@lightdash/common 0.1947.0 → 0.1948.0

package/dist/esm/authorization/scopeAbilityBuilder.test.js

@@ -20,7 +20,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...baseContextWithOrg,
-                scopes: ['view:organization'],
+                scopes: ['view:Organization'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', subject('Organization', {
@@ -36,7 +36,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...baseContext,
-                scopes: ['view:dashboard'],
+                scopes: ['view:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Should be able to view public dashboards
@@ -60,7 +60,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...contextWithUser,
-                scopes: ['view:dashboard'],
+                scopes: ['view:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Can view dashboards with user access
@@ -78,7 +78,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...projectContext,
-                scopes: ['view:project'],
+                scopes: ['view:Project'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', subject('Project', {
@@ -90,7 +90,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...baseContextWithOrg,
-                scopes: ['create:project'],
+                scopes: ['create:Project'],
             }, builder);
             const ability = builder.build();
             // Can create preview projects
@@ -112,7 +112,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...editorContext,
-                scopes: ['manage:dashboard'],
+                scopes: ['manage:Dashboard'],
             }, builder);
             const ability = builder.build();
             // Can manage dashboards where user is editor
@@ -134,7 +134,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...adminContext,
-                scopes: ['manage:space'],
+                scopes: ['manage:Space'],
             }, builder);
             const ability = builder.build();
             // Can manage spaces where user is admin
@@ -156,7 +156,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...userContext,
-                scopes: ['view:job_status'],
+                scopes: ['view:JobStatus@self'],
             }, builder);
             const ability = builder.build();
             // Can view job status created by the user
@@ -177,17 +177,17 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...userContext,
-                scopes: ['manage:ai_agent_thread'],
+                scopes: ['manage:AiAgentThread@self'],
             }, builder);
             const ability = builder.build();
             // Can manage user's own AI agent threads
             expect(ability.can('manage', subject('AiAgentThread', {
-                organizationUuid: 'org-123',
+                projectUuid: 'project-123',
                 userUuid: 'user-456',
             }))).toBe(true);
             // Cannot manage another user's threads
             expect(ability.can('manage', subject('AiAgentThread', {
-                organizationUuid: 'org-123',
+                projectUuid: 'project-123',
                 userUuid: 'other-user',
             }))).toBe(false);
         });
@@ -196,7 +196,7 @@ describe('scopeAbilityBuilder', () => {
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes({
                 ...baseContext,
-                scopes: ['view:analytics', 'manage:tags'],
+                scopes: ['view:Analytics', 'manage:Tags'],
             }, builder);
             const ability = builder.build();
             expect(ability.can('view', subject('Analytics', {
@@ -232,11 +232,7 @@ describe('scopeAbilityBuilder', () => {
                 organizationUuid: 'org-123',
                 isEnterprise: false,
                 organizationRole: 'admin',
-                scopes: [
-                    'view:dashboard',
-                    'manage:saved_chart',
-                    'view:project',
-                ],
+                scopes: ['view:Dashboard', 'manage:SavedChart', 'view:Project'],
             };
             const builder = new AbilityBuilder(Ability);
             buildAbilityFromScopes(context, builder);
@@ -267,7 +263,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization', 'manage:saved_chart'],
+                    scopes: ['manage:Organization', 'manage:SavedChart'],
                 };
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes(contextWithOrgManage, builder);
@@ -288,7 +284,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithoutOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:saved_chart'],
+                    scopes: ['manage:SavedChart@space'],
                 };
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes(contextWithoutOrgManage, builder);
@@ -315,7 +311,7 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithProjectManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:project', 'manage:space'],
+                    scopes: ['manage:Project', 'manage:Space'],
                 };
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes(contextWithProjectManage, builder);
@@ -342,12 +338,12 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization', 'promote:dashboard'],
+                    scopes: ['manage:Organization', 'promote:Dashboard'],
                 };
                 const contextWithoutOrgManage = {
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['promote:dashboard'],
+                    scopes: ['promote:Dashboard@space'],
                 };
                 // Test dashboard promotion with organization management
