@lightdash/common 0.2104.7 → 0.2104.8

package/dist/types/authorization/roleToScopeMapping.testUtils.js

@@ -0,0 +1,319 @@
+/* eslint-disable no-console */
+import { Ability, AbilityBuilder, subject } from '@casl/ability';
+import { ProjectMemberRole } from '../types/projectMemberRole';
+import { projectMemberAbilities } from './projectMemberAbility';
+import { getAllScopesForRole, getNonEnterpriseScopesForRole, } from './roleToScopeMapping';
+import { buildAbilityFromScopes } from './scopeAbilityBuilder';
+/**
+ * Test utilities for role to scope mapping validation
+ * These functions are only used for testing migration compatibility
+ */
+/**
+ * Validates that a role properly inherits permissions from lower roles
+ */
+export const validateRoleInheritance = () => {
+    const errors = [];
+    const roleOrder = [
+        ProjectMemberRole.VIEWER,
+        ProjectMemberRole.INTERACTIVE_VIEWER,
+        ProjectMemberRole.EDITOR,
+        ProjectMemberRole.DEVELOPER,
+        ProjectMemberRole.ADMIN,
+    ];
+    for (let i = 1; i < roleOrder.length; i += 1) {
+        const currentRole = roleOrder[i];
+        const previousRole = roleOrder[i - 1];
+        const currentScopes = new Set(getAllScopesForRole(currentRole));
+        const previousScopes = getAllScopesForRole(previousRole);
+        // Check that all previous scopes are included in current role
+        for (const scope of previousScopes) {
+            if (!currentScopes.has(scope)) {
+                errors.push(`Role ${currentRole} is missing inherited scope: ${scope} from ${previousRole}`);
+            }
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+};
+/**
+ * Extracts the actual permissions granted by a role builder for analysis and comparison
+ * This is useful for debugging and validating that our scope mappings are correct
+ */
+export const extractRolePermissions = (role) => {
+    const builder = new AbilityBuilder(Ability);
+    const testMember = {
+        role,
+        projectUuid: 'test-project-uuid',
+        userUuid: 'test-user-uuid',
+    };
+    // Build the ability using the role-based system
+    projectMemberAbilities[role](testMember, builder);
+    const ability = builder.build();
+    // Extract the rules for analysis
+    return {
+        rules: ability.rules.map((rule) => ({
+            action: rule.action,
+            subject: rule.subject,
+            conditions: rule.conditions,
+            inverted: rule.inverted,
+            reason: rule.reason,
+        })),
+        rawAbility: ability,
+    };
+};
+/**
+ * Helper function to create standardized test cases for role compatibility testing
+ */
+export const createStandardTestCases = () => [
+    // View permissions
+    {
+        action: 'view',
+        subject: 'Dashboard',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+            isPrivate: false,
+        },
+    },
+    {
+        action: 'view',
+        subject: 'SavedChart',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+            isPrivate: false,
+        },
+    },
+    {
+        action: 'view',
+        subject: 'Space',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+            isPrivate: false,
+        },
+    },
+    {
+        action: 'view',
+        subject: 'Project',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    // Create permissions
+    {
+        action: 'create',
+        subject: 'Space',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+        },
+    },
+    {
+        action: 'create',
+        subject: 'DashboardComments',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    {
+        action: 'create',
+        subject: 'ScheduledDeliveries',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    // Manage permissions (varies by role level)
+    {
+        action: 'manage',
+        subject: 'Space',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+            isPrivate: false,
+        },
+    },
+    {
+        action: 'manage',
+        subject: 'Job',
+        resource: {},
+    },
+    {
+        action: 'manage',
+        subject: 'PinnedItems',
+        resource: {
+            organizationUuid: 'org-uuid-test',
+            projectUuid: 'test-project-uuid',
+        },
+    },
+    {
+        action: 'manage',
+        subject: 'Explore',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    // Higher-level permissions (developer+ only)
+    {
