      },
+    });
+  }
 }

addons/api/addon/models/session.js

@@ -4,7 +4,6 @@
  */
 
 import GeneratedSessionModel from '../generated/models/session';
-import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 import { tracked } from '@glimmer/tracking';
 import { A } from '@ember/array';
@@ -77,7 +76,7 @@ class SessionCredential {
     if (this.#payloadSecret?.decoded) {
       const secretJSON = this.#payloadSecret.decoded;
       return Object.keys(secretJSON).map(
-        (key) => new SessionCredential.SecretItem(key, secretJSON[key])
+        (key) => new SessionCredential.SecretItem(key, secretJSON[key]),
       );
     } else {
       // decode from base64
@@ -127,8 +126,7 @@ export default class SessionModel extends GeneratedSessionModel {
   /**
    * @type {boolean}
    */
-  @computed('isActive', 'isPending')
-  get isCancelable() {
+  get isAvailable() {
     return this.isActive || this.isPending;
   }
 
@@ -136,7 +134,6 @@ export default class SessionModel extends GeneratedSessionModel {
    * The full proxy address and port if address exists, otherwise null.
    * @type {?string}
    */
-  @computed('proxy_address', 'proxy_port')
   get proxy() {
     return this.proxy_address
       ? `${this.proxy_address}:${this.proxy_port}`
@@ -148,9 +145,23 @@ export default class SessionModel extends GeneratedSessionModel {
    * @type {TargetModel}
    */
   get target() {
+    if (!this.target_id) {
+      return null;
+    }
     return this.store.peekRecord('target', this.target_id);
   }
 
+  /**
+   * The user associated with this session (if loaded).
+   * @type {UserModel}
+   */
+  get user() {
+    if (!this.user_id) {
+      return null;
+    }
+    return this.store.peekRecord('user', this.user_id);
+  }
+
   // =methods
 
   /**

addons/api/addon/models/storage-bucket.js

@@ -9,8 +9,10 @@ export const TYPE_STORAGE_BUCKET_PLUGIN = 'plugin';
 export const TYPES_STORAGE_BUCKET = Object.freeze([TYPE_STORAGE_BUCKET_PLUGIN]);
 
 export const TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3 = 'aws';
+export const TYPE_STORAGE_BUCKET_PLUGIN_MINIO = 'minio';
 export const TYPES_STORAGE_BUCKET_PLUGIN = Object.freeze([
   TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3,
+  TYPE_STORAGE_BUCKET_PLUGIN_MINIO,
 ]);
 
 export const TYPE_CREDENTIAL_STATIC = 'static';
@@ -75,6 +77,14 @@ export default class StorageBucketModel extends GeneratedStorageBucketModel {
     return this.compositeType === TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3;
   }
 
+  /**
+   * True if the storage bucket plugin type is MinIO
+   * @type {boolean}
+   */
+  get isMinIO() {
+    return this.compositeType === TYPE_STORAGE_BUCKET_PLUGIN_MINIO;
+  }
+
   /**
    * If the storage bucket is a plugin return `plugin.name`,
    * otherwise return the storage bucket type.

addons/api/addon/models/target.js

@@ -108,6 +108,14 @@ export default class TargetModel extends GeneratedTargetModel {
       .filter((s) => s && s.target_id === this.id);
   }
 
+  /**
+   * Available sessions associated with this target (but only already loaded sessions).
+   * @type {SessionModel[]}
+   */
+  get availableSessions() {
+    return this.sessions.filter((session) => session.isAvailable);
+  }
+
   /**
    * The project associated with this target (if already loaded).
    * @type {ScopeModel}
@@ -122,11 +130,17 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   get isActive() {
     const pendingOrActiveSessions = this.sessions.filter(
-      (s) => s.isActive || s.isPending
+      (s) => s.isActive || s.isPending,
     );
     return Boolean(pendingOrActiveSessions.length);
   }
 
+  get associatedAliases() {
+    return this.store
+      .peekAll('alias')
+      .filter((alias) => alias?.destination_id === this.id);
+  }
+
   // =methods
 
   /**
@@ -195,7 +209,7 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   addBrokeredCredentialSources(
     brokeredCredentialSourceIDs,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'add-credential-sources',
@@ -221,7 +235,7 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   addInjectedApplicationCredentialSources(
     injectedApplicationCredentialSourceIDs,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'add-credential-sources',
@@ -247,7 +261,7 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   removeBrokeredCredentialSources(
     brokeredCredentialSourceIDs,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'remove-credential-sources',
@@ -272,7 +286,7 @@ export default class TargetModel extends GeneratedTargetModel {
   removeBrokeredCredentialSource(brokeredCredentialSourceID, options) {
     return this.removeBrokeredCredentialSources(
       [brokeredCredentialSourceID],
-      options
+      options,
     );
   }
 
@@ -286,7 +300,7 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   removeInjectedApplicationCredentialSources(
     injectedApplicationCredentialSourceIDs,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'remove-credential-sources',
@@ -310,11 +324,11 @@ export default class TargetModel extends GeneratedTargetModel {
    */
   removeInjectedApplicationCredentialSource(
     injectedApplicationCredentialSourceID,
-    options
+    options,
   ) {
     return this.removeInjectedApplicationCredentialSources(
       [injectedApplicationCredentialSourceID],
-      options
+      options,
     );
   }
 

addons/api/addon/models/worker.js

@@ -37,7 +37,7 @@ export default class WorkerModel extends GeneratedWorkerModel {
 
     return Object.values(this.config_tags).reduce(
       (previousCount, currentTags) => previousCount + currentTags.length,
-      0
+      0,
     );
   }
 
@@ -51,7 +51,7 @@ export default class WorkerModel extends GeneratedWorkerModel {
     }
 
     return Object.entries(this.config_tags).flatMap(([key, value]) =>
-      value.map((tag) => ({ key, value: tag }))
+      value.map((tag) => ({ key, value: tag })),
     );
   }
 

addons/api/addon/serializers/account.js

@@ -110,7 +110,7 @@ export default class AccountSerializer extends ApplicationSerializer {
       serialized = this.serializeForChangePassword(
         snapshot,
         currentPassword,
-        newPassword
+        newPassword,
       );
     }
     return serialized;

addons/api/addon/serializers/application.js

@@ -145,18 +145,18 @@ export default class ApplicationSerializer extends RESTSerializer {
     const transformedPayload = {};
     // Find the Ember-data-expected root key name.
     const payloadKey = this.payloadKeyFromModelName(
-      primaryModelClass.modelName
+      primaryModelClass.modelName,
     );
     // Copy the data rooted under `items` in the existing payload into the new
     // payload under the expected root key name.
-    transformedPayload[payloadKey] = structuredClone(payload.items);
+    transformedPayload[payloadKey] = structuredClone(payload?.items);
     // Return the result of normalizing the transformed payload.
     return super.normalizeArrayResponse(
       store,
       primaryModelClass,
       transformedPayload,
       id,
-      requestType
+      requestType,
     );
   }
 
@@ -183,7 +183,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     const transformedPayload = {};
     // Find the Ember-data-expected root key name.
     const payloadKey = this.payloadKeyFromModelName(
-      primaryModelClass.modelName
+      primaryModelClass.modelName,
     );
     // Copy the unrooted payload under the expected root key name.
     transformedPayload[payloadKey] = payload;
@@ -193,7 +193,7 @@ export default class ApplicationSerializer extends RESTSerializer {
       primaryModelClass,
       transformedPayload,
       id,
-      requestType
+      requestType,
     );
   }
 
@@ -318,7 +318,7 @@ export default class ApplicationSerializer extends RESTSerializer {
     primaryModelClass,
     payload,
     id,
-    requestType
+    requestType,
   ) {
     const newPayload = structuredClone(payload);
 
