From 23d4efed9db55ce2a3d12378bd2b09851e5d2a43 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Thu, 5 Dec 2024 15:26:44 +0300
Subject: [PATCH 1/7] Add helm envs checker and update i18n documentation

---
 scripts/helm-envs-checker/js-yaml    | 0
 scripts/helm-envs-checker/typescript | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 scripts/helm-envs-checker/js-yaml
 create mode 100644 scripts/helm-envs-checker/typescript

diff --git a/scripts/helm-envs-checker/js-yaml b/scripts/helm-envs-checker/js-yaml
new file mode 100644
index 000000000..e69de29bb
diff --git a/scripts/helm-envs-checker/typescript b/scripts/helm-envs-checker/typescript
new file mode 100644
index 000000000..e69de29bb

From 80132ca0890937678dd542e01648d32f590554f2 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Tue, 17 Dec 2024 16:34:28 +0300
Subject: [PATCH 2/7] Update roledefinition and matching

---
 app/src/App/fhir-apps.tsx                     | 10 +-
 app/src/configs/dispatchConfig.ts             |  3 +
 app/src/routes/index.tsx                      |  2 +-
 .../src/containers/ImportDetailView/index.tsx |  2 +
 .../src/containers/ImportListView/index.tsx   |  4 +-
 .../tests/__snapshots__/index.test.tsx.snap   |  9 +-
 packages/pkg-config/src/configStore/index.ts  |  6 +-
 packages/pkg-config/src/constants.ts          |  4 +
 packages/pkg-config/src/index.tsx             |  1 +
 packages/rbac/src/adapters/keycloakAdapter.ts | 98 +++++++++++--------
 packages/rbac/src/constants.ts                | 31 +++---
 packages/rbac/src/helpers/utils.ts            | 27 +++--
 packages/rbac/src/roleDefinition/index.ts     |  6 +-
 .../react-utils/src/helpers/test-utils.tsx    |  4 +-
 14 files changed, 121 insertions(+), 86 deletions(-)

diff --git a/app/src/App/fhir-apps.tsx b/app/src/App/fhir-apps.tsx
index 2db3c804e..761fa9d20 100644
--- a/app/src/App/fhir-apps.tsx
+++ b/app/src/App/fhir-apps.tsx
@@ -216,7 +216,7 @@ const FHIRApps = () => {
         disableLoginProtection={DISABLE_LOGIN_PROTECTION}
         exact
         path={DATA_IMPORT_LIST_URL}
-        permissions={['WebDataImport.read']}
+        permissions={['DataImport.read']}
         component={DataImportList}
       />
       <PrivateComponent
@@ -224,7 +224,7 @@ const FHIRApps = () => {
         disableLoginProtection={DISABLE_LOGIN_PROTECTION}
         exact
         path={`${DATA_IMPORT_CREATE_URL}`}
-        permissions={['WebDataImport.create']}
+        permissions={['DataImport.create']}
         component={StartDataImport}
       />
       <PrivateComponent
@@ -233,7 +233,7 @@ const FHIRApps = () => {
         exact
         path={`${DATA_IMPORT_DETAIL_URL}/:${'workflowId'}`}
         {...patientProps}
-        permissions={['WebDataImport.read']}
+        permissions={['DataImport.read']}
         component={ImportDetailViewDetails}
       />
       <PrivateComponent
@@ -242,7 +242,7 @@ const FHIRApps = () => {
         exact
         path={`${DATA_IMPORT_LIST_URL}/:${'workflowId'}`}
         {...patientProps}
-        permissions={['WebDataImport.read']}
+        permissions={['DataImport.read']}
         component={DataImportList}
       />
       <PrivateComponent
@@ -590,7 +590,7 @@ const FHIRApps = () => {
         exact
         path={APP_LOGIN_URL}
         render={() => {
-          window.location.href = OpenSRP;
+          window.location.href = `${OpenSRP}&kc_locale=fr`;
           return <></>;
         }}
       />
diff --git a/app/src/configs/dispatchConfig.ts b/app/src/configs/dispatchConfig.ts
index d62aa52eb..1085b7494 100644
--- a/app/src/configs/dispatchConfig.ts
+++ b/app/src/configs/dispatchConfig.ts
@@ -4,6 +4,7 @@ import {
   ProjectCode,
   setAllConfigs,
   getAllConfigs,
+  clientIdConfig,
 } from '@opensrp/pkg-config';
 import {
   BACKEND_ACTIVE,
@@ -17,6 +18,7 @@ import {
   AUTHZ_STRATEGY,
   COMMODITIES_LIST_RESOURCE_ID,
   FHIR_INVENTORY_LIST_ID,
+  OPENSRP_CLIENT_ID,
 } from './env';
 import { URL_BACKEND_LOGIN, URL_REACT_LOGIN } from '../constants';
 
