"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const tslib_1 = require("tslib");
const ability_1 = require("@casl/ability");
const organizationMemberProfile_1 = require("../types/organizationMemberProfile");
const projects_1 = require("../types/projects");
const space_1 = require("../types/space");
const organizationMemberAbility_1 = tslib_1.__importDefault(require("./organizationMemberAbility"));
const organizationMemberAbility_mock_1 = require("./organizationMemberAbility.mock");
const defineAbilityForOrganizationMember = (member, permissionsConfig) => {
    const builder = new ability_1.AbilityBuilder(ability_1.Ability);
    if (member) {
        (0, organizationMemberAbility_1.default)({
            role: member.role,
            member,
            builder,
            permissionsConfig: permissionsConfig ?? {
                pat: {
                    enabled: true,
                    allowedOrgRoles: Object.values(organizationMemberProfile_1.OrganizationMemberRole),
                },
            },
        });
    }
    return builder.build();
};
describe('Organization member permissions', () => {
    describe('Member permissions', () => {
        let ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_VIEWER);
        describe('when user is an organization admin', () => {
            beforeEach(() => {
                ability =
                    defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_ADMIN);
            });
            it('can manage organizations', () => {
                expect(ability.can('manage', 'Organization')).toEqual(true);
            });
            it('cannot manage another organization', () => {
                const org = { organizationUuid: '789' };
                expect(ability.can('manage', (0, ability_1.subject)('Organization', org))).toEqual(false);
            });
            it('can manage their own organization', () => {
                const org = { organizationUuid: '456' };
                expect(ability.can('manage', (0, ability_1.subject)('Organization', org))).toEqual(true);
            });
            it('can manage member profiles', () => {
                expect(ability.can('manage', 'OrganizationMemberProfile')).toEqual(true);
            });
            it('cannot manage other members from another organization', () => {
                expect(ability.can('manage', (0, ability_1.subject)('OrganizationMemberProfile', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('OrganizationMemberProfile', {
                    organizationUuid: 'notmine',
                }))).toEqual(false);
            });
            it('can view and manage all kinds of dashboards', () => {
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
            });
            it('can view and manage all kinds of saved charts', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
            });
            it('can view and manage all kinds of space', () => {
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
            });
            describe('JobStatus', () => {
                it('can view his own job status', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        createdByUserUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view job status from the organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                        createdByUserUuid: undefined,
                    }))).toEqual(true);
                });
                it('cannot view job status from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', { organizationUuid: '54678' }))).toEqual(false);
                });
            });
            describe('AiAgent', () => {
                it('can manage AiAgent', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    }))).toEqual(true);
                });
                it('cannot manage AiAgent from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', { organizationUuid: '5678' }))).toEqual(false);
                });
            });
            describe('AiAgentThread', () => {
                it('can view all AiAgentThreads in the organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage all AiAgentThreads in the organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    }))).toEqual(true);
                });
                it('cannot view AiAgentThread from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
                it('cannot manage AiAgentThread from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
            describe('ScheduledDeliveries', () => {
                it('can create ScheduledDeliveries', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage all ScheduledDeliveries', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage ScheduledDeliveries created by other users', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(true);
                });
                it('cannot manage ScheduledDeliveries from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
        });
        describe('when user is an editor', () => {
            beforeEach(() => {
                ability =
                    defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_EDITOR);
            });
            it('cannot manage organizations', () => {
                expect(ability.can('manage', 'Organization')).toEqual(false);
            });
            it('can view and manage public & accessable dashboards', () => {
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
            });
            it('can view and manage public & accessable saved charts', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
            });
            it('can create a space', () => {
                expect(ability.can('create', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                }))).toEqual(true);
            });
            it('can view and manage public & accessable space', () => {
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                            role: space_1.SpaceMemberRole.ADMIN,
                        },
                    ],
                }))).toEqual(true);
            });
            it('can manage public dashboards from their own organization', () => {
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: '456',
                    isPrivate: false,
                    access: [],
                }))).toEqual(false);
            });