+        action: 'manage',
+        subject: 'Project',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    {
+        action: 'manage',
+        subject: 'Validation',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    {
+        action: 'manage',
+        subject: 'VirtualView',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    {
+        action: 'manage',
+        subject: 'CustomSql',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    // Admin-only permissions
+    {
+        action: 'delete',
+        subject: 'Project',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+    {
+        action: 'view',
+        subject: 'Analytics',
+        resource: { projectUuid: 'test-project-uuid' },
+    },
+];
+/**
+ * Helper function to create test parameters for role compatibility testing
+ */
+export const createRoleTestParams = (role, options = {}) => {
+    const { isEnterprise = false, projectUuid = 'test-project-uuid', userUuid = 'test-user-uuid', organizationUuid = 'test-org-uuid', } = options;
+    const scopes = isEnterprise
+        ? getAllScopesForRole(role)
+        : getNonEnterpriseScopesForRole(role);
+    const scopeBuilderParams = {
+        userUuid,
+        scopes,
+        isEnterprise,
+        organizationRole: 'editor',
+        permissionsConfig: {
+            pat: {
+                enabled: false,
+                allowedOrgRoles: [],
+            },
+        },
+    };
+    return {
+        role,
+        scopes,
+        projectMember: {
+            role,
+            projectUuid,
+            userUuid,
+        },
+        scopeOrgBuilderParams: {
+            ...scopeBuilderParams,
+            organizationUuid,
+        },
+        scopeProjectBuilderParams: {
+            ...scopeBuilderParams,
+            projectUuid,
+        },
+    };
+};
+/**
+ * Compares role-based and scope-based abilities for a specific set of test cases
+ * Returns detailed results showing which permissions match or differ
+ */
+export const compareRoleAndScopeAbilities = (role, testCases, options = {}) => {
+    const { isEnterprise = false } = options;
+    const testParams = createRoleTestParams(role, { isEnterprise });
+    // Build role-based ability
+    const roleBuilder = new AbilityBuilder(Ability);
+    projectMemberAbilities[role](testParams.projectMember, roleBuilder);
+    const roleAbility = roleBuilder.build();
+    // Build Project-based scope-based ability
+    const scopeBuilder = new AbilityBuilder(Ability);
+    buildAbilityFromScopes(testParams.scopeProjectBuilderParams, scopeBuilder);
+    const scopeAbility = scopeBuilder.build();
+    const results = testCases.map((testCase) => {
+        const subjectWithResource = subject(testCase.subject, testCase.resource);
+        const roleResult = roleAbility.can(testCase.action, subjectWithResource);
+        const scopeResult = scopeAbility.can(testCase.action, subjectWithResource);
+        return {
+            ...testCase,
+            roleResult,
+            scopeResult,
+            match: roleResult === scopeResult,
+        };
+    });
+    const summary = {
+        total: results.length,
+        matches: results.filter((r) => r.match).length,
+        mismatches: results.filter((r) => !r.match),
+        allMatch: results.every((r) => r.match),
+    };
+    return {
+        role,
+        scopes: testParams.scopes,
+        results,
+        summary,
+    };
+};
+/**
+ * Runs a comprehensive comparison of all roles against standard test cases
+ */
+export const validateAllRoleMappings = (options = {}) => {
+    const roles = [
+        ProjectMemberRole.VIEWER,
+        ProjectMemberRole.INTERACTIVE_VIEWER,
+        ProjectMemberRole.EDITOR,
+        ProjectMemberRole.DEVELOPER,
+        ProjectMemberRole.ADMIN,
+    ];
+    const testCases = createStandardTestCases();
+    const results = roles.map((role) => compareRoleAndScopeAbilities(role, testCases, options));
+    const overallSummary = {
+        rolesValidated: results.length,
+        successfulRoles: results
+            .filter((r) => r.summary.allMatch)
+            .map((r) => r.role),
+        failedRoles: results
+            .filter((r) => !r.summary.allMatch)
+            .map((r) => ({
+            role: r.role,
+            mismatches: r.summary.mismatches.length,
+        })),
+        totalTestCases: results.reduce((sum, r) => sum + r.summary.total, 0),
