@lightdash/common 0.1936.2 → 0.1937.1

package/dist/cjs/authorization/scopeAbilityBuilder.test.js

@@ -7,17 +7,24 @@ const scopeAbilityBuilder_1 = require("./scopeAbilityBuilder");
 describe('scopeAbilityBuilder', () => {
     describe('buildAbilityFromScopes', () => {
         const baseContext = {
-            organizationUuid: 'org-123',
             isEnterprise: false,
             organizationRole: 'admin',
             projectUuid: 'project-123',
+            userUuid: 'user1',
             scopes: [],
         };
+        const baseContextWithOrg = {
+            ...baseContext,
+            projectUuid: undefined,
+            organizationUuid: 'org-123',
+        };
         it('should build ability with organization view permissions', () => {
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                ...baseContext,
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                ...baseContextWithOrg,
                 scopes: ['view:organization'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Organization', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-123',
@@ -28,10 +35,12 @@ describe('scopeAbilityBuilder', () => {
             }))).toBe(false);
         });
         it('should build ability with dashboard view permissions', () => {
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContext,
                 scopes: ['view:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Should be able to view public dashboards
             expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                 organizationUuid: 'org-123',
@@ -50,10 +59,12 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 userUuid: 'user-456',
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...contextWithUser,
                 scopes: ['view:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can view dashboards with user access
             expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                 organizationUuid: 'org-123',
@@ -66,20 +77,24 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 projectUuid: 'project-789',
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...projectContext,
                 scopes: ['view:project'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Project', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-789',
             }))).toBe(true);
         });
         it('should build ability with project creation permissions and type restrictions', () => {
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                ...baseContext,
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                ...baseContextWithOrg,
                 scopes: ['create:project'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can create preview projects
             expect(ability.can('create', (0, ability_1.subject)('Project', {
                 organizationUuid: 'org-123',
@@ -93,13 +108,15 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with editor permissions for dashboards', () => {
             const editorContext = {
-                ...baseContext,
+                ...baseContextWithOrg,
                 userUuid: 'user-456',
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...editorContext,
                 scopes: ['manage:dashboard'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage dashboards where user is editor
             expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                 organizationUuid: 'org-123',
@@ -113,13 +130,15 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with admin permissions for spaces', () => {
             const adminContext = {
-                ...baseContext,
+                ...baseContextWithOrg,
                 userUuid: 'user-456',
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...adminContext,
                 scopes: ['manage:space'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage spaces where user is admin
             expect(ability.can('manage', (0, ability_1.subject)('Space', {
                 organizationUuid: 'org-123',
@@ -136,10 +155,12 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 userUuid: 'user-456',
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...userContext,
                 scopes: ['view:job_status'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can view job status created by the user
             expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                 createdByUserUuid: 'user-456',
@@ -155,10 +176,12 @@ describe('scopeAbilityBuilder', () => {
                 userUuid: 'user-456',
                 isEnterprise: true,
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...userContext,
                 scopes: ['manage:ai_agent_thread'],
-            });
+            }, builder);
+            const ability = builder.build();
             // Can manage user's own AI agent threads
             expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                 organizationUuid: 'org-123',
@@ -172,10 +195,12 @@ describe('scopeAbilityBuilder', () => {
         });
         it('should build ability with basic permissions for scopes without custom logic', () => {
             // These scopes don't have custom applyConditions
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContext,
                 scopes: ['view:analytics', 'manage:tags'],
-            });
+            }, builder);
+            const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Analytics', {
                 organizationUuid: 'org-123',
                 projectUuid: 'project-123',
@@ -186,7 +211,9 @@ describe('scopeAbilityBuilder', () => {
             }))).toBe(true);
         });
         it('should handle unknown scopes gracefully', () => {
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(baseContext);
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(baseContext, builder);
+            const ability = builder.build();
             // Unknown scope should not add any abilities
             expect(ability.rules.length).toBe(0);
         });
@@ -195,15 +222,16 @@ describe('scopeAbilityBuilder', () => {
                 ...baseContext,
                 isEnterprise: false,
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(nonEnterpriseContext);
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(nonEnterpriseContext, builder);
+            const ability = builder.build();
             // Enterprise scope should not add abilities in non-enterprise context
             expect(ability.rules.length).toBe(0);
         });
         it('should build a complete ability from multiple scopes', () => {
             const context = {
-                organizationUuid: 'org-123',
                 userUuid: 'user-456',
-                projectUuid: 'project-789',
+                organizationUuid: 'org-123',
                 isEnterprise: false,
                 organizationRole: 'admin',
                 scopes: [
@@ -212,7 +240,9 @@ describe('scopeAbilityBuilder', () => {
                     'view:project',
                 ],
             };
-            const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(context);
+            const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+            (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(context, builder);
+            const ability = builder.build();
             // Check that all abilities were applied
             expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                 organizationUuid: 'org-123',
@@ -241,7 +271,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:organization', 'manage:saved_chart'],
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithOrgManage);