                 const builder = new AbilityBuilder(Ability);
@@ -379,6 +375,82 @@ describe('scopeAbilityBuilder', () => {
                 }))).toBe(false);
             });
         });
+        describe('AI agent thread permissions with modifiers', () => {
+            it('should handle view:ai_agent_thread@self permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    isEnterprise: true,
+                };
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...contextWithUser,
+                    scopes: ['view:AiAgentThread@self'],
+                }, builder);
+                const ability = builder.build();
+                // Can view own AI agent threads
+                expect(ability.can('view', subject('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot view other users' threads
+                expect(ability.can('view', subject('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'other-user',
+                }))).toBe(false);
+            });
+            it('should handle manage:ai_agent_thread@self permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    isEnterprise: true,
+                };
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...contextWithUser,
+                    userUuid: 'user-456',
+                    scopes: ['manage:AiAgentThread@self'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage own AI agent threads
+                expect(ability.can('manage', subject('AiAgentThread', {
+                    projectUuid: 'project-123',
+                    userUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot manage other users' threads
+                expect(ability.can('manage', subject('AiAgentThread', {
+                    userUuid: 'other-user',
+                }))).toBe(false);
+            });
+            it('should handle view:ai_agent_thread permissions for all threads', () => {
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
+                    isEnterprise: true,
+                    scopes: ['view:AiAgentThread'],
+                }, builder);
+                const ability = builder.build();
+                // Can view any AI agent thread
+                expect(ability.can('view', subject('AiAgentThread', {
+                    organizationUuid: 'org-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+            it('should handle manage:ai_agent_thread permissions for all threads', () => {
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContextWithOrg,
+                    isEnterprise: true,
+                    scopes: ['manage:AiAgentThread'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage any AI agent thread
+                expect(ability.can('manage', subject('AiAgentThread', {
+                    organizationUuid: 'org-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+        });
         describe('edge cases and error handling', () => {
             it('should handle empty scope array', () => {
                 const builder = new AbilityBuilder(Ability);
@@ -393,7 +465,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithoutUser,
-                    scopes: ['view:dashboard'],
+                    scopes: ['view:Dashboard'],
                 }, builder);
                 const ability = builder.build();
                 // Should only allow viewing public dashboards
@@ -413,8 +485,8 @@ describe('scopeAbilityBuilder', () => {
                 buildAbilityFromScopes({
                     ...baseContext,
                     scopes: [
-                        'view:dashboard',
-                        'view:project',
+                        'view:Dashboard',
+                        'view:Project',
                         'invalid:scope',
                     ],
                 }, builder);
@@ -431,9 +503,9 @@ describe('scopeAbilityBuilder', () => {
                 buildAbilityFromScopes({
                     ...baseContext,
                     scopes: [
-                        'view:dashboard',
-                        'manage:saved_chart',
-                        'view:space',
+                        'view:Dashboard',
+                        'manage:SavedChart',
+                        'view:Space',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -456,7 +528,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:saved_chart'],
+                    scopes: ['view:SavedChart'],
                 }, builder);
                 const ability = builder.build();
                 // Should not access saved chart from different project
@@ -476,7 +548,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['view:dashboard'],
+                    scopes: ['view:Dashboard'],
                 }, builder);
                 const ability = builder.build();
                 // Can view private dashboard with viewer access
@@ -516,7 +588,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['manage:dashboard'],
+                    scopes: ['manage:Dashboard@space'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage dashboard with editor role
@@ -563,7 +635,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['manage:space@assigned'],
+                    scopes: ['manage:Space@assigned'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage space with admin role
@@ -601,7 +673,7 @@ describe('scopeAbilityBuilder', () => {
             });
         });
         describe('job and job status permissions', () => {
-            it('should handle view:job permissions', () => {
