latest changes

Author: roncodes

addon/components/widget/access-risk.hbs

@@ -0,0 +1,20 @@
+<Widget::IamDashboardWidget @endpoint="privileged-access" @title="Access Risk" @subtitle="Privileged exposure requiring review" @icon="user-lock" as |data|>
+    <div class="iam-stat-grid iam-stat-grid-3 iam-risk-summary">
+        <div class="iam-stat-card"><span>{{data.privileged_roles_count}}</span><small>Admin roles</small></div>
+        <div class="iam-stat-card"><span>{{data.wildcard_policies_count}}</span><small>Wildcard policies</small></div>
+        <div class="iam-stat-card"><span>{{data.direct_privileged_grants}}</span><small>Direct grants</small></div>
+    </div>
+    <div class="iam-scroll-list mt-3">
+        {{#each data.roles as |role|}}
+            <div class="iam-list-row iam-risk-row">
+                <div class="min-w-0">
+                    <div class="iam-list-title">{{role.name}}</div>
+                    <div class="iam-list-subtitle">{{role.type}}</div>
+                </div>
+                <strong>{{role.permissions_count}}</strong>
+            </div>
+        {{else}}
+            <div class="iam-widget-empty">No privileged access risks detected</div>
+        {{/each}}
+    </div>
+</Widget::IamDashboardWidget>

addon/components/widget/access-risk.js

@@ -0,0 +1,3 @@
+import Component from '@glimmer/component';
+
+export default class WidgetAccessRiskComponent extends Component {}

addon/components/widget/user-type-creation-trend.hbs

@@ -0,0 +1,11 @@
+<Widget::IamDashboardWidget
+    @endpoint="users-by-type-created"
+    @title="Users by Type Created Over Time"
+    @subtitle="New identities grouped by user type"
+    @icon="chart-column"
+    as |data|
+>
+    <div class="iam-chart-frame iam-chart-frame-tall">
+        <Chart @type="bar" @labels={{data.labels}} @datasets={{data.datasets}} @options={{this.chartOptions}} />
+    </div>
+</Widget::IamDashboardWidget>

addon/components/widget/user-type-creation-trend.js

@@ -0,0 +1,18 @@
+import Component from '@glimmer/component';
+
+export default class WidgetUserTypeCreationTrendComponent extends Component {
+    get chartOptions() {
+        return {
+            responsive: true,
+            maintainAspectRatio: false,
+            plugins: {
+                legend: { position: 'bottom' },
+                tooltip: { mode: 'index', intersect: false },
+            },
+            scales: {
+                x: { stacked: true, grid: { display: false }, ticks: { font: { size: 10 } } },
+                y: { stacked: true, ticks: { precision: 0, font: { size: 10 } } },
+            },
+        };
+    }
+}

