@lightdash/common 0.2104.6 → 0.2104.8

package/dist/types/authorization/buildAccountHelpers.js

@@ -0,0 +1,11 @@
+export const buildAccountHelpers = (account) => ({
+    isAuthenticated: () => !!account.authentication && !!account.user?.id,
+    isRegisteredUser: () => account.user?.type === 'registered',
+    isAnonymousUser: () => account.user?.type === 'anonymous',
+    isSessionUser: () => account.authentication?.type === 'session',
+    isJwtUser: () => account.authentication?.type === 'jwt',
+    isServiceAccount: () => account.authentication?.type === 'service-account',
+    isPatUser: () => account.authentication?.type === 'pat',
+    isOauthUser: () => account.authentication?.type === 'oauth',
+});
+//# sourceMappingURL=buildAccountHelpers.js.map

package/dist/types/authorization/buildAccountHelpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildAccountHelpers.js","sourceRoot":"","sources":["../../../src/authorization/buildAccountHelpers.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,OAAiC,EACnB,EAAE,CAAC,CAAC;IAClB,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;IACrE,gBAAgB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;IAC3D,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW;IACzD,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,KAAK,SAAS;IAC/D,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,KAAK,KAAK;IACvD,gBAAgB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,KAAK,iBAAiB;IAC1E,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,KAAK,KAAK;IACvD,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,KAAK,OAAO;CAC9D,CAAC,CAAC"}

package/dist/types/authorization/index.d.ts

@@ -12,11 +12,8 @@ type UserAbilityBuilderArgs = {
     customRolesEnabled?: boolean;
     isEnterprise?: boolean;
 };
-export * from './buildAccountHelpers';
-export * from './jwtAbility';
-export * from './parseAccount';
-export * from './serviceAccountAbility';
 export declare const JWT_HEADER_NAME = "lightdash-embed-token";
 export declare const getUserAbilityBuilder: ({ user, projectProfiles, permissionsConfig, customRoleScopes, customRolesEnabled, isEnterprise, }: UserAbilityBuilderArgs) => AbilityBuilder<MemberAbility>;
 export declare const defineUserAbility: (user: Pick<LightdashUser, "role" | "organizationUuid" | "userUuid" | "roleUuid">, projectProfiles: Pick<ProjectMemberProfile, "projectUuid" | "role" | "userUuid" | "roleUuid">[], customRoleScopes?: Record<Role["roleUuid"], RoleWithScopes["scopes"]>) => MemberAbility;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/types/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,cAAc,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAyC,EACrC,KAAK,+BAA+B,EACvC,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,sBAAsB,GAAG;IAC1B,IAAI,EAAE,IAAI,CACN,aAAa,EACb,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,CACxD,CAAC;IACF,eAAe,EAAE,IAAI,CACjB,oBAAoB,EACpB,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CACnD,EAAE,CAAC;IACJ,iBAAiB,EAAE,+BAA+B,CAAC,mBAAmB,CAAC,CAAC;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AAExC,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAEvD,eAAO,MAAM,qBAAqB,sGAO/B,sBAAsB,kCAmDxB,CAAC;AAGF,eAAO,MAAM,iBAAiB,SACpB,IAAI,CACN,aAAa,EACb,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,CACxD,mBACgB,IAAI,CACjB,oBAAoB,EACpB,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CACnD,EAAE,qBACgB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,KACtE,aAaF,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,cAAc,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAyC,EACrC,KAAK,+BAA+B,EACvC,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,sBAAsB,GAAG;IAC1B,IAAI,EAAE,IAAI,CACN,aAAa,EACb,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,CACxD,CAAC;IACF,eAAe,EAAE,IAAI,CACjB,oBAAoB,EACpB,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CACnD,EAAE,CAAC;IACJ,iBAAiB,EAAE,+BAA+B,CAAC,mBAAmB,CAAC,CAAC;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAEvD,eAAO,MAAM,qBAAqB,sGAO/B,sBAAsB,kCAmDxB,CAAC;AAGF,eAAO,MAAM,iBAAiB,SACpB,IAAI,CACN,aAAa,EACb,MAAM,GAAG,kBAAkB,GAAG,UAAU,GAAG,UAAU,CACxD,mBACgB,IAAI,CACjB,oBAAoB,EACpB,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CACnD,EAAE,qBACgB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,KACtE,aAaF,CAAC"}