            it('cannot manage public dashboards from another organization', () => {
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: '789',
                    isPrivate: false,
                    access: [],
                }))).toEqual(false);
            });
            it('can view member profiles', () => {
                expect(ability.can('view', 'OrganizationMemberProfile')).toEqual(true);
            });
            it('can create invite links', () => {
                expect(ability.can('create', 'InviteLink')).toEqual(false);
            });
            it('cannot run SQL Queries', () => {
                expect(ability.can('manage', 'SqlRunner')).toEqual(false);
            });
            it('can use the SemanticViewer', () => {
                expect(ability.can('manage', 'SemanticViewer')).toEqual(true);
            });
            describe('JobStatus', () => {
                it('can view his own job status', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        createdByUserUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view job status from the organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                        createdByUserUuid: undefined,
                    }))).toEqual(false);
                });
                it('cannot view job status from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', { organizationUuid: '54678' }))).toEqual(false);
                });
            });
            describe('ScheduledDeliveries', () => {
                it('can create ScheduledDeliveries', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage only his own ScheduledDeliveries', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.userUuid,
                    }))).toEqual(true);
                });
                it('cannot manage ScheduledDeliveries created by other users', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot manage ScheduledDeliveries from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
        });
        describe('when user is an developer', () => {
            beforeEach(() => {
                ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER);
            });
            it('can run SQL Queries', () => {
                expect(ability.can('manage', 'SqlRunner')).toEqual(true);
            });
            it('can use the SemanticViewer', () => {
                expect(ability.can('manage', 'SemanticViewer')).toEqual(true);
            });
            describe('JobStatus', () => {
                it('can view his own job status', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        createdByUserUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view job status from the organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        createdByUserUuid: undefined,
                    }))).toEqual(true);
                });
                it('cannot view job status from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', { organizationUuid: '54678' }))).toEqual(false);
                });
            });
            describe('AiAgent', () => {
                it('can manage AiAgent', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                    }))).toEqual(true);
                });
                it('cannot manage AiAgent from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', { organizationUuid: '5678' }))).toEqual(false);
                });
            });
            describe('AiAgentThread', () => {
                it('can manage only his own AiAgentThread', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot manage other users AiAgentThread', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot manage AiAgentThread from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
            describe('ScheduledDeliveries', () => {
                it('can create ScheduledDeliveries', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage only his own ScheduledDeliveries', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot manage ScheduledDeliveries created by other users', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot manage ScheduledDeliveries from another organization', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
        });
        describe('when user is a member', () => {
            beforeEach(() => {
                ability =
                    defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_MEMBER);
            });
            it('can view member profiles', () => {
                expect(ability.can('view', 'OrganizationMemberProfile')).toEqual(true);
            });
            it('can create invitations', () => {
                expect(ability.can('create', 'InviteLink')).toEqual(false);
            });
            it('cannot view organizations', () => {
                expect(ability.can('view', 'Organization')).toEqual(false);
            });
            it('cannot view charts', () => {
                expect(ability.can('view', 'SavedChart')).toEqual(false);
            });
            describe('JobStatus', () => {
                it('can view his own job status', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        createdByUserUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view job status from the organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                        createdByUserUuid: undefined,
                    }))).toEqual(false);
                });
                it('cannot view job status from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('JobStatus', { organizationUuid: '54678' }))).toEqual(false);
                });
            });
        });
        describe('when user is a viewer', () => {
            beforeEach(() => {
                ability =
                    defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_VIEWER);
            });
            it('can only view public & accessable dashboards', () => {
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(false);
            });
            it('can view and manage public & accessable saved charts', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(false);
            });
            it('can view and manage public & accessable space', () => {
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: false,
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.VIEWER,
                        },
                    ],
                }))).toEqual(false);
