"use strict";
/*
 *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *  SPDX-License-Identifier: Apache-2.0
 */
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const workbench_core_audit_1 = require("@aws/workbench-core-audit");
const workbench_core_authorization_1 = require("@aws/workbench-core-authorization");
const authorizationSetup_1 = __importDefault(require("./authorizationSetup"));
describe('AuthorizationSetup', () => {
    let mockGroupManagementPlugin;
    let mockDynamicAuthorizationPermissionsPlugin;
    let auditService;
    let mockAuthorizationPlugin;
    let authService;
    let authSetup;
    beforeEach(() => {
        mockGroupManagementPlugin = {
            createGroup: jest.fn(),
            deleteGroup: jest.fn(),
            getUserGroups: jest.fn(),
            getGroupUsers: jest.fn(),
            addUserToGroup: jest.fn(),
            isUserAssignedToGroup: jest.fn(),
            removeUserFromGroup: jest.fn(),
            getGroupStatus: jest.fn(),
            setGroupStatus: jest.fn(),
            doesGroupExist: jest.fn(),
            validateUserGroups: jest.fn()
        };
        mockDynamicAuthorizationPermissionsPlugin = {
            isRouteIgnored: jest.fn(),
            isRouteProtected: jest.fn(),
            getDynamicOperationsByRoute: jest.fn(),
            createIdentityPermissions: jest.fn(),
            deleteIdentityPermissions: jest.fn(),
            getIdentityPermissionsByIdentity: jest.fn().mockResolvedValue({
                data: {
                    identityPermissions: []
                }
            }),
            getIdentityPermissionsBySubject: jest.fn(),
            deleteSubjectIdentityPermissions: jest.fn()
        };
        auditService = new workbench_core_audit_1.AuditService(new workbench_core_audit_1.BaseAuditPlugin({
            write: jest.fn()
        }));
        mockAuthorizationPlugin = {
            isAuthorized: jest.fn(),
            isAuthorizedOnDynamicOperations: jest.fn()
        };
        authService = new workbench_core_authorization_1.DynamicAuthorizationService({
            auditService,
            authorizationPlugin: mockAuthorizationPlugin,
            dynamicAuthorizationPermissionsPlugin: mockDynamicAuthorizationPermissionsPlugin,
            groupManagementPlugin: mockGroupManagementPlugin
        });
        authService.createGroup = jest.fn();
        authService.createIdentityPermissions = jest.fn();
        authSetup = new authorizationSetup_1.default(authService, { ROOT_USER_EMAIL: 'test' });
    });
    test('run: Create new group, assign permissions', async () => {
        await authSetup.run();
        expect(authService.createGroup).toBeCalledTimes(1);
        expect(authService.createGroup).toBeCalledWith(expect.objectContaining({ groupId: 'ITAdmin' }));
        expect(authService.createIdentityPermissions).toBeCalledTimes(1);
        expect(authService.createIdentityPermissions).toBeCalledWith(expect.objectContaining({
            identityPermissions: expect.arrayContaining([
                expect.objectContaining({ subjectType: "SWB_PROJECT" /* SwbAuthZSubject.SWB_PROJECT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT_TYPE" /* SwbAuthZSubject.SWB_ENVIRONMENT_TYPE */ }),
                expect.objectContaining({ subjectType: "SWB_ETC" /* SwbAuthZSubject.SWB_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_LIST_BY_ETC" /* SwbAuthZSubject.SWB_PROJECT_LIST_BY_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_DATASET" /* SwbAuthZSubject.SWB_DATASET */ }),
                expect.objectContaining({ subjectType: "SWB_USER" /* SwbAuthZSubject.SWB_USER */ }),
                expect.objectContaining({ subjectType: "SWB_COST_CENTER" /* SwbAuthZSubject.SWB_COST_CENTER */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT" /* SwbAuthZSubject.SWB_AWS_ACCOUNT */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_USER_ASSOCIATION" /* SwbAuthZSubject.SWB_PROJECT_USER_ASSOCIATION */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT_TEMPLATE_URL" /* SwbAuthZSubject.SWB_AWS_ACCOUNT_TEMPLATE_URL */ })
            ])
        }));
    });