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithOrgManage, builder);
+                const ability = builder.build();
                 // Should have organization-wide permissions for saved charts
                 expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                     organizationUuid: 'org-123',
@@ -260,7 +292,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:saved_chart'],
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithoutOrgManage);
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithoutOrgManage, builder);
+                const ability = builder.build();
                 // Should require user access restrictions
                 expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                     organizationUuid: 'org-123',
@@ -285,7 +319,9 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'user-456',
                     scopes: ['manage:project', 'manage:space'],
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithProjectManage);
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithProjectManage, builder);
+                const ability = builder.build();
                 // Should allow managing public spaces when user has project management
                 expect(ability.can('manage', (0, ability_1.subject)('Space', {
                     organizationUuid: 'org-123',
@@ -316,13 +352,17 @@ describe('scopeAbilityBuilder', () => {
                     scopes: ['promote:dashboard'],
                 };
                 // Test dashboard promotion with organization management
-                const abilityWithOrg = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithOrgManage);
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithOrgManage, builder);
+                const abilityWithOrg = builder.build();
                 expect(abilityWithOrg.can('promote', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
                 // Test dashboard promotion without organization management
-                const abilityWithoutOrg = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithoutOrgManage);
+                const builderWithoutOrg = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithoutOrgManage, builderWithoutOrg);
+                const abilityWithoutOrg = builderWithoutOrg.build();
                 expect(abilityWithoutOrg.can('promote', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -343,18 +383,21 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('edge cases and error handling', () => {
             it('should handle empty scope array', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(baseContext);
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(baseContext, builder);
+                const ability = builder.build();
                 expect(ability.rules.length).toBe(0);
             });
             it('should handle undefined userUuid in context', () => {
                 const contextWithoutUser = {
                     ...baseContext,
-                    userUuid: undefined,
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithoutUser,
                     scopes: ['view:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should only allow viewing public dashboards
                 expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'org-123',
@@ -367,62 +410,35 @@ describe('scopeAbilityBuilder', () => {
                     isPrivate: true,
                 }))).toBe(false);
             });
-            it('should handle missing projectUuid in context', () => {
-                const contextWithoutProject = {
-                    ...baseContext,
-                    projectUuid: '',
-                };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...contextWithoutProject,
-                    scopes: ['view:dashboard'],
-                });
-                // Should work with public dashboards without project restriction
-                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
-                    organizationUuid: 'org-123',
-                    isPrivate: false,
-                }))).toBe(true);
-            });
             it('should handle mixed valid and invalid scopes', () => {
-                // Should throw error for invalid scopes
-                expect(() => {
-                    (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                        ...baseContext,
-                        scopes: [
-                            'view:dashboard',
-                            'view:project',
-                            'invalid:scope',
-                        ],
-                    });
-                }).toThrow('Invalid scope: invalid:Scope. Please check the scope name and try again.');
-                // Should work with only valid scopes
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:dashboard', 'view:project'],
-                });
-                // Should apply valid scopes
-                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
-                    organizationUuid: 'org-123',
-                    projectUuid: 'project-123',
-                    isPrivate: false,
-                }))).toBe(true);
-                expect(ability.can('view', (0, ability_1.subject)('Project', {
-                    organizationUuid: 'org-123',
-                    projectUuid: 'project-123',
-                }))).toBe(true);
-                // Should have rules from valid scopes
-                expect(ability.rules.length).toBeGreaterThan(0);
+                    scopes: [
+                        'view:dashboard',
+                        'view:project',
+                        'invalid:scope',
+                    ],
+                }, builder);
+                const ability = builder.build();
+                // We have 3 valid rules, 2 for dashboard and 1 for project, dropping the invalid scope
+                expect(ability.rules.length).toBe(3);
+                expect(ability.rules.filter((r) => r.subject === 'Dashboard')).toHaveLength(2);
+                expect(ability.rules.find((r) => r.subject === 'Project')).toBeDefined();
             });
         });
         describe('cross-boundary access tests', () => {
             it('should not allow access to resources from different organizations', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: [
                         'view:dashboard',
                         'manage:saved_chart',
                         'view:space',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access dashboard from different org
                 expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'different-org',
@@ -439,10 +455,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should not allow access to resources from different projects', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['view:saved_chart'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access saved chart from different project
                 expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                     organizationUuid: 'org-123',
@@ -454,13 +472,15 @@ describe('scopeAbilityBuilder', () => {
         describe('private resource access with space roles', () => {
             it('should handle viewer role access to private resources', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
                     scopes: ['view:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view private dashboard with viewer access
                 expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'org-123',
@@ -492,13 +512,15 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle editor role for managing resources', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