addon/controllers/application.js

@@ -0,0 +1,115 @@
+import Controller from '@ember/controller';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+
+export default class ApplicationController extends Controller {
+    @service intl;
+    @service abilities;
+    @service fetch;
+
+    get navigationItems() {
+        return [
+            {
+                label: this.intl.t('iam.common.dashboard'),
+                description: 'Identity and access overview.',
+                tooltip: true,
+                icon: 'home',
+                route: 'console.iam.home',
+                keywords: ['home', 'overview', 'metrics'],
+            },
+            {
+                label: this.intl.t('iam.common.user'),
+                description: 'Manage identities and account types.',
+                icon: 'id-card',
+                route: 'console.iam.users',
+                permission: 'iam list user',
+                visible: this.can('iam see user'),
+                keywords: ['identity', 'accounts', 'members'],
+                children: [
+                    {
+                        label: 'Users',
+                        description: 'All console users.',
+                        icon: 'user',
+                        route: 'console.iam.users.index',
+                        permission: 'iam list user',
+                        visible: this.can('iam see user'),
+                        keywords: ['people', 'members'],
+                    },
+                    {
+                        label: 'Drivers',
+                        description: 'Driver accounts.',
+                        icon: 'id-card',
+                        route: 'console.iam.users.drivers',
+                        permission: 'iam list user',
+                        visible: this.can('iam see user'),
+                        keywords: ['fleet operators'],
+                    },
+                    {
+                        label: 'Customers',
+                        description: 'Customer accounts.',
+                        icon: 'users',
+                        route: 'console.iam.users.customers',
+                        permission: 'iam list user',
+                        visible: this.can('iam see user'),
+                        keywords: ['clients'],
+                    },
+                ],
+            },
+            {
+                label: this.intl.t('iam.common.group'),
+                description: 'Organize users into access groups.',
+                icon: 'building',
+                route: 'console.iam.groups',
+                permission: 'iam list group',
+                visible: this.can('iam see group'),
+                keywords: ['teams', 'memberships'],
+            },
+            {
+                label: this.intl.t('iam.common.roles'),
+                description: 'Define reusable permission bundles.',
+                icon: 'tag',
+                route: 'console.iam.roles',
+                permission: 'iam list role',
+                visible: this.can('iam see role'),
+                keywords: ['access levels'],
+            },
+            {
+                label: this.intl.t('iam.common.policies'),
+                description: 'Manage fine-grained access policies.',
+                icon: 'shield',
+                route: 'console.iam.policies',
+                permission: 'iam list policy',
+                visible: this.can('iam see policy'),
+                keywords: ['permissions', 'rules'],
+            },
+        ];
+    }
+
+    can(permission) {
+        try {
+            return this.abilities.can(permission);
+        } catch (_) {
+            return true;
+        }
+    }
+
+    @action
+    async searchNavigation({ query, limit = 12 }) {
+        const trimmedQuery = query?.trim();
+
+        if (!trimmedQuery) {
+            return [];
+        }
+
+        try {
+            const response = await this.fetch.get('iam/search', {
+                query: trimmedQuery,
+                limit,
+            });
+
+            return response.results ?? [];
+        } catch (_) {
+            return [];
+        }
+    }
+}

addon/controllers/groups/index.js

@@ -23,7 +23,7 @@ export default class GroupsIndexController extends Controller {
      *
      * @var {Array}
      */
-    queryParams = ['page', 'limit', 'sort', 'query', 'type', 'created_by', 'updated_by', 'status'];
+    queryParams = ['view_group', 'page', 'limit', 'sort', 'query', 'type', 'created_by', 'updated_by', 'status'];
 
     /**
      * The current page of data being viewed
@@ -45,6 +45,7 @@ export default class GroupsIndexController extends Controller {
      * @var {Integer}
      */
     @tracked query;
+    @tracked view_group;
 
     /**
      * The param to sort the data on, the param with prepended `-` is descending
@@ -271,4 +272,32 @@ export default class GroupsIndexController extends Controller {
             },
         });
     }
+
+    @action async openDeepLinkedResource() {
+        const resourceId = this.view_group;
+
+        if (!resourceId) {
+            return;
+        }
+
+        try {
+            const record = this.store.peekRecord('group', resourceId) ?? (await this.store.findRecord('group', resourceId));
+            this.editGroup(record, {
+                onDecline: this.clearDeepLinkedResource,
+                onFinish: this.clearDeepLinkedResource,
+            });
+        } catch (_) {
+            this.notifications.warning('Unable to open the selected IAM resource.');
+            this.clearDeepLinkedResource();
+        }
+    }
+
+    @action clearDeepLinkedResource() {
+        if (!this.view_group) {
+            return;
+        }
+
+        this.view_group = null;
+        this.hostRouter.transitionTo({ queryParams: { view_group: null } });
+    }
 }

addon/controllers/policies/index.js

@@ -23,7 +23,7 @@ export default class PoliciesIndexController extends Controller {
      *
      * @var {Array}
      */
-    queryParams = ['page', 'limit', 'sort', 'query', 'type', 'created_by', 'updated_by', 'status', 'service', 'type'];
+    queryParams = ['view_policy', 'page', 'limit', 'sort', 'query', 'type', 'created_by', 'updated_by', 'status', 'service', 'type'];
 
     /**
      * The current page of data being viewed
@@ -45,6 +45,7 @@ export default class PoliciesIndexController extends Controller {
      * @var {Integer}
      */
     @tracked query;
+    @tracked view_policy;
 