@@ -338,7 +338,7 @@ export default class ApplicationSerializer extends RESTSerializer {
       primaryModelClass,
       newPayload,
       id,
-      requestType
+      requestType,
     );
   }
 }

addons/api/addon/serializers/auth-method.js

@@ -74,7 +74,7 @@ export default class AuthMethodSerializer extends ApplicationSerializer {
   normalizeArrayResponse() {
     const normalized = super.normalizeArrayResponse(...arguments);
     normalized.data = normalized.data.sort((a) =>
-      a.attributes.is_primary ? -1 : 1
+      a.attributes.is_primary ? -1 : 1,
     );
     return normalized;
   }

addons/api/addon/serializers/channel-recording.js

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationSerializer from './application';
+import { EmbeddedRecordsMixin } from '@ember-data/serializer/rest';
+
+export default class ChannelSerializer extends ApplicationSerializer.extend(
+  EmbeddedRecordsMixin,
+) {
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const err = normalizedHash.errors;
+    delete normalizedHash.errors;
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // we should not override the ember models errors field,
+    // so we rename the errors field from the api
+    normalized.data.attributes.errors_number = err;
+
+    return normalized;
+  }
+}

addons/api/addon/serializers/connection-recording.js

@@ -7,9 +7,21 @@ import ApplicationSerializer from './application';
 import { EmbeddedRecordsMixin } from '@ember-data/serializer/rest';
 
 export default class ConnectionSerializer extends ApplicationSerializer.extend(
-  EmbeddedRecordsMixin
+  EmbeddedRecordsMixin,
 ) {
   attrs = {
     channel_recordings: { embedded: 'always' },
   };
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const err = normalizedHash.errors;
+    delete normalizedHash.errors;
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // we should not override the ember models errors field,
+    // so we rename the errors field from the api
+    normalized.data.attributes.errors_number = err;
+
+    return normalized;
+  }
 }

addons/api/addon/serializers/credential-library.js

@@ -7,6 +7,7 @@ import ApplicationSerializer from './application';
 import {
   TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
   TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+  options,
 } from '../models/credential-library';
 
 export default class CredentialLibrarySerializer extends ApplicationSerializer {
@@ -31,9 +32,34 @@ export default class CredentialLibrarySerializer extends ApplicationSerializer {
         return super.serialize(...arguments);
     }
   }
+  serializeAttribute(snapshot, json) {
+    const value = super.serializeAttribute(...arguments);
+    const { credential_type, type, credential_mapping_overrides, isNew } =
+      snapshot.record;
+    if (
+      type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC &&
+      credential_mapping_overrides &&
+      credential_type &&
+      !isNew
+    ) {
+      // API expects to send null to fields if it is undefined or deleted
+      json.credential_mapping_overrides = Object.keys(
+        options.mapping_overrides[credential_type],
+      ).reduce((obj, key) => {
+        if (credential_mapping_overrides[key]) {
+          obj[key] = credential_mapping_overrides[key];
+        } else {
+          obj[key] = null;
+        }
+        return obj;
+      }, {});
+      return value;
+    }
+  }
 
   serializeVaultGeneric() {
     const serialized = super.serialize(...arguments);
+
     if (serialized.attributes) {
       // Set `http_request_body` only if `http_method` is POST
       // otherwise set to null to have the field removed

addons/api/addon/serializers/credential.js

@@ -24,7 +24,7 @@ export default class CredentialSerializer extends ApplicationSerializer {
 
       if (serialized?.attributes?.json_object) {
         serialized.attributes.object = JSON.parse(
-          serialized.attributes.json_object
+          serialized.attributes.json_object,
         );
         delete serialized.attributes.json_object;
       }

addons/api/addon/serializers/role.js

@@ -14,7 +14,7 @@ export default class RoleSerializer extends ApplicationSerializer {
    * include **only grants** and the version.  Normally, grants are not
    * serialized.
    * If `adapterOptions.principalIDs` is set (to an array of user and
-   * group IDs), then the payload is serialized via `serializewithPrincipals`.
+   * group IDs), then the payload is serialized via `serializeWithPrincipals`.
    * @override
    * @param {Snapshot} snapshot
    * @return {object}
@@ -26,7 +26,7 @@ export default class RoleSerializer extends ApplicationSerializer {
       serialized = this.serializeWithGrantStrings(snapshot, grantStrings);
     const principalIDs = snapshot?.adapterOptions?.principalIDs;
     if (principalIDs)
-      serialized = this.serializewithPrincipals(snapshot, principalIDs);
+      serialized = this.serializeWithPrincipals(snapshot, principalIDs);
     return serialized;
   }
 
@@ -50,7 +50,7 @@ export default class RoleSerializer extends ApplicationSerializer {
    * @param {[string]} principalIDs
    * @return {object}
    */
-  serializewithPrincipals(snapshot, principalIDs) {
+  serializeWithPrincipals(snapshot, principalIDs) {
     return {
       version: snapshot.attr('version'),
       principal_ids: principalIDs,

addons/api/addon/serializers/scope.js

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import ApplicationSerializer from './application';
+
+export default class ScopeSerializer extends ApplicationSerializer {
+  // =methods
+
+  serialize(snapshot) {
+    let serialized = super.serialize(...arguments);
+    const policyId = snapshot?.adapterOptions?.policyId;
+
+    if (policyId) {
+      serialized = this.serializeWithStoragePolicy(snapshot, policyId);
+    }
+
+    return serialized;
+  }
+
+  /**
+   * Returns a payload containing only version and storage policy id,
+   * rather than existing instances on the model.
+   * @param {Snapshot} snapshot
+   * @param {[string]} hostSetIDs
+   * @return {object}
+   */
+  serializeWithStoragePolicy(snapshot, policyId) {
+    return {
+      version: snapshot.attr('version'),
+      storage_policy_id: policyId,
+    };
+  }
+}

addons/api/addon/serializers/session-recording.js

@@ -6,9 +6,31 @@
 import ApplicationSerializer from './application';
 import { EmbeddedRecordsMixin } from '@ember-data/serializer/rest';
 export default class RecordingSerializer extends ApplicationSerializer.extend(
-  EmbeddedRecordsMixin
+  EmbeddedRecordsMixin,
 ) {
   attrs = {
     connection_recordings: { embedded: 'always' },
   };
+
+  serialize(snapshot) {
+    let serialized = super.serialize(...arguments);
+    // The post request for reapply-storage-policy doesn't expect a payload,
+    // so we return nothing
+    if (snapshot?.adapterOptions?.method === 'reapply-storage-policy') {
+      return {};
+    }
+    return serialized;
+  }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const err = normalizedHash.errors;
+    delete normalizedHash.errors;
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // we should not override the ember models errors field,
+    // so we rename the errors field from the api
+    normalized.data.attributes.errors_number = err;
+
+    return normalized;
+  }
 }

addons/api/addon/serializers/storage-bucket.js

@@ -4,7 +4,10 @@
  */
 
 import ApplicationSerializer from './application';
-import { TYPE_CREDENTIAL_DYNAMIC } from '../models/storage-bucket';
+import {
+  TYPE_CREDENTIAL_DYNAMIC,
+  TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3,
+} from '../models/storage-bucket';
 
 const fieldsByCredentialType = {
   static: [
@@ -12,27 +15,55 @@ const fieldsByCredentialType = {
     'secret_access_key',
     'region',
     'disable_credential_rotation',
+    'endpoint_url',
   ],
   dynamic: [
     'role_arn',
     'role_external_id',
     'role_session_name',
     'role_tags',
-    'disable_credential_rotation',
     'region',
+    'disable_credential_rotation',
+    'endpoint_url',
   ],
 };
 export default class StorageBucketSerializer extends ApplicationSerializer {
+  /**
+   * Serializes storage-bucket. ATM just AWS needs specific serialization,
+   * for the other plugin types use default.
+   * @param {object} snapshot
+   * @returns
+   */
   serialize(snapshot) {
-    const serialized = super.serialize(...arguments);
     const { credentialType } = snapshot.record;
+    const pluginType = snapshot.record.plugin?.name;
+    const serialized = super.serialize(...arguments);
+
+    // Common for all pluginTypes
     if (!snapshot.record.isNew) {
       delete serialized.bucket_name;
       delete serialized.bucket_prefix;
     }
 