+            it('should handle view:job@self permissions', () => {
                 const contextWithUser = {
                     ...baseContext,
                     userUuid: 'user-456',
@@ -609,7 +681,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['view:job'],
+                    scopes: ['view:Job@self'],
                 }, builder);
                 const ability = builder.build();
                 // Can view own jobs
@@ -621,30 +693,31 @@ describe('scopeAbilityBuilder', () => {
                     userUuid: 'other-user',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions for organization context', () => {
+            it('should handle view:job_status@self permissions for user context', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:job_status'],
+                    userUuid: 'user-456',
+                    scopes: ['view:JobStatus@self'],
                 }, builder);
                 const ability = builder.build();
-                // Cannot view job status without user context when no manage:Organization scope
+                // Can view own job status
                 expect(ability.can('view', subject('JobStatus', {
-                    organizationUuid: 'org-123',
-                }))).toBe(false);
-                // Cannot view job status from another organization
+                    createdByUserUuid: 'user-456',
+                }))).toBe(true);
+                // Cannot view other users' job status
                 expect(ability.can('view', subject('JobStatus', {
-                    organizationUuid: 'different-org',
+                    createdByUserUuid: 'other-user',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions with manage:Organization scope', () => {
+            it('should handle view:job_status permissions for all job status', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContextWithOrg,
-                    scopes: ['view:job_status', 'manage:organization'],
+                    scopes: ['view:JobStatus'],
                 }, builder);
                 const ability = builder.build();
-                // Can view all job status in organization when manage:Organization scope is present
+                // Can view all job status in organization
                 expect(ability.can('view', subject('JobStatus', {
                     organizationUuid: 'org-123',
                 }))).toBe(true);
@@ -653,7 +726,70 @@ describe('scopeAbilityBuilder', () => {
                     organizationUuid: 'different-org',
                 }))).toBe(false);
             });
-            it('should handle view:job_status permissions for user context', () => {
+            it('should handle view:job permissions for all jobs', () => {
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...baseContext,
+                    scopes: ['view:Job'],
+                }, builder);
+                const ability = builder.build();
+                // Can view any job
+                expect(ability.can('view', subject('Job', {
+                    organizationUuid: 'org-123',
+                    projectUuid: 'project-123',
+                    userUuid: 'any-user',
+                }))).toBe(true);
+            });
+        });
+        describe('space-based permissions modifiers', () => {
+            it('should handle manage:dashboard@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContextWithOrg,
+                    userUuid: 'user-456',
+                };
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...contextWithUser,
+                    scopes: ['manage:Dashboard@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage dashboard with editor role
+                expect(ability.can('manage', subject('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Can manage dashboard with admin role
+                expect(ability.can('manage', subject('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.ADMIN,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage dashboard with viewer role
+                expect(ability.can('manage', subject('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.VIEWER,
+                        },
+                    ],
+                }))).toBe(false);
+                // Cannot manage dashboard without access
+                expect(ability.can('manage', subject('Dashboard', {
+                    organizationUuid: 'org-123',
+                    access: [],
+                }))).toBe(false);
+            });
+            it('should handle manage:saved_chart@space permissions', () => {
                 const contextWithUser = {
                     ...baseContext,
                     userUuid: 'user-456',
@@ -661,16 +797,102 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['view:job_status'],
+                    scopes: ['manage:SavedChart@space'],
                 }, builder);
                 const ability = builder.build();
-                // Can view own job status
-                expect(ability.can('view', subject('JobStatus', {
-                    createdByUserUuid: 'user-456',
+                // Can manage saved chart with editor role
+                expect(ability.can('manage', subject('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.EDITOR,
+                        },
+                    ],
                 }))).toBe(true);
-                // Cannot view other users' job status
-                expect(ability.can('view', subject('JobStatus', {
-                    createdByUserUuid: 'other-user',
+                // Can manage saved chart with admin role
