hashicc
b5d33948dc
* chore: 🤖 bump ember-can * chore: 🤖 rename "can" service (deprecated) to abilities See https://github.com/minutebase/ember-can/pull/152 * chore: 🤖 bump to ember-can@^8 * chore: 🤖 extend resolver for ember-can v7 breaking change https://github.com/minutebase/ember-can/pull/186
89 lines
3.1 KiB
JavaScript
89 lines
3.1 KiB
JavaScript
/**
|
|
* Copyright (c) HashiCorp, Inc.
|
|
* SPDX-License-Identifier: BUSL-1.1
|
|
*/
|
|
|
|
import { module, test } from 'qunit';
|
|
import { setupTest } from 'ember-qunit';
|
|
|
|
module('Unit | Abilities | Role', function (hooks) {
|
|
setupTest(hooks);
|
|
|
|
test('it reflects when a given role may set grants based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['set-grants'],
|
|
};
|
|
assert.true(service.can('setGrants role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('setGrants role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['add-principals'],
|
|
};
|
|
assert.true(service.can('addPrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('addPrincipals role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['remove-principals'],
|
|
};
|
|
assert.true(service.can('removePrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('removePrincipals role', model));
|
|
});
|
|
|
|
test('it proxies role principal read ability to the appropriate ability type', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const user = {
|
|
constructor: { modelName: 'user' },
|
|
authorized_actions: [],
|
|
};
|
|
const group = {
|
|
constructor: { modelName: 'group' },
|
|
authorized_actions: [],
|
|
};
|
|
const managedGroup = {
|
|
constructor: { modelName: 'managed-group' },
|
|
authorized_actions: [],
|
|
};
|
|
assert.false(service.can('readPrincipal role', user));
|
|
assert.false(service.can('readPrincipal role', group));
|
|
assert.false(service.can('readPrincipal role', managedGroup));
|
|
user.authorized_actions.push('read');
|
|
group.authorized_actions.push('read');
|
|
managedGroup.authorized_actions.push('read');
|
|
assert.true(service.can('readPrincipal role', user));
|
|
assert.true(service.can('readPrincipal role', group));
|
|
assert.true(service.can('readPrincipal role', managedGroup));
|
|
});
|
|
|
|
test('it throws an error for unknown principal types on principal read check', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const account = {
|
|
constructor: { modelName: 'account' },
|
|
authorized_actions: ['read'],
|
|
};
|
|
assert.throws(() => {
|
|
service.can('readPrincipal role', account);
|
|
});
|
|
assert.true(service.can('read account', account));
|
|
});
|
|
|
|
test('can set grant scopes based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['set-grant-scopes'],
|
|
};
|
|
assert.true(service.can('setGrantScopes role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('setGrantScopes role', model));
|
|
});
|
|
});
|