     /**
      * The param to sort the data on, the param with prepended `-` is descending
@@ -244,7 +245,7 @@ export default class PoliciesIndexController extends Controller {
      */
     @action editPolicy(policy, options = {}) {
         if (!policy.is_mutable) {
-            return this.viewPolicyPermissions(policy);
+            return this.viewPolicyPermissions(policy, options);
         }
 
         const formPermission = 'iam update policy';
@@ -282,12 +283,13 @@ export default class PoliciesIndexController extends Controller {
      * @param {PolicyModel} policy
      * @memberof PoliciesIndexController
      */
-    @action viewPolicyPermissions(policy) {
+    @action viewPolicyPermissions(policy, options = {}) {
         this.modalsManager.show('modals/view-policy-permissions', {
             title: this.intl.t('iam.components.modals.view-policy-permissions.view-permissions', { policyName: policy.name }),
             hideDeclineButton: true,
             acceptButtonText: this.intl.t('common.done'),
             policy,
+            ...options,
         });
     }
 
@@ -335,4 +337,32 @@ export default class PoliciesIndexController extends Controller {
     @action reload() {
         return this.hostRouter.refresh();
     }
+
+    @action async openDeepLinkedResource() {
+        const resourceId = this.view_policy;
+
+        if (!resourceId) {
+            return;
+        }
+
+        try {
+            const record = this.store.peekRecord('policy', resourceId) ?? (await this.store.findRecord('policy', resourceId));
+            this.editPolicy(record, {
+                onDecline: this.clearDeepLinkedResource,
+                onFinish: this.clearDeepLinkedResource,
+            });
+        } catch (_) {
+            this.notifications.warning('Unable to open the selected IAM resource.');
+            this.clearDeepLinkedResource();
+        }
+    }
+
+    @action clearDeepLinkedResource() {
+        if (!this.view_policy) {
+            return;
+        }
+
+        this.view_policy = null;
+        this.hostRouter.transitionTo({ queryParams: { view_policy: null } });
+    }
 }

addon/controllers/roles/index.js

@@ -23,7 +23,7 @@ export default class RolesIndexController extends Controller {
      *
      * @var {Array}
      */
-    queryParams = ['page', 'limit', 'sort', 'query', 'service', 'type'];
+    queryParams = ['view_role', 'page', 'limit', 'sort', 'query', 'service', 'type'];
 
     /**
      * The current page of data being viewed
@@ -45,6 +45,7 @@ export default class RolesIndexController extends Controller {
      * @var {Integer}
      */
     @tracked query;
+    @tracked view_role;
 
     /**
      * The param to sort the data on, the param with prepended `-` is descending
@@ -253,7 +254,7 @@ export default class RolesIndexController extends Controller {
      */
     @action editRole(role, options = {}) {
         if (!role.is_mutable) {
-            return this.viewRolePermissions(role);
+            return this.viewRolePermissions(role, options);
         }
 
         const formPermission = 'iam update role';
@@ -335,12 +336,13 @@ export default class RolesIndexController extends Controller {
      * @param {RoleModel} role
      * @memberof RolesIndexController
      */
-    @action viewRolePermissions(role) {
+    @action viewRolePermissions(role, options = {}) {
         this.modalsManager.show('modals/view-role-permissions', {
             title: this.intl.t('iam.components.modals.view-role-permissions.view-permissions', { roleName: role.name }),
             hideDeclineButton: true,
             acceptButtonText: this.intl.t('common.done'),
             role,
+            ...options,
         });
     }
 
@@ -359,4 +361,32 @@ export default class RolesIndexController extends Controller {
     @action reload() {
         return this.hostRouter.refresh();
     }
+
+    @action async openDeepLinkedResource() {
+        const resourceId = this.view_role;
+
+        if (!resourceId) {
+            return;
+        }
+
+        try {
+            const record = this.store.peekRecord('role', resourceId) ?? (await this.store.findRecord('role', resourceId));
+            this.editRole(record, {
+                onDecline: this.clearDeepLinkedResource,
+                onFinish: this.clearDeepLinkedResource,
+            });
+        } catch (_) {
+            this.notifications.warning('Unable to open the selected IAM resource.');
+            this.clearDeepLinkedResource();
+        }
+    }
+
+    @action clearDeepLinkedResource() {
+        if (!this.view_role) {
+            return;
+        }
+
+        this.view_role = null;
+        this.hostRouter.transitionTo({ queryParams: { view_role: null } });
+    }
 }