                     scopes: ['manage:dashboard'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can manage dashboard with editor role
                 expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                     organizationUuid: 'org-123',
@@ -540,13 +562,15 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['manage:space'],
-                });
+                    scopes: ['manage:space@assigned'],
+                }, builder);
+                const ability = builder.build();
                 // Can manage space with admin role
                 expect(ability.can('manage', (0, ability_1.subject)('Space', {
-                    organizationUuid: 'org-123',
+                    projectUuid: baseContext.projectUuid,
                     access: [
                         {
                             userUuid: 'user-456',
@@ -584,10 +608,12 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
                     scopes: ['view:job'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view own jobs
                 expect(ability.can('view', (0, ability_1.subject)('Job', {
                     userUuid: 'user-456',
@@ -598,14 +624,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle view:job_status permissions for organization context', () => {
-                const contextWithoutUser = {
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    userUuid: undefined,
-                };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...contextWithoutUser,
                     scopes: ['view:job_status'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Cannot view job status without user context when no manage:Organization scope
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                     organizationUuid: 'org-123',
@@ -616,14 +640,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle view:job_status permissions with manage:Organization scope', () => {
-                const contextWithoutUser = {
-                    ...baseContext,
-                    userUuid: undefined,
-                };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...contextWithoutUser,
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
                     scopes: ['view:job_status', 'manage:organization'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view all job status in organization when manage:Organization scope is present
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                     organizationUuid: 'org-123',
@@ -638,10 +660,12 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
                     scopes: ['view:job_status'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can view own job status
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                     createdByUserUuid: 'user-456',
@@ -654,10 +678,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('semantic viewer permissions', () => {
             it('should handle view:semantic_viewer permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['view:semantic_viewer'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('SemanticViewer', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -665,14 +691,19 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle manage:semantic_viewer with organization scope', () => {
                 const contextWithOrgManage = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                     scopes: ['manage:organization'],
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithOrgManage,
-                    scopes: ['manage:organization', 'manage:semantic_viewer'],
-                });
+                    scopes: [
+                        'manage:organization',
+                        'manage:semantic_viewer',
+                    ],
+                }, builder);
+                const ability = builder.build();
                 // Can manage semantic viewer organization-wide
                 expect(ability.can('manage', (0, ability_1.subject)('SemanticViewer', {
                     organizationUuid: 'org-123',
@@ -680,13 +711,15 @@ describe('scopeAbilityBuilder', () => {
             });
             it('should handle manage:semantic_viewer with editor role', () => {
                 const contextWithUser = {
-                    ...baseContext,
+                    ...baseContextWithOrg,
                     userUuid: 'user-456',
                 };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
                     scopes: ['manage:semantic_viewer'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can manage semantic viewer with editor role
                 expect(ability.can('manage', (0, ability_1.subject)('SemanticViewer', {
                     organizationUuid: 'org-123',
@@ -711,10 +744,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('create space permissions', () => {
             it('should handle create:space permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['create:space'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('create', (0, ability_1.subject)('Space', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -723,20 +758,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('export permissions', () => {
             it('should handle export csv permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:export_csv'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('ExportCsv', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle change csv results permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:change_csv_results'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('ChangeCsvResults', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -745,10 +784,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('underlying data permissions', () => {
             it('should handle view:underlying_data permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['view:underlying_data'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('UnderlyingData', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -757,20 +798,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('sql runner and custom sql permissions', () => {
             it('should handle manage:sql_runner permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:sql_runner'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('SqlRunner', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle manage:custom_sql permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:custom_sql'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('CustomSql', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -778,33 +823,31 @@ describe('scopeAbilityBuilder', () => {
             });
         });
         describe('project delete permissions', () => {
-            it('should handle delete:project with projectUuid', () => {
-                const contextWithProject = {
+            it('should handle delete:project@self permissions', () => {
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    projectUuid: 'project-456',
-                };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...contextWithProject,
-                    scopes: ['delete:project'],
-                });
+                    userUuid: 'user-456',
+                    scopes: ['delete:project@self'],
+                }, builder);
+                const ability = builder.build();
                 // Can delete specific project
                 expect(ability.can('delete', (0, ability_1.subject)('Project', {
-                    projectUuid: 'project-456',
+                    createdByUserUuid: 'user-456',
