hashicorp-copywrite[bot]andCameron Perera
3d610427d0
* [COMPLIANCE] Add Copyright and License Headers * chore: 🤖 update Copyright headers to satisfy our lint rules --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Cameron Perera <cameron.perera@hashicorp.com>
84 lines
2.8 KiB
JavaScript
84 lines
2.8 KiB
JavaScript
/**
|
|
* Copyright (c) HashiCorp, Inc.
|
|
* SPDX-License-Identifier: MPL-2.0
|
|
*/
|
|
|
|
import { module, test } from 'qunit';
|
|
import { setupTest } from 'ember-qunit';
|
|
|
|
module('Unit | Abilities | Role', function (hooks) {
|
|
setupTest(hooks);
|
|
|
|
test('it reflects when a given role may set grants based on authorized_actions', function (assert) {
|
|
assert.expect(2);
|
|
const service = this.owner.lookup('service:can');
|
|
const model = {
|
|
authorized_actions: ['set-grants'],
|
|
};
|
|
assert.true(service.can('setGrants role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('setGrants role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
|
|
assert.expect(2);
|
|
const service = this.owner.lookup('service:can');
|
|
const model = {
|
|
authorized_actions: ['add-principals'],
|
|
};
|
|
assert.true(service.can('addPrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('addPrincipals role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
|
|
assert.expect(2);
|
|
const service = this.owner.lookup('service:can');
|
|
const model = {
|
|
authorized_actions: ['remove-principals'],
|
|
};
|
|
assert.true(service.can('removePrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('removePrincipals role', model));
|
|
});
|
|
|
|
test('it proxies role principal read ability to the appropriate ability type', function (assert) {
|
|
assert.expect(6);
|
|
const service = this.owner.lookup('service:can');
|
|
const user = {
|
|
constructor: { modelName: 'user' },
|
|
authorized_actions: [],
|
|
};
|
|
const group = {
|
|
constructor: { modelName: 'group' },
|
|
authorized_actions: [],
|
|
};
|
|
const managedGroup = {
|
|
constructor: { modelName: 'managed-group' },
|
|
authorized_actions: [],
|
|
};
|
|
assert.false(service.can('readPrincipal role', user));
|
|
assert.false(service.can('readPrincipal role', group));
|
|
assert.false(service.can('readPrincipal role', managedGroup));
|
|
user.authorized_actions.push('read');
|
|
group.authorized_actions.push('read');
|
|
managedGroup.authorized_actions.push('read');
|
|
assert.true(service.can('readPrincipal role', user));
|
|
assert.true(service.can('readPrincipal role', group));
|
|
assert.true(service.can('readPrincipal role', managedGroup));
|
|
});
|
|
|
|
test('it throws an error for unknown principal types on principal read check', function (assert) {
|
|
assert.expect(2);
|
|
const service = this.owner.lookup('service:can');
|
|
const account = {
|
|
constructor: { modelName: 'account' },
|
|
authorized_actions: ['read'],
|
|
};
|
|
assert.throws(() => {
|
|
service.can('readPrincipal role', account);
|
|
});
|
|
assert.true(service.can('read account', account));
|
|
});
|
|
});
|