@lightdash/common 0.1946.0 → 0.1948.0

package/dist/cjs/authorization/scopeAbilityBuilder.test.js

@@ -22,7 +22,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContextWithOrg,
-                scopes: ['view:organization'],
+                scopes: ['view:Organization'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Organization', {
@@ -38,7 +38,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContext,
-                scopes: ['view:dashboard'],
+                scopes: ['view:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Should be able to view public dashboards
@@ -62,7 +62,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...contextWithUser,
-                scopes: ['view:dashboard'],
+                scopes: ['view:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Can view dashboards with user access
@@ -80,7 +80,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...projectContext,
-                scopes: ['view:project'],
+                scopes: ['view:Project'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Project', {
@@ -92,7 +92,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContextWithOrg,
-                scopes: ['create:project'],
+                scopes: ['create:Project'],
             }, builder);
             const ability = builder.build();
             // Can create preview projects
@@ -114,7 +114,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...editorContext,
-                scopes: ['manage:dashboard'],
+                scopes: ['manage:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Can manage dashboards where user is editor
@@ -136,7 +136,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...adminContext,
-                scopes: ['manage:space'],
+                scopes: ['manage:Space'],
             }, builder);
             const ability = builder.build();
             // Can manage spaces where user is admin
@@ -158,7 +158,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...userContext,
-                scopes: ['view:job_status'],
+                scopes: ['view:JobStatus@self'],
             }, builder);
             const ability = builder.build();
             // Can view job status created by the user
@@ -179,17 +179,17 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...userContext,
-                scopes: ['manage:ai_agent_thread'],
+                scopes: ['manage:AiAgentThread@self'],
             }, builder);
             const ability = builder.build();
             // Can manage user's own AI agent threads
             expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
-                organizationUuid: 'org-123',
+                projectUuid: 'project-123',
                 userUuid: 'user-456',
             }))).toBe(true);
             // Cannot manage another user's threads
             expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
-                organizationUuid: 'org-123',
+                projectUuid: 'project-123',
                 userUuid: 'other-user',
             }))).toBe(false);
         });
@@ -198,7 +198,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                 ...baseContext,
-                scopes: ['view:analytics', 'manage:tags'],
+                scopes: ['view:Analytics', 'manage:Tags'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', (0, ability_1.subject)('Analytics', {
@@ -234,11 +234,7 @@ describe('scopeAbilityBuilder', () => {
                 organizationUuid: 'org-123',
                 isEnterprise: false,
                 organizationRole: 'admin',
-                scopes: [
-                    'view:dashboard',
-                    'manage:saved_chart',
-                    'view:project',
-                ],
+                scopes: ['view:Dashboard', 'manage:SavedChart', 'view:Project'],
             };
             const builder = new ability_1.AbilityBuilder(ability_1.Ability);
             (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(context, builder);
@@ -269,7 +265,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization', 'manage:saved_chart'],
+                    scopes: ['manage:Organization', 'manage:SavedChart'],
                 };
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithOrgManage, builder);
@@ -290,7 +286,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithoutOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:saved_chart'],
+                    scopes: ['manage:SavedChart@space'],
                 };
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithoutOrgManage, builder);
@@ -317,7 +313,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithProjectManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:project', 'manage:space'],
+                    scopes: ['manage:Project', 'manage:Space'],
                 };
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)(contextWithProjectManage, builder);
@@ -344,12 +340,12 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization', 'promote:dashboard'],
+                    scopes: ['manage:Organization', 'promote:Dashboard'],
                 };
                 const contextWithoutOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['promote:dashboard'],
+                    scopes: ['promote:Dashboard@space'],
                 };
                 // Test dashboard promotion with organization management
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
@@ -381,6 +377,82 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
         });
+        describe('AI agent thread permissions with modifiers', () => {
+            it('should handle view:ai_agent_thread@self permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    isEnterprise: true,
+                };
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...contextWithUser,
+                    scopes: ['view:AiAgentThread@self'],
+                }, builder);
+                const ability = builder.build();
+                // Can view own AI agent threads
+                expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot view other users' threads
+                expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'other-user',
+                }))).toBe(false);
+            });
+            it('should handle manage:ai_agent_thread@self permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    isEnterprise: true,