@@ -26,6 +28,7 @@ const defaultvalues = getAllConfigs();
 
 const configObject: ConfigState = {
   ...defaultvalues,
+  [clientIdConfig]: OPENSRP_CLIENT_ID,
   languageCode: LANGUAGE_CODE as LanguageCode,
   projectCode: PROJECT_CODE as ProjectCode,
   appLoginURL: APP_LOGIN_URL,
diff --git a/app/src/routes/index.tsx b/app/src/routes/index.tsx
index 2528754e7..44aec1136 100644
--- a/app/src/routes/index.tsx
+++ b/app/src/routes/index.tsx
@@ -199,7 +199,7 @@ export function getRoutes(roles: string[], t: TFunction, userRole: UserRole): Ro
       title: t('Data Imports'),
       key: 'data-import',
       enabled: true,
-      permissions: ['WebDataImport.read'],
+      permissions: ['DataImport.read'],
       url: DATA_IMPORT_LIST_URL,
       isHomePageLink: true,
     },
diff --git a/packages/fhir-import/src/containers/ImportDetailView/index.tsx b/packages/fhir-import/src/containers/ImportDetailView/index.tsx
index 89692f968..de91d3db2 100644
--- a/packages/fhir-import/src/containers/ImportDetailView/index.tsx
+++ b/packages/fhir-import/src/containers/ImportDetailView/index.tsx
@@ -80,6 +80,8 @@ export const ImportDetailViewDetails = (_: RouteComponentProps) => {
     [t('Author')]: data.author,
   };
 
+  console.log({pageTitle})
+
   return (
     <BodyLayout headerProps={headerProps}>
       <Helmet>
diff --git a/packages/fhir-import/src/containers/ImportListView/index.tsx b/packages/fhir-import/src/containers/ImportListView/index.tsx
index ce6346c2c..728ea0831 100644
--- a/packages/fhir-import/src/containers/ImportListView/index.tsx
+++ b/packages/fhir-import/src/containers/ImportListView/index.tsx
@@ -81,7 +81,7 @@ export const DataImportList = () => {
       // eslint-disable-next-line react/display-name
       render: (_: unknown, record: WorkflowDescription) => (
         <span className="d-flex align-items-center">
-          <RbacCheck permissions={['WebDataImport.read']}>
+          <RbacCheck permissions={['DataImport.read']}>
             <>
               <Link
                 to={`${DATA_IMPORT_DETAIL_URL}/${record.workflowId.toString()}`}
@@ -118,7 +118,7 @@ export const DataImportList = () => {
         <Col className="main-content">
           <div className="main-content__header">
             <div />
-            <RbacCheck permissions={['WebDataImport.create']}>
+            <RbacCheck permissions={['DataImport.create']}>
               <Link to={DATA_IMPORT_CREATE_URL}>
                 <Button type="primary" onClick={() => history.push(DATA_IMPORT_CREATE_URL)}>
                   <CloudUploadOutlined />
diff --git a/packages/fhir-import/src/containers/ImportListView/tests/__snapshots__/index.test.tsx.snap b/packages/fhir-import/src/containers/ImportListView/tests/__snapshots__/index.test.tsx.snap
index 169b6900d..9e0e9c03d 100644
--- a/packages/fhir-import/src/containers/ImportListView/tests/__snapshots__/index.test.tsx.snap
+++ b/packages/fhir-import/src/containers/ImportListView/tests/__snapshots__/index.test.tsx.snap
@@ -50,6 +50,13 @@ exports[`Care Teams list view renders correctly: table row 1 page 1 6`] = `
 >
   <span
     class="d-flex align-items-center"
-  />
+  >
+    <a
+      class="m-0 p-1"
+      href="/importDetail/26aae779-0e6f-482d-82c3-a0fad1fd3689_orgToLocationAssignment"
+    >
+      View
+    </a>
+  </span>
 </td>
 `;
diff --git a/packages/pkg-config/src/configStore/index.ts b/packages/pkg-config/src/configStore/index.ts
index 44f909fb9..01cb7b8c2 100644
--- a/packages/pkg-config/src/configStore/index.ts
+++ b/packages/pkg-config/src/configStore/index.ts
@@ -1,6 +1,6 @@
 /** stores configuration for any other package */
 import { createGlobalState } from 'react-hooks-global-state';
-import { USER_PREFERENCE_KEY } from '../constants';
+import { clientIdConfig, USER_PREFERENCE_KEY } from '../constants';
 import { PaginationProps } from 'antd/lib/pagination/Pagination';
 
 export const supportedLanguageCodes = ['en', 'sw', 'fr', 'ar', 'th', 'vi'] as const;
@@ -31,6 +31,7 @@ export interface TableState {
 
 /** interface for configs for this package */
 export interface ConfigState {
+  [clientIdConfig]?: string;
   languageCode?: LanguageCode;
   projectCode?: ProjectCode;
   appLoginURL?: string;
@@ -58,7 +59,8 @@ export enum PractToOrgAssignmentStrategy {
   ONE_TO_MANY = 'ONE_TO_MANY', // one practitioner assignable to multiple organizations
 }
 
