From 21d0978ff9544d489daf58394eabf0a38486da2c Mon Sep 17 00:00:00 2001
From: Stan Silvert <ssilvert@redhat.com>
Date: Mon, 19 Aug 2024 16:13:00 -0400
Subject: [PATCH] Let create/edit client role w/ fine-grained auth.

Fixes #31537

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
---
 js/apps/admin-ui/src/clients/routes/NewRole.tsx       |  2 +-
 .../admin-ui/src/components/role-form/RoleForm.tsx    |  1 +
 js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx    | 11 +++++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/js/apps/admin-ui/src/clients/routes/NewRole.tsx b/js/apps/admin-ui/src/clients/routes/NewRole.tsx
index 0015c5f0812d..c492fcaeeb56 100644
--- a/js/apps/admin-ui/src/clients/routes/NewRole.tsx
+++ b/js/apps/admin-ui/src/clients/routes/NewRole.tsx
@@ -12,7 +12,7 @@ export const NewRoleRoute: AppRouteObject = {
   element: <CreateClientRole />,
   breadcrumb: (t) => t("createRole"),
   handle: {
-    access: "manage-clients",
+    access: "query-clients",
   },
 };
 
diff --git a/js/apps/admin-ui/src/components/role-form/RoleForm.tsx b/js/apps/admin-ui/src/components/role-form/RoleForm.tsx
index be3d556da72f..9f63ea3e58ee 100644
--- a/js/apps/admin-ui/src/components/role-form/RoleForm.tsx
+++ b/js/apps/admin-ui/src/components/role-form/RoleForm.tsx
@@ -50,6 +50,7 @@ export const RoleForm = ({
           onSubmit={handleSubmit(onSubmit)}
           role={role}
           className="pf-v5-u-mt-lg"
+          fineGrainedAccess={true} // We would never want to show this form in read-only mode
         >
           <TextControl
             name="name"
diff --git a/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx b/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
index 32f888059c25..8db092355327 100644
--- a/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
+++ b/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
@@ -80,6 +80,8 @@ export default function RealmRoleTabs() {
     "manage-authorization",
   );
 
+  const [canManageClientRole, setCanManageClientRole] = useState(false);
+
   const [open, setOpen] = useState(false);
   const convert = (role: RoleRepresentation) => {
     const { attributes, ...rest } = role;
@@ -116,6 +118,14 @@ export default function RealmRoleTabs() {
     [key],
   );
 
+  useFetch(
+    async () => adminClient.clients.findOne({ id: clientId }),
+    (client) => {
+      if (clientId) setCanManageClientRole(client?.access?.manage as boolean);
+    },
+    [],
+  );
+
   const onSubmit: SubmitHandler<AttributeForm> = async (formValues) => {
     try {
       const { attributes, ...rest } = formValues;
@@ -312,6 +322,7 @@ export default function RealmRoleTabs() {
                 <AttributesForm
                   form={form}
                   save={onSubmit}
+                  fineGrainedAccess={canManageClientRole}
                   reset={() =>
                     setValue("attributes", attributes, { shouldDirty: false })
                   }