+                expect(ability.can('manage', subject('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.ADMIN,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage without proper access
+                expect(ability.can('manage', subject('SavedChart', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'other-user',
+                            role: SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(false);
+            });
+            it('should handle promote:dashboard@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContext,
+                    userUuid: 'user-456',
+                };
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...contextWithUser,
+                    scopes: ['promote:Dashboard@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can promote dashboard with editor access
+                expect(ability.can('promote', subject('Dashboard', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot promote without editor access
+                expect(ability.can('promote', subject('Dashboard', {
+                    projectUuid: 'project-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.VIEWER,
+                        },
+                    ],
+                }))).toBe(false);
+            });
+            it('should handle manage:semantic_viewer@space permissions', () => {
+                const contextWithUser = {
+                    ...baseContextWithOrg,
+                    userUuid: 'user-456',
+                };
+                const builder = new AbilityBuilder(Ability);
+                buildAbilityFromScopes({
+                    ...contextWithUser,
+                    scopes: ['manage:SemanticViewer@space'],
+                }, builder);
+                const ability = builder.build();
+                // Can manage semantic viewer with editor role
+                expect(ability.can('manage', subject('SemanticViewer', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.EDITOR,
+                        },
+                    ],
+                }))).toBe(true);
+                // Cannot manage without editor role
+                expect(ability.can('manage', subject('SemanticViewer', {
+                    organizationUuid: 'org-123',
+                    access: [
+                        {
+                            userUuid: 'user-456',
+                            role: SpaceMemberRole.VIEWER,
+                        },
+                    ],
                 }))).toBe(false);
             });
         });
@@ -679,7 +901,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:semantic_viewer'],
+                    scopes: ['view:SemanticViewer'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', subject('SemanticViewer', {
@@ -691,14 +913,14 @@ describe('scopeAbilityBuilder', () => {
                 const contextWithOrgManage = {
                     ...baseContextWithOrg,
                     userUuid: 'user-456',
-                    scopes: ['manage:organization'],
+                    scopes: ['manage:Organization'],
                 };
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithOrgManage,
                     scopes: [
-                        'manage:organization',
-                        'manage:semantic_viewer',
+                        'manage:Organization',
+                        'manage:SemanticViewer',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -715,7 +937,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...contextWithUser,
-                    scopes: ['manage:semantic_viewer'],
+                    scopes: ['manage:SemanticViewer@space'],
                 }, builder);
                 const ability = builder.build();
                 // Can manage semantic viewer with editor role
@@ -745,7 +967,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['create:space'],
+                    scopes: ['create:Space'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('create', subject('Space', {
@@ -759,7 +981,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:export_csv'],
+                    scopes: ['manage:ExportCsv'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('ExportCsv', {
@@ -771,7 +993,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:change_csv_results'],
+                    scopes: ['manage:ChangeCsvResults'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('ChangeCsvResults', {
@@ -785,7 +1007,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:underlying_data'],
+                    scopes: ['view:UnderlyingData'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', subject('UnderlyingData', {
@@ -799,7 +1021,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:sql_runner'],
+                    scopes: ['manage:SqlRunner'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('SqlRunner', {
@@ -811,7 +1033,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:custom_sql'],
+                    scopes: ['manage:CustomSql'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('CustomSql', {
@@ -826,7 +1048,7 @@ describe('scopeAbilityBuilder', () => {
                 buildAbilityFromScopes({
                     ...baseContext,
                     userUuid: 'user-456',
-                    scopes: ['delete:project@self'],
+                    scopes: ['delete:Project@self'],
                 }, builder);
                 const ability = builder.build();
                 // Can delete specific project
@@ -839,21 +1061,22 @@ describe('scopeAbilityBuilder', () => {
