"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
/*
 *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *  SPDX-License-Identifier: Apache-2.0
 */
const workbench_core_accounts_1 = require("@aws/workbench-core-accounts");
const swbProjectService_1 = require("./swbProjectService");
describe('SWBProjectService', () => {
    let swbProjectService;
    let mockWorkbenchProjectService;
    let mockDynamicAuthZService;
    let mockUser;
    let mockProject;
    let allIdentityPermissions;
    const fakeProjectId = 'proj-fake-id';
    const fakeDate = '2021-02-26T22:42:16.652Z';
    beforeEach(() => {
        mockWorkbenchProjectService = {};
        mockDynamicAuthZService = {};
        mockUser = {
            id: '12345678-1234-1234-1234-123456789012',
            roles: [`${fakeProjectId}#ProjectAdmin`]
        };
        swbProjectService = new swbProjectService_1.SWBProjectService(mockDynamicAuthZService, mockWorkbenchProjectService);
        mockProject = {
            id: fakeProjectId,
            name: 'name1',
            description: '',
            costCenterId: 'cc-1',
            status: workbench_core_accounts_1.ProjectStatus.AVAILABLE,
            createdAt: fakeDate,
            updatedAt: fakeDate,
            awsAccountId: '',
            envMgmtRoleArn: '',
            hostingAccountHandlerRoleArn: '',
            vpcId: '',
            subnetId: '',
            environmentInstanceFiles: '',
            encryptionKeyArn: '',
            externalId: '',
            accountId: ''
        };
        mockDynamicAuthZService.createIdentityPermissions = jest.fn();
        mockDynamicAuthZService.createGroup = jest.fn();
        mockDynamicAuthZService.deleteIdentityPermissions = jest.fn();
        mockDynamicAuthZService.deleteGroup = jest.fn();
        const paIdentityPermissions = _getPAIdentityPermissions(fakeProjectId);
        const researcherIdentityPermissions = _getResearcherIdentityPermissions(fakeProjectId);
        allIdentityPermissions = [...paIdentityPermissions, ...researcherIdentityPermissions];
    });
    describe('createProject', () => {
        test('create and return project', async () => {
            mockWorkbenchProjectService.createProject = jest.fn().mockReturnValueOnce(mockProject);
            const request = {
                name: 'name1',
                description: '',
                costCenterId: 'cc-1'
            };
            const project = await swbProjectService.createProject(request, mockUser);
            expect(mockWorkbenchProjectService.createProject).toHaveBeenCalledWith(request);
            expect(mockDynamicAuthZService.createGroup).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                groupId: `${fakeProjectId}#ProjectAdmin`,
                description: `Project Admin group for ${fakeProjectId}`
            });
            expect(mockDynamicAuthZService.createGroup).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                groupId: `${fakeProjectId}#Researcher`,
                description: `Researcher group for ${fakeProjectId}`
            });
            expect(mockDynamicAuthZService.createIdentityPermissions).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                identityPermissions: allIdentityPermissions
            });
            expect(project).toEqual(mockProject);
        });
    });
    describe('deleteProject', () => {
        test('should call projectService and dynamicAuthorizationService', async () => {
            // SETUP
            mockWorkbenchProjectService.softDeleteProject = jest.fn();
            const request = {
                projectId: fakeProjectId,
                authenticatedUser: mockUser
            };
            const checkDependencies = async function () { };
            await swbProjectService.softDeleteProject(request, checkDependencies);
            expect(mockWorkbenchProjectService.softDeleteProject).toHaveBeenCalledWith(request, checkDependencies);
            expect(mockDynamicAuthZService.deleteIdentityPermissions).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                identityPermissions: allIdentityPermissions
            });
            expect(mockDynamicAuthZService.deleteGroup).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                groupId: `${fakeProjectId}#ProjectAdmin`
            });
            expect(mockDynamicAuthZService.deleteGroup).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                groupId: `${fakeProjectId}#Researcher`
            });
        });
    });
    describe('getProject', () => {
        test('should call projectService and return environment', async () => {
            // SETUP
            mockWorkbenchProjectService.getProject = jest.fn().mockReturnValueOnce(mockProject);
            const request = {
                projectId: fakeProjectId
            };
            // OPERATE
            const project = await swbProjectService.getProject(request);
            // VERIFY
            expect(mockWorkbenchProjectService.getProject).toHaveBeenCalledWith(request);
            expect(project).toEqual(mockProject);
        });
    });
    describe('getProjects', () => {
        test('should call projectService and return projects', async () => {
            // SETUP
            mockWorkbenchProjectService.getProjects = jest.fn().mockReturnValueOnce([mockProject]);
            const request = {
                projectIds: [fakeProjectId]
            };
            // OPERATE
            const projects = await swbProjectService.getProjects(request);
            // VERIFY
            expect(mockWorkbenchProjectService.getProjects).toHaveBeenCalledWith(request);
