@synchronized-console/shared 2.25.7 → 2.31.14

package/src/authz/policies/automate/function/canEditFunction.spec.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest'
+import { canEditFunctionPolicy } from './canEditFunction.js'
+import { OverridesOf } from '../../../../tests/helpers/types.js'
+import { parseFeatureFlags } from '../../../../environment/index.js'
+import cryptoRandomString from 'crypto-random-string'
+import {
+  AutomateFunctionNotCreatorError,
+  AutomateFunctionNotFoundError,
+  AutomateNotEnabledError
+} from '../../../domain/authErrors.js'
+
+describe('canEditFunctionPolicy creates a function, that', () => {
+  const buildCanEditFunctionPolicy = (
+    overrides?: OverridesOf<typeof canEditFunctionPolicy>
+  ) =>
+    canEditFunctionPolicy({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_AUTOMATE_MODULE_ENABLED: 'true'
+        }),
+      getAutomateFunction: async () => null,
+      ...overrides
+    })
+
+  it('forbids edit if automate is not enabled', async () => {
+    const result = await buildCanEditFunctionPolicy({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_AUTOMATE_MODULE_ENABLED: 'false'
+        })
+    })({
+      functionId: cryptoRandomString({ length: 9 })
+    })
+    expect(result).toBeAuthErrorResult({
+      code: AutomateNotEnabledError.code
+    })
+  })
+
+  it('forbids edit if function cannot be found', async () => {
+    const result = await buildCanEditFunctionPolicy()({
+      functionId: cryptoRandomString({ length: 9 })
+    })
+    expect(result).toBeAuthErrorResult({
+      code: AutomateFunctionNotFoundError.code
+    })
+  })
+
+  it('forbids edit if user is not function creator', async () => {
+    const result = await buildCanEditFunctionPolicy({
+      getAutomateFunction: async ({ functionId }) => ({
+        id: functionId,
+        name: cryptoRandomString({ length: 9 }),
+        functionCreator: {
+          synchronizedUserId: cryptoRandomString({ length: 9 }),
+          synchronizedServerOrigin: 'example.org'
+        },
+        workspaceIds: []
+      })
+    })({
+      functionId: cryptoRandomString({ length: 9 })
+    })
+    expect(result).toBeAuthErrorResult({
+      code: AutomateFunctionNotCreatorError.code
+    })
+  })
+
+  it('allows edit for function creators', async () => {
+    const userId = cryptoRandomString({ length: 9 })
+
+    const result = await buildCanEditFunctionPolicy({
+      getAutomateFunction: async ({ functionId }) => ({
+        id: functionId,
+        name: cryptoRandomString({ length: 9 }),
+        functionCreator: {
+          synchronizedUserId: userId,
+          synchronizedServerOrigin: 'example.org'
+        },
+        workspaceIds: []
+      })
+    })({
+      userId,
+      functionId: cryptoRandomString({ length: 9 })
+    })
+
+    expect(result).toBeAuthOKResult()
+  })
+})

package/src/authz/policies/automate/function/canEditFunction.ts

@@ -0,0 +1,46 @@
+import { err, ok } from 'true-myth/result'
+import {
+  AutomateFunctionNotCreatorError,
+  AutomateFunctionNotFoundError,
+  AutomateNotEnabledError
+} from '../../../domain/authErrors.js'
+import { AutomateFunctionContext, MaybeUserContext } from '../../../domain/context.js'
+import { AuthCheckContextLoaderKeys } from '../../../domain/loaders.js'
+import { AuthPolicy } from '../../../domain/policies.js'
+import {
+  ensureAutomateEnabledFragment,
+  ensureAutomateFunctionCreatorFragment
+} from '../../../fragments/automate.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getAutomateFunction
+
+type PolicyArgs = MaybeUserContext & AutomateFunctionContext
+
+type PolicyErrors = InstanceType<
+  | typeof AutomateNotEnabledError
+  | typeof AutomateFunctionNotFoundError
+  | typeof AutomateFunctionNotCreatorError
+>
+
+export const canEditFunctionPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, functionId }) => {
+    const isAutomateEnabled = await ensureAutomateEnabledFragment(loaders)({})
+    if (isAutomateEnabled.isErr) return err(isAutomateEnabled.error)
+
+    const isAutomateFunctionCreator = await ensureAutomateFunctionCreatorFragment(
+      loaders
+    )({
+      userId,
+      functionId
+    })
+    if (isAutomateFunctionCreator.isErr) return err(isAutomateFunctionCreator.error)
+
+    return ok()
+  }