+        totalMatches: results.reduce((sum, r) => sum + r.summary.matches, 0),
+    };
+    return {
+        roleResults: results,
+        overallSummary,
+        allRolesValid: overallSummary.failedRoles.length === 0,
+    };
+};
+/**
+ * Debug utility to show what scopes are missing or extra for a specific role
+ */
+export const debugRoleScopeMapping = (role) => {
+    const testCases = createStandardTestCases();
+    const comparison = compareRoleAndScopeAbilities(role, testCases);
+    const mismatches = comparison.results.filter((r) => !r.match);
+    console.debug(`\n=== Debug: ${role} Role Scope Mapping ===`);
+    console.debug(`Scopes assigned: ${comparison.scopes.length}`);
+    console.debug(`Test cases: ${comparison.summary.total}`);
+    console.debug(`Matches: ${comparison.summary.matches}`);
+    console.debug(`Mismatches: ${mismatches.length}`);
+    if (mismatches.length > 0) {
+        console.debug('\n--- Mismatched Permissions ---');
+        mismatches.forEach((mismatch) => {
+            console.debug(`${mismatch.action}:${mismatch.subject}`);
+            console.debug(`  Role-based: ${mismatch.roleResult}`);
+            console.debug(`  Scope-based: ${mismatch.scopeResult}`);
+            console.debug(`  Resource:`, mismatch.resource);
+            console.debug('');
+        });
+    }
+    console.debug(`\nAssigned Scopes:`);
+    comparison.scopes.forEach((scope) => console.debug(`  - ${scope}`));
+    return comparison;
+};
+//# sourceMappingURL=roleToScopeMapping.testUtils.js.map

package/dist/types/authorization/roleToScopeMapping.testUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleToScopeMapping.testUtils.js","sourceRoot":"","sources":["../../../src/authorization/roleToScopeMapping.testUtils.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACH,mBAAmB,EACnB,6BAA6B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAG/D;;;GAGG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAGrC,EAAE;IACA,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG;QACd,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,kBAAkB;QACpC,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,SAAS;QAC3B,iBAAiB,CAAC,KAAK;KAC1B,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEtC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAEzD,8DAA8D;QAC9D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CACP,QAAQ,WAAW,gCAAgC,KAAK,SAAS,YAAY,EAAE,CAClF,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO;QACH,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACT,CAAC;AACN,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,IAAuB,EAUzB,EAAE;IACA,MAAM,OAAO,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG;QACf,IAAI;QACJ,WAAW,EAAE,mBAAmB;QAChC,QAAQ,EAAE,gBAAgB;KAC7B,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhC,iCAAiC;IACjC,OAAO;QACH,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,MAAgB;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,UAAU,EAAE,OAAO;KACtB,CAAC;AACN,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAAC;IACzC,mBAAmB;IACnB;QACI,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,WAAoB;QAC7B,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;YAChC,SAAS,EAAE,KAAK;SACnB;KACJ;IACD;QACI,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,YAAqB;QAC9B,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;YAChC,SAAS,EAAE,KAAK;SACnB;KACJ;IACD;QACI,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,OAAgB;QACzB,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;YAChC,SAAS,EAAE,KAAK;SACnB;KACJ;IACD;QACI,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,SAAkB;QAC3B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IAED,qBAAqB;IACrB;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,OAAgB;QACzB,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;SACnC;KACJ;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,mBAA4B;QACrC,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,qBAA8B;QACvC,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IAED,4CAA4C;IAC5C;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,OAAgB;QACzB,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;YAChC,SAAS,EAAE,KAAK;SACnB;KACJ;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,KAAc;QACvB,QAAQ,EAAE,EAAE;KACf;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,aAAsB;QAC/B,QAAQ,EAAE;YACN,gBAAgB,EAAE,eAAe;YACjC,WAAW,EAAE,mBAAmB;SACnC;KACJ;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,SAAkB;QAC3B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IAED,6CAA6C;IAC7C;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,SAAkB;QAC3B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,YAAqB;QAC9B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,aAAsB;QAC/B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IACD;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,WAAoB;QAC7B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IAED,yBAAyB;IACzB;QACI,MAAM,EAAE,QAAiB;QACzB,OAAO,EAAE,SAAkB;QAC3B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;IACD;QACI,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,WAAoB;QAC7B,QAAQ,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjD;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAChC,IAAuB,EACvB,UAKI,EAAE,EACR,EAAE;IACA,MAAM,EACF,YAAY,GAAG,KAAK,EACpB,WAAW,GAAG,mBAAmB,EACjC,QAAQ,GAAG,gBAAgB,EAC3B,gBAAgB,GAAG,eAAe,GACrC,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,YAAY;QACvB,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,kBAAkB,GAAG;QACvB,QAAQ;QACR,MAAM;QACN,YAAY;QACZ,gBAAgB,EAAE,QAAiB;QACnC,iBAAiB,EAAE;YACf,GAAG,EAAE;gBACD,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,EAAE;aACtB;SACJ;KACJ,CAAC;IAEF,OAAO;QACH,IAAI;QACJ,MAAM;QACN,aAAa,EAAE;YACX,IAAI;YACJ,WAAW;YACX,QAAQ;SACX;QACD,qBAAqB,EAAE;YACnB,GAAG,kBAAkB;YACrB,gBAAgB;SACnB;QACD,yBAAyB,EAAE;YACvB,GAAG,kBAAkB;YACrB,WAAW;SACd;KACJ,CAAC;AACN,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CACxC,IAAuB,EACvB,SAAqD,EACrD,UAAsC,EAAE,EAC1C,EAAE;IACA,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAEhE,2BAA2B;IAC3B,MAAM,WAAW,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;IAExC,0CAA0C;IAC1C,MAAM,YAAY,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAChE,sBAAsB,CAAC,UAAU,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACvC,MAAM,mBAAmB,GAAG,OAAO,CAC/B,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,CACpB,CAAC;QACF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAC9B,QAAQ,CAAC,MAAM,EACf,mBAAmB,CACtB,CAAC;QACF,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAChC,QAAQ,CAAC,MAAM,EACf,mBAAmB,CACtB,CAAC;QAEF,OAAO;YACH,GAAG,QAAQ;YACX,UAAU;YACV,WAAW;YACX,KAAK,EAAE,UAAU,KAAK,WAAW;SACpC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG;QACZ,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAC9C,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KAC1C,CAAC;IAEF,OAAO;QACH,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO;QACP,OAAO;KACV,CAAC;AACN,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACnC,UAAsC,EAAE,EAC1C,EAAE;IACA,MAAM,KAAK,GAAG;QACV,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,kBAAkB;QACpC,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,SAAS;QAC3B,iBAAiB,CAAC,KAAK;KAC1B,CAAC;IAEF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,4BAA4B,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CACzD,CAAC;IAEF,MAAM,cAAc,GAAG;QACnB,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,eAAe,EAAE,OAAO;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvB,WAAW,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACT,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM;SAC1C,CAAC,CAAC;QACP,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;KACvE,CAAC;IAEF,OAAO;QACH,WAAW,EAAE,OAAO;QACpB,cAAc;QACd,aAAa,EAAE,cAAc,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;KACzD,CAAC;AACN,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAuB,EAAE,EAAE;IAC7D,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE9D,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,yBAAyB,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAElD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,iBAAiB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpE,OAAO,UAAU,CAAC;AACtB,CAAC,CAAC"}

package/dist/types/authorization/roleToScopeParity.test.js

@@ -0,0 +1,194 @@
+/* eslint-disable no-console */
+import { Ability, AbilityBuilder } from '@casl/ability';
+import groupBy from 'lodash/groupBy';
+import isEqual from 'lodash/isEqual';
+import { ProjectMemberRole } from '../types/projectMemberRole';
+import { projectMemberAbilities } from './projectMemberAbility';
+import { PROJECT_ADMIN, PROJECT_DEVELOPER, PROJECT_EDITOR, PROJECT_INTERACTIVE_VIEWER, PROJECT_VIEWER, } from './projectMemberAbility.mock';
+import { getAllScopesForRole } from './roleToScopeMapping';
+import { buildAbilityFromScopes } from './scopeAbilityBuilder';
+/**