            expect(projects).toEqual([mockProject]);
        });
    });
    describe('listProjects', () => {
        test('should call projectService and dynamicAuthorizationService, and return list of projects', async () => {
            // SETUP
            mockWorkbenchProjectService.listProjects = jest.fn().mockReturnValueOnce([mockProject]);
            const request = {
                user: mockUser
            };
            mockDynamicAuthZService.getUserGroups = jest
                .fn()
                .mockReturnValueOnce({ data: { groupIds: mockUser.roles } });
            // OPERATE
            const projects = await swbProjectService.listProjects(request);
            // VERIFY
            expect(mockWorkbenchProjectService.listProjects).toHaveBeenCalledWith(request, mockUser.roles);
            expect(mockDynamicAuthZService.getUserGroups).toHaveBeenCalledWith({
                authenticatedUser: mockUser,
                userId: mockUser.id
            });
            expect(projects).toEqual([mockProject]);
        });
    });
    describe('updateProject', () => {
        test('should call projectService and return project', async () => {
            // SETUP
            mockWorkbenchProjectService.updateProject = jest.fn().mockReturnValueOnce(mockProject);
            const request = {
                projectId: fakeProjectId,
                updatedValues: {}
            };
            // OPERATE
            const project = await swbProjectService.updateProject(request);
            // VERIFY
            expect(mockWorkbenchProjectService.updateProject).toHaveBeenCalledWith(request);
            expect(project).toEqual(mockProject);
        });
    });
});
function _getPAIdentityPermissions(projectId) {
    const identityPermissions = [];
    const identityType = 'GROUP';
    const allSubjectId = '*';
    const allowEffect = 'ALLOW';
    const paRole = `${projectId}#ProjectAdmin`;
    // Dataset permissions
    for (const action of ['CREATE']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_DATASET" /* SwbAuthZSubject.SWB_DATASET */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // List Datasets permission
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_DATASET_LIST" /* SwbAuthZSubject.SWB_DATASET_LIST */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // Environment permissions
    for (const action of ['CREATE', 'READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // Environment Type permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ENVIRONMENT_TYPE" /* SwbAuthZSubject.SWB_ENVIRONMENT_TYPE */
        });
    }
    // Environment Type Config permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ETC" /* SwbAuthZSubject.SWB_ETC */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // ListProjects permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_PROJECT_LIST" /* SwbAuthZSubject.SWB_PROJECT_LIST */
        });
    }
    // Project permissions
    for (const action of ['READ', 'UPDATE', 'DELETE']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: projectId,
            subjectType: "SWB_PROJECT" /* SwbAuthZSubject.SWB_PROJECT */
        });
    }
    // Project User Association permissions
    for (const action of ['CREATE', 'READ', 'DELETE']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_PROJECT_USER_ASSOCIATION" /* SwbAuthZSubject.SWB_PROJECT_USER_ASSOCIATION */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // SSH Key permissions
    for (const action of ['CREATE', 'READ', 'DELETE']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_SSH_KEY" /* SwbAuthZSubject.SWB_SSH_KEY */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // User permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: paRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_USER" /* SwbAuthZSubject.SWB_USER */
        });
    }
    return identityPermissions;
}
function _getResearcherIdentityPermissions(projectId) {
    const identityPermissions = [];
    const identityType = 'GROUP';
    const allSubjectId = '*';
    const allowEffect = 'ALLOW';
    const researcherRole = `${projectId}#Researcher`;
    // List Dataset permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_DATASET_LIST" /* SwbAuthZSubject.SWB_DATASET_LIST */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // Environment permissions
    for (const action of ['CREATE', 'READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // Environment Type permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ENVIRONMENT_TYPE" /* SwbAuthZSubject.SWB_ENVIRONMENT_TYPE */
        });
    }
    // Environment Type Config permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_ETC" /* SwbAuthZSubject.SWB_ETC */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    // ListProjects permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_PROJECT_LIST" /* SwbAuthZSubject.SWB_PROJECT_LIST */
        });
    }
    // Project permissions
    for (const action of ['READ']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: projectId,
            subjectType: "SWB_PROJECT" /* SwbAuthZSubject.SWB_PROJECT */
        });
    }
    // SSH Key permissions
    for (const action of ['CREATE', 'READ', 'DELETE']) {
        identityPermissions.push({
            action: action,
            effect: allowEffect,
            identityId: researcherRole,
            identityType: identityType,
            subjectId: allSubjectId,
            subjectType: "SWB_SSH_KEY" /* SwbAuthZSubject.SWB_SSH_KEY */,
            conditions: {
                projectId: { $eq: projectId }
            }
        });
    }
    return identityPermissions;
}
//# sourceMappingURL=swbProjectService.test.js.map