                expect(ability.can('view', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(true);
                expect(ability.can('manage', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    isPrivate: true,
                    access: [
                        {
                            userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                            role: space_1.SpaceMemberRole.EDITOR,
                        },
                    ],
                }))).toEqual(false);
            });
            it('can view member profiles', () => {
                expect(ability.can('view', (0, ability_1.subject)('OrganizationMemberProfile', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(true);
            });
            it('can create invitations', () => {
                expect(ability.can('create', (0, ability_1.subject)('InviteLink', {}))).toEqual(false);
            });
            it('cannot create a project in organization they belong to', () => {
                const check = {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                };
                expect(ability.can('create', (0, ability_1.subject)('Project', check))).toEqual(false);
            });
            it('cannot create any resource, except space when have editor space role', () => {
                expect(ability.can('create', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot run SQL queries', () => {
                expect(ability.can('manage', (0, ability_1.subject)('SqlRunner', {}))).toEqual(false);
            });
            it('cannot update any resource, except space when have editor space role', () => {
                expect(ability.can('update', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Project', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('InviteLink', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot delete any resource, except space when have editor space role', () => {
                expect(ability.can('delete', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Project', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('InviteLink', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('can view their own organization', () => {
                const org = { organizationUuid: '456' };
                expect(ability.can('view', (0, ability_1.subject)('Organization', org))).toEqual(true);
            });
            it('cannot view another organization', () => {
                const org = { organizationUuid: '789' };
                expect(ability.can('view', (0, ability_1.subject)('Organization', org))).toEqual(false);
            });
            it('can view dashboards from their own organization', () => {
                const org = { organizationUuid: '456', isPrivate: false };
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', org))).toEqual(true);
            });
            it('cannot view dashboards from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', { organizationUuid: '789' }))).toEqual(false);
            });
            it('can view savedCharts from their own organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: '456',
                    isPrivate: false,
                }))).toEqual(true);
            });
            it('cannot view savedCharts from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: '789',
                    isPrivate: false,
                }))).toEqual(false);
            });
            it('can view projects from their own organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Project', { organizationUuid: '456' }))).toEqual(true);
            });
            it('cannot view projects from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Project', { organizationUuid: '789' }))).toEqual(false);
            });
            it('can view their own jobs', () => {
                expect(ability.can('view', (0, ability_1.subject)('Job', {
                    userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                }))).toEqual(false);
            });
            it('cannot view jobs from another user', () => {
                expect(ability.can('view', (0, ability_1.subject)('Job', { userUuid: 'another-user-uuid' }))).toEqual(false);
            });
            it('cannot view the SemanticViewer', () => {
                expect(ability.can('view', 'SemanticViewer')).toEqual(false);
            });
            describe('AiAgent', () => {
                it('cannot view AiAgent', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
                it('cannot manage AiAgent', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
            });
            describe('AiAgentThread', () => {
                it('can view only his own AiAgentThread', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view other users AiAgentThread', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot manage his own AiAgentThread', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.userUuid,
                    }))).toEqual(false);
                });
                it('cannot create AiAgentThread', () => {
                    expect(ability.can('create', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
                it('cannot view AiAgentThread from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
            describe('ScheduledDeliveries', () => {
                it('cannot create ScheduledDeliveries', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
                it('cannot manage ScheduledDeliveries', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
            });
        });
        describe('when user is an interactive viewer', () => {
            beforeEach(() => {
                ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER);
            });
            it('can view member profiles', () => {
                expect(ability.can('view', (0, ability_1.subject)('OrganizationMemberProfile', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(true);
            });
            it('can create invitations', () => {
                expect(ability.can('create', (0, ability_1.subject)('InviteLink', {}))).toEqual(false);
            });
            it('cannot create any resource, except space when have editor space role', () => {
                expect(ability.can('create', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('create', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot run SQL queries', () => {
