@lightdash/common 0.1937.0 → 0.1937.1

package/dist/cjs/authorization/scopes.js

@@ -1,40 +1,42 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAllScopeMap = exports.getScopes = void 0;
+const lodash_1 = require("lodash");
 const projects_1 = require("../types/projects");
 const scopes_1 = require("../types/scopes");
 const space_1 = require("../types/space");
+/** Context can have either/or organizationUuid or projectUuid. Applies the one we have. */
+const addUuidCondition = (context, modifiers) => {
+    const projectOrOrg = context.organizationUuid
+        ? { organizationUuid: context.organizationUuid }
+        : { projectUuid: context.projectUuid };
+    return {
+        ...projectOrOrg,
+        ...modifiers,
+    };
+};
+/** Applies the UUID condition with Space access. */
 const addAccessCondition = (context, role) => ({
-    $elemMatch: {
-        userUuid: context.userUuid || false,
-        ...(role ? { role } : {}),
+    ...addUuidCondition(context),
+    access: {
+        $elemMatch: {
+            userUuid: context.userUuid || false,
+            ...(role ? { role } : {}),
+        },
     },
 });
-const addDefaultOrgIdCondition = (context) => [
-    {
-        organizationUuid: context.organizationUuid,
-    },
-];
+/** Applies the UUID condition as the only condition for a scope. */
+const addDefaultUuidCondition = (0, lodash_1.flow)(addUuidCondition, Array.of);
 const scopes = [
     {
         name: 'view:Dashboard',
         description: 'View dashboards',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: (context) => {
-            // Public dashboards
-            const conditions = [
-                {
-                    organizationUuid: context.organizationUuid,
-                    isPrivate: false,
-                },
-            ];
-            conditions.push({
-                organizationUuid: context.organizationUuid,
-                access: addAccessCondition(context),
-            });
-            return conditions;
-        },
+        getConditions: (context) => [
+            addUuidCondition(context, { isPrivate: false }),
+            addAccessCondition(context),
+        ],
     },
     {
         name: 'manage:Dashboard',
@@ -42,19 +44,12 @@ const scopes = [
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
         getConditions: (context) => {
-            const { organizationUuid } = context;
             if (context.scopes.has('manage:Organization')) {
-                return [{ organizationUuid }];
+                return addDefaultUuidCondition(context);
             }
             return [
-                {
-                    organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
-                },
-                {
-                    organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
-                },
+                addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
+                addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
             ];
         },
     },
@@ -63,23 +58,10 @@ const scopes = [
         description: 'View saved charts',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: (context) => {
-            // Public saved charts
-            const conditions = [
-                {
-                    organizationUuid: context.organizationUuid,
-                    projectUuid: context.projectUuid,
-                    isPrivate: false,
-                },
-            ];
-            // User's accessible saved charts via space access
-            conditions.push({
-                organizationUuid: context.organizationUuid,
-                projectUuid: context.projectUuid,
-                access: addAccessCondition(context),
-            });
-            return conditions;
-        },
+        getConditions: (context) => [
+            addUuidCondition(context, { isPrivate: false }),
+            addAccessCondition(context),
+        ],
     },
     {
         name: 'manage:SavedChart',
@@ -87,19 +69,12 @@ const scopes = [
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
         getConditions: (context) => {
-            const { organizationUuid } = context;
             if (context.scopes.has('manage:Organization')) {
-                return [{ organizationUuid }];
+                return addDefaultUuidCondition(context);
             }
             return [
-                {
-                    organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
-                },
-                {
-                    organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
-                },
+                addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
+                addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
             ];
         },
     },
@@ -108,110 +83,91 @@ const scopes = [
         description: 'View spaces',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: (context) => {
-            // Public spaces
-            const conditions = [
-                {
-                    organizationUuid: context.organizationUuid,
-                    projectUuid: context.projectUuid,
-                    isPrivate: false,
-                },
-            ];
-            // User's accessible spaces
-            conditions.push({
-                organizationUuid: context.organizationUuid,
-                projectUuid: context.projectUuid,
-                access: addAccessCondition(context),
-            });
-            return conditions;
-        },
+        getConditions: (context) => [
+            addUuidCondition(context, { isPrivate: false }),
+            addAccessCondition(context),
+        ],
     },
     {
         name: 'create:Space',
         description: 'Create new spaces',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:Space',
-        description: 'Edit and delete spaces',
+        description: 'Create, edit, and delete all spaces',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: (context) => {
-            const { organizationUuid } = context;
-            // Manage all spaces where user is admin of the organization
-            if (context.scopes.has('manage:Organization')) {
-                return [{ organizationUuid }];
-            }
-            const conditions = [
-                {
-                    organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