+                };
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...contextWithUser,
+                    userUuid: 'user-456',
+                    scopes: ['manage:AiAgentThread@self'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage own AI agent threads
+                expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot manage other users' threads
+                expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
+                    userUuid: 'other-user',
+                }))).toBe(false);
+            });
+            it('should handle view:ai_agent_thread permissions for all threads', () => {
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
+                    isEnterprise: true,
+                    scopes: ['view:AiAgentThread'],
+                }, builder);
+                const ability = builder.build();
+                // Can view any AI agent thread
+                expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
+                    organizationUuid: 'org-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+            it('should handle manage:ai_agent_thread permissions for all threads', () => {
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContextWithOrg,
+                    isEnterprise: true,
+                    scopes: ['manage:AiAgentThread'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage any AI agent thread
+                expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
+                    organizationUuid: 'org-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+        });
         describe('edge cases and error handling', () => {
             it('should handle empty scope array', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
@@ -395,7 +467,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithoutUser,
-                    scopes: ['view:dashboard'],
+                    scopes: ['view:Dashboard'],
                 }, builder);
                 const ability = builder.build();
                 // Should only allow viewing public dashboards
@@ -415,8 +487,8 @@ describe('scopeAbilityBuilder', () => {
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: [
-                        'view:dashboard',
-                        'view:project',
+                        'view:Dashboard',
+                        'view:Project',
                         'invalid:scope',
                     ],
                 }, builder);
@@ -433,9 +505,9 @@ describe('scopeAbilityBuilder', () => {
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     scopes: [
-                        'view:dashboard',
-                        'manage:saved_chart',
-                        'view:space',
+                        'view:Dashboard',
+                        'manage:SavedChart',
+                        'view:Space',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -458,7 +530,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:saved_chart'],
+                    scopes: ['view:SavedChart'],
                 }, builder);
                 const ability = builder.build();
                 // Should not access saved chart from different project
@@ -478,7 +550,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['view:dashboard'],
+                    scopes: ['view:Dashboard'],
                 }, builder);
                 const ability = builder.build();
                 // Can view private dashboard with viewer access
@@ -518,7 +590,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['manage:dashboard'],
+                    scopes: ['manage:Dashboard@space'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage dashboard with editor role
@@ -565,7 +637,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['manage:space@assigned'],
+                    scopes: ['manage:Space@assigned'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage space with admin role
@@ -603,7 +675,7 @@ describe('scopeAbilityBuilder', () => {
             });
         });
         describe('job and job status permissions', () => {
-            it('should handle view:job permissions', () => {
+            it('should handle view:job@self permissions', () => {
                 const contextWithUser = {
                     ...baseContext,
                     userUuid: 'user-456',
@@ -611,7 +683,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['view:job'],
+                    scopes: ['view:Job@self'],
                 }, builder);
                 const ability = builder.build();
                 // Can view own jobs
@@ -623,30 +695,31 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'other-user',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions for organization context', () => {
+            it('should handle view:job_status@self permissions for user context', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:job_status'],
+                    userUuid: 'user-456',
+                    scopes: ['view:JobStatus@self'],
                 }, builder);
                 const ability = builder.build();
-                // Cannot view job status without user context when no manage:Organization scope
+                // Can view own job status
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
-                    organizationUuid: 'org-123',
-                }))).toBe(false);
-                // Cannot view job status from another organization
+                    createdByUserUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot view other users' job status
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
-                    organizationUuid: 'different-org',
+                    createdByUserUuid: 'other-user',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions with manage:Organization scope', () => {
+            it('should handle view:job_status permissions for all job status', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContextWithOrg,
-                    scopes: ['view:job_status', 'manage:organization'],
+                    scopes: ['view:JobStatus'],
                 }, builder);
                 const ability = builder.build();
-                // Can view all job status in organization when manage:Organization scope is present
+                // Can view all job status in organization
                 expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                     organizationUuid: 'org-123',
