"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.HubPermissionsPolicies = void 0;
exports.getPermissionPolicy = getPermissionPolicy;
const InitiativeBusinessRules_1 = require("../initiatives/_internal/InitiativeBusinessRules");
const ProjectBusinessRules_1 = require("../projects/_internal/ProjectBusinessRules");
const SiteBusinessRules_1 = require("../sites/_internal/SiteBusinessRules");
const DiscussionBusinessRules_1 = require("../discussions/_internal/DiscussionBusinessRules");
const ChannelBusinessRules_1 = require("../channels/_internal/ChannelBusinessRules");
const ContentBusinessRules_1 = require("../content/_internal/ContentBusinessRules");
const GroupBusinessRules_1 = require("../groups/_internal/GroupBusinessRules");
const PageBusinessRules_1 = require("../pages/_internal/PageBusinessRules");
const PlatformPermissionPolicies_1 = require("./PlatformPermissionPolicies");
const InitiativeTemplateBusinessRules_1 = require("../initiative-templates/_internal/InitiativeTemplateBusinessRules");
const TemplateBusinessRules_1 = require("../templates/_internal/TemplateBusinessRules");
const EventBusinessRules_1 = require("../events/_internal/EventBusinessRules");
const UserBusinessRules_1 = require("../users/_internal/UserBusinessRules");
// Examples of possible Permission Policies
// const DiscussionPermissionPolicies: IPermissionPolicy[] = [
//   {
//     permission: "discussions:channel:create",
//     authenticated: true,
//     services: ["discussions"],
//     licenses: ["hub-basic", "hub-premium"],
//   },
//   {
//     permission: "discussions:channel:createprivate",
//     authenticated: true,
//     licenses: ["hub-basic", "hub-premium"],
//     assertions: [
//       {
//         property: "entity:group.typekeywords",
//         assertion: "without",
//         value: "cannotDiscuss",
//       },
//       {
//         property: "context:currentUser",
//         assertion: "is-group-admin",
//         value: "entity:group.id",
//       },
//     ],
//   },
//   {
//     permission: "discussions:channel:create",
//     services: ["discussions"],
//     authenticated: true,
//     licenses: ["hub-basic", "hub-premium"],
//     assertions: [
//       {
//         property: "entity:typeKeywords",
//         assertion: "without",
//         value: "cannotDiscuss",
//       },
//     ],
//   },
//   {
//     permission: "discussions:post:create",
//     services: ["discussions"],
//     authenticated: true,
//     licenses: ["hub-basic", "hub-premium"],
//     assertions: [
//       {
//         property: "entity:typeKeywords",
//         assertion: "without",
//         value: "cannotDiscuss",
//       },
//     ],
//   },
// ];
/**
 * Highlevel Permission definitions for the Hub System as a whole
 * Typically other permissions depend on these so a whole set of features
 * can be enabled / disabled by changing a single permission.
 * MAKE SURE to add the permission string to the SystemPermissions array
 * in Permissions.ts
 */
const SystemPermissionPolicies = [
    // GATING PERMISSIONS
    // these are used for the final release of a Hub Feature
    // and should be removed when the feature is released
    {
        // Feature that gates the workspace release
        // when all the other condition props are removed,
        // the workspace feature will be available to all users
        permission: "hub:gating:workspace:released",
    },
    // permission to gate the configurable views release
    {
        permission: "hub:gating:configurableViews:released",
        availability: ["alpha"],
        environments: ["devext", "qaext"],
    },
    {
        // Use &pe=hub:gating:entity:slugs to enable fetching
        // content from portal during development & testing
        permission: "hub:gating:entity:slugs",
        environments: ["devext"],
    },
    // AGO Release Permissions
    {
        permission: "hub:release:2025R3",
        platformVersion: 2025.3,
    },
    {
        permission: "hub:release:2026R1",
        platformVersion: 2026.1,
    },
    {
        permission: "hub:release:2026R2",
        platformVersion: 2026.2,
    },
    {
        permission: "hub:release:2026R3",
        platformVersion: 2026.3,
    },
    // AI Assistant org permissions
    // this is used to allow AI Assistant features from the org level
    // an org must have the AI Assistant feature enabled
    // and the org bust turn off the beta apps block
    // and be a premium org
    // to allow the AI Assistant to be enabled on an entity
    {
        permission: "hub:platform:ai-assistant",
        licenses: ["hub-premium"],
        services: ["hub-ai-assistant"],
        assertions: [
            {
                property: "context:portalSettings.aiAssistantsEnabled",
                type: "eq",
                value: true,
            },
            {
