From bbd1bb3485858acc0ce0de9dcb32c9aeca091d3a Mon Sep 17 00:00:00 2001
From: Phil Renaud <phil.renaud@hashicorp.com>
Date: Fri, 28 Jun 2024 17:30:56 -0400
Subject: [PATCH] Read-based checks for viewing templates and write-based
 checks for saving them (#23458)

---
 .changelog/23458.txt                           |  3 +++
 ui/app/templates/components/job-editor.hbs     |  2 +-
 .../templates/components/job-editor/edit.hbs   | 18 ++++++++++--------
 ui/app/templates/jobs/run/templates/manage.hbs |  7 +++++--
 4 files changed, 19 insertions(+), 11 deletions(-)
 create mode 100644 .changelog/23458.txt

diff --git a/.changelog/23458.txt b/.changelog/23458.txt
new file mode 100644
index 000000000..ed8d6fd91
--- /dev/null
+++ b/.changelog/23458.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix an issue where access to Job Templates in the UI was restricted to variable.write access
+```
diff --git a/ui/app/templates/components/job-editor.hbs b/ui/app/templates/components/job-editor.hbs
index 4dcfbb8b7..f9532e129 100644
--- a/ui/app/templates/components/job-editor.hbs
+++ b/ui/app/templates/components/job-editor.hbs
@@ -16,7 +16,7 @@
           Paste or author HCL or JSON to submit to your cluster, or select from a list of templates. A plan will be requested before the job is submitted. You can also attach a job spec by uploading a job file or dragging &amp; dropping a file to the editor.
         </p>
 
-        {{#if (can "write variable" path="*" namespace="*")}}
+        {{#if (can "read variable" path="nomad/job-templates/*" namespace="*")}}
           <Hds::ButtonSet>
             <label
               class="job-spec-upload hds-button hds-button--color-secondary hds-button--size-medium"
diff --git a/ui/app/templates/components/job-editor/edit.hbs b/ui/app/templates/components/job-editor/edit.hbs
index 371b779b4..44413c6f5 100644
--- a/ui/app/templates/components/job-editor/edit.hbs
+++ b/ui/app/templates/components/job-editor/edit.hbs
@@ -101,14 +101,16 @@
     data-test-plan
     @text="Plan"
   />
-  {{#if @data.job.isNew}}
-    <Hds::Button
-      @text="Save as template"
-      @color="secondary"
-      @route="jobs.run.templates.new"
-      {{on "click" @fns.onSaveAs}}
-      data-test-save-as-template
-    />
+  {{#if (can "write variable" path="nomad/job-templates/*" namespace="*")}}
+    {{#if @data.job.isNew}}
+      <Hds::Button
+        @text="Save as template"
+        @color="secondary"
+        @route="jobs.run.templates.new"
+        {{on "click" @fns.onSaveAs}}
+        data-test-save-as-template
+      />
+    {{/if}}
   {{/if}}
   <Hds::Button
     @text="Save as .nomad.hcl"
diff --git a/ui/app/templates/jobs/run/templates/manage.hbs b/ui/app/templates/jobs/run/templates/manage.hbs
index 4de41b081..02bfa52b8 100644
--- a/ui/app/templates/jobs/run/templates/manage.hbs
+++ b/ui/app/templates/jobs/run/templates/manage.hbs
@@ -20,8 +20,11 @@
             <:body as |B|>
                 <B.Tr>
                     <B.Td>
-                        {{#if B.data.isDefaultJobTemplate}}
-                            {{format-template-label B.data.path}}
+                        {{#if (or
+                          B.data.isDefaultJobTemplate
+                          (not (can "write variable" path="nomad/job-templates/*" namespace="*"))
+                        )}}
+                          {{format-template-label B.data.path}}
                         {{else}}
 													<LinkTo @route="jobs.run.templates.template" @model={{concat B.data.path "@" B.data.namespace}} data-test-edit-template={{B.data.path}}>
 														{{format-template-label B.data.path}}