package/dist/types/authorization/index.js

@@ -0,0 +1,62 @@
+import { Ability, AbilityBuilder } from '@casl/ability';
+import { NotFoundError } from '../types/errors';
+import applyOrganizationMemberAbilities from './organizationMemberAbility';
+import { projectMemberAbilities } from './projectMemberAbility';
+import { buildAbilityFromScopes } from './scopeAbilityBuilder';
+export const JWT_HEADER_NAME = 'lightdash-embed-token';
+export const getUserAbilityBuilder = ({ user, projectProfiles, permissionsConfig, customRoleScopes, customRolesEnabled, isEnterprise, }) => {
+    const builder = new AbilityBuilder(Ability);
+    if (user.role && user.organizationUuid) {
+        // TODO custom roles at organization level are not supported yet
+        applyOrganizationMemberAbilities({
+            role: user.role,
+            member: {
+                organizationUuid: user.organizationUuid,
+                userUuid: user.userUuid,
+            },
+            builder,
+            permissionsConfig,
+        });
+        projectProfiles.forEach((projectProfile) => {
+            if (projectProfile.roleUuid && customRolesEnabled) {
+                if (!user.organizationUuid) {
+                    throw new NotFoundError(`Organization with uuid ${user.organizationUuid} was not found`);
+                }
+                const scopes = customRoleScopes?.[projectProfile.roleUuid];
+                if (!scopes) {
+                    // eslint-disable-next-line no-console
+                    console.error(`Custom role with uuid ${projectProfile.roleUuid} was not found`);
+                    return;
+                }
+                buildAbilityFromScopes({
+                    projectUuid: projectProfile.projectUuid,
+                    userUuid: user.userUuid,
+                    scopes,
+                    isEnterprise,
+                    organizationRole: user.role,
+                    permissionsConfig,
+                }, builder);
+            }
+            else {
+                projectMemberAbilities[projectProfile.role](projectProfile, builder);
+            }
+        });
+    }
+    return builder;
+};
+// Defines user ability for test purposes
+export const defineUserAbility = (user, projectProfiles, customRoleScopes) => {
+    const builder = getUserAbilityBuilder({
+        user,
+        projectProfiles,
+        permissionsConfig: {
+            pat: {
+                enabled: false,
+                allowedOrgRoles: [],
+            },
+        },
+        customRoleScopes,
+    });
+    return builder.build();
+};
+//# sourceMappingURL=index.js.map

package/dist/types/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,gCAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAkB/D,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EAClC,IAAI,EACJ,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACS,EAAE,EAAE;IACzB,MAAM,OAAO,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACrC,gEAAgE;QAChE,gCAAgC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE;gBACJ,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aAC1B;YACD,OAAO;YACP,iBAAiB;SACpB,CAAC,CAAC;QAEH,eAAe,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACvC,IAAI,cAAc,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACzB,MAAM,IAAI,aAAa,CACnB,0BAA0B,IAAI,CAAC,gBAAgB,gBAAgB,CAClE,CAAC;gBACN,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CACT,yBAAyB,cAAc,CAAC,QAAQ,gBAAgB,CACnE,CAAC;oBACF,OAAO;gBACX,CAAC;gBAED,sBAAsB,CAClB;oBACI,WAAW,EAAE,cAAc,CAAC,WAAW;oBACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM;oBACN,YAAY;oBACZ,gBAAgB,EAAE,IAAI,CAAC,IAAI;oBAC3B,iBAAiB;iBACpB,EACD,OAAO,CACV,CAAC;YACN,CAAC;iBAAM,CAAC;gBACJ,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,CACvC,cAAc,EACd,OAAO,CACV,CAAC;YACN,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC7B,IAGC,EACD,eAGG,EACH,gBAAqE,EACxD,EAAE;IACf,MAAM,OAAO,GAAG,qBAAqB,CAAC;QAClC,IAAI;QACJ,eAAe;QACf,iBAAiB,EAAE;YACf,GAAG,EAAE;gBACD,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,EAAE;aACtB;SACJ;QACD,gBAAgB;KACnB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC,CAAC"}

