feat: [UIE-8940] - IAM RBAC: add a permission check for linode create flow

packages/manager/.changeset/pr-12522-upcoming-features-1752659041786.md

@@ -0,0 +1,5 @@
+---
+"@linode/manager": Upcoming Features
+---
+
+Implement the new RBAC permission hook in Linode Create flow ([#12522](https://github.com/linode/manager/pull/12522))

packages/manager/src/features/Account/Agreements/EUAgreementCheckbox.tsx

@@ -8,14 +8,15 @@ interface Props {
   centerCheckbox?: boolean;
   checked: boolean;
   className?: string;
+  disabled?: boolean;
   onChange: (
     event: React.ChangeEvent<HTMLInputElement>,
     checked: boolean
   ) => void;
 }
 
 export const EUAgreementCheckbox = (props: Props) => {
-  const { centerCheckbox, checked, className, onChange } = props;
+  const { centerCheckbox, checked, className, onChange, disabled } = props;
   const theme = useTheme();
 
   const checkboxStyle = centerCheckbox
@@ -40,6 +41,7 @@ export const EUAgreementCheckbox = (props: Props) => {
     >
       <Checkbox
         checked={checked}
+        disabled={disabled}
         id="gdpr-checkbox"
         onChange={onChange}
         sx={checkboxStyle}

packages/manager/src/features/IAM/hooks/adapters/accountGrantsToPermissions.ts

@@ -20,6 +20,7 @@ export const accountGrantsToPermissions = (
   return {
     // AccountAdmin
     accept_service_transfer: unrestricted,
+    acknowledge_account_agreement: unrestricted,
     cancel_account: unrestricted || globalGrants?.cancel_account,
     cancel_service_transfer: unrestricted,
     create_service_transfer: unrestricted,

packages/manager/src/features/Linodes/LinodeCreate/Actions.test.tsx

@@ -8,6 +8,16 @@ const queryMocks = vi.hoisted(() => ({
   useNavigate: vi.fn(),
   useParams: vi.fn(),
   useSearch: vi.fn(),
+  userPermissions: vi.fn(() => ({
+    permissions: {
+      create_linode: false,
+      clone_linode: false,
+    },
+  })),
+}));
+
+vi.mock('src/features/IAM/hooks/usePermissions', () => ({
+  usePermissions: queryMocks.userPermissions,
 }));
 
 vi.mock('@tanstack/react-router', async () => {
@@ -27,7 +37,58 @@ describe('Actions', () => {
     queryMocks.useParams.mockReturnValue({});
   });
 
-  it('should render a create button', () => {
+  it('should render a disabled create button, if user does not have create_linode permission', () => {
+    const { getByText } = renderWithThemeAndHookFormContext({
+      component: <Actions />,
+    });
+
+    const button = getByText('Create Linode').closest('button');
+
+    expect(button).toBeVisible();
+    expect(button).toHaveAttribute('type', 'submit');
+    expect(button).toBeDisabled();
+  });
+
+  it('should render a disabled create button for cloning, if user does not have clone_linode permission', () => {
+    queryMocks.useParams.mockReturnValue({ type: 'Clone Linode' });
+
+    const { getByText } = renderWithThemeAndHookFormContext({
+      component: <Actions />,
+    });
+
+    const button = getByText('Create Linode').closest('button');
+
+    expect(button).toBeVisible();
+    expect(button).toHaveAttribute('type', 'submit');
+    expect(button).toBeDisabled();
+  });
+
+  it('should render an enabled create button, if user has create_linode permission', () => {
+    queryMocks.userPermissions.mockReturnValue({
+      permissions: {
+        create_linode: true,
+        clone_linode: true,
+      },
+    });
+    const { getByText } = renderWithThemeAndHookFormContext({
+      component: <Actions />,
+    });
+
+    const button = getByText('Create Linode').closest('button');
+
+    expect(button).toBeVisible();
+    expect(button).toHaveAttribute('type', 'submit');
+    expect(button).toBeEnabled();
+  });
+
+  it('should render an enabled create button for cloning, if user has clone_linode permission', () => {
+    queryMocks.useParams.mockReturnValue({ type: 'Clone Linode' });
+    queryMocks.userPermissions.mockReturnValue({
+      permissions: {
+        create_linode: true,
+        clone_linode: true,
+      },
+    });
     const { getByText } = renderWithThemeAndHookFormContext({
       component: <Actions />,
     });