                     type: ProjectType.PREVIEW,
                 }))).toBe(false);
             });
-            it('should handle delete:project for preview projects', () => {
+            it('should handle delete:project@self for own preview projects', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
-                    ...baseContextWithOrg,
-                    scopes: ['delete:project'],
+                    ...baseContext,
+                    userUuid: 'user-456',
+                    scopes: ['delete:Project@self'],
                 }, builder);
                 const ability = builder.build();
-                // Can delete preview projects in organization
+                // Can delete preview projects in a project
                 expect(ability.can('delete', subject('Project', {
-                    organizationUuid: 'org-123',
+                    createdByUserUuid: 'user-456',
                     type: ProjectType.PREVIEW,
                 }))).toBe(true);
                 // Cannot delete default projects
                 expect(ability.can('delete', subject('Project', {
-                    organizationUuid: 'org-123',
+                    createdByUserUuid: 'user-456',
                     type: ProjectType.DEFAULT,
                 }))).toBe(false);
             });
@@ -863,7 +1086,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['view:pinned_items'],
+                    scopes: ['view:PinnedItems'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', subject('PinnedItems', {
@@ -875,7 +1098,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:pinned_items'],
+                    scopes: ['manage:PinnedItems'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('PinnedItems', {
@@ -889,7 +1112,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:explore'],
+                    scopes: ['manage:Explore'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('Explore', {
@@ -903,7 +1126,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['create:virtual_view'],
+                    scopes: ['create:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('create', subject('VirtualView', {
@@ -920,7 +1143,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['delete:virtual_view'],
+                    scopes: ['delete:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('delete', subject('VirtualView', {
@@ -937,7 +1160,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:virtual_view'],
+                    scopes: ['manage:VirtualView'],
                 }, builder);
                 const ability = builder.build();
                 // Should be able to manage (create and delete)
@@ -960,9 +1183,9 @@ describe('scopeAbilityBuilder', () => {
                 buildAbilityFromScopes({
                     ...baseContextWithOrg,
                     scopes: [
-                        'create:virtual_view',
-                        'delete:virtual_view',
-                        'manage:virtual_view',
+                        'create:VirtualView',
+                        'delete:VirtualView',
+                        'manage:VirtualView',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -985,9 +1208,9 @@ describe('scopeAbilityBuilder', () => {
                 buildAbilityFromScopes({
                     ...baseContextWithOrg,
                     scopes: [
-                        'create:virtual_view',
-                        'delete:virtual_view',
-                        'manage:virtual_view',
+                        'create:VirtualView',
+                        'delete:VirtualView',
+                        'manage:VirtualView',
                     ],
                 }, builder);
                 const ability = builder.build();
@@ -1012,7 +1235,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContextWithOrg,
-                    scopes: ['view:organization_member_profile'],
+                    scopes: ['view:OrganizationMemberProfile'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('view', subject('OrganizationMemberProfile', {
@@ -1029,7 +1252,7 @@ describe('scopeAbilityBuilder', () => {
                 const builder = new AbilityBuilder(Ability);
                 buildAbilityFromScopes({
                     ...baseContext,
-                    scopes: ['manage:organization_member_profile'],
+                    scopes: ['manage:OrganizationMemberProfile'],
                 }, builder);
                 const ability = builder.build();
                 expect(ability.can('manage', subject('OrganizationMemberProfile', {
@@ -1045,7 +1268,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,
@@ -1062,7 +1285,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: false,
@@ -1079,7 +1302,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'developer',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,
@@ -1096,7 +1319,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: 'admin',
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     // No permissionsConfig provided
                 }, builder);
                 const ability = builder.build();
@@ -1108,7 +1331,7 @@ describe('scopeAbilityBuilder', () => {
                     ...baseContext,
                     isEnterprise: true,
                     organizationRole: '', // Empty organization role
-                    scopes: ['manage:personal_access_token'],
+                    scopes: ['manage:PersonalAccessToken'],
                     permissionsConfig: {
                         pat: {
                             enabled: true,