package/src/authz/policies/dashboard/canCreateToken.ts

@@ -0,0 +1,89 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js'
+import {
+  DashboardNoProjectsError,
+  DashboardNotFoundError,
+  DashboardProjectsNotEnoughPermissionsError,
+  DashboardsNotEnabledError,
+  WorkspaceNoEditorSeatError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardProjectsReadAccess,
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getDashboard
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat
+  | typeof AuthCheckContextLoaderKeys.getProjectRole
+  | typeof AuthCheckContextLoaderKeys.getProject
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspace
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoProvider
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoSession
+
+type PolicyArgs = MaybeUserContext & DashboardContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+  | typeof WorkspaceNoEditorSeatError
+  | typeof DashboardNotFoundError
+  | typeof DashboardNoProjectsError
+  | typeof DashboardProjectsNotEnoughPermissionsError
+>
+
+export const canCreateDashboardTokenPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return err(new DashboardNotFoundError())
+
+    const { workspaceId } = dashboard
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Member
+    })
+    if (!isWorkspaceMember) return err(new WorkspaceNotEnoughPermissionsError())
+
+    const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
+      userId: userId!,
+      workspaceId
+    })
+    if (!isWorkspaceEditorSeat) return err(new WorkspaceNoEditorSeatError())
+
+    if (!dashboard.projectIds.length) return err(new DashboardNoProjectsError())
+    const ensuredProjectAccess = await ensureDashboardProjectsReadAccess(loaders)({
+      userId: userId!,
+      dashboardId
+    })
+    if (ensuredProjectAccess.isErr) return err(ensuredProjectAccess.error)
+
+    return ok()
+  }

package/src/authz/policies/dashboard/canDelete.ts

@@ -0,0 +1,84 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js'
+import {
+  DashboardNotFoundError,
+  DashboardNotOwnerError,
+  DashboardsNotEnabledError,
+  WorkspaceNoEditorSeatError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+import { isDashboardOwner } from '../../checks/dashboards.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
+  | typeof AuthCheckContextLoaderKeys.getDashboard
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat
+
+type PolicyArgs = MaybeUserContext & DashboardContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof DashboardNotOwnerError
+  | typeof DashboardNotFoundError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+  | typeof WorkspaceNoEditorSeatError
+>
+
+export const canDeleteDashboardPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return err(new DashboardNotFoundError())
+
+    const { workspaceId } = dashboard
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
+    const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
+      userId: userId!,
+      workspaceId
+    })
+    if (!isWorkspaceEditorSeat) return err(new WorkspaceNoEditorSeatError())
+
+    const isWorkspaceAdmin = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Admin
+    })
+    const isOwner = await isDashboardOwner(loaders)({ userId: userId!, dashboardId })
+
+    if (!isWorkspaceAdmin && !isOwner) return err(new DashboardNotOwnerError())
+
+    return ok()
+  }

package/src/authz/policies/dashboard/canEdit.ts

@@ -0,0 +1,79 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { MaybeUserContext, DashboardContext } from '../../domain/context.js'
+import {
+  DashboardNotFoundError,
+  DashboardsNotEnabledError,
+  WorkspaceNoEditorSeatError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+import { hasEditorSeat } from '../../checks/workspaceSeat.js'
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
+  | typeof AuthCheckContextLoaderKeys.getDashboard
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat
+
+type PolicyArgs = MaybeUserContext & DashboardContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof DashboardNotFoundError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+  | typeof WorkspaceNoEditorSeatError
+>
+
+export const canEditDashboardPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return err(new DashboardNotFoundError())
+
+    const { workspaceId } = dashboard
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Member
+    })
+    if (!isWorkspaceMember) return err(new WorkspaceNotEnoughPermissionsError())
+
+    const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
+      userId: userId!,
+      workspaceId
+    })
+    if (!isWorkspaceEditorSeat) return err(new WorkspaceNoEditorSeatError())
+
+    return ok()
+  }

