@lightdash/common 0.1936.2 → 0.1937.1

package/dist/esm/authorization/scopeAbilityBuilder.test.js

@@ -1,21 +1,28 @@
-import { subject } from '@casl/ability';
+import { Ability, AbilityBuilder, subject } from '@casl/ability';
 import { ProjectType } from '../types/projects';
 import { SpaceMemberRole } from '../types/space';
 import { buildAbilityFromScopes } from './scopeAbilityBuilder';
 describe('scopeAbilityBuilder', () => {
     describe('buildAbilityFromScopes', () => {
         const baseContext = {
-            organizationUuid: 'org-123',
             isEnterprise: false,
             organizationRole: 'admin',
             projectUuid: 'project-123',
+            userUuid: 'user1',
             scopes: [],
         };
+        const baseContextWithOrg = {
+            ...baseContext,
+            projectUuid: undefined,
+            organizationUuid: 'org-123',
+        };
         it('should build ability with organization view permissions', () => {
-            const ability = buildAbilityFromScopes({
-                ...baseContext,
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
+                ...baseContextWithOrg,
                 scopes: ['view:organization'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', subject('Organization', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-123',
@@ -26,10 +33,12 @@ describe('scopeAbilityBuilder', () => {
             }))).toBe(false);
         });
         it('should build ability with dashboard view permissions', () => {
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...baseContext,
                 scopes: ['view:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Should be able to view public dashboards
             expect(ability.can('view', subject('Dashboard', {
                 organizationUuid: 'org-123',
@@ -48,10 +57,12 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 userUuid: 'user-456',
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...contextWithUser,
                 scopes: ['view:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can view dashboards with user access
             expect(ability.can('view', subject('Dashboard', {
                 organizationUuid: 'org-123',
@@ -64,20 +75,24 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 projectUuid: 'project-789',
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...projectContext,
                 scopes: ['view:project'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', subject('Project', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-789',
             }))).toBe(true);
         });
         it('should build ability with project creation permissions and type restrictions', () => {
-            const ability = buildAbilityFromScopes({
-                ...baseContext,
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
+                ...baseContextWithOrg,
                 scopes: ['create:project'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can create preview projects
             expect(ability.can('create', subject('Project', {
                 organizationUuid: 'org-123',
@@ -91,13 +106,15 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with editor permissions for dashboards', () => {
             const editorContext = {
-                ...baseContext,
+                ...baseContextWithOrg,
                 userUuid: 'user-456',
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...editorContext,
                 scopes: ['manage:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage dashboards where user is editor
             expect(ability.can('manage', subject('Dashboard', {
                 organizationUuid: 'org-123',
@@ -111,13 +128,15 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with admin permissions for spaces', () => {
             const adminContext = {
-                ...baseContext,
+                ...baseContextWithOrg,
                 userUuid: 'user-456',
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...adminContext,
                 scopes: ['manage:space'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage spaces where user is admin
             expect(ability.can('manage', subject('Space', {
                 organizationUuid: 'org-123',
@@ -134,10 +153,12 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 userUuid: 'user-456',
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...userContext,
                 scopes: ['view:job_status'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can view job status created by the user
             expect(ability.can('view', subject('JobStatus', {
                 createdByUserUuid: 'user-456',
@@ -153,10 +174,12 @@ describe('scopeAbilityBuilder', () => {
                 userUuid: 'user-456',
                 isEnterprise: true,
             };
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...userContext,
                 scopes: ['manage:ai_agent_thread'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage user's own AI agent threads
             expect(ability.can('manage', subject('AiAgentThread', {
                 organizationUuid: 'org-123',
@@ -170,10 +193,12 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with basic permissions for scopes without custom logic', () => {
             // These scopes don't have custom applyConditions
-            const ability = buildAbilityFromScopes({
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes({
                 ...baseContext,
                 scopes: ['view:analytics', 'manage:tags'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', subject('Analytics', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-123',
@@ -184,7 +209,9 @@ describe('scopeAbilityBuilder', () => {
             }))).toBe(true);
         });
         it('should handle unknown scopes gracefully', () => {
-            const ability = buildAbilityFromScopes(baseContext);
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes(baseContext, builder);
+            const ability = builder.build();
             // Unknown scope should not add any abilities
             expect(ability.rules.length).toBe(0);
         });
@@ -193,15 +220,16 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 isEnterprise: false,
             };
-            const ability = buildAbilityFromScopes(nonEnterpriseContext);
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes(nonEnterpriseContext, builder);
+            const ability = builder.build();
             // Enterprise scope should not add abilities in non-enterprise context
             expect(ability.rules.length).toBe(0);
         });
         it('should build a complete ability from multiple scopes', () => {
             const context = {
-                organizationUuid: 'org-123',
                 userUuid: 'user-456',
-                projectUuid: 'project-789',
+                organizationUuid: 'org-123',
                 isEnterprise: false,
                 organizationRole: 'admin',
                 scopes: [
@@ -210,7 +238,9 @@ describe('scopeAbilityBuilder', () => {
                     'view:project',
                 ],
             };
-            const ability = buildAbilityFromScopes(context);
+            const builder = new AbilityBuilder(Ability);
+            buildAbilityFromScopes(context, builder);
+            const ability = builder.build();
             // Check that all abilities were applied
             expect(ability.can('view', subject('Dashboard', {
                 organizationUuid: 'org-123',