package/dist/types/authorization/index.mock.js

@@ -0,0 +1,42 @@
+import { OrganizationMemberRole, } from '../types/organizationMemberProfile';
+import { ProjectMemberRole } from '../types/projectMemberRole';
+export const userWithoutOrg = {
+    userUuid: 'user-uuid-1234',
+};
+export const orgProfile = {
+    userUuid: 'user-uuid-1234',
+    role: OrganizationMemberRole.VIEWER,
+    roleUuid: undefined,
+    email: '',
+    firstName: '',
+    lastName: '',
+    organizationUuid: 'organization-uuid-view',
+    isActive: true,
+    userCreatedAt: new Date(),
+    userUpdatedAt: new Date(),
+};
+export const projectProfile = {
+    userUuid: 'user-uuid-1234',
+    role: ProjectMemberRole.VIEWER,
+    projectUuid: 'project-uuid-view',
+    roleUuid: undefined,
+    email: '',
+    firstName: '',
+    lastName: '',
+};
+export const adminOrgProfile = {
+    ...orgProfile,
+    role: OrganizationMemberRole.ADMIN,
+    organizationUuid: 'organization-uuid-admin',
+};
+export const adminProjectProfile = {
+    ...projectProfile,
+    role: ProjectMemberRole.ADMIN,
+    projectUuid: 'project-uuid-admin',
+};
+export const conditions = {
+    organizationUuid: orgProfile.organizationUuid,
+    projectUuid: projectProfile.projectUuid,
+    isPrivate: false,
+};
+//# sourceMappingURL=index.mock.js.map

package/dist/types/authorization/index.mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mock.js","sourceRoot":"","sources":["../../../src/authorization/index.mock.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,sBAAsB,GAEzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC1B,QAAQ,EAAE,gBAAgB;CAC7B,CAAC;AACF,MAAM,CAAC,MAAM,UAAU,GAA8B;IACjD,QAAQ,EAAE,gBAAgB;IAC1B,IAAI,EAAE,sBAAsB,CAAC,MAAM;IACnC,QAAQ,EAAE,SAAS;IACnB,KAAK,EAAE,EAAE;IACT,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,gBAAgB,EAAE,wBAAwB;IAC1C,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI,IAAI,EAAE;IACzB,aAAa,EAAE,IAAI,IAAI,EAAE;CAC5B,CAAC;AACF,MAAM,CAAC,MAAM,cAAc,GAAyB;IAChD,QAAQ,EAAE,gBAAgB;IAC1B,IAAI,EAAE,iBAAiB,CAAC,MAAM;IAC9B,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,SAAS;IACnB,KAAK,EAAE,EAAE;IACT,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,GAAG,UAAU;IACb,IAAI,EAAE,sBAAsB,CAAC,KAAK;IAClC,gBAAgB,EAAE,yBAAyB;CAC9C,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAC/B,GAAG,cAAc;IACjB,IAAI,EAAE,iBAAiB,CAAC,KAAK;IAC7B,WAAW,EAAE,oBAAoB;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;IACtB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;IAC7C,WAAW,EAAE,cAAc,CAAC,WAAW;IACvC,SAAS,EAAE,KAAK;CACnB,CAAC"}