-                },
-            ];
-            if (context.scopes.has('manage:Project')) {
-                // Manage public spaces where user is admin of the project
-                conditions.push({
-                    organizationUuid: context.organizationUuid,
-                    isPrivate: false,
-                });
-            }
-            return conditions;
-        },
+        getConditions: addDefaultUuidCondition,
+    },
+    {
+        name: 'manage:Space@public',
+        description: 'Create, edit, and delete public spaces',
+        isEnterprise: false,
+        group: scopes_1.ScopeGroup.CONTENT,
+        getConditions: (context) => [
+            addUuidCondition(context, { isPrivate: false }),
+        ],
+    },
+    {
+        name: 'manage:Space@assigned',
+        description: 'Create, edit, and delete spaces owned by the user',
+        isEnterprise: false,
+        group: scopes_1.ScopeGroup.CONTENT,
+        getConditions: (context) => [
+            addAccessCondition(context, space_1.SpaceMemberRole.ADMIN),
+        ],
     },
     {
         name: 'view:DashboardComments',
         description: 'View dashboard comments',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'create:DashboardComments',
         description: 'Create dashboard comments',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:DashboardComments',
         description: 'Edit and delete dashboard comments',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:Tags',
         description: 'View tags',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: (context) => [
-            {
-                organizationUuid: context.organizationUuid,
-            },
-        ],
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:Tags',
         description: 'Create, edit, and delete tags',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:PinnedItems',
         description: 'View pinned items',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:PinnedItems',
         description: 'Pin and unpin items',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.CONTENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'promote:SavedChart',
@@ -220,19 +176,9 @@ const scopes = [
         group: scopes_1.ScopeGroup.CONTENT,
         getConditions: (context) => {
             if (context.scopes.has('manage:Organization')) {
-                return [
-                    {
-                        organizationUuid: context.organizationUuid,
-                    },
-                ];
+                return addDefaultUuidCondition(context);
             }
-            return [
-                {
-                    organizationUuid: context.organizationUuid,
-                    projectUuid: context.projectUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
-                },
-            ];
+            return [addAccessCondition(context, space_1.SpaceMemberRole.EDITOR)];
         },
     },
     {
@@ -242,19 +188,9 @@ const scopes = [
         group: scopes_1.ScopeGroup.CONTENT,
         getConditions: (context) => {
             if (context.scopes.has('manage:Organization')) {
-                return [
-                    {
-                        organizationUuid: context.organizationUuid,
-                    },
-                ];
+                return addDefaultUuidCondition(context);
             }
-            return [
-                {
-                    organizationUuid: context.organizationUuid,
-                    projectUuid: context.projectUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
-                },
-            ];
+            return [addAccessCondition(context, space_1.SpaceMemberRole.EDITOR)];
         },
     },
     // Project Management Scopes
@@ -263,7 +199,7 @@ const scopes = [
         description: 'View project details',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'create:Project',
@@ -274,7 +210,7 @@ const scopes = [
         // Allow creating preview projects by default
         [
             {
-                organizationUuid: context.organizationUuid,
+                ...addUuidCondition(context),
                 type: projects_1.ProjectType.PREVIEW,
             },
         ],
@@ -284,7 +220,7 @@ const scopes = [
         description: 'Update project settings',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'delete:Project',
@@ -293,69 +229,77 @@ const scopes = [
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
         getConditions: (context) => {
             if (context.projectUuid) {
-                return [
-                    {
-                        projectUuid: context.projectUuid,
-                    },
-                ];
+                return [{}];
             }
             // Can delete preview projects in organization
             return [
                 {
-                    organizationUuid: context.organizationUuid,
+                    ...addUuidCondition(context),
                     type: projects_1.ProjectType.PREVIEW,
                 },
             ];
         },
     },
+    {
+        name: 'delete:Project@self',
+        description: 'Delete projects created by the user',
+        isEnterprise: false,
+        group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
+        getConditions: (context) => [
+            {
+                createdByUserUuid: context.userUuid || false,
+                type: projects_1.ProjectType.PREVIEW,
+            },
+        ],
+    },
     {
         name: 'manage:Project',
         description: 'Full project management permissions',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:CompileProject',
         description: 'Compile and refresh dbt projects',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:Validation',
         description: 'Manage data validation rules',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'create:ScheduledDeliveries',
         description: 'Create scheduled deliveries',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:ScheduledDeliveries',
         description: 'Manage scheduled deliveries',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:GoogleSheets',
         description: 'Manage google sheets',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:Analytics',
         description: 'View usage analytics',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'create:Job',