    test('Should not throw an error if ITAdmin role already exists', async () => {
        authService.createGroup = jest.fn().mockRejectedValue(new workbench_core_authorization_1.GroupAlreadyExistsError());
        await authSetup.run();
        expect(authService.createGroup).toBeCalledTimes(1);
        expect(authService.createGroup).toBeCalledWith(expect.objectContaining({ groupId: 'ITAdmin' }));
        expect(authService.createIdentityPermissions).toBeCalledTimes(1);
        expect(authService.createIdentityPermissions).toBeCalledWith(expect.objectContaining({
            identityPermissions: expect.arrayContaining([
                expect.objectContaining({ subjectType: "SWB_PROJECT" /* SwbAuthZSubject.SWB_PROJECT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT_TYPE" /* SwbAuthZSubject.SWB_ENVIRONMENT_TYPE */ }),
                expect.objectContaining({ subjectType: "SWB_ETC" /* SwbAuthZSubject.SWB_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_LIST_BY_ETC" /* SwbAuthZSubject.SWB_PROJECT_LIST_BY_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_DATASET" /* SwbAuthZSubject.SWB_DATASET */ }),
                expect.objectContaining({ subjectType: "SWB_USER" /* SwbAuthZSubject.SWB_USER */ }),
                expect.objectContaining({ subjectType: "SWB_COST_CENTER" /* SwbAuthZSubject.SWB_COST_CENTER */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT" /* SwbAuthZSubject.SWB_AWS_ACCOUNT */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_USER_ASSOCIATION" /* SwbAuthZSubject.SWB_PROJECT_USER_ASSOCIATION */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT_TEMPLATE_URL" /* SwbAuthZSubject.SWB_AWS_ACCOUNT_TEMPLATE_URL */ })
            ])
        }));
    });
    test('Should not throw an error if ITAdmin identity permissions already exists', async () => {
        authService.createIdentityPermissions = jest
            .fn()
            .mockRejectedValue(new workbench_core_authorization_1.IdentityPermissionCreationError());
        await authSetup.run();
        expect(authService.createGroup).toBeCalledTimes(1);
        expect(authService.createGroup).toBeCalledWith(expect.objectContaining({ groupId: 'ITAdmin' }));
        expect(authService.createIdentityPermissions).toBeCalledTimes(1);
        expect(authService.createIdentityPermissions).toBeCalledWith(expect.objectContaining({
            identityPermissions: expect.arrayContaining([
                expect.objectContaining({ subjectType: "SWB_PROJECT" /* SwbAuthZSubject.SWB_PROJECT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */ }),
                expect.objectContaining({ subjectType: "SWB_ENVIRONMENT_TYPE" /* SwbAuthZSubject.SWB_ENVIRONMENT_TYPE */ }),
                expect.objectContaining({ subjectType: "SWB_ETC" /* SwbAuthZSubject.SWB_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_LIST_BY_ETC" /* SwbAuthZSubject.SWB_PROJECT_LIST_BY_ETC */ }),
                expect.objectContaining({ subjectType: "SWB_DATASET" /* SwbAuthZSubject.SWB_DATASET */ }),
                expect.objectContaining({ subjectType: "SWB_USER" /* SwbAuthZSubject.SWB_USER */ }),
                expect.objectContaining({ subjectType: "SWB_COST_CENTER" /* SwbAuthZSubject.SWB_COST_CENTER */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT" /* SwbAuthZSubject.SWB_AWS_ACCOUNT */ }),
                expect.objectContaining({ subjectType: "SWB_PROJECT_USER_ASSOCIATION" /* SwbAuthZSubject.SWB_PROJECT_USER_ASSOCIATION */ }),
                expect.objectContaining({ subjectType: "SWB_AWS_ACCOUNT_TEMPLATE_URL" /* SwbAuthZSubject.SWB_AWS_ACCOUNT_TEMPLATE_URL */ })
            ])
        }));
    });
    test('Non GroupAlreadyExistsError should be thrown', async () => {
        authService.createGroup = jest.fn().mockRejectedValue(new Error());
        await expect(authSetup.run()).rejects.toThrow(Error);
    });
    test('Non IdentityPermissionCreationError should be thrown', async () => {
        authService.createIdentityPermissions = jest.fn().mockRejectedValue(new Error());
        await expect(authSetup.run()).rejects.toThrow(Error);
    });
});
//# sourceMappingURL=authorizationSetup.test.js.map