package/dist/types/authorization/index.test.js

@@ -0,0 +1,220 @@
+import { subject } from '@casl/ability';
+import { defineUserAbility } from './index';
+import { adminOrgProfile, adminProjectProfile, conditions as defaultConditions, orgProfile, projectProfile, userWithoutOrg, } from './index.mock';
+describe('Lightdash member permissions', () => {
+    let ability = defineUserAbility(orgProfile, [projectProfile]);
+    let conditions = defaultConditions;
+    describe('when user not in an org', () => {
+        beforeEach(() => {
+            ability = defineUserAbility(userWithoutOrg, []);
+        });
+        it('can not view org and project', async () => {
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(false);
+        });
+    });
+    describe('when user is an org viewer and project viewer', () => {
+        beforeEach(() => {
+            ability = defineUserAbility(orgProfile, [projectProfile]);
+        });
+        it('can view org and project', async () => {
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(true);
+        });
+        it('cannot view another org or another project', async () => {
+            conditions = {
+                projectUuid: 'another-project',
+                organizationUuid: 'another-org',
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(false);
+        });
+        it('cannot view another org', async () => {
+            conditions = {
+                ...defaultConditions,
+                organizationUuid: 'another-org',
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(true);
+        });
+        it('cannot view another project', async () => {
+            conditions = {
+                ...defaultConditions,
+                projectUuid: 'another-project',
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(true);
+        });
+        it('cannot manage org or project', async () => {
+            expect(ability.can('manage', subject('SavedChart', { ...conditions }))).toEqual(false);
+            expect(ability.can('manage', subject('Dashboard', { ...conditions }))).toEqual(false);
+            expect(ability.can('manage', subject('Project', { ...conditions }))).toEqual(false);
+        });
+    });
+    describe('when user is an org admin and project viewer', () => {
+        // org admins and editors have `manage` permissions over all projects
+        // within the org
+        beforeEach(() => {
+            ability = defineUserAbility(adminOrgProfile, [projectProfile]);
+            conditions = {
+                organizationUuid: adminOrgProfile.organizationUuid,
+                projectUuid: projectProfile.projectUuid,
+                isPrivate: false,
+            };
+        });
+        it('can view org and project', async () => {
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(true);
+        });
+        it('cannot view another org and or another project', async () => {
+            conditions = {
+                organizationUuid: 'another-org',
+                projectUuid: 'another-project',
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(false);
+        });
+        it('can manage org AND project', async () => {
+            expect(ability.can('manage', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Project', { ...conditions }))).toEqual(true);
+        });
+    });
+    describe('when user is an org viewer and project admin', () => {
+        beforeEach(() => {
+            ability = defineUserAbility(orgProfile, [adminProjectProfile]);
+            conditions = {
+                organizationUuid: orgProfile.organizationUuid,
+                projectUuid: adminProjectProfile.projectUuid,
+                isPrivate: false,
+            };
+        });
+        it('can view org and project', async () => {
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(true);
+        });
+        it('cannot view another org and or another project', async () => {
+            conditions = {
+                organizationUuid: 'another-org',
+                projectUuid: 'another-project',
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Dashboard', { ...conditions }))).toEqual(false);
+            expect(ability.can('view', subject('Project', { ...conditions }))).toEqual(false);
+        });
+        it('cannot manage org alone but can manage project', async () => {
+            // Combined
+            expect(ability.can('manage', subject('SavedChart', { ...conditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Dashboard', { ...conditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Project', { ...conditions }))).toEqual(true);
+            // Org specific
+            const orgConditions = {
+                organizationUuid: conditions.organizationUuid,
+            };
+            expect(ability.can('manage', subject('SavedChart', { ...orgConditions }))).toEqual(false);
+            expect(ability.can('manage', subject('Dashboard', { ...orgConditions }))).toEqual(false);
+            expect(ability.can('manage', subject('Project', { ...orgConditions }))).toEqual(false);
+            // Project specific
+            const projectConditions = {
+                projectUuid: conditions.projectUuid,
+                isPrivate: false,
+            };
+            expect(ability.can('manage', subject('SavedChart', { ...projectConditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Dashboard', { ...projectConditions }))).toEqual(true);
+            expect(ability.can('manage', subject('Project', { ...projectConditions }))).toEqual(true);
+        });
+    });
+    describe('when user is viewer in one project but admin in another', () => {
+        beforeEach(() => {
+            ability = defineUserAbility(orgProfile, [
+                projectProfile,
+                adminProjectProfile,
+            ]);
+            conditions = {
+                organizationUuid: orgProfile.organizationUuid,
+                projectUuid: projectProfile.projectUuid,
+                isPrivate: false,
+            };
+        });
+        it('can view org and project', async () => {
+            const conditionsProjectView = {
+                projectUuid: projectProfile.projectUuid,
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditionsProjectView }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditionsProjectView }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditionsProjectView }))).toEqual(true);
+            const conditionsProjectAdmin = {
+                projectUuid: adminProjectProfile.projectUuid,
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...conditionsProjectAdmin }))).toEqual(true);
+            expect(ability.can('view', subject('Dashboard', { ...conditionsProjectAdmin }))).toEqual(true);
+            expect(ability.can('view', subject('Project', { ...conditionsProjectAdmin }))).toEqual(true);
+        });
+        it('cannot view another project', async () => {
+            const projectConditions = {
+                projectUuid: 'another-project',
+                isPrivate: false,
+            };
+            expect(ability.can('view', subject('SavedChart', { ...projectConditions }))).toEqual(false);
+            expect(ability.can('view', subject('Dashboard', { ...projectConditions }))).toEqual(false);
+            expect(ability.can('view', subject('Project', { ...projectConditions }))).toEqual(false);
+        });