@@ -239,7 +269,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:organization', 'manage:saved_chart'],
                 };
-                const ability = buildAbilityFromScopes(contextWithOrgManage);
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(contextWithOrgManage, builder);
+                const ability = builder.build();
                 // Should have organization-wide permissions for saved charts
                 expect(ability.can('manage', subject('SavedChart', {
                     organizationUuid: 'org-123',
@@ -258,7 +290,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:saved_chart'],
                 };
-                const ability = buildAbilityFromScopes(contextWithoutOrgManage);
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(contextWithoutOrgManage, builder);
+                const ability = builder.build();
                 // Should require user access restrictions
                 expect(ability.can('manage', subject('SavedChart', {
                     organizationUuid: 'org-123',
@@ -283,7 +317,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:project', 'manage:space'],
                 };
-                const ability = buildAbilityFromScopes(contextWithProjectManage);
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(contextWithProjectManage, builder);
+                const ability = builder.build();
                 // Should allow managing public spaces when user has project management
                 expect(ability.can('manage', subject('Space', {
                     organizationUuid: 'org-123',
@@ -314,13 +350,17 @@ describe('scopeAbilityBuilder', () => {
                     scopes: ['promote:dashboard'],
                 };
                 // Test dashboard promotion with organization management
-                const abilityWithOrg = buildAbilityFromScopes(contextWithOrgManage);
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(contextWithOrgManage, builder);
+                const abilityWithOrg = builder.build();
                 expect(abilityWithOrg.can('promote', subject('Dashboard', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
                 // Test dashboard promotion without organization management
-                const abilityWithoutOrg = buildAbilityFromScopes(contextWithoutOrgManage);
+                const builderWithoutOrg = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(contextWithoutOrgManage, builderWithoutOrg);
+                const abilityWithoutOrg = builderWithoutOrg.build();
                 expect(abilityWithoutOrg.can('promote', subject('Dashboard', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -341,18 +381,21 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('edge cases and error handling', () => {
             it('should handle empty scope array', () => {
-                const ability = buildAbilityFromScopes(baseContext);
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes(baseContext, builder);
+                const ability = builder.build();
                 expect(ability.rules.length).toBe(0);
             });
             it('should handle undefined userUuid in context', () => {
                 const contextWithoutUser = {
                     ...baseContext,
-                    userUuid: undefined,
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithoutUser,
                     scopes: ['view:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should only allow viewing public dashboards
                 expect(ability.can('view', subject('Dashboard', {
                     organizationUuid: 'org-123',
@@ -365,62 +408,35 @@ describe('scopeAbilityBuilder', () => {
                     isPrivate: true,
                 }))).toBe(false);
             });
-            it('should handle missing projectUuid in context', () => {
-                const contextWithoutProject = {
-                    ...baseContext,
-                    projectUuid: '',
-                };
-                const ability = buildAbilityFromScopes({
-                    ...contextWithoutProject,
-                    scopes: ['view:dashboard'],
-                });
-                // Should work with public dashboards without project restriction
-                expect(ability.can('view', subject('Dashboard', {
-                    organizationUuid: 'org-123',
-                    isPrivate: false,
-                }))).toBe(true);
-            });
             it('should handle mixed valid and invalid scopes', () => {
-                // Should throw error for invalid scopes
-                expect(() => {
-                    buildAbilityFromScopes({
-                        ...baseContext,
-                        scopes: [
-                            'view:dashboard',
-                            'view:project',
-                            'invalid:scope',
-                        ],
-                    });
-                }).toThrow('Invalid scope: invalid:Scope. Please check the scope name and try again.');
-                // Should work with only valid scopes
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:dashboard', 'view:project'],
-                });
-                // Should apply valid scopes
-                expect(ability.can('view', subject('Dashboard', {
-                    organizationUuid: 'org-123',
-                    projectUuid: 'project-123',
-                    isPrivate: false,
-                }))).toBe(true);
-                expect(ability.can('view', subject('Project', {
-                    organizationUuid: 'org-123',
-                    projectUuid: 'project-123',
-                }))).toBe(true);
-                // Should have rules from valid scopes
-                expect(ability.rules.length).toBeGreaterThan(0);
+                    scopes: [
+                        'view:dashboard',
+                        'view:project',
+                        'invalid:scope',
+                    ],
+                }, builder);
+                const ability = builder.build();
+                // We have 3 valid rules, 2 for dashboard and 1 for project, dropping the invalid scope
+                expect(ability.rules.length).toBe(3);
+                expect(ability.rules.filter((r) => r.subject === 'Dashboard')).toHaveLength(2);
+                expect(ability.rules.find((r) => r.subject === 'Project')).toBeDefined();
             });
         });
         describe('cross-boundary access tests', () => {
             it('should not allow access to resources from different organizations', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: [
                         'view:dashboard',
                         'manage:saved_chart',
                         'view:space',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access dashboard from different org
                 expect(ability.can('view', subject('Dashboard', {
                     organizationUuid: 'different-org',
@@ -437,10 +453,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should not allow access to resources from different projects', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['view:saved_chart'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access saved chart from different project
                 expect(ability.can('view', subject('SavedChart', {
                     organizationUuid: 'org-123',
@@ -452,13 +470,15 @@ describe('scopeAbilityBuilder', () => {
         describe('private resource access with space roles', () => {