@@ -385,7 +329,7 @@ const scopes = [
         group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
         getConditions: (context) => {
             if (context.scopes.has('manage:Organization')) {
-                return addDefaultOrgIdCondition(context);
+                return addDefaultUuidCondition(context);
             }
             return [
                 {
@@ -394,62 +338,69 @@ const scopes = [
             ];
         },
     },
+    {
+        name: 'manage:Validation',
+        description: 'Manage data validation rules',
+        isEnterprise: false,
+        group: scopes_1.ScopeGroup.PROJECT_MANAGEMENT,
+        getConditions: addDefaultUuidCondition,
+    },
     // Organization Management Scopes
     {
         name: 'view:Organization',
         description: 'View organization details',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:Organization',
         description: 'Manage organization settings',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:OrganizationMemberProfile',
         description: 'View organization member profiles',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:OrganizationMemberProfile',
         description: 'Manage organization member profiles and roles',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:InviteLink',
         description: 'Create and manage invite links',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:Group',
         description: 'Manage user groups',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:ContentAsCode',
         description: 'Manage content as code features',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:PersonalAccessToken',
         description: 'Create and manage personal access tokens',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.ORGANIZATION_MANAGEMENT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     // Data Scopes
     {
@@ -457,14 +408,14 @@ const scopes = [
         description: 'View underlying data in charts',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:SemanticViewer',
         description: 'View data in semantic viewer',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:SemanticViewer',
@@ -473,14 +424,9 @@ const scopes = [
         group: scopes_1.ScopeGroup.DATA,
         getConditions: (context) => {
             if (context.scopes.has('manage:Organization')) {
-                return addDefaultOrgIdCondition(context);
+                return addDefaultUuidCondition(context);
             }
-            return [
-                {
-                    organizationUuid: context.organizationUuid,
-                    access: addAccessCondition(context, space_1.SpaceMemberRole.EDITOR),
-                },
-            ];
+            return [addAccessCondition(context, space_1.SpaceMemberRole.EDITOR)];
         },
     },
     {
@@ -488,56 +434,56 @@ const scopes = [
         description: 'Explore and query data',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:SqlRunner',
         description: 'Run SQL queries directly',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:CustomSql',
         description: 'Create custom SQL queries',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'create:VirtualView',
         description: 'Create virtual views',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'delete:VirtualView',
         description: 'Delete virtual views',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:VirtualView',
         description: 'Create and manage virtual views',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:ExportCsv',
         description: 'Export data to CSV',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:ChangeCsvResults',
         description: 'Modify CSV export results',
         isEnterprise: false,
         group: scopes_1.ScopeGroup.DATA,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     // Sharing Scopes
     {
@@ -567,14 +513,14 @@ const scopes = [
         description: 'View AI agent features',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.AI,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:AiAgent',
         description: 'Configure AI agent settings',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.AI,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:AiAgentThread',
@@ -585,9 +531,8 @@ const scopes = [
         // View user's own AI agent threads
         [
             {
-                organizationUuid: context.organizationUuid,
-                projectUuid: context.projectUuid,
-                ...(context.userUuid && { userUuid: context.userUuid }),
+                ...addUuidCondition(context),
+                userUuid: context.userUuid || false,
             },
         ],
     },
@@ -596,7 +541,7 @@ const scopes = [
         description: 'Start new AI agent conversations',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.AI,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:AiAgentThread',
@@ -605,7 +550,7 @@ const scopes = [
         group: scopes_1.ScopeGroup.AI,
         getConditions: (context) => {
             if (context.scopes.has('manage:Organization')) {
-                return addDefaultOrgIdCondition(context);
+                return addDefaultUuidCondition(context);
             }
             // Manage user's own AI agent threads
             return [{ userUuid: context.userUuid || false }];
@@ -617,28 +562,28 @@ const scopes = [
         description: 'Configure spotlight table settings',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.SPOTLIGHT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:SpotlightTableConfig',
         description: 'View spotlight table configuration',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.SPOTLIGHT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'view:MetricsTree',
         description: 'View metrics tree',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.SPOTLIGHT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
     {
         name: 'manage:MetricsTree',
         description: 'Manage metrics tree configuration',
         isEnterprise: true,
         group: scopes_1.ScopeGroup.SPOTLIGHT,
-        getConditions: addDefaultOrgIdCondition,
+        getConditions: addDefaultUuidCondition,
     },
 ];
 const getNonEnterpriseScopes = () => scopes.filter((scope) => !scope.isEnterprise);