+        it('can manage admin project but cannot manage view project', async () => {
+            const conditionsProjectView = {
+                projectUuid: projectProfile.projectUuid,
+                isPrivate: false,
+            };
+            expect(ability.can('manage', subject('SavedChart', { ...conditionsProjectView }))).toEqual(false);
+            expect(ability.can('manage', subject('Dashboard', { ...conditionsProjectView }))).toEqual(false);
+            expect(ability.can('manage', subject('Project', { ...conditionsProjectView }))).toEqual(false);
+            const conditionsProjectAdmin = {
+                projectUuid: adminProjectProfile.projectUuid,
+                isPrivate: false,
+            };
+            expect(ability.can('manage', subject('SavedChart', { ...conditionsProjectAdmin }))).toEqual(true);
+            expect(ability.can('manage', subject('Dashboard', { ...conditionsProjectAdmin }))).toEqual(true);
+            expect(ability.can('manage', subject('Project', { ...conditionsProjectAdmin }))).toEqual(true);
+        });
+    });
+    describe('when user is an org admin and has no project roles', () => {
+        // org admins and editors have `manage` permissions over all projects
+        // within the org
+        beforeEach(() => {
+            ability = defineUserAbility(adminOrgProfile, []);
+        });
+        it('can view project', async () => {
+            expect(ability.rules).toContainEqual({
+                action: 'manage',
+                subject: 'Project',
+                conditions: {
+                    organizationUuid: adminOrgProfile.organizationUuid,
+                },
+            });
+            expect(ability.can('manage', 'Project')).toEqual(true);
+            expect(ability.can('manage', subject('Project', {
+                organizationUuid: adminOrgProfile.organizationUuid,
+            }))).toEqual(true);
+            expect(ability.can('manage', subject('Project', {
+                projectUuid: projectProfile.projectUuid,
+            }))).toEqual(false);
+            expect(ability.can('manage', subject('Project', {
+                organizationUuid: adminOrgProfile.organizationUuid,
+                projectUuid: projectProfile.projectUuid,
+            }))).toEqual(true);
+        });
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/types/authorization/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../../src/authorization/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EACH,eAAe,EACf,mBAAmB,EACnB,UAAU,IAAI,iBAAiB,EAC/B,UAAU,EACV,cAAc,EACd,cAAc,GACjB,MAAM,cAAc,CAAC;AAEtB,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC1C,IAAI,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACrC,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC3D,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YACxD,UAAU,GAAG;gBACT,WAAW,EAAE,iBAAiB;gBAC9B,gBAAgB,EAAE,aAAa;gBAC/B,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACrC,UAAU,GAAG;gBACT,GAAG,iBAAiB;gBACpB,gBAAgB,EAAE,aAAa;aAClC,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YACzC,UAAU,GAAG;gBACT,GAAG,iBAAiB;gBACpB,WAAW,EAAE,iBAAiB;aACjC,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAClE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CACjE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAC1D,qEAAqE;QACrE,iBAAiB;QACjB,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/D,UAAU,GAAG;gBACT,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;gBAClD,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC5D,UAAU,GAAG;gBACT,gBAAgB,EAAE,aAAa;gBAC/B,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAClE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CACjE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAC1D,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/D,UAAU,GAAG;gBACT,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,WAAW,EAAE,mBAAmB,CAAC,WAAW;gBAC5C,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC5D,UAAU,GAAG;gBACT,gBAAgB,EAAE,aAAa;gBAC/B,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC5D,WAAW;YACX,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAClE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CACjE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhB,eAAe;YACf,MAAM,aAAa,GAAG;gBAClB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;aAChD,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAC9C,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAC7C,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAC,CAClE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEjB,mBAAmB;YACnB,MAAM,iBAAiB,GAAG;gBACtB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAClD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CACjD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAC/C,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACrE,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE;gBACpC,cAAc;gBACd,mBAAmB;aACtB,CAAC,CAAC;YACH,UAAU,GAAG;gBACT,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,qBAAqB,GAAG;gBAC1B,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,SAAS,EAAE,KAAK;aACnB,CAAC;YAEF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACtD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACrD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACnD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhB,MAAM,sBAAsB,GAAG;gBAC3B,WAAW,EAAE,mBAAmB,CAAC,WAAW;gBAC5C,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACvD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACtD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACpD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,iBAAiB,GAAG;gBACtB,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAClD,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CACjD,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,MAAM,EACN,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAC/C,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,qBAAqB,GAAG;gBAC1B,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,SAAS,EAAE,KAAK;aACnB,CAAC;YAEF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACtD,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACrD,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACnD,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,sBAAsB,GAAG;gBAC3B,WAAW,EAAE,mBAAmB,CAAC,WAAW;gBAC5C,SAAS,EAAE,KAAK;aACnB,CAAC;YACF,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACvD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACtD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CACpD,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAChE,qEAAqE;QACrE,iBAAiB;QACjB,UAAU,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC9B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC;gBACjC,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE;oBACR,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;iBACrD;aACJ,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE;gBACf,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;aACrD,CAAC,CACL,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE;gBACf,WAAW,EAAE,cAAc,CAAC,WAAW;aAC1C,CAAC,CACL,CACJ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CACF,OAAO,CAAC,GAAG,CACP,QAAQ,EACR,OAAO,CAAC,SAAS,EAAE;gBACf,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;gBAClD,WAAW,EAAE,cAAc,CAAC,WAAW;aAC1C,CAAC,CACL,CACJ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/types/authorization/jwtAbility.js