-    if (credentialType === TYPE_CREDENTIAL_DYNAMIC) {
-      serialized.attributes.disable_credential_rotation = true;
+    if (pluginType === TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3) {
+      return this.serializeAws(serialized, credentialType);
+    }
+
+    return serialized;
+  }
+
+  /**
+   * Returns a storage bucket serialized object specific for aws
+   * @param {object} serialized
+   * @param {string} credentialType
+   * @returns
+   */
+  serializeAws(serialized, credentialType) {
+    if (serialized.attributes) {
+      if (credentialType === TYPE_CREDENTIAL_DYNAMIC) {
+        serialized.attributes.disable_credential_rotation = true;
+      }
+      delete serialized.attributes.endpoint_url;
     }
     return serialized;
   }
@@ -45,7 +76,7 @@ export default class StorageBucketSerializer extends ApplicationSerializer {
     if (options.isNestedAttribute && json.attributes) {
       // The key must be included in the fieldsByType list above
       if (!fieldsByCredentialType[credentialType].includes(key))
-        //API requires these fields to be null
+        // API requires these fields to be null
         json.attributes[key] = null;
     }
 

addons/api/addon/serializers/target.js

@@ -36,14 +36,22 @@ export default class TargetSerializer extends ApplicationSerializer {
     if (brokeredCredentialSourceIDs)
       serialized = this.serializeWithBrokeredCredentialSources(
         snapshot,
-        brokeredCredentialSourceIDs
+        brokeredCredentialSourceIDs,
       );
     if (injectedApplicationCredentialSourceIDs)
       serialized = this.serializeWithInjectedApplicationCredentialSources(
         snapshot,
-        injectedApplicationCredentialSourceIDs
+        injectedApplicationCredentialSourceIDs,
       );
 
+    if (serialized?.with_aliases) {
+      // API expects scope id along with every alias value
+      serialized.with_aliases = serialized.with_aliases.map((item) => ({
+        ...item,
+        scope_id: 'global',
+      }));
+    }
+
     // Delete session recording related fields from non-SSH targets
     if (type !== TYPE_TARGET_SSH) {
       delete serialized?.attributes?.storage_bucket_id;
@@ -75,7 +83,7 @@ export default class TargetSerializer extends ApplicationSerializer {
    */
   serializeWithBrokeredCredentialSources(
     snapshot,
-    brokered_credential_source_ids
+    brokered_credential_source_ids,
   ) {
     return {
       version: snapshot.attr('version'),
@@ -92,7 +100,7 @@ export default class TargetSerializer extends ApplicationSerializer {
    */
   serializeWithInjectedApplicationCredentialSources(
     snapshot,
-    injected_application_credential_source_ids
+    injected_application_credential_source_ids,
   ) {
     return {
       version: snapshot.attr('version'),
@@ -112,4 +120,17 @@ export default class TargetSerializer extends ApplicationSerializer {
       storage_bucket_id: snapshot?.attr('storage_bucket_id'),
     };
   }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = structuredClone(hash);
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // Ember data retains the previous entry in the array attr when the updated attr becomes undefined/empty.
+    // So, we explicitly set the attr to an empty array if the updated attribute is undefined from the API
+
+    if (!normalized.data.attributes.aliases) {
+      normalized.data.attributes.aliases = [];
+    }
+
+    return normalized;
+  }
 }

addons/api/addon/serializers/worker.js

@@ -22,7 +22,7 @@ export default class WorkerSerializer extends ApplicationSerializer {
     if (workerGeneratedAuthToken)
       serialized = this.serializeWithGeneratedToken(
         snapshot,
-        workerGeneratedAuthToken
+        workerGeneratedAuthToken,
       );
     return serialized;
   }

addons/api/addon/services/indexed-db.js

@@ -0,0 +1,147 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import Service from '@ember/service';
+import Dexie from 'dexie';
+import { typeOf } from '@ember/utils';
+
+// List of resources we support to be cached and searched in
+// indexedDb. Any field that can be searched upon should be added to
+// this index. Increment the version number of the database whenever
+// indexes change.
+export const modelIndexes = {
+  token: '&id, token',
+  target:
+    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.address, attributes.scope.scope_id',
+  session:
+    '&id, attributes.created_time, attributes.type, attributes.status, attributes.endpoint, attributes.target_id, attributes.user_id, attributes.scope.scope_id',
+  user: '&id, attributes.created_time, attributes.name, attributes.description, attributes.scope.scope_id',
+  group:
+    '&id, attributes.created_time, attributes.name, attributes.description, attributes.scope.scope_id',
+  role: '&id, attributes.created_time, attributes.name, attributes.description, attributes.scope.scope_id',
+  scope:
+    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.scope.scope_id',
+  'credential-store':
+    '&id, attributes.created_time, attributes.name, attributes.description, attributes.type, attributes.scope.scope_id',
+  'host-catalog':
+    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.scope.scope_id, attributes.plugin.name',
+  'auth-method':
+    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.is_primary, attributes.scope.scope_id',
+};
+
+export const formatDbName = (userId, clusterUrl) =>
+  `boundary-${userId}-${clusterUrl}`;
+
+/**
+ * Recursively copy over the object and convert any booleans to "true" or "false" so they can be indexed.
+ * Also converts any ember-like arrays back to a standard array.
+ * @param result
+ * @param object
+ * @returns {*}
+ */
+const convertFields = (result, object) => {
+  Object.entries(object).forEach(([key, value]) => {
+    if (typeOf(value) === 'object') {
+      result[key] = convertFields({}, value);
+    } else if (typeOf(value) === 'boolean') {
+      result[key] = value ? 'true' : 'false';
+    } else if (typeOf(value) === 'array') {
+      result[key] = [...value];
+    } else {
+      result[key] = value;
+    }
+  });
+
+  return result;
+};
+
+/**
+ * Recursively copy over the object and convert any string "true" or "false" back to booleans.
+ * Will also convert any array fields back using their model transformation.
+ * @param result
+ * @param object
+ * @param schema
+ * @param serializer
+ * @returns {*}
+ */
+const unconvertFields = (result, object, schema, serializer) => {
+  Object.entries(object).forEach(([key, value]) => {
+    if (typeOf(value) === 'object') {
+      result[key] = unconvertFields({}, value, schema, serializer);
+    } else if (value === 'true' || value === 'false') {
+      result[key] = value === 'true';
+    } else if (typeOf(value) === 'array') {
+      const attribute = schema.attributes.get(key);
+
+      // If attribute type is array, we transform it back to a tracked array
+      if (attribute?.type === 'array') {
+        const transformer = serializer.transformFor(attribute.type);
+        result[key] = transformer.deserialize(value, attribute.options);
+        return;
+      }
+
+      result[key] = value;
+    } else {
+      result[key] = value;
+    }
+  });
+
+  return result;
+};
+
+/**
+ * Service to encapsulate the IndexedDB implementation. To use this service, call
+ * `setup` from the application root and
+ */
+export default class IndexedDbService extends Service {
+  // =attributes
+  #db;
+  get db() {
+    return this.#db;
+  }
+
+  setup(dbName) {
+    // Don't run setup again if we already have one or if we didn't get a name
+    if (this.#db || !dbName) {
+      return;
+    }
+
+    this.#db = new Dexie(dbName);
+    this.#db.version(1).stores(modelIndexes);
+  }
+
+  /**
+   * Cleanup the data by converting all fields to plain javascript objects.
+   * We will also convert booleans to "false" or "true".
+   * IndexedDB doesn't support indexes on boolean values so we have to
+   * convert them to be able to support using boolean values.
+   *
+   * Undo the operation by setting `convertFields` to false.
+   *
+   * @param {Object} data
+   * @param {Boolean} cleanData
+   * @param {Object} schema
+   * @param {Object} serializer
+   * @return {{id, type, attributes: {}, relationships: {}}}
+   */
+  normalizeData({ data, cleanData, schema, serializer }) {
+    if (!data) {
+      return data;
+    }
+
+    let { id, type, attributes = {}, relationships = {} } = data;
+
+    return {
+      id,
+      type,
+      attributes: cleanData
+        ? convertFields({}, attributes)
+        : unconvertFields({}, attributes, schema, serializer),
+      relationships: cleanData
+        ? convertFields({}, relationships)
+        : unconvertFields({}, relationships, schema, serializer),
+    };
+  }
+}

addons/api/addon/services/resource-filter-store.js

@@ -42,8 +42,8 @@ export class ResourceFilter {
                 return this.in(value.contains, key);
               }
               return this.equals(key, value);
-            })
-          )
+            }),
+          ),
         );
       })
       .flat()