-const defaultConfigs: GlobalState = {
+const defaultConfigs: Partial<GlobalState> = {
+  [clientIdConfig]: undefined,
   languageCode: 'en',
   appLoginURL: undefined,
   keycloakBaseURL: undefined,
diff --git a/packages/pkg-config/src/constants.ts b/packages/pkg-config/src/constants.ts
index 0f5ae08bb..8ce97cae1 100644
--- a/packages/pkg-config/src/constants.ts
+++ b/packages/pkg-config/src/constants.ts
@@ -1,3 +1,7 @@
 export const SLICE_NOT_REGISTERED =
   'Looks like configuration slice is being used without having been yet registered to the store';
 export const USER_PREFERENCE_KEY = 'Preference';
+
+
+// magic strings
+export const clientIdConfig = "clientId" as const
diff --git a/packages/pkg-config/src/index.tsx b/packages/pkg-config/src/index.tsx
index a335889a7..2438b3d4b 100644
--- a/packages/pkg-config/src/index.tsx
+++ b/packages/pkg-config/src/index.tsx
@@ -1 +1,2 @@
 export * from './configStore';
+export * from './constants';
diff --git a/packages/rbac/src/adapters/keycloakAdapter.ts b/packages/rbac/src/adapters/keycloakAdapter.ts
index 8abd115b6..33b72bf3c 100644
--- a/packages/rbac/src/adapters/keycloakAdapter.ts
+++ b/packages/rbac/src/adapters/keycloakAdapter.ts
@@ -1,11 +1,7 @@
-import {
-  AuthZResource,
-  KeycloakDefinedResource,
-  KeycloakDefinedResources,
-  Permit,
-} from '../constants';
+import { AllSupportedRoles, allSupportedRoles, Permit } from '../constants';
 import { RbacAdapter } from '../helpers/types';
 import { UserRole } from '../roleDefinition';
+import { clientIdConfig, getConfig } from '@opensrp/pkg-config';
 
 const fhirVerbToPermitLookup: Record<string, Permit> = {
   GET: Permit.READ,
@@ -15,8 +11,8 @@ const fhirVerbToPermitLookup: Record<string, Permit> = {
   MANAGE: Permit.MANAGE,
 };
 
-const getFhirResourceString = (rawResourceString: string): KeycloakDefinedResource | undefined => {
-  const matchedResource = KeycloakDefinedResources.filter(
+const getFhirResourceString = (rawResourceString: string): AllSupportedRoles | undefined => {
+  const matchedResource = allSupportedRoles.filter(
     (resource) => resource.toUpperCase() === rawResourceString.toUpperCase()
   );
   return matchedResource[0];
@@ -37,24 +33,43 @@ export const parseFHirRoles = (role: string) => {
   const permit = fhirVerbToPermitLookup[verb.toUpperCase()];
   // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
   if (resource && permit) {
-    return new UserRole(resource as AuthZResource, permit);
+    return new UserRole(resource as AllSupportedRoles, permit);
   }
 };
 
-const keycloakRoleMappings: Record<string, UserRole> = {
-  'realm-admin': new UserRole(['iam_group', 'iam_role', 'iam_user'], Permit.MANAGE),
-  'view-users': new UserRole(['iam_user'], Permit.READ),
-  'manage-users': UserRole.combineRoles([
-    new UserRole(['iam_user'], Permit.MANAGE),
-    new UserRole(['iam_role', 'iam_group'], Permit.READ),
-  ]),
-  'query-groups': new UserRole(['iam_group'], Permit.READ),
-  'view-groups': new UserRole(['iam_group'], Permit.READ),
-  'query-users': new UserRole(['iam_user'], Permit.READ),
-};
+export const parseKeycloakClientRoles = (scope: string, stringRole: string) => {
+  const configuredClientId = getConfig(clientIdConfig) ?? '';
+  const keycloakRoleMappings: Record<string, Record<string, UserRole> | undefined> = {
+    'realm-management': {
+      'realm-admin': new UserRole(
+        ['iam_group', 'iam_role', 'iam_user', 'iam_realm'],
+        Permit.MANAGE
+      ),
+      'manage-realm': new UserRole(
+        ['iam_group', 'iam_role', 'iam_user', 'iam_realm'],
+        Permit.MANAGE
+      ),
+      'view-realm': new UserRole(['iam_group', 'iam_role', 'iam_user', 'iam_realm'], Permit.READ),
+      'query-realm': new UserRole(['iam_group', 'iam_role', 'iam_user', 'iam_realm'], Permit.READ),
+      'view-users': new UserRole(['iam_user'], Permit.READ),
+      'query-users': new UserRole(['iam_user'], Permit.READ),
+      'manage-users': UserRole.combineRoles([new UserRole(['iam_user'], Permit.MANAGE)]),
+      'query-groups': new UserRole(['iam_group'], Permit.READ),
+      'view-groups': new UserRole(['iam_group'], Permit.READ),
+    },
+    account: {
+      'manage-account': new UserRole(
+        ['account_user', 'account_application', 'account_group'],
+        Permit.MANAGE
+      ),
+      'view-groups': new UserRole(['account_group'], Permit.READ),
+    },
+  };
 
-export const parseKeycloakRoles = (stringRole: string) => {
-  const lookedURole = keycloakRoleMappings[stringRole] as UserRole | undefined;
+  if (scope === configuredClientId) {
+    return parseFHirRoles(stringRole);
+  }
+  const lookedURole = keycloakRoleMappings[scope]?.[stringRole] as UserRole | undefined;
   return lookedURole;
 };
 