                 }))).toBe(true);
@@ -655,7 +728,70 @@ describe('scopeAbilityBuilder', () => {
                     organizationUuid: 'different-org',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions for user context', () => {
+            it('should handle view:job permissions for all jobs', () => {
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...baseContext,
+                    scopes: ['view:Job'],
+                }, builder);
+                const ability = builder.build();
+                // Can view any job
+                expect(ability.can('view', (0, ability_1.subject)('Job', {
+                    organizationUuid: 'org-123',
+                    projectUuid: 'project-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+        });
+        describe('space-based permissions modifiers', () => {
+            it('should handle manage:dashboard@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContextWithOrg,
+                    userUuid: 'user-456',
+                };
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...contextWithUser,
+                    scopes: ['manage:Dashboard@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage dashboard with editor role
+                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Can manage dashboard with admin role
+                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.ADMIN,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage dashboard with viewer role
+                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.VIEWER,
+                        },
+                    ],
+                }))).toBe(false);
+                // Cannot manage dashboard without access
+                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [],
+                }))).toBe(false);
+            });
+            it('should handle manage:saved_chart@space permissions', () => {
                 const contextWithUser = {
                     ...baseContext,
                     userUuid: 'user-456',
@@ -663,16 +799,102 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['view:job_status'],
+                    scopes: ['manage:SavedChart@space'],
                 }, builder);
                 const ability = builder.build();
-                // Can view own job status
-                expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
-                    createdByUserUuid: 'user-456',
+                // Can manage saved chart with editor role
+                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.EDITOR,
+                        },
+                    ],
                 }))).toBe(true);
-                // Cannot view other users' job status
-                expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
-                    createdByUserUuid: 'other-user',
+                // Can manage saved chart with admin role
+                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.ADMIN,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage without proper access
+                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'other-user',
+                            role: space_1.SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(false);
+            });
+            it('should handle promote:dashboard@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                };
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...contextWithUser,
+                    scopes: ['promote:Dashboard@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can promote dashboard with editor access
+                expect(ability.can('promote', (0, ability_1.subject)('Dashboard', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot promote without editor access
+                expect(ability.can('promote', (0, ability_1.subject)('Dashboard', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.VIEWER,
+                        },
+                    ],
+                }))).toBe(false);
+            });
+            it('should handle manage:semantic_viewer@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContextWithOrg,
+                    userUuid: 'user-456',
+                };
+                const builder = new ability_1.AbilityBuilder(ability_1.Ability);
+                (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
+                    ...contextWithUser,
+                    scopes: ['manage:SemanticViewer@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage semantic viewer with editor role
+                expect(ability.can('manage', (0, ability_1.subject)('SemanticViewer', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage without editor role
+                expect(ability.can('manage', (0, ability_1.subject)('SemanticViewer', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: space_1.SpaceMemberRole.VIEWER,
+                        },
+                    ],
                 }))).toBe(false);
             });
         });
@@ -681,7 +903,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:semantic_viewer'],
+                    scopes: ['view:SemanticViewer'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('SemanticViewer', {
@@ -693,14 +915,14 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContextWithOrg,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization'],
+                    scopes: ['manage:Organization'],
                 };
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithOrgManage,
                     scopes: [
-                        'manage:organization',
-                        'manage:semantic_viewer',
+                        'manage:Organization',
+                        'manage:SemanticViewer',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -717,7 +939,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...contextWithUser,
-                    scopes: ['manage:semantic_viewer'],
+                    scopes: ['manage:SemanticViewer@space'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage semantic viewer with editor role
@@ -747,7 +969,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['create:space'],
+                    scopes: ['create:Space'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('create', (0, ability_1.subject)('Space', {
@@ -761,7 +983,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:export_csv'],