addons/api/addon/services/store.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import Store, { CacheHandler } from '@ember-data/store';
+import RequestManager from '@ember-data/request';
+import { LegacyNetworkHandler } from '@ember-data/legacy-compat';
+import IndexedDbHandler from 'api/handlers/indexed-db-handler';
+
+export default class extends Store {
+  requestManager = new RequestManager();
+
+  constructor(args) {
+    super(args);
+
+    const indexedDbHandler = new IndexedDbHandler(this);
+
+    this.requestManager.use([indexedDbHandler, LegacyNetworkHandler]);
+    this.requestManager.useCache(CacheHandler);
+  }
+}

addons/api/addon/transforms/array.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import Transform from '@ember-data/serializer/transform';
+import { TrackedArray } from 'tracked-built-ins';
+
+export default class ArrayTransform extends Transform {
+  deserialize(serialized) {
+    const arr = new TrackedArray(serialized || []);
+    return arr;
+  }
+
+  serialize(deserialized) {
+    const arr = deserialized || [];
+    return arr;
+  }
+}

addons/api/addon/transforms/object.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import Transform from '@ember-data/serializer/transform';
+import { TrackedObject } from 'tracked-built-ins';
+
+export default class ObjectTransform extends Transform {
+  /**
+   * @param serialized
+   * @returns {object}
+   */
+  deserialize(serialized) {
+    const obj = new TrackedObject(serialized || {});
+    return obj;
+  }
+
+  /**
+   * @param deserialized
+   * @returns {object}
+   */
+  serialize(deserialized) {
+    if (!deserialized) {
+      return {};
+    }
+    return deserialized;
+  }
+}

addons/api/addon/transforms/principal-array.js

@@ -1,26 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
- */
-
-import Transform from '@ember-data/serializer/transform';
-
-export default class PrincipalArrayTransform extends Transform {
-  deserialize(serialized) {
-    const stringValues = serialized || [];
-    return stringValues.map(({ id: principal_id, scope_id, type }) => ({
-      principal_id,
-      scope_id,
-      type,
-    }));
-  }
-
-  serialize(deserialized) {
-    const strings = deserialized || [];
-    return strings.map(({ principal_id: id, scope_id, type }) => ({
-      id,
-      scope_id,
-      type,
-    }));
-  }
-}

addons/api/addon/utils/hash-code.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * Takes an object and gets the JSON stringified version of it to be converted
+ * to a hash code. Taken from https://stackoverflow.com/a/8076436
+ * @param obj
+ */
+export const hashCode = (obj) => {
+  if (!obj) {
+    return 0;
+  }
+
+  // Use a replacer function to sort the keys of the object so we get the same hashcode
+  // regardless of the order of the keys.
+  const jsonString = JSON.stringify(obj, Object.keys(obj).sort());
+
+  let hash = 0;
+  for (let i = 0; i < jsonString.length; i++) {
+    let code = jsonString.charCodeAt(i);
+    hash = (hash << 5) - hash + code;
+    hash = hash & hash; // Convert to 32bit integer
+  }
+
+  // Make sure the hash is positive since we're using it as an ID
+  return Math.abs(hash);
+};

addons/api/addon/utils/indexed-db-query.js

@@ -0,0 +1,263 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { get } from '@ember/object';
+import { modelIndexes } from '../services/indexed-db';
+
+/**
+ * Takes a POJO representing a filter query and builds a query to
+ * query indexedDb with. Note that the first filter is important as that
+ * will use the actual index in indexedDb while any subsequent ones will be less efficient.
+ *
+ * @example
+ *   const filter = queryIndexedDb(indexedDb, type, {
+ *     search: generated',
+ *     filters: {
+ *       scope_id: {
+ *         logicalOperator: 'and',
+ *         values: [{ notEquals: 'scope1' }, { notEquals: 'scope2' }],
+ *       },
+ *     },
+ *   });
+ */
+export async function queryIndexedDb(indexedDb, resource, query) {
+  let { search, filters = {} } = query ?? {};
+  let filterCollection = indexedDb[resource];
+
+  search = getSearchObject(search, resource);
+  filters = cleanObject(filters);
+
+  if (Object.keys(filters).length) {
+    // Remove the first item to use as the initial collection and then reduce the remaining ones
+    const entries = Object.entries(filters);
+    const [firstKey, firstFilterArrayOrObject] = entries.shift();
+
+    filterCollection = await entries.reduce(
+      async (currCollection, [key, filterArrayOrObject]) => {
+        // Grab the results from the set of one filters to be `AND` together with the rest of the filters
+        const filterResults = await buildInitialWhereClause({
+          table: indexedDb[resource],
+          key,
+          filterArrayOrObject,
+        }).primaryKeys();
+        const resultIdsSet = new Set(filterResults);
+
+        return (await currCollection).and((record) => {
+          return resultIdsSet.has(record.id);
+        });
+      },
+      buildInitialWhereClause({
+        key: firstKey,
+        table: indexedDb[resource],
+        filterArrayOrObject: firstFilterArrayOrObject,
+      }),
+    );
+  }
+
+  if (search) {
+    const { text, fields } = search;
+
+    filterCollection = filterCollection.filter((record) =>
+      fields
+        .map((key) => get(record, key))
+        .some((element) => {
+          if (typeof element === 'string') {
+            return element?.toLowerCase().includes(text?.toLowerCase());
+          }
+        }),
+    );
+  }
+
+  // OrderBy has to be used on where clauses while if it's a
+  // collection already we have to use sortBy. We'll also sort by
+  // descending order based on created time to match the API as any
+  // "or" clause can change the order
+  if (filterCollection.orderBy) {
+    return filterCollection.orderBy(getKey('created_time')).reverse().toArray();
+  }
+  return filterCollection.reverse().sortBy(getKey('created_time'));
+}
+
+const buildInitialWhereClause = ({ filterArrayOrObject, table, key }) => {
+  const filterValueArray = Array.isArray(filterArrayOrObject)
+    ? filterArrayOrObject
+    : filterArrayOrObject.values;
+
+  const { logicalOperator } = filterArrayOrObject;
+
+  // Short circuit if all the filter types were equals or notEquals since indexedDb
+  // can more efficiently query if we pass all values at once
+  const checkAllFilterType = (type) =>
+    filterValueArray.every((obj) => Object.keys(obj)[0] === type);
+  if (checkAllFilterType('equals')) {
+    return table
+      .where(getKey(key))
+      .anyOf(filterValueArray.map((obj) => obj['equals']));
+  }
+  if (checkAllFilterType('notEquals')) {
+    return table
+      .where(getKey(key))
+      .noneOf(filterValueArray.map((obj) => obj['notEquals']));
+  }
+
+  // Remove the first item to use as the initial where clause and then reduce the remaining ones
+  const [firstOperation, firstFilterValue] = Object.entries(
+    filterValueArray[0],
+  )[0];
+
+  // Not all are filters are equals or notEquals,
+  // manually build the initial where clause and resulting collections
+  return filterValueArray.slice(1).reduce(
+    (result, currObj) => {
+      const [operation, value] = Object.entries(currObj)[0];
+
+      return buildIndexedDbCollection({
+        key: getKey(key),
+        value,
+        collection: result,
+        operation,
+        logicalOperator,
+      });
+    },
+    buildIndexedDbWhere({
+      table,
+      key: getKey(key),
+      operation: firstOperation,
+      value: firstFilterValue,
+    }),
+  );
+};
+
+/**
+ * Builds the initial where clause for indexed DB to filter on. Note that this makes
+ * the first filter important as that will do the real filtering from indexed DB while
+ * any subsequent filter has to be done in memory.
+ */
+const buildIndexedDbWhere = ({ table, key, value, operation }) => {
+  const baseWhereClause = table.where(key);
+  switch (operation) {
+    case 'contains':
+      // We return an error due to not being able to support contains on first filter due to performance.
+      throw new Error('Contains is not supported as the first filter.');
+    case 'gt':
+      return baseWhereClause.above(value);
+    case 'gte':
+      return baseWhereClause.aboveOrEqual(value);
+    case 'lt':
+      return baseWhereClause.below(value);
+    case 'lte':
+      return baseWhereClause.belowOrEqual(value);
+    case 'notEquals':
+      return baseWhereClause.notEqual(value);
+    default:
+      return baseWhereClause.equals(value);
+  }
+};
+
+/**
+ * Continues building the queries for indexed DB to filter on. Note that these are not true
+ * indexed DB queries and in fact just standard JS filters for logical "and" queries and parallel queries
+ * to indexed DB for logical "or" queries that get deduped.
+ */
+const buildIndexedDbCollection = ({
+  key,
+  value,
+  collection,
+  operation,
+  logicalOperator,
+}) => {
+  if (logicalOperator === 'and') {
+    switch (operation) {
+      case 'contains':
+        return collection.and((record) => get(record, key)?.includes(value));
+      case 'gt':
+        return collection.and((record) => get(record, key) > value);
+      case 'gte':
+        return collection.and((record) => get(record, key) >= value);
+      case 'lt':
+        return collection.and((record) => get(record, key) < value);
+      case 'lte':
+        return collection.and((record) => get(record, key) <= value);
+      case 'notEquals':
+        return collection.and((record) => get(record, key) !== value);
+      default:
+        return collection.and((record) => get(record, key) === value);
+    }
+  }
+
+  switch (operation) {
+    case 'contains':
+      // We return an error due to not being able to support contains on this filter due to performance.
+      throw new Error(
+        'Contains is not supported as a filter option with "or" operator.',
+      );
+    case 'gt':
+      return collection.or(key).above(value);
+    case 'gte':
+      return collection.or(key).aboveOrEqual(value);
+    case 'lt':
+      return collection.or(key).below(value);
+    case 'lte':
+      return collection.or(key).belowOrEqual(value);
+    case 'notEquals':
+      return collection.or(key).notEqual(value);
+    default:
+      return collection.or(key).equals(value);
+  }
+};
+
+/**
+ * Translates the fields passed in from the UI for resources to the keys indexed DB knows them as.
+ * Usually it's the path of the actual normalized model.
+ */
+const getKey = (key) => {
+  switch (key) {
+    case 'scope_id':
+      return `attributes.scope.${key}`;
+    case 'id':
+      return key;
+    default:
+      return `attributes.${key}`;
+  }
+};
+
+/**
+ * Cleans the object to remove any keys that have a value of an empty array. This makes
+ * it easier so we don't have to worry about empty arrays getting queried in indexed db.
+ */
+const cleanObject = (obj) => {
+  if (!obj) {
+    return {};
+  }
+
+  return Object.entries(obj).reduce((result, [key, value]) => {
+    if (Array.isArray(value)) {
+      if (value.length > 0) {
+        result[key] = value;
+      }
+    } else if (value.values.length > 0) {
+      result[key] = value;
+    }
+
+    return result;
+  }, {});
+};
+
+/**
+ * Makes the search object that is expected when a user searches. Uses
+ * the indexes we setup in indexed db.
+ */
+const getSearchObject = (text, resource) => {
+  if (!text) {
+    return null;
+  }
+
+  return {
+    text,
+    fields: modelIndexes[resource]
+      .split(', ')
+      .map((index) => index.replace('&', '')),
+  };
+};