@@ -72,28 +87,33 @@ export const adapter: RbacAdapter = (roles: KeycloakRoleData = defaultRoleData)
   /**
     parse each role, figure out which resource and verb permission it maps to and add that to the permission object
    */
-
-  let allRoleStrings = roles.realmAccess ?? [];
-  const invalidRoleStrings: string[] = [];
-  Object.values(roles.clientRoles ?? {}).forEach((roleArray) => {
-    allRoleStrings = [...allRoleStrings, ...roleArray];
-  });
-
+  const allRoleStrings = roles.realmAccess ?? [];
   const allRoles: UserRole[] = [];
-
-  allRoleStrings.forEach((role) => {
-    // check if we can first get a hit from keycloak default roles.
-    let asRole = parseKeycloakRoles(role);
-
-    if (asRole === undefined) {
-      asRole = parseFHirRoles(role);
-    }
-    if (asRole) {
-      allRoles.push(asRole);
+  const invalidRoleStrings: string[] = [];
+  for (const role of allRoleStrings) {
+    const asRoleDef = parseFHirRoles(role);
+    if (asRoleDef) {
+      allRoles.push(asRoleDef);
     } else {
       invalidRoleStrings.push(role);
     }
+  }
+  Object.entries(roles.clientRoles ?? {}).forEach(([scope, roleArray]) => {
+    roleArray.forEach((role) => {
+      // check if we can first get a hit from keycloak default roles.
+      let asRole = parseKeycloakClientRoles(scope, role);
+
+      if (asRole === undefined) {
+        asRole = parseFHirRoles(role);
+      }
+      if (asRole) {
+        allRoles.push(asRole);
+      } else {
+        invalidRoleStrings.push(role);
+      }
+    });
   });
+
   if (invalidRoleStrings.length > 0) {
     /* eslint-disable no-console */
     console.warn(`Could not understand the following roles: ${invalidRoleStrings.join(', ')}`);
diff --git a/packages/rbac/src/constants.ts b/packages/rbac/src/constants.ts
index 7381895fc..0a2cd7d89 100644
--- a/packages/rbac/src/constants.ts
+++ b/packages/rbac/src/constants.ts
@@ -8,18 +8,21 @@ export enum Permit {
   MANAGE = 0b1111,
 }
 
-/**
- * Authorization server resources that this web client is familiar with, thus we can enforce rbac for permissions on views that
- * deal with the below resource.
- */
-export const IamResources = ['iam_user', 'iam_role', 'iam_group'] as const;
-export type IamResource = typeof IamResources[number];
+/** Resources that the web client understands */
+
+/** Resources that relate with user self administration like deleting own account */
+export const accountClientResources = ['account_user', 'account_application', 'account_group'] as const
+export type AccountClientResources = typeof accountClientResources[number]
+
+/** Resources that relate to the realm administration like managing other users accounts */
+export const realmClientResources = ['iam_user', 'iam_realm', 'iam_group', 'iam_role'] as const
+export type RealmClientResources = typeof realmClientResources[number]
 
 /**
  * fhir hapi Server resources that this web client is familiar with, thus we can enforce rbac for permissions on views that
  * deal with the below resource.
  */
-export const FhirResources = [
+export const fhirResources = [
   'Patient',
   'Practitioner',
   'PractitionerRole',
@@ -42,22 +45,20 @@ export const FhirResources = [
   'Encounter',
   'Flag',
 ] as const;
-export type FhirResource = typeof FhirResources[number];
+export type FhirResources = typeof fhirResources[number];
 
 /**
  * Roles for Situations where we have views that are not directly tied to any of the native fhir resources.
  * These are custom and only relevant for the web. These should also be defined and parsed in a similar design as
  * FhirResources
  */
-export const WebCustomResources = ['WebDataImport'] as const;
-
-export type WebCustomResource = typeof WebCustomResources[number];
+export const webClientRoles = ['DataImport'] as const;
+export type WebClientRoles = typeof webClientRoles[number];
 
-export const KeycloakDefinedResources = [...FhirResources, ...WebCustomResources] as const;
-export type KeycloakDefinedResource = typeof KeycloakDefinedResources[number];
+export const allSupportedRoles = [...fhirResources, ...accountClientResources, ...realmClientResources, ...webClientRoles];
+export type AllSupportedRoles = typeof allSupportedRoles[number];
 
-export type AuthZResource = IamResource | FhirResource | WebCustomResource;
 export type BinaryNumber = number;
 export type PermitKey = keyof typeof Permit;
 export type PermitKeyValues = Valueof<typeof Permit>;
-export type ResourcePermitMap = Map<AuthZResource, number>;
+export type ResourcePermitMap = Map<AllSupportedRoles, number>;
diff --git a/packages/rbac/src/helpers/utils.ts b/packages/rbac/src/helpers/utils.ts
index 3c0e60ad3..38effb3e4 100644
--- a/packages/rbac/src/helpers/utils.ts
+++ b/packages/rbac/src/helpers/utils.ts
@@ -1,11 +1,9 @@
 import {
-  AuthZResource,
-  KeycloakDefinedResources,
-  IamResources,
+  allSupportedRoles,
   Permit,
   PermitKey,
   ResourcePermitMap,
-  WebCustomResources,
+  AllSupportedRoles,
 } from '../constants';
 import invariant from 'invariant';
 
@@ -22,17 +20,15 @@ export function makeArray<T>(obj: T | T[]): T[] {
   return asArray;
 }
 
-// TODO - this is not actually lowercased
-const lowerCasedAuthZResources = [
-  ...IamResources,
-  ...KeycloakDefinedResources,
-  ...WebCustomResources,
-].map(
-  (tag) => tag
-  // tag.toLowerCase()
-) as string[];
 export const permitLiteralKeys = Object.keys(Permit).map((x) => x.toLowerCase());
 
