From 58fdb3767bc7df91dcbb0fd4773f0c87c76c8dce Mon Sep 17 00:00:00 2001
From: Stan Silvert <ssilvert@redhat.com>
Date: Fri, 13 Oct 2023 14:34:57 -0400
Subject: [PATCH 1/3] Allow full use of Authorization tab for anyone with
 manage-authorization access.

---
 js/apps/admin-ui/src/clients/ClientDetails.tsx | 18 ++++++++++--------
 .../src/clients/routes/AuthenticationTab.tsx   |  2 +-
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/js/apps/admin-ui/src/clients/ClientDetails.tsx b/js/apps/admin-ui/src/clients/ClientDetails.tsx
index e758630cf3ef..f92f71de8292 100644
--- a/js/apps/admin-ui/src/clients/ClientDetails.tsx
+++ b/js/apps/admin-ui/src/clients/ClientDetails.tsx
@@ -586,14 +586,16 @@ export default function ClientDetails() {
                   >
                     <AuthorizationPermissions clientId={clientId} />
                   </Tab>
-                  <Tab
-                    id="evaluate"
-                    data-testid="authorizationEvaluate"
-                    title={<TabTitleText>{t("evaluate")}</TabTitleText>}
-                    {...authorizationEvaluateTab}
-                  >
-                    <AuthorizationEvaluate client={client} save={save} />
-                  </Tab>
+                  {hasViewUsers && (
+                    <Tab
+                      id="evaluate"
+                      data-testid="authorizationEvaluate"
+                      title={<TabTitleText>{t("evaluate")}</TabTitleText>}
+                      {...authorizationEvaluateTab}
+                    >
+                      <AuthorizationEvaluate client={client} save={save} />
+                    </Tab>
+                  )}
                   <Tab
                     id="export"
                     data-testid="authorizationExport"
diff --git a/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx b/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
index 16c1f6530496..968552b39489 100644
--- a/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
+++ b/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
@@ -25,7 +25,7 @@ export const AuthorizationRoute: AppRouteObject = {
   element: <ClientDetails />,
   breadcrumb: (t) => t("clientSettings"),
   handle: {
-    access: "view-clients",
+    access: "anyone", // Actual access is on the parent tab.  See issue #23294.
   },
 };
 

From 2812cbc67b3745ef7046eba6abf420bd9869cc72 Mon Sep 17 00:00:00 2001
From: Stan Silvert <ssilvert@redhat.com>
Date: Fri, 13 Oct 2023 16:36:41 -0400
Subject: [PATCH 2/3] Allow export with manage-authorization role.

---
 .../src/clients/authorization/AuthorizationExport.tsx       | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx b/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
index 0792a0bd1ae9..2466fca1590e 100644
--- a/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
@@ -63,7 +63,11 @@ export const AuthorizationExport = () => {
 
   return (
     <PageSection>
-      <FormAccess isHorizontal role="view-realm" className="pf-u-mt-lg">
+      <FormAccess
+        isHorizontal
+        role="manage-authorization"
+        className="pf-u-mt-lg"
+      >
         <FormGroup
           label={t("authDetails")}
           labelIcon={

From 79a8f26ada66bba50316d4772931658a2ed7995c Mon Sep 17 00:00:00 2001
From: Stan Silvert <ssilvert@redhat.com>
Date: Fri, 13 Oct 2023 16:44:59 -0400
Subject: [PATCH 3/3] manage-authorization makes more sense for the subtabs

---
 js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx b/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
index 968552b39489..b145c39703f8 100644
--- a/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
+++ b/js/apps/admin-ui/src/clients/routes/AuthenticationTab.tsx
@@ -25,7 +25,7 @@ export const AuthorizationRoute: AppRouteObject = {
   element: <ClientDetails />,
   breadcrumb: (t) => t("clientSettings"),
   handle: {
-    access: "anyone", // Actual access is on the parent tab.  See issue #23294.
+    access: "manage-authorization",
   },
 };