From ace0bc47b9e3930b96a1ef037673eb1affdde1b7 Mon Sep 17 00:00:00 2001
From: Richard Cox <richard.cox@suse.com>
Date: Fri, 19 Mar 2021 11:44:04 +0000
Subject: [PATCH] Ensure user cannot unassign in assign page, improve visuals

---
 assets/translations/en-us.yaml                        |  1 +
 components/GlobalRoleBindings.vue                     | 11 +++++++++++
 pages/c/_cluster/auth/group.principal/assign-edit.vue |  2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/assets/translations/en-us.yaml b/assets/translations/en-us.yaml
index 7b0aaf84e1..5ff5fba9dd 100644
--- a/assets/translations/en-us.yaml
+++ b/assets/translations/en-us.yaml
@@ -2194,6 +2194,7 @@ rbac:
         description: Additional roles to define more fine-grain permissions model.
     unknownRole:
         description: No description provided
+    assignOnlyRole: This role is already assigned
     role:
       admin:
         label: Administrator
diff --git a/components/GlobalRoleBindings.vue b/components/GlobalRoleBindings.vue
index 68d755e4c8..a3eccecf9b 100644
--- a/components/GlobalRoleBindings.vue
+++ b/components/GlobalRoleBindings.vue
@@ -24,6 +24,10 @@ export default {
       type:    String,
       default: _VIEW,
     },
+    assignOnly: {
+      type:    Boolean,
+      default: false,
+    },
     type: {
       type:    String,
       default: 'group',
@@ -83,6 +87,7 @@ export default {
       sortedRoles:           null,
       selectedRoles:         [],
       startingSelectedRoles: [],
+      assignOnlyRoles:       {},
       roleChanges:           {}
     };
   },
@@ -127,6 +132,7 @@ export default {
     update() {
       this.selectedRoles = [];
       this.startingSelectedRoles = [];
+      this.assignOnlyRoles = {};
       if (this.isCreate) {
         // Start with the new user default for each role
         Object.values(this.sortedRoles).forEach((roles) => {
@@ -156,6 +162,8 @@ export default {
                 roleId:    mappedRole.id,
                 bindingId: boundRole.id
               });
+              // Checkboxes should be disabled, besides normal 'mode' ways, if we're only assigning and not removing existing roles
+              this.assignOnlyRoles[mappedRole.id] = this.assignOnly;
             }
           });
         });
@@ -264,6 +272,7 @@ export default {
         return verbsRequiredForLogin.includes(verbs[0]);
       }
     },
+
   }
 };
 </script>
@@ -285,6 +294,8 @@ export default {
                 :key="getUnique(roleType, role.id, 'checkbox')"
                 v-model="selectedRoles"
                 :value-when-true="role.id"
+                :disabled="!!assignOnlyRoles[role.id]"
+                :tooltip-key="!!assignOnlyRoles[role.id] ? 'rbac.globalRoles.assignOnlyRole' : ''"
                 :label="role.nameDisplay"
                 :mode="mode"
                 @input="checkboxChanged"
diff --git a/pages/c/_cluster/auth/group.principal/assign-edit.vue b/pages/c/_cluster/auth/group.principal/assign-edit.vue
index c237ece9f3..8f612b99bb 100644
--- a/pages/c/_cluster/auth/group.principal/assign-edit.vue
+++ b/pages/c/_cluster/auth/group.principal/assign-edit.vue
@@ -83,7 +83,7 @@ export default {
       <form>
         <SelectPrincipal :retain-selection="true" class="mb-20" :show-my-group-types="['group']" :search-group-types="'group'" @add="setPrincipal" />
 
-        <GlobalRoleBindings ref="grb" :group-principal-id="principalId" :mode="mode" />
+        <GlobalRoleBindings ref="grb" :group-principal-id="principalId" :mode="mode" :assign-only="true" />
 
         <FooterComponent
           :mode="mode"