+ * Normalize a CASL rule for comparison by sorting object keys and handling undefined values
+ */
+const normalizeRule = (rule) => ({
+    action: rule.action,
+    subject: rule.subject,
+});
+/**
+ * Compare two sets of CASL rules for functional equivalence
+ */
+const compareRuleSets = (roleBasedRules, scopeBasedRules, roleName) => {
+    const normalizedRoleRules = roleBasedRules.map(normalizeRule);
+    const normalizedScopeRules = scopeBasedRules.map(normalizeRule);
+    const mismatches = [];
+    // Check if rule counts match
+    if (normalizedRoleRules.length !== normalizedScopeRules.length) {
+        mismatches.push(`Rule count mismatch: role-based has ${normalizedRoleRules.length} rules, scope-based has ${normalizedScopeRules.length} rules`);
+    }
+    // Group rules by action+subject for easier comparison
+    const roleRulesGrouped = groupBy(normalizedRoleRules, (rule) => `${rule.action}:${rule.subject}`);
+    const scopeRulesGrouped = groupBy(normalizedScopeRules, (rule) => `${rule.action}:${rule.subject}`);
+    // Check for missing or extra rule types
+    const roleKeys = new Set(Object.keys(roleRulesGrouped));
+    const scopeKeys = new Set(Object.keys(scopeRulesGrouped));
+    const missingInScope = [...roleKeys].filter((key) => !scopeKeys.has(key));
+    const extraInScope = [...scopeKeys].filter((key) => !roleKeys.has(key));
+    missingInScope.forEach((key) => {
+        mismatches.push(`Missing in scope-based: ${key}`);
+    });
+    extraInScope.forEach((key) => {
+        mismatches.push(`Extra in scope-based: ${key}`);
+    });
+    // Compare matching rule groups
+    const commonKeys = [...roleKeys].filter((key) => scopeKeys.has(key));
+    commonKeys.forEach((key) => {
+        const roleRulesForKey = roleRulesGrouped[key];
+        const scopeRulesForKey = scopeRulesGrouped[key];
+        // For rules with the same action+subject, we need to check if the conditions are equivalent
+        // This is more complex because multiple rules might combine to create the same effective permissions
+        if (roleRulesForKey.length !== scopeRulesForKey.length) {
+            // Different number of rules for same action+subject - this might be OK if conditions are equivalent
+            // For now, we'll flag this as a potential issue but continue checking
+            mismatches.push(`Different rule count for ${key}: role-based has ${roleRulesForKey.length}, scope-based has ${scopeRulesForKey.length}`);
+        }
+        // Check if rule sets contain equivalent conditions
+        const roleConditions = roleRulesForKey
+            .map((r) => r.conditions)
+            .filter(Boolean);
+        const scopeConditions = scopeRulesForKey
+            .map((r) => r.conditions)
+            .filter(Boolean);
+        if (!isEqual(roleConditions, scopeConditions)) {
+            mismatches.push(`Condition mismatch on ${roleName} for ${key}:\nRole-based: ${JSON.stringify(roleConditions, null, 2)}\nScope-based: ${JSON.stringify(scopeConditions, null, 2)}`);
+        }
+    });
+    return {
+        isEqual: mismatches.length === 0,
+        mismatches,
+    };
+};
+/**
+ * List of enterprise-only subject names that should be filtered in non-enterprise mode
+ */
+const ENTERPRISE_SUBJECTS = new Set([
+    'MetricsTree',
+    'SpotlightTableConfig',
+    'AiAgent',
+    'AiAgentThread',
+    'ContentAsCode',
+]);
+/**
+ * Filter enterprise rules from role-based abilities when testing in non-enterprise mode
+ */
+const filterEnterpriseRules = (rules, isEnterprise) => {
+    if (isEnterprise) {
+        return rules;
+    }
+    return rules.filter((rule) => !ENTERPRISE_SUBJECTS.has(rule.subject));
+};
+/**
+ * Test role-to-scope parity for a specific role
+ */
+const testRoleScopeParity = (role, isEnterprise = false) => {
+    // Get the appropriate mock member profile
+    const memberProfiles = {
+        [ProjectMemberRole.VIEWER]: PROJECT_VIEWER,
+        [ProjectMemberRole.INTERACTIVE_VIEWER]: PROJECT_INTERACTIVE_VIEWER,
+        [ProjectMemberRole.EDITOR]: PROJECT_EDITOR,
+        [ProjectMemberRole.DEVELOPER]: PROJECT_DEVELOPER,
+        [ProjectMemberRole.ADMIN]: PROJECT_ADMIN,
+    };
+    const member = memberProfiles[role];
+    // Build abilities using role-based approach
+    const roleBuilder = new AbilityBuilder(Ability);
+    projectMemberAbilities[role](member, roleBuilder);
+    const roleAbility = roleBuilder.build();