@@ -0,0 +1,77 @@
+import flow from 'lodash/flow';
+const dashboardAbilities = ({ embedUser, dashboardUuid, embed, externalId, builder, }) => {
+    const { organization } = embed;
+    const { can } = builder;
+    can('view', 'Dashboard', {
+        dashboardUuid,
+        organizationUuid: organization.organizationUuid,
+    });
+    if (embedUser.content.canDateZoom) {
+        can('view', 'Dashboard', {
+            dateZoom: true,
+            organizationUuid: organization.organizationUuid,
+        });
+    }
+    can('view', 'SavedChart', {
+        organizationUuid: organization.organizationUuid,
+        projectUuid: embed.projectUuid,
+        isPrivate: false,
+    });
+    can('view', 'Project', {
+        organizationUuid: organization.organizationUuid,
+        projectUuid: embed.projectUuid,
+    });
+    return { embedUser, dashboardUuid, embed, builder, externalId };
+};
+const exploreAbilities = ({ embedUser, dashboardUuid, embed, externalId, builder, }) => {
+    const { content } = embedUser;
+    const { organization } = embed;
+    const { can } = builder;
+    if (content.canExplore || content.canViewUnderlyingData) {
+        can('view', 'UnderlyingData', {
+            organizationUuid: organization.organizationUuid,
+            projectUuid: embed.projectUuid,
+        });
+    }
+    if (content.canExplore) {
+        can('view', 'Explore', {
+            organizationUuid: organization.organizationUuid,
+            projectUuid: embed.projectUuid,
+        });
+    }
+    return { embedUser, dashboardUuid, embed, externalId, builder };
+};
+const exportAbilities = ({ embedUser, dashboardUuid, embed, externalId, builder, }) => {
+    const { content } = embedUser;
+    const { organization } = embed;
+    const { can } = builder;
+    if (content.canExportCsv) {
+        can('export', 'Dashboard', {
+            organizationUuid: organization.organizationUuid,
+            type: 'csv',
+        });
+        can('view', 'JobStatus', {
+            organizationUuid: organization.organizationUuid,
+            projectUuid: embed.projectUuid,
+            createdByUserUuid: externalId,
+        });
+    }
+    if (content.canExportPagePdf) {
+        can('export', 'Dashboard', {
+            organizationUuid: organization.organizationUuid,
+            type: 'pdf',
+        });
+    }
+    if (content.canExportImages) {
+        can('export', 'Dashboard', {
+            organizationUuid: organization.organizationUuid,
+            type: 'images',
+        });
+    }
+    return { embedUser, dashboardUuid, embed, externalId, builder };
+};
+const applyAbilities = flow(dashboardAbilities, exportAbilities, exploreAbilities);
+export function applyEmbeddedAbility(embedUser, dashboardUuid, embed, externalId, builder) {
+    applyAbilities({ embedUser, dashboardUuid, embed, externalId, builder });
+}
+//# sourceMappingURL=jwtAbility.js.map

