Ensure user cannot unassign in assign page, improve visuals

assets/translations/en-us.yaml

@@ -2194,6 +2194,7 @@ rbac:
         description: Additional roles to define more fine-grain permissions model.
     unknownRole:
         description: No description provided
+    assignOnlyRole: This role is already assigned
     role:
       admin:
         label: Administrator

components/GlobalRoleBindings.vue

@@ -24,6 +24,10 @@ export default {
       type:    String,
       default: _VIEW,
     },
+    assignOnly: {
+      type:    Boolean,
+      default: false,
+    },
     type: {
       type:    String,
       default: 'group',
@@ -83,6 +87,7 @@ export default {
       sortedRoles:           null,
       selectedRoles:         [],
       startingSelectedRoles: [],
+      assignOnlyRoles:       {},
       roleChanges:           {}
     };
   },
@@ -127,6 +132,7 @@ export default {
     update() {
       this.selectedRoles = [];
       this.startingSelectedRoles = [];
+      this.assignOnlyRoles = {};
       if (this.isCreate) {
         // Start with the new user default for each role
         Object.values(this.sortedRoles).forEach((roles) => {
@@ -156,6 +162,8 @@ export default {
                 roleId:    mappedRole.id,
                 bindingId: boundRole.id
               });
+              // Checkboxes should be disabled, besides normal 'mode' ways, if we're only assigning and not removing existing roles
+              this.assignOnlyRoles[mappedRole.id] = this.assignOnly;
             }
           });
         });
@@ -264,6 +272,7 @@ export default {
         return verbsRequiredForLogin.includes(verbs[0]);
       }
     },
+
   }
 };
 </script>
@@ -285,6 +294,8 @@ export default {
                 :key="getUnique(roleType, role.id, 'checkbox')"
                 v-model="selectedRoles"
                 :value-when-true="role.id"
+                :disabled="!!assignOnlyRoles[role.id]"
+                :tooltip-key="!!assignOnlyRoles[role.id] ? 'rbac.globalRoles.assignOnlyRole' : ''"
                 :label="role.nameDisplay"
                 :mode="mode"
                 @input="checkboxChanged"

pages/c/_cluster/auth/group.principal/assign-edit.vue

@@ -83,7 +83,7 @@ export default {
       <form>
         <SelectPrincipal :retain-selection="true" class="mb-20" :show-my-group-types="['group']" :search-group-types="'group'" @add="setPrincipal" />
 
-        <GlobalRoleBindings ref="grb" :group-principal-id="principalId" :mode="mode" />
+        <GlobalRoleBindings ref="grb" :group-principal-id="principalId" :mode="mode" :assign-only="true" />
 
         <FooterComponent
           :mode="mode"