packages/manager/src/features/Linodes/LinodeCreate/Actions.tsx

@@ -3,8 +3,8 @@ import { scrollErrorIntoView } from '@linode/utilities';
 import React, { useState } from 'react';
 import { useFormContext, useWatch } from 'react-hook-form';
 
+import { usePermissions } from 'src/features/IAM/hooks/usePermissions';
 import { useFlags } from 'src/hooks/useFlags';
-import { useRestrictedGlobalGrantCheck } from 'src/hooks/useRestrictedGlobalGrantCheck';
 import { sendApiAwarenessClickEvent } from 'src/utilities/analytics/customEventAnalytics';
 import { sendLinodeCreateFormInputEvent } from 'src/utilities/analytics/formEventAnalytics';
 import { useIsLinodeInterfacesEnabled } from 'src/utilities/linodes';
@@ -24,6 +24,7 @@ interface ActionProps {
 
 export const Actions = ({ isAlertsBetaMode }: ActionProps) => {
   const { params } = useLinodeCreateQueryParams();
+
   const [isAPIAwarenessModalOpen, setIsAPIAwarenessModalOpen] = useState(false);
 
   const { isLinodeInterfacesEnabled } = useIsLinodeInterfacesEnabled();
@@ -32,14 +33,27 @@ export const Actions = ({ isAlertsBetaMode }: ActionProps) => {
   const { formState, getValues, trigger, control } =
     useFormContext<LinodeCreateFormValues>();
 
-  const isLinodeCreateRestricted = useRestrictedGlobalGrantCheck({
-    globalGrantType: 'add_linodes',
-  });
+  const [legacyFirewallId, linodeInterfaces, interfaceGeneration, linodeId] =
+    useWatch({
+      control,
+      name: [
+        'firewall_id',
+        'linodeInterfaces',
+        'interface_generation',
+        'linode.id',
+      ],
+    });
+
+  const { permissions } = usePermissions('linode', ['clone_linode'], linodeId);
+
+  const { permissions: accountPermissions } = usePermissions('account', [
+    'create_linode',
+  ]);
 
-  const [legacyFirewallId, linodeInterfaces, interfaceGeneration] = useWatch({
-    control,
-    name: ['firewall_id', 'linodeInterfaces', 'interface_generation'],
-  });
+  const isCloneMode = params.type === 'Clone Linode';
+  const isDisabled = isCloneMode
+    ? !permissions.clone_linode
+    : !accountPermissions.create_linode;
 
   const userNeedsToAssignFirewall =
     'firewallOverride' in formState.errors &&
@@ -71,7 +85,7 @@ export const Actions = ({ isAlertsBetaMode }: ActionProps) => {
       </Button>
       <Button
         buttonType="primary"
-        disabled={isLinodeCreateRestricted || userNeedsToAssignFirewall}
+        disabled={isDisabled || userNeedsToAssignFirewall}
         loading={formState.isSubmitting}
         type="submit"
       >

packages/manager/src/features/Linodes/LinodeCreate/Addons/Backups.test.tsx

@@ -1,8 +1,4 @@
-import {
-  grantsFactory,
-  profileFactory,
-  regionFactory,
-} from '@linode/utilities';
+import { regionFactory } from '@linode/utilities';
 import { waitFor } from '@testing-library/react';
 import React from 'react';
 
@@ -19,6 +15,11 @@ const queryMocks = vi.hoisted(() => ({
   useNavigate: vi.fn(),
   useParams: vi.fn(),
   useSearch: vi.fn(),
+  userPermissions: vi.fn(() => ({
+    permissions: {
+      create_linode: false,
+    },
+  })),
 }));
 
 vi.mock('@tanstack/react-router', async () => {
@@ -31,6 +32,10 @@ vi.mock('@tanstack/react-router', async () => {
   };
 });
 