             it('should handle viewer role access to private resources', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
                     scopes: ['view:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view private dashboard with viewer access
                 expect(ability.can('view', subject('Dashboard', {
                     organizationUuid: 'org-123',
@@ -490,13 +510,15 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle editor role for managing resources', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
                     scopes: ['manage:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can manage dashboard with editor role
                 expect(ability.can('manage', subject('Dashboard', {
                     organizationUuid: 'org-123',
@@ -538,13 +560,15 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['manage:space'],
-                });
+                    scopes: ['manage:space@assigned'],
+                }, builder);
+                const ability = builder.build();
                 // Can manage space with admin role
                 expect(ability.can('manage', subject('Space', {
-                    organizationUuid: 'org-123',
+                    projectUuid: baseContext.projectUuid,
                     access: [
                         {
                             userUuid: 'user-456',
@@ -582,10 +606,12 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
                     scopes: ['view:job'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view own jobs
                 expect(ability.can('view', subject('Job', {
                     userUuid: 'user-456',
@@ -596,14 +622,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle view:job_status permissions for organization context', () => {
-                const contextWithoutUser = {
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
-                    userUuid: undefined,
-                };
-                const ability = buildAbilityFromScopes({
-                    ...contextWithoutUser,
                     scopes: ['view:job_status'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Cannot view job status without user context when no manage:Organization scope
                 expect(ability.can('view', subject('JobStatus', {
                     organizationUuid: 'org-123',
@@ -614,14 +638,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle view:job_status permissions with manage:Organization scope', () => {
-                const contextWithoutUser = {
-                    ...baseContext,
-                    userUuid: undefined,
-                };
-                const ability = buildAbilityFromScopes({
-                    ...contextWithoutUser,
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
                     scopes: ['view:job_status', 'manage:organization'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view all job status in organization when manage:Organization scope is present
                 expect(ability.can('view', subject('JobStatus', {
                     organizationUuid: 'org-123',
@@ -636,10 +658,12 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
                     scopes: ['view:job_status'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view own job status
                 expect(ability.can('view', subject('JobStatus', {
                     createdByUserUuid: 'user-456',
@@ -652,10 +676,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('semantic viewer permissions', () => {
             it('should handle view:semantic_viewer permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['view:semantic_viewer'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', subject('SemanticViewer', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -663,14 +689,19 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle manage:semantic_viewer with organization scope', () => {
                 const contextWithOrgManage = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                     scopes: ['manage:organization'],
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithOrgManage,
-                    scopes: ['manage:organization', 'manage:semantic_viewer'],
-                });
+                    scopes: [
+                        'manage:organization',
+                        'manage:semantic_viewer',
+                    ],
+                }, builder);
+                const ability = builder.build();
                 // Can manage semantic viewer organization-wide
                 expect(ability.can('manage', subject('SemanticViewer', {
                     organizationUuid: 'org-123',
@@ -678,13 +709,15 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle manage:semantic_viewer with editor role', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...contextWithUser,
                     scopes: ['manage:semantic_viewer'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can manage semantic viewer with editor role
                 expect(ability.can('manage', subject('SemanticViewer', {
                     organizationUuid: 'org-123',
@@ -709,10 +742,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('create space permissions', () => {
             it('should handle create:space permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['create:space'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('create', subject('Space', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -721,20 +756,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('export permissions', () => {
             it('should handle export csv permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:export_csv'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('ExportCsv', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle change csv results permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:change_csv_results'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('ChangeCsvResults', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -743,10 +782,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('underlying data permissions', () => {
             it('should handle view:underlying_data permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['view:underlying_data'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', subject('UnderlyingData', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -755,20 +796,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('sql runner and custom sql permissions', () => {
             it('should handle manage:sql_runner permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:sql_runner'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('SqlRunner', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle manage:custom_sql permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:custom_sql'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('CustomSql', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -776,33 +821,31 @@ describe('scopeAbilityBuilder', () => {
             });
         });
         describe('project delete permissions', () => {
-            it('should handle delete:project with projectUuid', () => {
-                const contextWithProject = {
+            it('should handle delete:project@self permissions', () => {
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
-                    projectUuid: 'project-456',
-                };
-                const ability = buildAbilityFromScopes({
-                    ...contextWithProject,