                expect(ability.can('manage', (0, ability_1.subject)('SqlRunner', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot use the SemanticViewer', () => {
                expect(ability.can('manage', (0, ability_1.subject)('SemanticViewer', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot update any resource, except space when have editor space role', () => {
                expect(ability.can('update', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Project', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('update', (0, ability_1.subject)('InviteLink', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('cannot delete any resource, except space when have editor space role', () => {
                expect(ability.can('delete', (0, ability_1.subject)('Space', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Project', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('Organization', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
                expect(ability.can('delete', (0, ability_1.subject)('InviteLink', {
                    organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                }))).toEqual(false);
            });
            it('can view their own organization', () => {
                const org = { organizationUuid: '456' };
                expect(ability.can('view', (0, ability_1.subject)('Organization', org))).toEqual(true);
            });
            it('cannot view another organization', () => {
                const org = { organizationUuid: '789' };
                expect(ability.can('view', (0, ability_1.subject)('Organization', org))).toEqual(false);
            });
            it('can view dashboards from their own organization', () => {
                const org = { organizationUuid: '456', isPrivate: false };
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', org))).toEqual(true);
            });
            it('cannot view dashboards from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Dashboard', {
                    organizationUuid: '789',
                    isPrivate: false,
                }))).toEqual(false);
            });
            it('can view savedCharts from their own organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: '456',
                    isPrivate: false,
                }))).toEqual(true);
            });
            it('cannot view savedCharts from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('SavedChart', {
                    organizationUuid: '789',
                    isPrivate: false,
                }))).toEqual(false);
            });
            it('can view projects from their own organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Project', { organizationUuid: '456' }))).toEqual(true);
            });
            it('cannot view projects from another organization', () => {
                expect(ability.can('view', (0, ability_1.subject)('Project', { organizationUuid: '789' }))).toEqual(false);
            });
            it('can view their own jobs', () => {
                expect(ability.can('view', (0, ability_1.subject)('Job', {
                    userUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.userUuid,
                }))).toEqual(true);
            });
            it('cannot view jobs from another user', () => {
                expect(ability.can('view', (0, ability_1.subject)('Job', { userUuid: 'another-user-uuid' }))).toEqual(false);
            });
            describe('AiAgent', () => {
                it('can view AiAgent', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                    }))).toEqual(true);
                });
                it('cannot manage AiAgent', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgent', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                    }))).toEqual(false);
                });
                it('cannot view AiAgent from another organization', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgent', { organizationUuid: '5678' }))).toEqual(false);
                });
            });
            describe('AiAgentThread', () => {
                it('can create AiAgentThread', () => {
                    expect(ability.can('create', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                    }))).toEqual(true);
                });
                it('can view only his own AiAgentThread', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot view other users AiAgentThread', () => {
                    expect(ability.can('view', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot manage his own AiAgentThread', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.userUuid,
                    }))).toEqual(false);
                });
                it('cannot create AiAgentThread in another organization', () => {
                    expect(ability.can('create', (0, ability_1.subject)('AiAgentThread', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
            describe('ScheduledDeliveries', () => {
                it('can create ScheduledDeliveries', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                    }))).toEqual(true);
                });
                it('can manage only his own ScheduledDeliveries', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                        userUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.userUuid,
                    }))).toEqual(true);
                });
                it('cannot manage ScheduledDeliveries created by other users', () => {
                    expect(ability.can('manage', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER.organizationUuid,
                        userUuid: 'another-user-uuid',
                    }))).toEqual(false);
                });
                it('cannot create ScheduledDeliveries in another organization', () => {
                    expect(ability.can('create', (0, ability_1.subject)('ScheduledDeliveries', {
                        organizationUuid: '5678',
                    }))).toEqual(false);
                });
            });
        });
    });
    describe('Project creation permissions', () => {
        [
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN,
                canCreateProject: true,
                canCreatePreview: true,