+vi.mock('src/features/IAM/hooks/usePermissions', () => ({
+  usePermissions: queryMocks.userPermissions,
+}));
+
 describe('Linode Create Backups Addon', () => {
   beforeEach(() => {
     queryMocks.useNavigate.mockReturnValue(vi.fn());
@@ -45,10 +50,35 @@ describe('Linode Create Backups Addon', () => {
 
     const checkbox = getByLabelText('Backups', { exact: false });
 
-    expect(checkbox).toBeEnabled();
     expect(checkbox).not.toBeChecked();
   });
 
+  it('should be disabled if the user does not have create_linode permission', async () => {
+    const { getByRole } =
+      renderWithThemeAndHookFormContext<LinodeCreateFormValues>({
+        component: <Backups />,
+      });
+
+    const checkbox = getByRole('checkbox');
+    expect(checkbox).toBeDisabled();
+  });
+
+  it('should be enabled if the user has create_linode permission', async () => {
+    queryMocks.userPermissions.mockReturnValue({
+      permissions: {
+        create_linode: true,
+      },
+    });
+
+    const { getByRole } =
+      renderWithThemeAndHookFormContext<LinodeCreateFormValues>({
+        component: <Backups />,
+      });
+
+    const checkbox = getByRole('checkbox');
+    expect(checkbox).toBeEnabled();
+  });
+
   it('should get its value from the form context', () => {
     const { getByRole } =
       renderWithThemeAndHookFormContext<LinodeCreateFormValues>({
@@ -107,30 +137,6 @@ describe('Linode Create Backups Addon', () => {
     });
   });
 
-  it('should be disabled if the user does not have permission to create a linode', async () => {
-    server.use(
-      http.get('*/v4/profile', () => {
-        return HttpResponse.json(profileFactory.build({ restricted: true }));
-      }),
-      http.get('*/v4/profile/grants', () => {
-        return HttpResponse.json(
-          grantsFactory.build({ global: { add_linodes: false } })
-        );
-      })
-    );
-
-    const { getByRole } =
-      renderWithThemeAndHookFormContext<LinodeCreateFormValues>({
-        component: <Backups />,
-      });
-
-    const checkbox = getByRole('checkbox');
-
-    await waitFor(() => {
-      expect(checkbox).toBeDisabled();
-    });
-  });
-
   it('renders a warning if disk encryption is enabled and backups are enabled', async () => {
     const { getByText } =
       renderWithThemeAndHookFormContext<LinodeCreateFormValues>({

packages/manager/src/features/Linodes/LinodeCreate/Addons/Backups.tsx

@@ -16,7 +16,7 @@ import { useController, useFormContext, useWatch } from 'react-hook-form';
 import { Currency } from 'src/components/Currency';
 import { DISK_ENCRYPTION_BACKUPS_CAVEAT_COPY } from 'src/components/Encryption/constants';
 import { Link } from 'src/components/Link';
-import { useRestrictedGlobalGrantCheck } from 'src/hooks/useRestrictedGlobalGrantCheck';
+import { usePermissions } from 'src/features/IAM/hooks/usePermissions';
 import { getMonthlyBackupsPrice } from 'src/utilities/pricing/backups';
 
 import { getBackupsEnabledValue } from './utilities';
@@ -35,9 +35,7 @@ export const Backups = () => {
     name: ['region', 'type', 'disk_encryption'],
   });
 
-  const isLinodeCreateRestricted = useRestrictedGlobalGrantCheck({
-    globalGrantType: 'add_linodes',
-  });
+  const { permissions } = usePermissions('account', ['create_linode']);
 
   const { data: type } = useTypeQuery(typeId, Boolean(typeId));
   const { data: regions } = useRegionsQuery();
@@ -73,7 +71,7 @@ export const Backups = () => {
       data-testid="backups"
       disabled={
         isDistributedRegionSelected ||
-        isLinodeCreateRestricted ||
+        !permissions.create_linode ||
         isAccountBackupsEnabled
       }
       label={