                property: "context:portalSettings.blockBetaApps",
                type: "eq",
                value: false,
            },
        ],
    },
    // FEATURE PERMISSIONS
    // these are used to enable/disable features in the Hub
    // and are expected to be long-lived
    {
        permission: "hub:feature:ai-assistant",
        flagValue: false, // default to not enabled; site must opt-in
        entityConfigurable: true,
    },
    {
        permission: "hub:feature:privacy",
        // alpha does not do what we want here, it says "grant if the _logged in user_ is in an alpha org"
        // but what we really want is "grant if the _current site_ is in an alpha org" which we can't do
        // availability: ["alpha"],
        // so the fallback is to deny this permission in all cases except when the feature flag is passed (?pe=hub:feature:privacy)
        // but we can't do that either
        // so we will just enable it only in devext since we don't use that env
        environments: ["devext"],
    },
    {
        // Feature we can override to opt in/out of workspace
        permission: "hub:feature:workspace",
        dependencies: ["hub:gating:workspace:released"],
    },
    // permission to enable the configurable views feature
    {
        permission: "hub:feature:configurableViews",
        dependencies: ["hub:gating:configurableViews:released"],
        assertions: [
            {
                property: "entity:type",
                type: "included-in",
                // only enable configurable views for Projects for now.
                // update this list as we enable for more entity types
                value: ["Hub Project"],
            },
        ],
    },
    {
        // Enables access to the user preferences section of the user profile
        // This will likely be removed when we swap the user profile to use workspace
        permission: "hub:feature:user:preferences",
        // gated to qa/dev for now, but will be accessible on PROD when
        // we pass `?pe=hub:feature:user:preferences` in the URL
        environments: ["devext", "qaext", "production"],
    },
    // These should only be used when needing to gate functionality that is not
    // connected to an entity, for example notices. These should NOT be used
    // in dependencies arrays.
    {
        permission: "hub:environment:qaext",
        environments: ["qaext"],
    },
    {
        permission: "hub:environment:devext",
        environments: ["devext"],
    },
    {
        permission: "hub:environment:production",
        environments: ["production"],
    },
    {
        permission: "hub:environment:enterprise",
        environments: ["enterprise"],
    },
    {
        // When enabled, the new follow card will be loaded
        // instead of the old follow initiative card.
        // To enable it, we need to pass the feature flag
        // (?pe=hub:card:follow) into the URL
        permission: "hub:card:follow",
        environments: ["qaext"],
        availability: ["flag"],
        licenses: ["hub-basic", "hub-premium"],
    },
    {
        // TODO: remove this permission once the embed card is released
        permission: "hub:card:embed",
        environments: ["devext", "qaext"],
        availability: ["alpha"],
        licenses: ["hub-basic", "hub-premium"],
    },
    {
        // When enabled, the manage links will take the user the org home site
        permission: "hub:feature:workspace:user",
        // depends on hub:feature:workspace so users can opt out
        dependencies: ["hub:feature:workspace"],
    },
    {
        // When enabled, the manage links will take the user the org home site
        permission: "hub:feature:workspace:org",
        availability: ["alpha"],
        environments: ["devext", "qaext"],
    },
    {
        // when enabled keyboard shortcuts will be available
        permission: "hub:feature:keyboardshortcuts",
        availability: ["alpha"],
        environments: ["devext", "qaext"],
    },
    {
        // Enables the history feature
        permission: "hub:feature:history",
        availability: ["alpha"],
        environments: ["devext", "qaext"],
    },
    {
        // Enables the new entity view to render on a view route
        // To enable it, we need to pass the feature flag
        // (?pe=hub:feature:newentityview) into the URL
        permission: "hub:feature:newentityview",
        environments: ["qaext"],
        availability: ["flag"],
    },
    // DEPRECATED PERMISSION - TODO: remove at next major version
    {
        // Enables catalog configuration and viewing
        permission: "hub:feature:catalogs",
        environments: ["qaext"],
        availability: ["alpha"],
    },
    /**
     * Gates catalog & collection appearance editing
     * in the catalog configuration experience.