+    // Filter enterprise rules from role-based abilities if not enterprise
+    const filteredRoleRules = filterEnterpriseRules(roleAbility.rules, isEnterprise);
+    // Build abilities using scope-based approach
+    const scopeBuilder = new AbilityBuilder(Ability);
+    const scopes = getAllScopesForRole(role);
+    buildAbilityFromScopes({
+        userUuid: member.userUuid,
+        projectUuid: member.projectUuid,
+        scopes,
+        isEnterprise,
+    }, scopeBuilder);
+    const scopeAbility = scopeBuilder.build();
+    // Compare the filtered rule sets
+    const result = compareRuleSets(filteredRoleRules, scopeAbility.rules, role);
+    return result;
+};
+describe('Role to Scope Parity', () => {
+    const systemProjectRoles = [
+        ProjectMemberRole.VIEWER,
+        ProjectMemberRole.INTERACTIVE_VIEWER,
+        ProjectMemberRole.EDITOR,
+        ProjectMemberRole.DEVELOPER,
+        ProjectMemberRole.ADMIN,
+    ];
+    describe('Non-Enterprise Environment', () => {
+        it.each(systemProjectRoles)('should have equivalent permissions for %s role', (role) => {
+            const comparison = testRoleScopeParity(role, false);
+            if (!comparison.isEqual) {
+                console.error(`\n=== PARITY MISMATCH FOR ${role.toUpperCase()} ROLE ===`);
+                comparison.mismatches.forEach((mismatch) => {
+                    console.error(`❌ ${mismatch}`);
+                });
+                console.error('=== END MISMATCH REPORT ===\n');
+            }
+            expect(comparison.isEqual).toBe(true);
+        });
+    });
+    describe('Enterprise Environment', () => {
+        it.each(systemProjectRoles)('should have equivalent permissions for %s role in enterprise', (role) => {
+            const comparison = testRoleScopeParity(role, true);
+            if (!comparison.isEqual) {
+                console.error(`\n=== ENTERPRISE PARITY MISMATCH FOR ${role.toUpperCase()} ROLE ===`);
+                comparison.mismatches.forEach((mismatch) => {
+                    console.error(`❌ ${mismatch}`);
+                });
+                console.error('=== END MISMATCH REPORT ===\n');
+            }
+            expect(comparison.isEqual).toBe(true);
+        });
+    });
+    // This is helpful for debugging, but it's not a test
+    describe.skip('Rule Count Analysis', () => {
+        it('should report rule counts for documentation', () => {
+            console.log('\n=== ROLE PERMISSION RULE COUNTS ===');
+            systemProjectRoles.forEach((role) => {
+                const member = {
+                    [ProjectMemberRole.VIEWER]: PROJECT_VIEWER,
+                    [ProjectMemberRole.INTERACTIVE_VIEWER]: PROJECT_INTERACTIVE_VIEWER,
+                    [ProjectMemberRole.EDITOR]: PROJECT_EDITOR,
+                    [ProjectMemberRole.DEVELOPER]: PROJECT_DEVELOPER,
+                    [ProjectMemberRole.ADMIN]: PROJECT_ADMIN,
+                }[role];
+                // Count role-based rules
+                const roleBuilder = new AbilityBuilder(Ability);
+                projectMemberAbilities[role](member, roleBuilder);
+                const roleRuleCount = roleBuilder.build().rules.length;
+                // Count scope-based rules
+                const scopeBuilder = new AbilityBuilder(Ability);
+                const scopes = getAllScopesForRole(role);
+                buildAbilityFromScopes({
+                    userUuid: member.userUuid,
+                    projectUuid: member.projectUuid,
+                    scopes,
+                    isEnterprise: false,
+                }, scopeBuilder);
+                const scopeRuleCount = scopeBuilder.build().rules.length;
+                console.log(`${role.padEnd(20)}: Role-based: ${roleRuleCount
+                    .toString()
+                    .padStart(3)}, Scope-based: ${scopeRuleCount
+                    .toString()
+                    .padStart(3)}, Scopes: ${scopes.length
+                    .toString()
+                    .padStart(3)}`);
+            });
+            console.log('=== END RULE COUNT ANALYSIS ===\n');
+        });
+    });
+});
+//# sourceMappingURL=roleToScopeParity.test.js.map

