Suppress UI <Allow> functionality

Fixes PLAT-3350

Test Plan:
- Create a Site Admin developer key
- Verify the site admin has an allow option, and
on and off
- Verify any sub accounts do not have an allow option,
but only on and off
- Verify that the default status for inheritted key
under root account is 'Off' (when site admin set it
as 'Allow')
- Verify Canvas allows retrieving an access token when
the UI shows a key is "on" in a root account (account
and inherited keys)
- Verify Canvas does not allow retrieving an access
token when the UI shows a key is "off" in a root
account (account and inherited keys).

Change-Id: I93da83384a4000790ca3251a381f6c706ef1a53b
Reviewed-on: https://gerrit.instructure.com/150580
Tested-by: Jenkins
Reviewed-by: Marc Alan Phillips <mphillips@instructure.com>
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Jesse Poulos <jpoulos@instructure.com>

app/jsx/developer_keys/InheritanceStateControl.js

@@ -48,12 +48,20 @@ export default class DeveloperKeyStateControl extends React.Component {
     return 'allow'
   }
 
+  isSiteAdmin() {
+    return this.props.ctx.params.contextId === "site_admin"
+  }
+
+  getDefaultValue() {
+    return this.radioGroupValue() === 'allow' && !this.isSiteAdmin() ? 'off' : this.radioGroupValue()
+  }
+
   render() {
     return (
       <RadioInputGroup
         size="medium"
         variant="toggle"
-        defaultValue={this.radioGroupValue()}
+        defaultValue={this.getDefaultValue()}
         description={
           <ScreenReaderContent>{I18n.t('Key state for the current account')}</ScreenReaderContent>
         }
@@ -62,7 +70,7 @@ export default class DeveloperKeyStateControl extends React.Component {
         name={this.props.developerKey.id}
       >
         <RadioInput label={I18n.t('On')} value="on" context="success" />
-        <RadioInput label={I18n.t('Allow')} value="allow" context="off" />
+        {this.isSiteAdmin() && <RadioInput label={I18n.t('Allow')} value="allow" context="off"/>}
         <RadioInput label={I18n.t('Off')} value="off" context="danger" />
       </RadioInputGroup>
     )

spec/javascripts/jsx/developer_keys/AdminTableSpec.js

@@ -38,7 +38,11 @@ function component(keyList, inherited, props = {}) {
       store={{dispatch: () => {}}}
       actions={{}}
       developerKeysList={keyList || devKeyList()}
-      ctx={{}}
+      ctx={{
+        params: {
+          contextId: ""
+        }
+      }}
       inherited={inherited}
       {...props}
     />

spec/javascripts/jsx/developer_keys/AppSpec.js

@@ -79,6 +79,11 @@ function renderComponent (overrides = {}) {
     applicationState: initialApplicationState(),
     actions: {},
     store: fakeStore(),
+    ctx: {
+      params: {
+        contextId: ""
+      }
+    },
     ...overrides
   }
   return TestUtils.renderIntoDocument(<DeveloperKeysApp {...props} />);

spec/javascripts/jsx/developer_keys/InheritanceStateControlSpec.js

@@ -23,6 +23,18 @@ import DeveloperKeyStateControl from 'jsx/developer_keys/InheritanceStateControl
 
 QUnit.module('InheritanceStateControl')
 
+const rootAccountCTX = {
+  params: {
+    contextId: "1"
+  }
+}
+
+const siteAdminCTX = {
+  params: {
+    contextId: "site_admin"
+  }
+}
+
 function developerKey(workflowState, isOwnedByAccount) {
   return {
     developer_key_account_binding: {
@@ -32,8 +44,8 @@ function developerKey(workflowState, isOwnedByAccount) {
   }
 }
 
-function componentNode(key) {
-  const component = TestUtils.renderIntoDocument(<DeveloperKeyStateControl developerKey={key} />)
+function componentNode(key, context = rootAccountCTX) {
+  const component = TestUtils.renderIntoDocument(<DeveloperKeyStateControl developerKey={key} ctx={context}/>)
   return ReactDOM.findDOMNode(component)
 }
 
@@ -57,10 +69,10 @@ test('the correct state for the developer key', () => {
   ok(offRadioInput.checked)
 })
 
-test('renders "allow" if no binding is sent', () => {
+test('renders "allow" if no binding is sent only for site_admin', () => {
   const modifiedKey = developerKey()
   modifiedKey.developer_key_account_binding = undefined
-  const allowRadioInput = componentNode(modifiedKey).querySelector('input[value="allow"]')
+  const allowRadioInput = componentNode(modifiedKey, siteAdminCTX).querySelector('input[value="allow"]')
   ok(allowRadioInput.checked)
 })
 
@@ -72,6 +84,20 @@ test('renders an "off" option', () => {
   ok(componentNode().querySelector('input[value="off"]'))
 })
 
-test('renders an "allow" option', () => {
-  ok(componentNode().querySelector('input[value="allow"]'))
+test('renders an "allow" option only for site_admin', () => {
+  ok(componentNode(developerKey(), siteAdminCTX).querySelector('input[value="allow"]'))
+})
+
+test('do not render an "allow" option only for root-account', () => {
+  notOk(componentNode(rootAccountCTX).querySelector('input[value="allow"]'))
+})
+
+test('renders "allow" if "allow" is set as the workflow state for site admin', () => {
+  const allowRadioInput = componentNode(developerKey("allow"), siteAdminCTX).querySelector('input[value="allow"]')
+  ok(allowRadioInput.checked)
+})
+
+test('renders "off" if "allow" is set as the workflow state for root account', () => {
+  const offRadioInput = componentNode(developerKey("allow"), rootAccountCTX).querySelector('input[value="off"]')
+  ok(offRadioInput.checked)
 })

spec/selenium/admin/account_admin_developer_keys_rewrite_spec.rb

@@ -256,15 +256,6 @@ describe 'Developer Keys' do
         expect(fj("fieldset:last")).not_to have_attribute('aria-disabled')
       end
 
-      it "allows for root account dev key status 'allow'", test_id: 3482823 do
-        root_developer_key
-        DeveloperKeyAccountBinding.last.update(workflow_state: 'off')
-        get "/accounts/#{Account.default.id}/developer_keys"
-        fj("span:contains('Allow'):last").click
-        keep_trying_until { expect(current_active_element.attribute('value')).to eq 'allow' }
-        expect(DeveloperKeyAccountBinding.last.reload.workflow_state).to eq 'allow'
-      end
-
       it "allows for root account dev key status 'on'", test_id: 3482823 do
         root_developer_key
         get "/accounts/#{Account.default.id}/developer_keys"
@@ -301,7 +292,7 @@ describe 'Developer Keys' do
         click_account_tab
         click_inherited_tab
         expect(fj("fieldset:last")).not_to have_attribute('aria-disabled')
-        expect(fxpath("//*[@id='keys']/tbody/tr[1]/td[3]/fieldset/span/span/span/span[2]/span/span/span[3]/div/label/span[1]").css_value('background-color')).to be_truthy
+        expect(fxpath("//*[@id='keys']/tbody/tr[1]/td[3]/fieldset/span/span/span/span[2]/span/span/span[2]/div/label/span[2]").css_value('background-color')).to be_truthy
       end
 
       it "only show create developer key button for account tab panel" do