-                    scopes: ['delete:project'],
-                });
+                    userUuid: 'user-456',
+                    scopes: ['delete:project@self'],
+                }, builder);
+                const ability = builder.build();
                 // Can delete specific project
                 expect(ability.can('delete', subject('Project', {
-                    projectUuid: 'project-456',
+                    createdByUserUuid: 'user-456',
+                    type: ProjectType.PREVIEW,
                 }))).toBe(true);
-                // Cannot delete different project
                 expect(ability.can('delete', subject('Project', {
-                    projectUuid: 'different-project',
+                    createdByUserUuid: 'different-user',
+                    type: ProjectType.PREVIEW,
                 }))).toBe(false);
             });
             it('should handle delete:project for preview projects', () => {
-                const contextWithoutProject = {
-                    ...baseContext,
-                    projectUuid: '',
-                };
-                const ability = buildAbilityFromScopes({
-                    ...contextWithoutProject,
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
                     scopes: ['delete:project'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can delete preview projects in organization
                 expect(ability.can('delete', subject('Project', {
                     organizationUuid: 'org-123',
@@ -817,20 +860,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('pinned items permissions', () => {
             it('should handle view:pinned_items permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['view:pinned_items'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', subject('PinnedItems', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle manage:pinned_items permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:pinned_items'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('PinnedItems', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -839,10 +886,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('explore permissions', () => {
             it('should handle manage:explore permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:explore'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('Explore', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -851,10 +900,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('virtual view permissions', () => {
             it('should handle create:virtual_view permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['create:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('create', subject('VirtualView', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -866,10 +917,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle delete:virtual_view permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['delete:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('delete', subject('VirtualView', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -881,10 +934,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle manage:virtual_view permissions for both create and delete', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should be able to manage (create and delete)
                 expect(ability.can('manage', subject('VirtualView', {
                     organizationUuid: 'org-123',
@@ -901,14 +956,16 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(true);
             });
             it('should not allow virtual view actions for different organizations', () => {
-                const ability = buildAbilityFromScopes({
-                    ...baseContext,
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
                     scopes: [
                         'create:virtual_view',
                         'delete:virtual_view',
                         'manage:virtual_view',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access virtual views from different org
                 expect(ability.can('create', subject('VirtualView', {
                     organizationUuid: 'different-org',
@@ -924,14 +981,16 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should allow virtual view actions for different projects within same organization', () => {
-                const ability = buildAbilityFromScopes({
-                    ...baseContext,
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
                     scopes: [
                         'create:virtual_view',
                         'delete:virtual_view',
                         'manage:virtual_view',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Virtual view permissions are organization-scoped, not project-scoped
                 // So they should work across different projects within the same org
                 expect(ability.can('create', subject('VirtualView', {
@@ -950,25 +1009,29 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('organization member profile permissions', () => {
             it('should handle view:organization_member_profile permissions', () => {
-                const ability = buildAbilityFromScopes({
-                    ...baseContext,
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
                     scopes: ['view:organization_member_profile'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', subject('OrganizationMemberProfile', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
-                // Cannot view profiles from different organization
+                // Cannot view profiles from different project
                 expect(ability.can('view', subject('OrganizationMemberProfile', {
                     organizationUuid: 'different-org',
                     projectUuid: 'project-123',
                 }))).toBe(false);
             });
             it('should handle manage:organization_member_profile permissions', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     scopes: ['manage:organization_member_profile'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('OrganizationMemberProfile', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -977,7 +1040,8 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('personal access token permissions', () => {
             it('should allow managing PAT when enabled and user has allowed role', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
@@ -988,11 +1052,13 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', 'PersonalAccessToken')).toBe(true);
             });
             it('should not allow managing PAT when disabled', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
@@ -1003,11 +1069,13 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when user role not in allowed roles', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'developer',
@@ -1018,21 +1086,25 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when no permissions config provided', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
                     scopes: ['manage:personal_access_token'],
                     // No permissionsConfig provided
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when no organization role provided', () => {
-                const ability = buildAbilityFromScopes({
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: '', // Empty organization role
@@ -1043,7 +1115,8 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', subject('PersonalAccessToken', {}))).toBe(false);
             });
         });