addons/api/addon/utils/mql-query.js

@@ -0,0 +1,141 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * Takes a POJO representing a filter query and converts it to an
+ * MQL expression string which is understood by the client daemon.
+ *
+ * @example
+ *   const filter = generateMQLFilterExpression({
+ *     name: { logicalOperator: 'and', values: [{ notEquals: 'search text' }, { notEquals: 'test' }] },
+ *     scope_id: [{ equals: 'scope1'}, { equals: 'scope2' }],
+ *   });
+ *
+ *   // (name % "search text") and (scope_id = "scope1" or scope_id = "scope2")
+ */
+export function generateMQLFilterExpression(filterObj) {
+  if (!filterObj) {
+    return null;
+  }
+
+  const expressions = Object.entries(filterObj)
+    .map(([key, filterArrayOrObject]) => {
+      const filterValueArray = Array.isArray(filterArrayOrObject)
+        ? filterArrayOrObject
+        : filterArrayOrObject.values;
+
+      let clauses;
+      const filterValues = filterValueArray.map((filterObjValue) => {
+        if (!filterObjValue) {
+          return null;
+        }
+
+        const [operation, value] = Object.entries(filterObjValue)[0];
+
+        switch (operation) {
+          case 'contains':
+            return contains(key, value);
+          case 'gt':
+            return gt(key, value);
+          case 'gte':
+            return gte(key, value);
+          case 'lt':
+            return lt(key, value);
+          case 'lte':
+            return lte(key, value);
+          case 'notEquals':
+            return notEquals(key, value);
+          default:
+            return equals(key, value);
+        }
+      });
+
+      // Default to `or` if we don't have a logical operator
+      const { logicalOperator } = filterArrayOrObject;
+      if (logicalOperator === 'and') {
+        clauses = and(filterValues);
+      } else {
+        clauses = or(filterValues);
+      }
+
+      return parenthetical(clauses);
+    })
+    .filter((item) => item);
+  return and(expressions);
+}
+
+/**
+ * Takes a POJO representing a search query and converts it to an
+ * MQL expression string which is understood by the client daemon.
+ *
+ * @example
+ *   const search = generateMQLSearchExpression({
+ *     text: 'search',
+ *     fields: ['id', 'name', 'description']
+ *   });
+ *
+ *   // (id % 'search' or name % 'search' or description % 'search')
+ */
+export function generateMQLSearchExpression(searchObj) {
+  if (!searchObj) {
+    return null;
+  }
+
+  const { text, fields } = searchObj;
+
+  return parenthetical(
+    or(fields.map((field) => contains(field, text)).filter((item) => item)),
+  );
+}
+
+/**
+ * Generates the MQL expression when a user passes in both search and filters.
+ */
+export function generateMQLExpression(obj) {
+  const { search, filters } = obj;
+
+  const expressions = [
+    generateMQLSearchExpression(search),
+    generateMQLFilterExpression(filters),
+  ].filter((item) => item);
+
+  return and(expressions);
+}
+
+const isEmpty = (input) =>
+  input === null || input === undefined || input === '';
+
+// Escape any double quotes or backslashes and add quotes if it's a string
+const sanitize = (input) =>
+  typeof input === 'string' ? `"${input?.replace(/(["\\])/g, '\\$1')}"` : input;
+
+// Comparison Operators
+const equals = (key, value) =>
+  !isEmpty(value) ? `${key} = ${sanitize(value)}` : null;
+
+const notEquals = (key, value) =>
+  !isEmpty(value) ? `${key} != ${sanitize(value)}` : null;
+
+const contains = (key, value) =>
+  !isEmpty(value) ? `${key} % ${sanitize(value)}` : null;
+
+const gt = (key, value) =>
+  !isEmpty(value) ? `${key} > ${sanitize(value)}` : null;
+
+const gte = (key, value) =>
+  !isEmpty(value) ? `${key} >= ${sanitize(value)}` : null;
+
+const lt = (key, value) =>
+  !isEmpty(value) ? `${key} < ${sanitize(value)}` : null;
+
+const lte = (key, value) =>
+  !isEmpty(value) ? `${key} <= ${sanitize(value)}` : null;
+
+// Logical Operators
+const and = (clauses) => clauses.join(' and ');
+
+const or = (clauses) => clauses.join(' or ');
+
+const parenthetical = (expression) => (expression ? `(${expression})` : null);

addons/api/addon/utils/paginate-results.js

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * Takes an array and the current page and pagesize to calculate the correct
+ * number of results to return to the caller.
+ *
+ * @param array
+ * @param page
+ * @param pageSize
+ * @returns {[*]}
+ */
+export const paginateResults = (array, page, pageSize) => {
+  const length = array?.length;
+  if (!array || length === 0) {
+    return [];
+  }
+  if (!page || !pageSize) {
+    return array;
+  }
+
+  const offset = (page - 1) * pageSize;
+  const start = Math.min(length - 1, offset);
+  const end = Math.min(length, offset + pageSize);
+
+  return array.slice(start, end);
+};

addons/api/app/abilities/policy.js

@@ -3,4 +3,4 @@
  * SPDX-License-Identifier: MPL-2.0
  */
 
-export { default } from 'api/transforms/principal-array';
+export { default } from 'api/abilities/policy';

addons/api/app/abilities/scope.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/abilities/scope';

addons/api/app/handlers/client-daemon-handler.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default, resourceNames } from 'api/handlers/client-daemon-handler';

addons/api/app/initializers/deprecations.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default, initialize } from 'api/initializers/deprecations';

addons/api/app/models/alias.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/models/alias';

addons/api/app/models/policy.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/models/policy';

addons/api/app/serializers/channel-recording.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/serializers/channel-recording';

addons/api/app/serializers/scope.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/serializers/scope';

addons/api/app/services/indexed-db.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/services/indexed-db';

addons/api/app/services/store.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/services/store';

addons/api/app/transforms/array.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/transforms/array';

addons/api/app/transforms/object.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export { default } from 'api/transforms/object';

addons/api/mirage/config.js

@@ -73,8 +73,12 @@ function routes() {
           return scope.scope ? scope.scope.id === scope_id : false;
         });
       }
-      return resultSet.filter(makeBooleanFilter(filter));
-    }
+      const filteredResultSet = resultSet.filter(makeBooleanFilter(filter));
+      // add a response_type to the response to simulate pagination
+      // without having response_type, the unsupported controller modal
+      // will show when running with mirage
+      return { items: filteredResultSet.models, response_type: 'complete' };
+    },
   );
   this.post('/scopes', function ({ scopes }) {
     // Parent scope comes through the payload via `scope_id`, but this needs
@@ -88,31 +92,32 @@ function routes() {
   this.get('/scopes/:id');
   this.patch('/scopes/:id');
   this.del('/scopes/:id');
+  this.post(
+    '/scopes/:idMethod',
+    function ({ scopes }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const scope = scopes.find(id);
 