package/dist/types/authorization/roleToScopeParity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleToScopeParity.test.js","sourceRoot":"","sources":["../../../src/authorization/roleToScopeParity.test.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,0BAA0B,EAC1B,cAAc,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAW/D;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,IAAc,EAAY,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,OAAO,EAAE,IAAI,CAAC,OAAO;CACxB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,eAAe,GAAG,CACpB,cAA0B,EAC1B,eAA2B,EAC3B,QAAgB,EAC0B,EAAE;IAC5C,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,6BAA6B;IAC7B,IAAI,mBAAmB,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAC7D,UAAU,CAAC,IAAI,CACX,uCAAuC,mBAAmB,CAAC,MAAM,2BAA2B,oBAAoB,CAAC,MAAM,QAAQ,CAClI,CAAC;IACN,CAAC;IAED,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,OAAO,CAC5B,mBAAmB,EACnB,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAC7C,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAC7B,oBAAoB,EACpB,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAC7C,CAAC;IAEF,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE1D,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAExE,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,UAAU,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,UAAU,CAAC,IAAI,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAErE,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEhD,4FAA4F;QAC5F,qGAAqG;QACrG,IAAI,eAAe,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;YACrD,oGAAoG;YACpG,sEAAsE;YACtE,UAAU,CAAC,IAAI,CACX,4BAA4B,GAAG,oBAAoB,eAAe,CAAC,MAAM,qBAAqB,gBAAgB,CAAC,MAAM,EAAE,CAC1H,CAAC;QACN,CAAC;QAED,mDAAmD;QACnD,MAAM,cAAc,GAAG,eAAe;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,MAAM,eAAe,GAAG,gBAAgB;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;QAErB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CACX,yBAAyB,QAAQ,QAAQ,GAAG,kBAAkB,IAAI,CAAC,SAAS,CACxE,cAAc,EACd,IAAI,EACJ,CAAC,CACJ,kBAAkB,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAChE,CAAC;QACN,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,UAAU;KACb,CAAC;AACN,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAChC,aAAa;IACb,sBAAsB;IACtB,SAAS;IACT,eAAe;IACf,eAAe;CAClB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAC1B,KAAiB,EACjB,YAAqB,EACX,EAAE;IACZ,IAAI,YAAY,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,mBAAmB,GAAG,CACxB,IAAuB,EACvB,eAAwB,KAAK,EACa,EAAE;IAC5C,0CAA0C;IAC1C,MAAM,cAAc,GAAG;QACnB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc;QAC1C,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;QAClE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc;QAC1C,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;QAChD,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,aAAa;KAC3C,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEpC,4CAA4C;IAC5C,MAAM,WAAW,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAC/D,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;IAExC,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,qBAAqB,CAC3C,WAAW,CAAC,KAAmB,EAC/B,YAAY,CACf,CAAC;IAEF,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEzC,sBAAsB,CAClB;QACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM;QACN,YAAY;KACf,EACD,YAAY,CACf,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;IAE1C,iCAAiC;IACjC,MAAM,MAAM,GAAG,eAAe,CAC1B,iBAAiB,EACjB,YAAY,CAAC,KAAmB,EAChC,IAAI,CACP,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAClC,MAAM,kBAAkB,GAAG;QACvB,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,kBAAkB;QACpC,iBAAiB,CAAC,MAAM;QACxB,iBAAiB,CAAC,SAAS;QAC3B,iBAAiB,CAAC,KAAK;KAC1B,CAAC;IAEF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CACvB,gDAAgD,EAChD,CAAC,IAAI,EAAE,EAAE;YACL,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEpD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACT,6BAA6B,IAAI,CAAC,WAAW,EAAE,WAAW,CAC7D,CAAC;gBACF,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACvC,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CACvB,8DAA8D,EAC9D,CAAC,IAAI,EAAE,EAAE;YACL,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACT,wCAAwC,IAAI,CAAC,WAAW,EAAE,WAAW,CACxE,CAAC;gBACF,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACvC,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YAErD,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,MAAM,GAAG;oBACX,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc;oBAC1C,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAClC,0BAA0B;oBAC9B,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc;oBAC1C,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;oBAChD,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