package/dist/types/authorization/jwtAbility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAbility.js","sourceRoot":"","sources":["../../../src/authorization/jwtAbility.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,aAAa,CAAC;AAiB/B,MAAM,kBAAkB,GAA2B,CAAC,EAChD,SAAS,EACT,aAAa,EACb,KAAK,EACL,UAAU,EACV,OAAO,GACV,EAAE,EAAE;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE;QACrB,aAAa;QACb,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;KAClD,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE;YACrB,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;SAClD,CAAC,CAAC;IACP,CAAC;IAED,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE;QACtB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK;KACnB,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;QACnB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAA2B,CAAC,EAC9C,SAAS,EACT,aAAa,EACb,KAAK,EACL,UAAU,EACV,OAAO,GACV,EAAE,EAAE;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE;YAC1B,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;YACnB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,eAAe,GAA2B,CAAC,EAC7C,SAAS,EACT,aAAa,EACb,KAAK,EACL,UAAU,EACV,OAAO,GACV,EAAE,EAAE;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE;YACvB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE;YACrB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iBAAiB,EAAE,UAAU;SAChC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE;YACvB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1B,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE;YACvB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,CACnB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAChC,SAAyB,EACzB,aAAqB,EACrB,KAAe,EACf,UAAkB,EAClB,OAAsC;IAEtC,cAAc,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC"}