+      const updatedAttrs = {
+        version: attrs.version,
+        storagePolicyId: attrs.storagePolicyId,
+      };
+
+      if (method === 'attach-storage-policy') {
+        updatedAttrs.storagePolicyId = attrs.storagePolicyId;
+      }
+
+      if (method === 'detach-storage-policy') {
+        updatedAttrs.storagePolicyId = '';
+      }
+      return scope.update(updatedAttrs);
+    },
+  );
   // Auth & IAM resources
 
-  this.get(
-    '/auth-methods',
-    ({ authMethods }, { queryParams: { scope_id, recursive, filter } }) => {
-      let resultSet;
-      if (recursive && scope_id === 'global') {
-        resultSet = authMethods.all();
-      } else if (recursive) {
-        resultSet = authMethods.where((authMethod) => {
-          const authMethodModel = authMethods.find(authMethod.id);
-          return (
-            authMethod.scopeId === scope_id ||
-            authMethodModel?.scope?.scope?.id === scope_id
-          );
-        });
-      } else {
-        resultSet = authMethods.where(
-          (authMethod) => authMethod.scopeId === scope_id
-        );
-      }
-      return resultSet.filter(makeBooleanFilter(filter));
-    }
-  );
+  this.get('/auth-methods');
   this.post('/auth-methods', function ({ authMethods }) {
     const attrs = this.normalizedRequestAttrs();
     if (attrs.type === 'oidc') {
@@ -130,7 +135,7 @@ function routes() {
       }
 
       return authMethods.find(id).update(attrs);
-    }
+    },
   );
   this.del('/auth-methods/:id', ({ authMethods }, { params: { id } }) => {
     const authMethod = authMethods.find(id);
@@ -149,7 +154,7 @@ function routes() {
     '/accounts',
     (
       { accounts },
-      { queryParams: { auth_method_id: authMethodId, filter } }
+      { queryParams: { auth_method_id: authMethodId, filter } },
     ) => {
       let resultSet;
       if (authMethodId) {
@@ -158,7 +163,7 @@ function routes() {
         resultSet = accounts.all();
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.post('/accounts');
   this.get('/accounts/:id');
@@ -184,7 +189,7 @@ function routes() {
         updatedAttrs.attributes.password = attrs.new_password;
       }
       return account.update(updatedAttrs);
-    }
+    },
   );
 
   // Authenticate + auth methods custom routes
@@ -211,7 +216,7 @@ function routes() {
         resultSet = users.where((user) => user.scopeId === scope_id);
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.post('/users');
   this.get('/users/:id');
@@ -262,7 +267,7 @@ function routes() {
         resultSet = groups.where((group) => group.scopeId === scope_id);
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.post('/groups');
   this.get('/groups/:id');
@@ -294,13 +299,11 @@ function routes() {
         });
       }
       return group.update(updatedAttrs);
-    }
+    },
   );
 
   // IAM: Roles
-  this.get('/roles', ({ roles }, { queryParams: { scope_id: scopeId } }) => {
-    return roles.where({ scopeId });
-  });
+  this.get('/roles');
   this.post('/roles');
   this.get('/roles/:id');
   this.patch('/roles/:id');
@@ -309,7 +312,7 @@ function routes() {
     '/roles/:idMethod',
     function (
       { roles, users, groups, managedGroups },
-      { params: { idMethod } }
+      { params: { idMethod } },
     ) {
       const attrs = this.normalizedRequestAttrs();
       const id = idMethod.split(':')[0];
@@ -361,7 +364,7 @@ function routes() {
         updatedAttrs.managedGroupIds = updatedAttrs.managedGroupIds.filter(
           (id) => {
             return !attrs.principalIds.includes(id);
-          }
+          },
         );
       }
 
@@ -373,18 +376,13 @@ function routes() {
       }
 
       return role.update(updatedAttrs);
-    }
+    },
   );
 
   // Other resources
   // host-catalog
 
-  this.get(
-    '/host-catalogs',
-    ({ hostCatalogs }, { queryParams: { scope_id: scopeId } }) => {
-      return hostCatalogs.where({ scopeId });
-    }
-  );
+  this.get('/host-catalogs');
   this.post(
     '/host-catalogs',
     function ({ hostCatalogs }, { queryParams: { plugin_name } }) {
@@ -396,7 +394,7 @@ function routes() {
         };
       }
       return hostCatalogs.create(attrs);
-    }
+    },
   );
   this.get('/host-catalogs/:id');
   this.patch('/host-catalogs/:id');
@@ -408,7 +406,7 @@ function routes() {
     '/hosts',
     function ({ hosts }, { queryParams: { host_catalog_id: hostCatalogId } }) {
       return hosts.where({ hostCatalogId });
-    }
+    },
   );
   this.post('/hosts', function ({ hostCatalogs, hosts }) {
     const attrs = this.normalizedRequestAttrs();
@@ -426,14 +424,22 @@ function routes() {
     '/host-sets',
     function (
       { hostSets },
-      { queryParams: { host_catalog_id: hostCatalogId } }
+      { queryParams: { host_catalog_id: hostCatalogId } },
     ) {
       return hostSets.where({ hostCatalogId });
-    }
+    },
   );
+
   this.post('/host-sets', function ({ hostCatalogs, hostSets }) {
     const attrs = this.normalizedRequestAttrs();
     const hostCatalog = hostCatalogs.find(attrs.hostCatalogId);
+    //this needs to be attached while creating a plugin type host set to mimic API
+    if (hostCatalog.plugin) {
+      attrs.type = 'plugin';
+      attrs.plugin = {
+        name: hostCatalog.plugin.name,
+      };
+    }
     attrs.scopeId = hostCatalog.scope.id;
     return hostSets.create(attrs);
   });
@@ -469,7 +475,7 @@ function routes() {
       }
 
       return hostSet.update(updatedAttrs);
-    }
+    },
   );
 
   // target
@@ -492,7 +498,7 @@ function routes() {
         resultSet = targets.where((target) => target.scopeId === scope_id);
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.post('/targets', function ({ targets }) {
     const attrs = this.normalizedRequestAttrs();
@@ -540,7 +546,7 @@ function routes() {
         resultSet = sessions.where((session) => session.scopeId === scope_id);
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.get('/sessions/:id', function ({ sessions }, { params: { id } }) {
     const session = sessions.find(id);
@@ -565,7 +571,7 @@ function routes() {
         updatedAttrs.status = 'canceling';
       }
       return session.update(updatedAttrs);
-    }
+    },
   );
 