+/**
+ * @param resource
+ */
+function resourceStringIsValid(resource: string): resource is AllSupportedRoles {
+  return allSupportedRoles.includes(resource as AllSupportedRoles);
+}
+
 /**
  * validates that a string is a valid representation of one of the recognized
  * resource permit combinations.
@@ -45,8 +41,7 @@ export function validatePermissionStr(permission: string) {
     return false;
   }
   const [resource, permit] = parts;
-  // const resourceIsRecognized = lowecasedAuthZResourceTags.includes(resource.toLowerCase());
-  const resourceIsRecognized = lowerCasedAuthZResources.includes(resource);
+  const resourceIsRecognized = allSupportedRoles.includes(resource as AllSupportedRoles);
   const permitIsRecognized = permitLiteralKeys.includes(permit.toLowerCase());
   if (!resourceIsRecognized || !permitIsRecognized) {
     return false;
@@ -68,7 +63,7 @@ export function parsePermissionStr(permissions: string[]) {
       `Permission string: '${permission}' is not internally recognized as a valid permission string.`
     );
     const parts = permission.split('.');
-    const resource = parts[0] as AuthZResource;
+    const resource = parts[0] as AllSupportedRoles;
     const permit = Permit[parts[1].toUpperCase() as PermitKey];
     newMap.set(resource, permit);
     return newMap;
diff --git a/packages/rbac/src/roleDefinition/index.ts b/packages/rbac/src/roleDefinition/index.ts
index cee4fb3e4..4831ed58d 100644
--- a/packages/rbac/src/roleDefinition/index.ts
+++ b/packages/rbac/src/roleDefinition/index.ts
@@ -1,11 +1,11 @@
-import { AuthZResource, BinaryNumber, ResourcePermitMap } from '../constants';
+import { AllSupportedRoles, BinaryNumber, ResourcePermitMap } from '../constants';
 import { MatchStrategy } from '../helpers/types';
 import { combineResourcePermits, makeArray, parsePermissionStr } from '../helpers/utils';
 
 export class UserRole {
   private permissions: ResourcePermitMap;
 
-  constructor(resource: AuthZResource | AuthZResource[] = [], verb?: BinaryNumber) {
+  constructor(resource: AllSupportedRoles | AllSupportedRoles[] = [], verb?: BinaryNumber) {
     const newMap = new Map();
     if (!verb) {
       this.permissions = newMap;
@@ -68,7 +68,7 @@ export class UserRole {
     if (!mapEntries.length) {
       return;
     }
-    const last = mapEntries.pop() as [AuthZResource, number];
+    const last = mapEntries.pop() as [AllSupportedRoles, number];
     const resourceType = last[0];
     const verb = last[1];
     const newRole = new UserRole(resourceType, verb);
diff --git a/packages/react-utils/src/helpers/test-utils.tsx b/packages/react-utils/src/helpers/test-utils.tsx
index cc7884171..673c94c91 100644
--- a/packages/react-utils/src/helpers/test-utils.tsx
+++ b/packages/react-utils/src/helpers/test-utils.tsx
@@ -1,14 +1,14 @@
 import { store } from '@opensrp/store';
 import { Provider } from 'react-redux';
 import React from 'react';
-import { RoleContext, UserRole, FhirResources, Permit, IamResources } from '@opensrp/rbac';
+import { RoleContext, UserRole, FhirResources, Permit, AllSupportedRoles, allSupportedRoles } from '@opensrp/rbac';
 import { history } from '@onaio/connected-reducer-registry';
 import { Router } from 'react-router';
 /* eslint-disable @typescript-eslint/no-non-null-assertion */
 import { fireEvent } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 
-export const superUserRole = new UserRole([...FhirResources, ...IamResources], Permit.MANAGE);
+export const superUserRole = new UserRole(allSupportedRoles, Permit.MANAGE);
 
 export interface ContextProviderProps {
   children: JSX.Element;

From 265935a785702910dc142aa763e8cf48a1dd86d6 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Thu, 19 Dec 2024 18:43:40 +0300
Subject: [PATCH 3/7] Remove surplus files

---
 scripts/helm-envs-checker/js-yaml    | 0
 scripts/helm-envs-checker/typescript | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 scripts/helm-envs-checker/js-yaml
 delete mode 100644 scripts/helm-envs-checker/typescript

diff --git a/scripts/helm-envs-checker/js-yaml b/scripts/helm-envs-checker/js-yaml
deleted file mode 100644
index e69de29bb..000000000
diff --git a/scripts/helm-envs-checker/typescript b/scripts/helm-envs-checker/typescript
deleted file mode 100644
index e69de29bb..000000000

From 57554cb147c07a76bb73e2ee78e55ab04d85fd50 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Thu, 19 Dec 2024 19:02:16 +0300
Subject: [PATCH 4/7] Fix lint issues

---
 .../src/containers/ImportDetailView/index.tsx |  2 --
 packages/pkg-config/src/constants.ts          |  3 +--
 packages/rbac/src/constants.ts                | 19 ++++++++++++++-----
 packages/rbac/src/helpers/utils.ts            |  7 -------
 .../react-utils/src/helpers/test-utils.tsx    |  2 +-
 5 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/packages/fhir-import/src/containers/ImportDetailView/index.tsx b/packages/fhir-import/src/containers/ImportDetailView/index.tsx
index de91d3db2..89692f968 100644
--- a/packages/fhir-import/src/containers/ImportDetailView/index.tsx
+++ b/packages/fhir-import/src/containers/ImportDetailView/index.tsx
@@ -80,8 +80,6 @@ export const ImportDetailViewDetails = (_: RouteComponentProps) => {
     [t('Author')]: data.author,
   };
 