,aAAa;iBAC3C,CAAC,IAAI,CAAC,CAAC;gBAER,yBAAyB;gBACzB,MAAM,WAAW,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;gBAC/D,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAClD,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvD,0BAA0B;gBAC1B,MAAM,YAAY,GAAG,IAAI,cAAc,CAAgB,OAAO,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACzC,sBAAsB,CAClB;oBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,MAAM;oBACN,YAAY,EAAE,KAAK;iBACtB,EACD,YAAY,CACf,CAAC;gBACF,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEzD,OAAO,CAAC,GAAG,CACP,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,aAAa;qBAC3C,QAAQ,EAAE;qBACV,QAAQ,CAAC,CAAC,CAAC,kBAAkB,cAAc;qBAC3C,QAAQ,EAAE;qBACV,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM;qBACrC,QAAQ,EAAE;qBACV,QAAQ,CAAC,CAAC,CAAC,EAAE,CACrB,CAAC;YACN,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/types/authorization/scopeAbilityBuilder.js

@@ -0,0 +1,57 @@
+import { parseScope, parseScopes } from './parseScopes';
+import { getAllScopeMap } from './scopes';
+const handlePatConfigApplication = (context, builder) => {
+    const { pat } = context?.permissionsConfig || {};
+    const hasPatRule = builder.rules.find((rule) => rule.action === 'manage' && rule.subject === 'PersonalAccessToken');
+    if (!hasPatRule &&
+        pat?.enabled &&
+        context.organizationRole &&
+        pat?.allowedOrgRoles?.includes(context.organizationRole)) {
+        builder.can('manage', 'PersonalAccessToken');
+    }
+};
+/**
+ * Apply scope-based abilities to a CASL ability builder
+ * @param scopeNames - Array of scope names to apply
+ * @param context - Context containing organization, project, user, and space access information
+ * @param builder - CASL ability builder to add permissions to
+ */
+const applyScopeAbilities = (context, builder) => {
+    const scopeMap = getAllScopeMap({ isEnterprise: context.isEnterprise });
+    context.scopes.forEach((scopeName) => {
+        const scope = scopeMap[scopeName];
+        if (!scope)
+            return;
+        const [action, subject] = parseScope(scopeName);
+        const conditionsList = scope.getConditions(context);
+        // Apply each condition set if there are any
+        if (conditionsList.length === 0) {
+            builder.can(action, subject);
+        }
+        else {
+            conditionsList.forEach((conditions) => {
+                builder.can(action, subject, conditions);
+            });
+        }
+    });
+    handlePatConfigApplication(context, builder);
+};
+/**
+ * Apply CASL abilities from scopes to a builder
+ * @param context - Context containing organization, project, user, and space access information
+ * @param builder - CASL ability builder to add permissions to
+ */
+export const buildAbilityFromScopes = (context, builder) => {
+    const isEnterprise = context.isEnterprise ?? false;
+    const scopes = parseScopes({
+        scopes: context.scopes,
+        isEnterprise,
+    });
+    const parsedContext = {
+        ...context,
+        scopes,
+        isEnterprise,
+    };
+    applyScopeAbilities(parsedContext, builder);
+};
+//# sourceMappingURL=scopeAbilityBuilder.js.map

package/dist/types/authorization/scopeAbilityBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeAbilityBuilder.js","sourceRoot":"","sources":["../../../src/authorization/scopeAbilityBuilder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,0BAA0B,GAAG,CAC/B,OAAqB,EACrB,OAAsC,EACxC,EAAE;IACA,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACL,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,qBAAqB,CACzE,CAAC;IAEF,IACI,CAAC,UAAU;QACX,GAAG,EAAE,OAAO;QACZ,OAAO,CAAC,gBAAgB;QACxB,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC1D,CAAC;QACC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACL,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CACxB,OAAqB,EACrB,OAAsC,EAClC,EAAE;IACN,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEpD,4CAA4C;QAC5C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACJ,cAAc,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBAClC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AAyBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,OAAuB,EACvB,OAAsC,EAClC,EAAE;IACN,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY;KACf,CAAC,CAAC;IACH,MAAM,aAAa,GAAG;QAClB,GAAG,OAAO;QACV,MAAM;QACN,YAAY;KACf,CAAC;IAEF,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC,CAAC"}