package/src/authz/policies/dashboard/canRead.ts

@@ -0,0 +1,83 @@
+import { err, ok } from 'true-myth/result'
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js'
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js'
+import {
+  DashboardNotFoundError,
+  DashboardsNotEnabledError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureDashboardsEnabledFragment,
+  ensureWorkspaceDashboardsFeatureAccessFragment
+} from '../../fragments/dashboards.js'
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js'
+import { Roles } from '../../../core/constants.js'
+import {
+  checkIfAdminOverrideEnabledFragment,
+  ensureMinimumServerRoleFragment
+} from '../../fragments/server.js'
+
+type PolicyLoaderKeys =
+  | typeof AuthCheckContextLoaderKeys.getEnv
+  | typeof AuthCheckContextLoaderKeys.getServerRole
+  | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled
+  | typeof AuthCheckContextLoaderKeys.getDashboard
+  | typeof AuthCheckContextLoaderKeys.getWorkspaceRole
+  | typeof AuthCheckContextLoaderKeys.getWorkspacePlan
+
+type PolicyArgs = MaybeUserContext & DashboardContext
+
+type PolicyErrors = InstanceType<
+  | typeof DashboardsNotEnabledError
+  | typeof DashboardNotFoundError
+  | typeof ServerNoSessionError
+  | typeof ServerNoAccessError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+>
+
+export const canReadDashboardPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, dashboardId }) => {
+    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
+      userId,
+      role: Roles.Server.User
+    })
+    if (ensuredServerRole.isErr) return err(ensuredServerRole.error)
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({})
+    if (isDashboardsEnabled.isErr) return err(isDashboardsEnabled.error)
+
+    const dashboard = await loaders.getDashboard({ dashboardId })
+    if (!dashboard) return err(new DashboardNotFoundError())
+
+    const { workspaceId } = dashboard
+
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(
+      loaders
+    )({ workspaceId })
+    if (ensuredFeatureAccess.isErr) return err(ensuredFeatureAccess.error)
+
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+      userId
+    })
+    if (hasAdminAccess.isOk && hasAdminAccess.value) return ok()
+
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+      userId: userId!,
+      workspaceId,
+      role: Roles.Workspace.Member
+    })
+    if (!isWorkspaceMember) return err(new WorkspaceNotEnoughPermissionsError())
+
+    return ok()
+  }

package/src/authz/policies/index.spec.ts

@@ -0,0 +1,13 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/* eslint-disable @typescript-eslint/no-unsafe-argument */
+import { describe, expect, it } from 'vitest'
+import { authPoliciesFactory } from './index.js'
+
+describe('authPoliciesFactory', () => {
+  it('builds and contains policies', () => {
+    const policies = authPoliciesFactory({} as any) // fake loaders
+    expect(policies.project.canLeave).toBeDefined()
+    expect(policies.automate.function.canRegenerateToken).toBeDefined()
+    expect(policies.workspace.canInvite).toBeDefined()
+  })
+})