-  console.log({pageTitle})
-
   return (
     <BodyLayout headerProps={headerProps}>
       <Helmet>
diff --git a/packages/pkg-config/src/constants.ts b/packages/pkg-config/src/constants.ts
index 8ce97cae1..cafcd80a5 100644
--- a/packages/pkg-config/src/constants.ts
+++ b/packages/pkg-config/src/constants.ts
@@ -2,6 +2,5 @@ export const SLICE_NOT_REGISTERED =
   'Looks like configuration slice is being used without having been yet registered to the store';
 export const USER_PREFERENCE_KEY = 'Preference';
 
-
 // magic strings
-export const clientIdConfig = "clientId" as const
+export const clientIdConfig = 'clientId' as const;
diff --git a/packages/rbac/src/constants.ts b/packages/rbac/src/constants.ts
index 0a2cd7d89..ec8b079a9 100644
--- a/packages/rbac/src/constants.ts
+++ b/packages/rbac/src/constants.ts
@@ -11,12 +11,16 @@ export enum Permit {
 /** Resources that the web client understands */
 
 /** Resources that relate with user self administration like deleting own account */
-export const accountClientResources = ['account_user', 'account_application', 'account_group'] as const
-export type AccountClientResources = typeof accountClientResources[number]
+export const accountClientResources = [
+  'account_user',
+  'account_application',
+  'account_group',
+] as const;
+export type AccountClientResources = typeof accountClientResources[number];
 
 /** Resources that relate to the realm administration like managing other users accounts */
-export const realmClientResources = ['iam_user', 'iam_realm', 'iam_group', 'iam_role'] as const
-export type RealmClientResources = typeof realmClientResources[number]
+export const realmClientResources = ['iam_user', 'iam_realm', 'iam_group', 'iam_role'] as const;
+export type RealmClientResources = typeof realmClientResources[number];
 
 /**
  * fhir hapi Server resources that this web client is familiar with, thus we can enforce rbac for permissions on views that
@@ -55,7 +59,12 @@ export type FhirResources = typeof fhirResources[number];
 export const webClientRoles = ['DataImport'] as const;
 export type WebClientRoles = typeof webClientRoles[number];
 
-export const allSupportedRoles = [...fhirResources, ...accountClientResources, ...realmClientResources, ...webClientRoles];
+export const allSupportedRoles = [
+  ...fhirResources,
+  ...accountClientResources,
+  ...realmClientResources,
+  ...webClientRoles,
+];
 export type AllSupportedRoles = typeof allSupportedRoles[number];
 
 export type BinaryNumber = number;
diff --git a/packages/rbac/src/helpers/utils.ts b/packages/rbac/src/helpers/utils.ts
index 38effb3e4..874f888c4 100644
--- a/packages/rbac/src/helpers/utils.ts
+++ b/packages/rbac/src/helpers/utils.ts
@@ -22,13 +22,6 @@ export function makeArray<T>(obj: T | T[]): T[] {
 
 export const permitLiteralKeys = Object.keys(Permit).map((x) => x.toLowerCase());
 
-/**
- * @param resource
- */
-function resourceStringIsValid(resource: string): resource is AllSupportedRoles {
-  return allSupportedRoles.includes(resource as AllSupportedRoles);
-}
-
 /**
  * validates that a string is a valid representation of one of the recognized
  * resource permit combinations.
diff --git a/packages/react-utils/src/helpers/test-utils.tsx b/packages/react-utils/src/helpers/test-utils.tsx
index 673c94c91..19d5120fd 100644
--- a/packages/react-utils/src/helpers/test-utils.tsx
+++ b/packages/react-utils/src/helpers/test-utils.tsx
@@ -1,7 +1,7 @@
 import { store } from '@opensrp/store';
 import { Provider } from 'react-redux';
 import React from 'react';
-import { RoleContext, UserRole, FhirResources, Permit, AllSupportedRoles, allSupportedRoles } from '@opensrp/rbac';
+import { RoleContext, UserRole, Permit, allSupportedRoles } from '@opensrp/rbac';
 import { history } from '@onaio/connected-reducer-registry';
 import { Router } from 'react-router';
 /* eslint-disable @typescript-eslint/no-non-null-assertion */

From 3d283bd4e263f0f454872d9a71b2b7d8c63744e2 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Fri, 20 Dec 2024 10:31:50 +0300
Subject: [PATCH 5/7] Revert test change

---
 app/src/App/fhir-apps.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/src/App/fhir-apps.tsx b/app/src/App/fhir-apps.tsx
index 761fa9d20..086ace84b 100644
--- a/app/src/App/fhir-apps.tsx
+++ b/app/src/App/fhir-apps.tsx
@@ -590,7 +590,7 @@ const FHIRApps = () => {
         exact
         path={APP_LOGIN_URL}
         render={() => {
-          window.location.href = `${OpenSRP}&kc_locale=fr`;
+          window.location.href = OpenSRP;
           return <></>;
         }}
       />