+                    type: projects_1.ProjectType.PREVIEW,
                 }))).toBe(true);
-                // Cannot delete different project
                 expect(ability.can('delete', (0, ability_1.subject)('Project', {
-                    projectUuid: 'different-project',
+                    createdByUserUuid: 'different-user',
+                    type: projects_1.ProjectType.PREVIEW,
                 }))).toBe(false);
             });
             it('should handle delete:project for preview projects', () => {
-                const contextWithoutProject = {
-                    ...baseContext,
-                    projectUuid: '',
-                };
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...contextWithoutProject,
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
                     scopes: ['delete:project'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Can delete preview projects in organization
                 expect(ability.can('delete', (0, ability_1.subject)('Project', {
                     organizationUuid: 'org-123',
@@ -819,20 +862,24 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('pinned items permissions', () => {
             it('should handle view:pinned_items permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['view:pinned_items'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('PinnedItems', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
             });
             it('should handle manage:pinned_items permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:pinned_items'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PinnedItems', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -841,10 +888,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('explore permissions', () => {
             it('should handle manage:explore permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:explore'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('Explore', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -853,10 +902,12 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('virtual view permissions', () => {
             it('should handle create:virtual_view permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['create:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('create', (0, ability_1.subject)('VirtualView', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -868,10 +919,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle delete:virtual_view permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['delete:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('delete', (0, ability_1.subject)('VirtualView', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -883,10 +936,12 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should handle manage:virtual_view permissions for both create and delete', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:virtual_view'],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should be able to manage (create and delete)
                 expect(ability.can('manage', (0, ability_1.subject)('VirtualView', {
                     organizationUuid: 'org-123',
@@ -903,14 +958,16 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(true);
             });
             it('should not allow virtual view actions for different organizations', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...baseContext,
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
                     scopes: [
                         'create:virtual_view',
                         'delete:virtual_view',
                         'manage:virtual_view',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Should not access virtual views from different org
                 expect(ability.can('create', (0, ability_1.subject)('VirtualView', {
                     organizationUuid: 'different-org',
@@ -926,14 +983,16 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
             it('should allow virtual view actions for different projects within same organization', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...baseContext,
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
                     scopes: [
                         'create:virtual_view',
                         'delete:virtual_view',
                         'manage:virtual_view',
                     ],
-                });
+                }, builder);
+                const ability = builder.build();
                 // Virtual view permissions are organization-scoped, not project-scoped
                 // So they should work across different projects within the same org
                 expect(ability.can('create', (0, ability_1.subject)('VirtualView', {
@@ -952,25 +1011,29 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('organization member profile permissions', () => {
             it('should handle view:organization_member_profile permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...baseContext,
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
                     scopes: ['view:organization_member_profile'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('OrganizationMemberProfile', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
                 }))).toBe(true);
-                // Cannot view profiles from different organization
+                // Cannot view profiles from different project
                 expect(ability.can('view', (0, ability_1.subject)('OrganizationMemberProfile', {
                     organizationUuid: 'different-org',
                     projectUuid: 'project-123',
                 }))).toBe(false);
             });
             it('should handle manage:organization_member_profile permissions', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: ['manage:organization_member_profile'],
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('OrganizationMemberProfile', {
                     organizationUuid: 'org-123',
                     projectUuid: 'project-123',
@@ -979,7 +1042,8 @@ describe('scopeAbilityBuilder', () => {
         });
         describe('personal access token permissions', () => {
             it('should allow managing PAT when enabled and user has allowed role', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
@@ -990,11 +1054,13 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', 'PersonalAccessToken')).toBe(true);
             });
             it('should not allow managing PAT when disabled', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
@@ -1005,11 +1071,13 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when user role not in allowed roles', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'developer',
@@ -1020,21 +1088,25 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when no permissions config provided', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
                     scopes: ['manage:personal_access_token'],
                     // No permissionsConfig provided
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PersonalAccessToken', {}))).toBe(false);
             });
             it('should not allow managing PAT when no organization role provided', () => {
-                const ability = (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: '', // Empty organization role
@@ -1045,7 +1117,8 @@ describe('scopeAbilityBuilder', () => {
                             allowedOrgRoles: ['admin', 'developer'],
                         },
                     },
-                });
+                }, builder);
+                const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PersonalAccessToken', {}))).toBe(false);
             });
         });