fix: [M3-10458] - IAM incorrect tags permission on Linode details page (linode#12674)

* fix tags permission

* Added changeset: Incorrect tags permission check on Linode details page

* update unit test

* clean up comment

---------

Co-authored-by: Banks Nussman <[email protected]>

Author: bnussman-akamai

packages/manager/.changeset/pr-12674-fixed-1754934049071.md

@@ -0,0 +1,5 @@
+---
+"@linode/manager": Fixed
+---
+
+Incorrect tags permission check on Linode details page ([#12674](https://github.com/linode/manager/pull/12674))

packages/manager/src/features/Linodes/LinodeEntityDetailFooter.test.tsx

@@ -1,5 +1,8 @@
-import * as React from 'react';
+import { profileFactory } from '@linode/utilities';
+import { waitFor } from '@testing-library/react';
+import React from 'react';
 
+import { http, HttpResponse, server } from 'src/mocks/testServer';
 import { renderWithTheme } from 'src/utilities/testHelpers';
 
 import { LinodeEntityDetailFooter } from './LinodeEntityDetailFooter';
@@ -13,40 +16,48 @@ const props = {
   linodeTags: ['test', 'linode'],
 };
 
-const queryMocks = vi.hoisted(() => ({
-  userPermissions: vi.fn(() => ({
-    data: { update_account: false },
-  })),
-}));
+describe('LinodeEntityDetailFooter', () => {
+  it('should disable the "Add a tag" button by default', async () => {
+    const { getByRole } = renderWithTheme(
+      <LinodeEntityDetailFooter {...props} />
+    );
 
-vi.mock('src/features/IAM/hooks/usePermissions', () => ({
-  usePermissions: queryMocks.userPermissions,
-}));
+    expect(getByRole('button', { name: 'Add a tag' })).toBeDisabled();
+  });
+
+  it('should enable the "Add a tag" button if the user is unrestricted (legacy grants)', async () => {
+    server.use(
+      http.get('*/v4*/profile', () =>
+        HttpResponse.json(profileFactory.build({ restricted: false }))
+      )
+    );
 
-describe('LinodeEntityDetailFooter', () => {
-  it('should disable "Add a tag" button if the user does not have update_account permission', async () => {
     const { getByRole } = renderWithTheme(
       <LinodeEntityDetailFooter {...props} />
     );
 
-    const addTagBtn = getByRole('button', {
-      name: 'Add a tag',
+    await waitFor(() => {
+      expect(getByRole('button', { name: 'Add a tag' })).toBeEnabled();
     });
-    expect(addTagBtn).toHaveAttribute('aria-disabled', 'true');
   });
 
-  it('should enable "Add a tag" button if the user has update_account permission', async () => {
-    queryMocks.userPermissions.mockReturnValue({
-      data: { update_account: true },
-    });
+  it('should enable the "Add a tag" button if the user is an account admin (IAM)', async () => {
+    server.use(
+      http.get('*/v4*/profile', () =>
+        HttpResponse.json(profileFactory.build({ restricted: true }))
+      ),
+      http.get('*/v4*/iam/users/:username/permissions/account', () =>
+        HttpResponse.json(['is_account_admin'])
+      )
+    );
 
     const { getByRole } = renderWithTheme(
-      <LinodeEntityDetailFooter {...props} />
+      <LinodeEntityDetailFooter {...props} />,
+      { flags: { iam: { enabled: true, beta: true } } }
     );
 
-    const addTagBtn = getByRole('button', {
-      name: 'Add a tag',
+    await waitFor(() => {
+      expect(getByRole('button', { name: 'Add a tag' })).toBeEnabled();
     });
-    expect(addTagBtn).not.toHaveAttribute('aria-disabled', 'true');
   });
 });

packages/manager/src/features/Linodes/LinodeEntityDetailFooter.tsx

@@ -40,7 +40,7 @@ export const LinodeEntityDetailFooter = React.memo((props: FooterProps) => {
     linodeTags,
   } = props;
 
-  const { data: permissions } = usePermissions('account', ['update_account']);
+  const { data: permissions } = usePermissions('account', ['is_account_admin']);
 
   const { mutateAsync: updateLinode } = useLinodeUpdateMutation(linodeId);
 
@@ -143,7 +143,10 @@ export const LinodeEntityDetailFooter = React.memo((props: FooterProps) => {
         }}
       >
         <TagCell
-          disabled={!permissions.update_account}
+          // A restricted user can technically add tags to a Linode if they have read-write permission on the Linode,
+          // but for the sake of the user experience, we choose to disable the "Add a tag" button in the UI because
+          // restricted users can't see account tags using GET /v4/tags
+          disabled={!permissions.is_account_admin}
           entityLabel={linodeLabel}
           sx={{
             width: '100%',