hashiccandLisbet Alvarez
3a847605ed
* chore: 🤖 reapply previous ember-can upgrade from #3093 * chore: 🤖 add missing ember-inflector dependency * chore: 🤖 move @ember/string to be a dependency in desktop * chore: 🤖 re-run pnpm install to resolve lockfile dupe key error * chore: 🤖 remove unused abilities service injections Co-Authored-By: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com> --------- Co-authored-by: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com>
89 lines
3.1 KiB
JavaScript
89 lines
3.1 KiB
JavaScript
/**
|
|
* Copyright IBM Corp. 2021, 2026
|
|
* SPDX-License-Identifier: BUSL-1.1
|
|
*/
|
|
|
|
import { module, test } from 'qunit';
|
|
import { setupTest } from 'ember-qunit';
|
|
|
|
module('Unit | Abilities | Role', function (hooks) {
|
|
setupTest(hooks);
|
|
|
|
test('it reflects when a given role may set grants based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['set-grants'],
|
|
};
|
|
assert.true(service.can('setGrants role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('setGrants role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may add principals based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['add-principals'],
|
|
};
|
|
assert.true(service.can('addPrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('addPrincipals role', model));
|
|
});
|
|
|
|
test('it reflects when a given role may remove principals based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['remove-principals'],
|
|
};
|
|
assert.true(service.can('removePrincipals role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('removePrincipals role', model));
|
|
});
|
|
|
|
test('it proxies role principal read ability to the appropriate ability type', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const user = {
|
|
constructor: { modelName: 'user' },
|
|
authorized_actions: [],
|
|
};
|
|
const group = {
|
|
constructor: { modelName: 'group' },
|
|
authorized_actions: [],
|
|
};
|
|
const managedGroup = {
|
|
constructor: { modelName: 'managed-group' },
|
|
authorized_actions: [],
|
|
};
|
|
assert.false(service.can('readPrincipal role', user));
|
|
assert.false(service.can('readPrincipal role', group));
|
|
assert.false(service.can('readPrincipal role', managedGroup));
|
|
user.authorized_actions.push('read');
|
|
group.authorized_actions.push('read');
|
|
managedGroup.authorized_actions.push('read');
|
|
assert.true(service.can('readPrincipal role', user));
|
|
assert.true(service.can('readPrincipal role', group));
|
|
assert.true(service.can('readPrincipal role', managedGroup));
|
|
});
|
|
|
|
test('it throws an error for unknown principal types on principal read check', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const account = {
|
|
constructor: { modelName: 'account' },
|
|
authorized_actions: ['read'],
|
|
};
|
|
assert.throws(() => {
|
|
service.can('readPrincipal role', account);
|
|
});
|
|
assert.true(service.can('read account', account));
|
|
});
|
|
|
|
test('can set grant scopes based on authorized_actions', function (assert) {
|
|
const service = this.owner.lookup('service:abilities');
|
|
const model = {
|
|
authorized_actions: ['set-grant-scopes'],
|
|
};
|
|
assert.true(service.can('setGrantScopes role', model));
|
|
model.authorized_actions = [];
|
|
assert.false(service.can('setGrantScopes role', model));
|
|
});
|
|
});
|