     *
     * TODO: remove environment & availability gating once
     * we are ready to release catalog appearance
     * configuration.
     */
    {
        permission: "hub:feature:catalogs:edit:appearance",
        entityEdit: true,
        licenses: ["hub-premium"],
        environments: ["qaext"],
        availability: ["alpha"],
    },
    {
        // Enable inline-workspace for Entity Views
        // limited to devext alpha so we have to pass as a flag to enable
        permission: "hub:feature:inline-workspace",
        environments: ["devext"],
        availability: ["alpha"],
    },
    {
        // Enable site getting pages from it's catalog
        // instead of those linked in the site's data
        permission: "hub:feature:pagescatalog",
        environments: ["qaext"],
        availability: ["alpha"],
    },
    // Whether the enterprise version of the gallery card should be used
    {
        permission: "hub:feature:gallery-card:enterprise",
        environments: ["enterprise", "enterprise-k8s"],
    },
    // DISCUSSION SUBSCRIPTIONS
    // TODO: remove the environments & availability gating before release
    {
        permission: "hub:feature:discussions:subscription",
        environments: ["devext", "qaext"],
        availability: ["alpha"],
        licenses: ["hub-basic", "hub-premium"],
    },
    // NOTE: only use this permission if necessary. Use the licenses check on a permission to check license when able instead of a separate permission.
    // checks if using hub-premium
    {
        permission: "hub:license:hub-premium",
        licenses: ["hub-premium"],
    },
    // NOTE: only use this permission if necessary. Use the licenses check on a permission to check license when able instead of a separate permission.
    // checks if using hub-basic
    {
        permission: "hub:license:hub-basic",
        licenses: ["hub-basic"],
    },
    // NOTE: only use this permission if necessary. Use the licenses check on a permission to check license when able instead of a separate permission.
    // checks if using enterprise-sites
    {
        permission: "hub:license:enterprise-sites",
        licenses: ["enterprise-sites"],
    },
    // NOTE: only use this permission if necessary. Use the availability check on a permission to check availability when able instead of a separate permission.
    // checks if in alpha
    {
        permission: "hub:availability:alpha",
        availability: ["alpha"],
    },
    // NOTE: only use this permission if necessary. Use the availability check on a permission to check availability when able instead of a separate permission.
    // checks if in beta
    {
        permission: "hub:availability:beta",
        availability: ["beta"],
    },
    // NOTE: only use this permission if necessary. Use the availability check on a permission to check availability when able instead of a separate permission.
    // checks if in general
    {
        permission: "hub:availability:general",
        availability: ["general"],
    },
];
/**
 * All the permission policies for the Hub
 */
exports.HubPermissionsPolicies = [
    ...SiteBusinessRules_1.SitesPermissionPolicies,
    ...ProjectBusinessRules_1.ProjectPermissionPolicies,
    ...InitiativeBusinessRules_1.InitiativePermissionPolicies,
    ...DiscussionBusinessRules_1.DiscussionPermissionPolicies,
    ...ChannelBusinessRules_1.ChannelPermissionPolicies,
    ...ContentBusinessRules_1.ContentPermissionPolicies,
    ...GroupBusinessRules_1.GroupPermissionPolicies,
    ...PageBusinessRules_1.PagePermissionPolicies,
    ...TemplateBusinessRules_1.TemplatePermissionPolicies,
    ...PlatformPermissionPolicies_1.PlatformPermissionPolicies,
    ...InitiativeTemplateBusinessRules_1.InitiativeTemplatePermissionPolicies,
    ...SystemPermissionPolicies,
    ...EventBusinessRules_1.EventPermissionPolicies,
    ...UserBusinessRules_1.UserPermissionPolicies,
];
/**
 * Get the policies defined for a specific permission
 * @param permission
 * @returns
 */
function getPermissionPolicy(permission) {
    return exports.HubPermissionsPolicies.find((p) => p.permission === permission);
}
//# sourceMappingURL=HubPermissionPolicies.js.map