                canDeleteProject: true,
                canDeletePreview: true,
            },
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER,
                canCreateProject: false,
                canCreatePreview: true,
                canDeleteProject: false,
                canDeletePreview: true,
            },
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_MEMBER,
                canCreateProject: false,
                canCreatePreview: false,
                canDeleteProject: false,
                canDeletePreview: false,
            },
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_VIEWER,
                canCreateProject: false,
                canCreatePreview: false,
                canDeleteProject: false,
                canDeletePreview: false,
            },
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_INTERACTIVE_VIEWER,
                canCreateProject: false,
                canCreatePreview: false,
                canDeleteProject: false,
                canDeletePreview: false,
            },
            {
                membership: organizationMemberAbility_mock_1.ORGANIZATION_EDITOR,
                canCreateProject: false,
                canCreatePreview: false,
                canDeleteProject: false,
                canDeletePreview: false,
            },
        ].forEach(({ membership, canCreateProject, canCreatePreview, canDeleteProject, canDeletePreview, }) => {
            const ability = defineAbilityForOrganizationMember(membership);
            describe(`user is '${membership.role}' role`, () => {
                it('checks if users can create project in organization they belong to', () => {
                    expect(ability.can('create', (0, ability_1.subject)('Project', {
                        organizationUuid: membership.organizationUuid,
                        type: projects_1.ProjectType.DEFAULT,
                    }))).toEqual(canCreateProject);
                });
                it('checks that users cannot create a project in another organization', () => {
                    expect(ability.can('create', (0, ability_1.subject)('Project', {
                        organizationUuid: '789',
                        type: projects_1.ProjectType.DEFAULT,
                    }))).toEqual(false);
                });
                it('checks if users can create a PREVIEW project in organization they belong to', () => {
                    expect(ability.can('create', (0, ability_1.subject)('Project', {
                        organizationUuid: membership.organizationUuid,
                        type: projects_1.ProjectType.PREVIEW,
                    }))).toEqual(canCreatePreview);
                });
                it('checks that users cannot create a PREVIEW project in another organization', () => {
                    expect(ability.can('create', (0, ability_1.subject)('Project', {
                        organizationUuid: '789',
                        type: projects_1.ProjectType.PREVIEW,
                    }))).toEqual(false);
                });
                it('checks if users can delete a project in organization they belong to', () => {
                    expect(ability.can('delete', (0, ability_1.subject)('Project', {
                        organizationUuid: membership.organizationUuid,
                    }))).toEqual(canDeleteProject);
                });
                it('checks that users cannot delete a project in another organization', () => {
                    expect(ability.can('delete', (0, ability_1.subject)('Project', {
                        organizationUuid: '789',
                    }))).toEqual(false);
                });
                it('checks if users can delete a PREVIEW project in organization they belong to', () => {
                    expect(ability.can('delete', (0, ability_1.subject)('Project', {
                        organizationUuid: membership.organizationUuid,
                        type: projects_1.ProjectType.PREVIEW,
                    }))).toEqual(canDeletePreview);
                });
                it('checks that users cannot delete a PREVIEW project in another organization', () => {
                    expect(ability.can('delete', (0, ability_1.subject)('Project', {
                        organizationUuid: '789',
                        type: projects_1.ProjectType.PREVIEW,
                    }))).toEqual(false);
                });
            });
        });
    });
    // test permissionsConfig
    describe('Personal Access Tokens permissions', () => {
        it('cannot create a personal access token as PAT is disabled', () => {
            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_ADMIN, {
                pat: {
                    enabled: false,
                    allowedOrgRoles: Object.values(organizationMemberProfile_1.OrganizationMemberRole),
                },
            });
            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
            }))).toEqual(false);
        });
        it('cannot create a personal access token as PAT allowed roles dont match', () => {
            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER, {
                pat: {
                    enabled: true,
                    allowedOrgRoles: [organizationMemberProfile_1.OrganizationMemberRole.ADMIN],
                },
            });
            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.organizationUuid,
                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_DEVELOPER.userUuid,
            }))).toEqual(false);
        });
        it('can create a personal access token as PAT is enabled', () => {
            const ability = defineAbilityForOrganizationMember(organizationMemberAbility_mock_1.ORGANIZATION_ADMIN, {
                pat: {
                    enabled: true,
                    allowedOrgRoles: [organizationMemberProfile_1.OrganizationMemberRole.ADMIN],
                },
            });
            expect(ability.can('create', (0, ability_1.subject)('PersonalAccessToken', {
                organizationUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.organizationUuid,
                userUuid: organizationMemberAbility_mock_1.ORGANIZATION_ADMIN.userUuid,
            }))).toEqual(true);
        });
    });
});
//# sourceMappingURL=organizationMemberAbility.test.js.map