package/src/authz/policies/index.ts

@@ -28,10 +28,40 @@ import { canDeleteProjectPolicy } from './project/canDelete.js'
 import { canDeleteAutomationPolicy } from './project/automation/canDelete.js'
 import { canPublishPolicy } from './project/canPublish.js'
 import { canLoadPolicy } from './project/canLoad.js'
-import { canUpdateEmbedOptionsPolicy } from './workspace/canUpdateEmbedOptions.js'
 import { canReadMemberEmailPolicy } from './workspace/canReadMemberEmail.js'
+import { canCreateWorkspacePolicy } from './workspace/canCreateWorkspace.js'
+import { canUseWorkspacePlanFeature } from './workspace/canUseWorkspacePlanFeature.js'
+import { canEditFunctionPolicy } from './automate/function/canEditFunction.js'
+import { canUpdateEmbedTokensPolicy } from './project/canUpdateEmbedTokens.js'
+import { canReadAccIntegrationSettingsPolicy } from './project/canReadAccIntegrationSettings.js'
+import { canCreateSavedViewPolicy } from './project/savedViews/canCreate.js'
+import { canUpdateSavedViewPolicy } from './project/savedViews/canUpdate.js'
+import { canUpdateSavedViewGroupPolicy } from './project/savedViews/canUpdateGroup.js'
+import { canReadSavedViewPolicy } from './project/savedViews/canRead.js'
+import { canListDashboardsPolicy } from './workspace/canListDashboards.js'
+import { canDeleteDashboardPolicy } from './dashboard/canDelete.js'
+import { canCreateDashboardsPolicy } from './workspace/canCreateDashboards.js'
+import { canCreateDashboardTokenPolicy } from './dashboard/canCreateToken.js'
+import { canEditDashboardPolicy } from './dashboard/canEdit.js'
+import { canReadDashboardPolicy } from './dashboard/canRead.js'
+import { canMoveSavedViewPolicy } from './project/savedViews/canMove.js'
+import { canEditSavedViewTitlePolicy } from './project/savedViews/canEditTitle.js'
+import { canEditSavedViewDescriptionPolicy } from './project/savedViews/canEditDescription.js'
+import { canCreateSavedViewGroupTokenPolicy } from './project/savedViews/canCreateSavedViewGroupToken.js'
+import { canSetSavedViewAsHomeViewPolicy } from './project/savedViews/canSetAsHomeView.js'
 
 export const authPoliciesFactory = (loaders: AllAuthCheckContextLoaders) => ({
+  automate: {
+    function: {
+      canRegenerateToken: canEditFunctionPolicy(loaders)
+    }
+  },
+  dashboard: {
+    canCreateToken: canCreateDashboardTokenPolicy(loaders),
+    canDelete: canDeleteDashboardPolicy(loaders),
+    canEdit: canEditDashboardPolicy(loaders),
+    canRead: canReadDashboardPolicy(loaders)
+  },
   project: {
     automation: {
       canCreate: canCreateAutomationPolicy(loaders),
@@ -55,6 +85,17 @@ export const authPoliciesFactory = (loaders: AllAuthCheckContextLoaders) => ({
       canReceive: canLoadPolicy(loaders),
       canRequestRender: canRequestProjectVersionRenderPolicy(loaders)
     },
+    savedViews: {
+      canCreate: canCreateSavedViewPolicy(loaders),
+      canUpdate: canUpdateSavedViewPolicy(loaders),
+      canUpdateGroup: canUpdateSavedViewGroupPolicy(loaders),
+      canCreateToken: canCreateSavedViewGroupTokenPolicy(loaders),
+      canRead: canReadSavedViewPolicy(loaders),
+      canMove: canMoveSavedViewPolicy(loaders),
+      canEditTitle: canEditSavedViewTitlePolicy(loaders),
+      canEditDescription: canEditSavedViewDescriptionPolicy(loaders),
+      canSetAsHomeView: canSetSavedViewAsHomeViewPolicy(loaders)
+    },
     canBroadcastActivity: canBroadcastProjectActivityPolicy(loaders),
     canRead: canReadProjectPolicy(loaders),
     canMoveToWorkspace: canMoveToWorkspacePolicy(loaders),
@@ -67,15 +108,22 @@ export const authPoliciesFactory = (loaders: AllAuthCheckContextLoaders) => ({
     canLeave: canLeaveProjectPolicy(loaders),
     canInvite: canInviteToProjectPolicy(loaders),
     canPublish: canPublishPolicy(loaders),
-    canLoad: canLoadPolicy(loaders)
+    canLoad: canLoadPolicy(loaders),
+    canReadEmbedTokens: canUpdateEmbedTokensPolicy(loaders),
+    canUpdateEmbedTokens: canUpdateEmbedTokensPolicy(loaders),
+    canReadAccIntegrationSettings: canReadAccIntegrationSettingsPolicy(loaders),
+    canUpdateAccIntegrationSettings: canReadAccIntegrationSettingsPolicy(loaders)
   },
   workspace: {
     canCreateProject: canCreateWorkspaceProjectPolicy(loaders),
     canInvite: canInviteToWorkspacePolicy(loaders),
     canReceiveProjectsUpdatedMessage:
       canReceiveWorkspaceProjectsUpdatedMessagePolicy(loaders),
-    canUpdateEmbedOptions: canUpdateEmbedOptionsPolicy(loaders),
-    canReadMemberEmail: canReadMemberEmailPolicy(loaders)
+    canUseWorkspacePlanFeature: canUseWorkspacePlanFeature(loaders),
+    canReadMemberEmail: canReadMemberEmailPolicy(loaders),
+    canCreateWorkspace: canCreateWorkspacePolicy(loaders),
+    canCreateDashboards: canCreateDashboardsPolicy(loaders),
+    canListDashboards: canListDashboardsPolicy(loaders)
   }
 })
 