   // auth-tokens
@@ -578,11 +584,7 @@ function routes() {
 
   // credential-stores
 
-  this.get(
-    '/credential-stores',
-    ({ credentialStores }, { queryParams: { scope_id: scopeId } }) =>
-      credentialStores.where({ scopeId })
-  );
+  this.get('/credential-stores');
 
   this.get('/credential-stores/:id');
   this.post('/credential-stores');
@@ -595,8 +597,8 @@ function routes() {
     '/credential-libraries',
     (
       { credentialLibraries },
-      { queryParams: { credential_store_id: credentialStoreId } }
-    ) => credentialLibraries.where({ credentialStoreId })
+      { queryParams: { credential_store_id: credentialStoreId } },
+    ) => credentialLibraries.where({ credentialStoreId }),
   );
   this.get('/credential-libraries/:id');
   this.post(
@@ -606,7 +608,7 @@ function routes() {
       const credentialStore = credentialStores.find(attrs.credentialStoreId);
       attrs.scopeId = credentialStore.scope.id;
       return credentialLibraries.create(attrs);
-    }
+    },
   );
   this.del('/credential-libraries/:id');
   this.patch('/credential-libraries/:id');
@@ -617,8 +619,8 @@ function routes() {
     '/credentials',
     (
       { credentials },
-      { queryParams: { credential_store_id: credentialStoreId } }
-    ) => credentials.where({ credentialStoreId })
+      { queryParams: { credential_store_id: credentialStoreId } },
+    ) => credentials.where({ credentialStoreId }),
   );
   this.get('/credentials/:id');
   this.post('/credentials', function ({ credentialStores, credentials }) {
@@ -636,7 +638,7 @@ function routes() {
     '/managed-groups',
     (
       { managedGroups },
-      { queryParams: { auth_method_id: authMethodId, filter } }
+      { queryParams: { auth_method_id: authMethodId, filter } },
     ) => {
       let resultSet;
       if (authMethodId) {
@@ -645,7 +647,7 @@ function routes() {
         resultSet = managedGroups.all();
       }
       return resultSet.filter(makeBooleanFilter(filter));
-    }
+    },
   );
   this.post('/managed-groups');
   this.get('/managed-groups/:id');
@@ -657,7 +659,7 @@ function routes() {
     '/workers',
     ({ workers }, { queryParams: { scope_id: scopeId } }) => {
       return workers.where({ scopeId });
-    }
+    },
   );
   this.get('/workers/:id');
   this.del('/workers/:id');
@@ -681,7 +683,7 @@ function routes() {
         return storageBuckets.all();
       }
       return storageBuckets.where({ scopeId });
-    }
+    },
   );
   this.get('/storage-buckets/:id');
   this.del('/storage-buckets/:id');
@@ -700,21 +702,53 @@ function routes() {
       delete attrs.secrets;
 
       return storageBuckets.create(attrs);
-    }
+    },
   );
 
+  //storage-policy
+  this.get(
+    '/policies',
+    ({ policies }, { queryParams: { scope_id: scopeId } }) => {
+      return policies.where({ scopeId });
+    },
+  );
+  this.get('/policies/:id');
+  this.del('/policies/:id');
+  this.patch('/policies/:id');
+  this.post('/policies', function ({ policies }) {
+    const attrs = this.normalizedRequestAttrs();
+
+    return policies.create(attrs);
+  });
+
+  // Alias
+  this.get(
+    '/aliases',
+    ({ aliases }, { queryParams: { scope_id: scopeId } }) => {
+      return aliases.where({ scopeId });
+    },
+  );
+  this.get('/aliases/:id');
+  this.del('/aliases/:id');
+  this.patch('/aliases/:id');
+  this.post('/aliases', function ({ aliases }) {
+    const attrs = this.normalizedRequestAttrs();
+
+    return aliases.create(attrs);
+  });
+
   // session recordings
   this.get(
     '/session-recordings',
     (
       { sessionRecordings },
-      { queryParams: { scope_id: scopeId, recursive } }
+      { queryParams: { scope_id: scopeId, recursive } },
     ) => {
       if (recursive && scopeId === 'global') {
         return sessionRecordings.all();
       }
       return sessionRecordings.where({ scopeId });
-    }
+    },
   );
   this.get(
     '/session-recordings/:idMethod',
@@ -727,9 +761,29 @@ function routes() {
       } else {
         return sessionRecordings.find(id);
       }
-    }
+    },
   );
 
+  this.post(
+    '/session-recordings/:idMethod',
+    function ({ sessionRecordings }, { params: { idMethod } }) {
+      const attrs = this.normalizedRequestAttrs();
+      const id = idMethod.split(':')[0];
+      const method = idMethod.split(':')[1];
+      const record = sessionRecordings.find(id);
+      const updatedAttrs = {
+        version: attrs.version,
+      };
+      if (method === 'reapply-storage-policy') {
+        updatedAttrs.retain_until = faker.date.recent();
+        updatedAttrs.delete_after = faker.date.recent();
+      }
+      return record.update(updatedAttrs);
+    },
+  );
+
+  this.del('/session-recordings/:id');
+
   /* Uncomment the following line and the Response import above
    * Then change the response code to simulate error responses.
    * this.get('/scopes', () => new Response(505));

addons/api/mirage/factories/alias.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import factory from '../generated/factories/alias';
+import permissions from '../helpers/permissions';
+import generateId from '../helpers/id';
+
+const destinationIDs = ['', generateId('t_')];
+
+export default factory.extend({
+  id: () => generateId('alt_'),
+  destination_id: (i) => destinationIDs[i % destinationIDs.length],
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('alias') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
+});

addons/api/mirage/factories/auth-method.js

@@ -9,6 +9,7 @@ import permissions from '../helpers/permissions';
 import generateId from '../helpers/id';
 
 import {
+  TYPE_AUTH_METHOD_PASSWORD,
   TYPE_AUTH_METHOD_OIDC,
   TYPE_AUTH_METHOD_LDAP,
   TYPES_AUTH_METHOD,
@@ -23,11 +24,17 @@ export default factory.extend({
       'delete',
       'authenticate',
     ],
-  authorized_collection_actions: () => {
-    return {
-      accounts: ['create', 'list'],
-      'managed-groups': ['create', 'list'],
-    };
+  authorized_collection_actions() {
+    switch (this.type) {
+      case TYPE_AUTH_METHOD_PASSWORD:
+        return { accounts: ['create', 'list'] };
+      case TYPE_AUTH_METHOD_LDAP:
+      case TYPE_AUTH_METHOD_OIDC:
+        return {
+          accounts: ['create', 'list'],
+          'managed-groups': ['create', 'list'],
+        };
+    }
   },
 
   id: () => generateId('am_'),

addons/api/mirage/factories/credential-library.js

@@ -11,12 +11,18 @@ import {
   TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
   TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
   TYPES_CREDENTIAL_LIBRARY,
+  options,
 } from 'api/models/credential-library';
 
 export default factory.extend({
   id: () => generateId('cl_'),
   type: (i) => TYPES_CREDENTIAL_LIBRARY[i % TYPES_CREDENTIAL_LIBRARY.length],
 
+  credential_type(i) {
+    if (this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC) {
+      return options.credential_types[i % options.credential_types.length];
+    }
+  },
   authorized_actions: () =>
     permissions.authorizedActionsFor('credential-library') || [
       'no-op',

addons/api/mirage/factories/host-catalog.js

@@ -54,7 +54,7 @@ export default factory.extend({
         return {
           disable_credential_rotation: faker.datatype.boolean(),
           region: `us-${faker.location.cardinalDirection()}-${faker.number.int(
-            9
+            9,
           )}`,
         };
       case 'azure':
@@ -85,7 +85,16 @@ export default factory.extend({
     afterCreate(hostCatalog, server) {
       const { scope, type } = hostCatalog;
       const hosts = server.createList('host', 10, { scope, hostCatalog, type });
-      server.createList('host-set', 3, { scope, hostCatalog, hosts, type });
+      const hostSets = server.createList('host-set', 3, {
+        scope,
+        hostCatalog,
+        hosts,
+        type,
+      });
+      const hostSetIds = hostSets.map((hostSet) => hostSet.id);
+      hosts.forEach((host) => {
+        host.update({ hostSetIds });
+      });
     },
   }),
 });

addons/api/mirage/factories/policy.js

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import factory from '../generated/factories/policy';
+import permissions from '../helpers/permissions';
+import { faker } from '@faker-js/faker';
+import generateId from '../helpers/id';
+
+export default factory.extend({
+  id: () => generateId('pst_'),
+
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('policy') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
+
+  attributes() {
+    return {
+      retain_for: {
+        days: faker.number.int({ min: 10, max: 100 }),
+        overridable: faker.datatype.boolean(),
+      },
+
+      delete_after: {
+        days: faker.number.int({ min: 101, max: 500 }),
+        overridable: faker.datatype.boolean(),
+      },
+    };
+  },
+});

addons/api/mirage/factories/role.js

@@ -21,8 +21,8 @@ export default factory.extend({
     ],
   // eslint-disable-next-line ember/avoid-leaking-state-in-ember-objects
   grant_strings: () => [
-    'id=*;action=*',
-    'id=*;type=host-catalog;actions=create,read',
+    'ids=*;action=*',
+    'ids=*;type=host-catalog;actions=create,read',
   ],
 
   id: () => generateId('r_'),

addons/api/mirage/factories/scope.js

@@ -11,36 +11,48 @@ import generateId from '../helpers/id';
 export default factory.extend({
   type: 'global',
 