+                    scopes: ['manage:ExportCsv'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('ExportCsv', {
@@ -773,7 +995,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:change_csv_results'],
+                    scopes: ['manage:ChangeCsvResults'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('ChangeCsvResults', {
@@ -787,7 +1009,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:underlying_data'],
+                    scopes: ['view:UnderlyingData'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('UnderlyingData', {
@@ -801,7 +1023,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:sql_runner'],
+                    scopes: ['manage:SqlRunner'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('SqlRunner', {
@@ -813,7 +1035,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:custom_sql'],
+                    scopes: ['manage:CustomSql'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('CustomSql', {
@@ -828,7 +1050,7 @@ describe('scopeAbilityBuilder', () => {
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['delete:project@self'],
+                    scopes: ['delete:Project@self'],
                 }, builder);
                 const ability = builder.build();
                 // Can delete specific project
@@ -841,21 +1063,22 @@ describe('scopeAbilityBuilder', () => {
                     type: projects_1.ProjectType.PREVIEW,
                 }))).toBe(false);
             });
-            it('should handle delete:project for preview projects', () => {
+            it('should handle delete:project@self for own preview projects', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
-                    ...baseContextWithOrg,
-                    scopes: ['delete:project'],
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    scopes: ['delete:Project@self'],
                 }, builder);
                 const ability = builder.build();
-                // Can delete preview projects in organization
+                // Can delete preview projects in a project
                 expect(ability.can('delete', (0, ability_1.subject)('Project', {
-                    organizationUuid: 'org-123',
+                    createdByUserUuid: 'user-456',
                     type: projects_1.ProjectType.PREVIEW,
                 }))).toBe(true);
                 // Cannot delete default projects
                 expect(ability.can('delete', (0, ability_1.subject)('Project', {
-                    organizationUuid: 'org-123',
+                    createdByUserUuid: 'user-456',
                     type: projects_1.ProjectType.DEFAULT,
                 }))).toBe(false);
             });
@@ -865,7 +1088,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['view:pinned_items'],
+                    scopes: ['view:PinnedItems'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('PinnedItems', {
@@ -877,7 +1100,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:pinned_items'],
+                    scopes: ['manage:PinnedItems'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('PinnedItems', {
@@ -891,7 +1114,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:explore'],
+                    scopes: ['manage:Explore'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('Explore', {
@@ -905,7 +1128,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['create:virtual_view'],
+                    scopes: ['create:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('create', (0, ability_1.subject)('VirtualView', {
@@ -922,7 +1145,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['delete:virtual_view'],
+                    scopes: ['delete:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('delete', (0, ability_1.subject)('VirtualView', {
@@ -939,7 +1162,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:virtual_view'],
+                    scopes: ['manage:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 // Should be able to manage (create and delete)
@@ -962,9 +1185,9 @@ describe('scopeAbilityBuilder', () => {
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContextWithOrg,
                     scopes: [
-                        'create:virtual_view',
-                        'delete:virtual_view',
-                        'manage:virtual_view',
+                        'create:VirtualView',
+                        'delete:VirtualView',
+                        'manage:VirtualView',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -987,9 +1210,9 @@ describe('scopeAbilityBuilder', () => {
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContextWithOrg,
                     scopes: [
-                        'create:virtual_view',
-                        'delete:virtual_view',
-                        'manage:virtual_view',
+                        'create:VirtualView',
+                        'delete:VirtualView',
+                        'manage:VirtualView',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -1014,7 +1237,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContextWithOrg,
-                    scopes: ['view:organization_member_profile'],
+                    scopes: ['view:OrganizationMemberProfile'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', (0, ability_1.subject)('OrganizationMemberProfile', {
@@ -1031,7 +1254,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new ability_1.AbilityBuilder(ability_1.Ability);
                 (0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                     ...baseContext,
-                    scopes: ['manage:organization_member_profile'],
+                    scopes: ['manage:OrganizationMemberProfile'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', (0, ability_1.subject)('OrganizationMemberProfile', {
@@ -1047,7 +1270,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,
@@ -1064,7 +1287,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: false,
@@ -1081,7 +1304,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'developer',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,
@@ -1098,7 +1321,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     // No permissionsConfig provided
                 }, builder);
                 const ability = builder.build();
@@ -1110,7 +1333,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: '', // Empty organization role
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,