package/src/authz/policies/project/automation/canCreate.spec.ts

@@ -14,6 +14,7 @@ import {
 } from '../../../domain/authErrors.js'
 import { TIME_MS } from '../../../../core/index.js'
 import { ProjectVisibility } from '../../../domain/projects/types.js'
+import { getWorkspaceFake } from '../../../../tests/fakes.js'
 
 const buildCanCreatePolicy = (
   overrides?: Partial<Parameters<typeof canCreateAutomationPolicy>[0]>
@@ -134,7 +135,7 @@ describe('canCreateAutomation', () => {
         visibility: ProjectVisibility.Private,
         allowPublicComments: false
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/automation/canDelete.spec.ts

@@ -14,6 +14,7 @@ import {
 } from '../../../domain/authErrors.js'
 import { TIME_MS } from '../../../../core/index.js'
 import { ProjectVisibility } from '../../../domain/projects/types.js'
+import { getWorkspaceFake } from '../../../../tests/fakes.js'
 
 const buildCanDeletePolicy = (
   overrides?: Partial<Parameters<typeof canDeleteAutomationPolicy>[0]>
@@ -134,7 +135,7 @@ describe('canDeleteAutomation', () => {
         visibility: ProjectVisibility.Private,
         allowPublicComments: false
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/automation/canUpdate.spec.ts

@@ -14,6 +14,7 @@ import {
 } from '../../../domain/authErrors.js'
 import { TIME_MS } from '../../../../core/index.js'
 import { ProjectVisibility } from '../../../domain/projects/types.js'
+import { getWorkspaceFake } from '../../../../tests/fakes.js'
 
 const buildCanUpdatePolicy = (
   overrides?: Partial<Parameters<typeof canUpdateAutomationPolicy>[0]>
@@ -134,7 +135,7 @@ describe('canUpdateAutomation', () => {
         visibility: ProjectVisibility.Private,
         allowPublicComments: false
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canBroadcastActivity.spec.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { OverridesOf } from '../../../tests/helpers/types.js'
 import { canBroadcastProjectActivityPolicy } from './canBroadcastActivity.js'
 import { parseFeatureFlags } from '../../../environment/index.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { Roles } from '../../../core/constants.js'
 import {
   ProjectNoAccessError,
@@ -48,7 +48,7 @@ describe('canBroadcastProjectActivityPolicy', () => {
         visibility: ProjectVisibility.Workspace
       }),
       getProjectRole: async () => null,
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),

package/src/authz/policies/project/canDelete.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { canDeleteProjectPolicy } from './canDelete.js'
 import { parseFeatureFlags } from '../../../environment/index.js'
-import { getProjectFake } from '../../../tests/fakes.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
 import { Roles } from '../../../core/constants.js'
 import { TIME_MS } from '../../../core/index.js'
 
@@ -32,7 +32,7 @@ describe('canDeleteProjectPolicy', () => {
         id: 'project-id',
         workspaceId: 'workspace-id'
       }),
-      getWorkspace: async () => ({
+      getWorkspace: getWorkspaceFake({
         id: 'workspace-id',
         slug: 'workspace-slug'
       }),