From 4ebe41f72cdda11dcb4655559b7eaae1643fca66 Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Fri, 20 Dec 2024 11:31:23 +0300
Subject: [PATCH 6/7] Remove unnecessary role combination

---
 packages/rbac/src/adapters/keycloakAdapter.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/rbac/src/adapters/keycloakAdapter.ts b/packages/rbac/src/adapters/keycloakAdapter.ts
index 33b72bf3c..83cb8df70 100644
--- a/packages/rbac/src/adapters/keycloakAdapter.ts
+++ b/packages/rbac/src/adapters/keycloakAdapter.ts
@@ -53,7 +53,7 @@ export const parseKeycloakClientRoles = (scope: string, stringRole: string) => {
       'query-realm': new UserRole(['iam_group', 'iam_role', 'iam_user', 'iam_realm'], Permit.READ),
       'view-users': new UserRole(['iam_user'], Permit.READ),
       'query-users': new UserRole(['iam_user'], Permit.READ),
-      'manage-users': UserRole.combineRoles([new UserRole(['iam_user'], Permit.MANAGE)]),
+      'manage-users': new UserRole(['iam_user'], Permit.MANAGE),
       'query-groups': new UserRole(['iam_group'], Permit.READ),
       'view-groups': new UserRole(['iam_group'], Permit.READ),
     },

From 5ef9cd969f45e240dbf81a1a59dee43b2af5f84a Mon Sep 17 00:00:00 2001
From: Peter Muriuki <pmuriuki98@gmail.com>
Date: Fri, 20 Dec 2024 18:58:44 +0300
Subject: [PATCH 7/7] Fix test regressions

---
 app/src/App/tests/App.test.tsx                |  4 +-
 .../tests/__snapshots__/index.test.tsx.snap   | 40 +++++++++++++++
 .../containers/pages/Home/tests/Home.test.tsx |  1 +
 .../tests/__snapshots__/Home.test.tsx.snap    | 11 ++++
 app/src/routes/tests/index.test.tsx           | 51 +++++++++++++++++--
 5 files changed, 102 insertions(+), 5 deletions(-)

diff --git a/app/src/App/tests/App.test.tsx b/app/src/App/tests/App.test.tsx
index d788c6c23..2a8a491dd 100644
--- a/app/src/App/tests/App.test.tsx
+++ b/app/src/App/tests/App.test.tsx
@@ -60,7 +60,7 @@ describe('App - unauthenticated', () => {
       </ContextProvider>
     );
     // before resolving get oauth state request, the user is logged out
-    expect(wrapper.text()).toMatchInlineSnapshot(`"AdministrationLogin"`);
+    expect(wrapper.text()).toMatchInlineSnapshot(`"AdministrationData ImportsLogin"`);
 
     await act(async () => {
       await flushPromises();
@@ -175,7 +175,7 @@ describe('App - authenticated', () => {
     );
     // before resolving get oauth state request, the user is logged out
     expect(wrapper.text()).toMatchInlineSnapshot(
-      `"AdministrationdemoWelcome to OpenSRPUser ManagementQuestionnaire Management"`
+      `"AdministrationData ImportsdemoWelcome to OpenSRPUser ManagementQuestionnaire ManagementData Imports"`
     );
 
     await act(async () => {
diff --git a/app/src/containers/ConnectedSidebar/tests/__snapshots__/index.test.tsx.snap b/app/src/containers/ConnectedSidebar/tests/__snapshots__/index.test.tsx.snap
index 2fd2bec0b..8800dcb24 100644
--- a/app/src/containers/ConnectedSidebar/tests/__snapshots__/index.test.tsx.snap
+++ b/app/src/containers/ConnectedSidebar/tests/__snapshots__/index.test.tsx.snap
@@ -83,6 +83,16 @@ Array [
       </Link>
     </MenuItem>
   </SubMenu>,
+  <MenuItem
+    icon={<UploadIcon />}
+  >
+    <Link
+      className="admin-link"
+      to="/import"
+    >
+      Data Imports
+    </Link>
+  </MenuItem>,
 ]
 `;
 
@@ -169,6 +179,16 @@ Array [
       </Link>
     </MenuItem>
   </SubMenu>,
+  <MenuItem
+    icon={<UploadIcon />}
+  >
+    <Link
+      className="admin-link"
+      to="/import"
+    >
+      Data Imports
+    </Link>
+  </MenuItem>,
 ]
 `;
 