-  authorized_actions: () =>
-    permissions.authorizedActionsFor('scope') || [
-      'no-op',
-      'read',
-      'update',
-      'delete',
-    ],
+  authorized_actions() {
+    const authorizedActions = ['no-op', 'read', 'update'];
+
+    // Storage policies can only be attatched to global and org scopes.
+    if (this.type === 'global' || this.type === 'org') {
+      authorizedActions.push('attach-storage-policy', 'detach-storage-policy');
+    }
+
+    if (this.type === 'org' || this.type === 'project') {
+      authorizedActions.push('delete');
+    }
+
+    return permissions.authorizedActionsFor('scope') || authorizedActions;
+  },
 
   authorized_collection_actions() {
     const collectionActions = {
       scopes: ['create', 'list'],
-      users: ['create', 'list'],
-      sessions: ['list'],
       groups: ['create', 'list'],
       roles: ['create', 'list'],
-      targets: ['create', 'list'],
-      'credential-stores': ['create', 'list'],
-      'auth-methods': ['create', 'list'],
-      'host-catalogs': ['create', 'list'],
     };
 
-    // Worker permissions only available on the global scope
+    // Resources that are available only on the global scope
     if (this.type === 'global') {
       collectionActions.workers = ['create:worker-led', 'list'];
+      collectionActions.aliases = ['create', 'list'];
     }
 
-    // Session recording resources are only available on global or org scope
+    // Resources that are only available on the global or the org scope
     if (this.type === 'global' || this.type === 'org') {
       collectionActions['storage-buckets'] = ['create', 'list'];
       collectionActions['session-recordings'] = ['list'];
+      collectionActions.users = ['create', 'list'];
+      collectionActions['auth-methods'] = ['create', 'list'];
+      collectionActions['policies'] = ['create', 'list'];
+    }
+
+    if (this.type === 'project') {
+      collectionActions['credential-stores'] = ['create', 'list'];
+      collectionActions['host-catalogs'] = ['create', 'list'];
+      collectionActions.sessions = ['list'];
+      collectionActions.targets = ['create', 'list'];
     }
 
     return collectionActions;
@@ -58,7 +70,7 @@ export default factory.extend({
             type: 'org',
             scope: { id: record.id, type: record.type },
           },
-          'withChildren'
+          'withChildren',
         );
       }
       if (record.type === 'org') {

addons/api/mirage/factories/session-recording.js

@@ -43,11 +43,24 @@ export default factory.extend({
       : null;
   },
 
+  retain_until() {
+    return this.state === STATE_SESSION_RECORDING_AVAILABLE
+      ? faker.date.recent()
+      : null;
+  },
+  delete_after() {
+    return this.state === STATE_SESSION_RECORDING_AVAILABLE
+      ? faker.date.recent()
+      : null;
+  },
+
   authorized_actions: () =>
     permissions.authorizedActionsFor('session-recording') || [
       'no-op',
       'read',
       'download',
+      'reapply-storage-policy',
+      'delete',
     ],
 
   withNonExistingUserAndTarget: trait({
@@ -57,7 +70,8 @@ export default factory.extend({
       const session = pickRandomElement(server.schema.sessions.all().models);
       session.id = 'deleted_session';
       const target = pickRandomElement(
-        server.schema.targets.where((target) => target.storage_bucket_id).models
+        server.schema.targets.where((target) => target.storage_bucket_id)
+          .models,
       );
       target.id = 'deleted_target';
 
@@ -77,7 +91,8 @@ export default factory.extend({
       const user = pickRandomElement(server.schema.users.all().models);
       const session = pickRandomElement(server.schema.sessions.all().models);
       const target = pickRandomElement(
-        server.schema.targets.where((target) => target.storage_bucket_id).models
+        server.schema.targets.where((target) => target.storage_bucket_id)
+          .models,
       );
 
       sessionRecording.update({

addons/api/mirage/factories/session.js

@@ -7,6 +7,7 @@ import factory from '../generated/factories/session';
 import { trait } from 'miragejs';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';
+import permissions from '../helpers/permissions';
 
 const statusStrings = ['pending', 'active', 'canceling', 'terminated'];
 
@@ -15,7 +16,8 @@ export const pickRandomStatusString = () =>
 
 export default factory.extend({
   id: () => generateId('ss_'),
-
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('session') || ['read', 'cancel'],
   status: pickRandomStatusString(),
 
   /**

addons/api/mirage/factories/storage-bucket.js

@@ -11,6 +11,7 @@ import {
   TYPES_STORAGE_BUCKET as types,
   TYPES_STORAGE_BUCKET_PLUGIN,
   TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3,
+  TYPE_STORAGE_BUCKET_PLUGIN_MINIO,
 } from 'api/models/storage-bucket';
 
 // Represents known plugin types, except "foobar" which models the possibility
@@ -46,10 +47,14 @@ export default factory.extend({
       case TYPE_STORAGE_BUCKET_PLUGIN_AWS_S3:
         return {
           region: `us-${faker.location.cardinalDirection()}-${faker.number.int(
-            9
+            9,
           )}`,
           disable_credential_rotation: faker.datatype.boolean(),
         };
+      case TYPE_STORAGE_BUCKET_PLUGIN_MINIO:
+        return {
+          endpoint_url: faker.internet.url(),
+        };
     }
   },
 });

addons/api/mirage/factories/target.js

@@ -60,7 +60,7 @@ export default factory.extend({
 
       randomlySelectedCredentialLibraries = server.schema.credentialLibraries
         .where(
-          (credentialLibrary) => credentialLibrary.scopeId === target.scope.id
+          (credentialLibrary) => credentialLibrary.scopeId === target.scope.id,
         )
         .models.filter(() => randomBoolean())
         .map((cred) => cred.id);
@@ -82,6 +82,14 @@ export default factory.extend({
         });
       }
 
+      const aliases = server.schema.aliases.all().models;
+      const randomlySelectedAliases =
+        aliases.length === 0 ? undefined : faker.helpers.arrayElement(aliases);
+      if (randomlySelectedAliases) {
+        target.update({
+          aliases: randomlySelectedAliases.aliases,
+        });
+      }
       target.update({
         hostSets: randomlySelectedHostSets,
         brokeredCredentialSourceIds: [

addons/api/mirage/generated/factories/alias.js

@@ -0,0 +1,21 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+import { Factory } from 'miragejs';
+import { faker } from '@faker-js/faker';
+import { TYPE_ALIAS_TARGET } from 'api/models/alias';
+
+/**
+ * GeneratedAliasModelFactory
+ */
+export default Factory.extend({
+  name: () => faker.word.words(),
+  type: TYPE_ALIAS_TARGET,
+  value: () => faker.word.words(),
+  description: () => faker.word.words(),
+  created_time: () => faker.date.recent(),
+  updated_time: () => faker.date.recent(),
+  version: () => faker.number.int(),
+});

addons/api/mirage/generated/factories/auth-method.js

@@ -42,6 +42,7 @@ export default Factory.extend({
           signing_algorithms: ['RS256', 'RS384'],
           allowed_audiences: ['www.alice.com', 'www.alice.com/admin'],
           idp_ca_certs: ['certificate-1234', 'certificate-5678'],
+          prompts: ['consent'],
         };
         break;
       case TYPE_AUTH_METHOD_LDAP:
@@ -51,7 +52,7 @@ export default Factory.extend({
           certificates: [faker.string.alphanumeric(50)],
           client_certificate: faker.string.alphanumeric(50),
           client_certificate_key: `---Begin Certificate --- ${faker.string.alphanumeric(
-            170
+            170,
           )} ---End Certificate ---`,
           client_certificate_key_hmac: faker.string.alphanumeric(50),
           enable_groups: true,