@@ -300,6 +320,16 @@ Object {
             </Link>
           </MenuItem>
         </SubMenu>
+        <MenuItem
+          icon={<UploadIcon />}
+        >
+          <Link
+            className="admin-link"
+            to="/import"
+          >
+            Data Imports
+          </Link>
+        </MenuItem>
       </Menu>
     </div>,
     null,
@@ -389,5 +419,15 @@ Array [
       </Link>
     </MenuItem>
   </SubMenu>,
+  <MenuItem
+    icon={<UploadIcon />}
+  >
+    <Link
+      className="admin-link"
+      to="/import"
+    >
+      Data Imports
+    </Link>
+  </MenuItem>,
 ]
 `;
diff --git a/app/src/containers/pages/Home/tests/Home.test.tsx b/app/src/containers/pages/Home/tests/Home.test.tsx
index a6898b014..1363d3c60 100644
--- a/app/src/containers/pages/Home/tests/Home.test.tsx
+++ b/app/src/containers/pages/Home/tests/Home.test.tsx
@@ -66,6 +66,7 @@ describe('containers/pages/Home', () => {
       'Location Management',
       'Organization Management',
       'Questionnaire Management',
+      'Data Imports',
     ]);
     links.forEach((link) => {
       expect(link).toMatchSnapshot(link.textContent ?? undefined);
diff --git a/app/src/containers/pages/Home/tests/__snapshots__/Home.test.tsx.snap b/app/src/containers/pages/Home/tests/__snapshots__/Home.test.tsx.snap
index d9c45804b..1c2f9da1a 100644
--- a/app/src/containers/pages/Home/tests/__snapshots__/Home.test.tsx.snap
+++ b/app/src/containers/pages/Home/tests/__snapshots__/Home.test.tsx.snap
@@ -1,5 +1,16 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
+exports[`containers/pages/Home renders Home correctly & changes Title of page 2: Data Imports 1`] = `
+<button
+  class="ant-btn css-dev-only-do-not-override-k7429z ant-btn-link admin-link btn-links"
+  type="button"
+>
+  <span>
+    Data Imports
+  </span>
+</button>
+`;
+
 exports[`containers/pages/Home renders Home correctly & changes Title of page 2: Location Management 1`] = `
 <button
   class="ant-btn css-dev-only-do-not-override-k7429z ant-btn-link admin-link btn-links"
diff --git a/app/src/routes/tests/index.test.tsx b/app/src/routes/tests/index.test.tsx
index b1b3f5828..69c6e4bcd 100644
--- a/app/src/routes/tests/index.test.tsx
+++ b/app/src/routes/tests/index.test.tsx
@@ -1,9 +1,10 @@
+import React from 'react';
 import { store } from '@opensrp/store';
 import { authenticateUser } from '@onaio/session-reducer';
 import { filterFalsyRoutes, getRoutes } from '..';
 import { DashboardOutlined } from '@ant-design/icons';
-import React from 'react';
 import { superUserRole } from '@opensrp/react-utils';
+import UploadIcon from '@2fd/ant-design-icons/lib/Upload';
 
 jest.mock('../../configs/env');
 jest.mock('../../configs/settings');
@@ -124,67 +125,111 @@ describe('routes', () => {
               {
                 key: 'users',
                 title: 'Users',
+                permissions: ['iam_user.read'],
+
                 url: '/admin/users',
               },
               {
                 key: 'user-groups',
+                permissions: ['iam_group.read'],
+
                 title: 'User Groups',
                 url: '/admin/users/groups',
               },
               {
                 key: 'user-roles',
+                permissions: ['iam_role.read'],
                 title: 'User Roles',
                 url: '/admin/users/roles',
               },
             ],
             enabled: true,
+            isHomePageLink: true,
             key: 'user-management',
+            permissions: ['iam_user.read'],
             title: 'User Management',
+            url: '/admin/users',
           },
           {
             children: [
               {
                 key: 'location-unit',
+                permissions: ['Location.read'],
+
                 title: 'Hierarchy',
                 url: '/admin/location/unit',
               },
               {
                 key: 'all-locations',
+                permissions: ['Location.read'],
+
                 title: 'All Locations',
                 url: '/admin/location/all',
               },
             ],
             enabled: true,
+            isHomePageLink: true,
             key: 'location-management',
+            permissions: ['Location.read'],
+
             title: 'Location Management',
+            url: '/admin/location/unit',
           },
           {
             children: [
               {
                 key: 'ORGS',
+                permissions: ['Organization.read'],
+
                 title: 'Organizations',
                 url: '/admin/teams',
               },
               {
                 enabled: true,
                 key: 'org-assignment',
+                permissions: ['OrganizationAffiliation.read', 'Location.read'],
+
                 title: 'Organization Assignment',
                 url: '/admin/teams/team-assignment',
               },
             ],
             enabled: true,
+            isHomePageLink: true,
             key: 'org-management',
+            permissions: ['Organization.read'],
+
             title: 'Organization Management',
+            url: '/admin/teams',
+          },
+          {
+            enabled: true,
+            isHomePageLink: true,
+            key: 'fhir-quest',
+            permissions: ['Questionnaire.read'],
+
+            title: 'Questionnaire Management',
+            url: '/quest',
           },
-          { enabled: true, key: 'fhir-quest', title: 'Questionnaire Management', url: '/quest' },
         ],
         enabled: true,
         key: 'admin',
         otherProps: {
           icon: <DashboardOutlined />,
         },
+        permissions: [],
         title: 'Administration',
       },
+      {
+        enabled: true,
+        isHomePageLink: true,
+        key: 'data-import',
+        otherProps: {
+          icon: <UploadIcon />,
+        },
+        permissions: ['DataImport.read'],
+        title: 'Data Imports',
+        url: '/import',
+      },
     ]);
   });
 
@@ -201,7 +246,7 @@ describe('routes', () => {
       (t: string) => t,
       superUserRole
     );
-    const parentKeys = routes.flatMap((x) => x.children).map((x) => x.key);
+    const parentKeys = routes.flatMap((x) => x.children).map((x) => (x ? x.key ?? '' : ''));
     expect(parentKeys).toContain('org-management');
     expect(parentKeys).toContain('user-management');
     expect(parentKeys).toContain('location-management');