"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.defineUserAbility = exports.getUserAbilityBuilder = exports.JWT_HEADER_NAME = void 0;
const tslib_1 = require("tslib");
const ability_1 = require("@casl/ability");
const errors_1 = require("../types/errors");
const collapseAbilityRules_1 = require("./collapseAbilityRules");
const organizationMemberAbility_1 = tslib_1.__importDefault(require("./organizationMemberAbility"));
const projectMemberAbility_1 = require("./projectMemberAbility");
const scopeAbilityBuilder_1 = require("./scopeAbilityBuilder");
exports.JWT_HEADER_NAME = 'lightdash-embed-token';
const getUserAbilityBuilder = ({ user, projectProfiles, permissionsConfig, customRoleScopes, customRolesEnabled, isEnterprise, }) => {
    const builder = new ability_1.AbilityBuilder(ability_1.Ability);
    const invalidScopes = [];
    if (user.role && user.organizationUuid) {
        // Org-level custom role: if the user's organization_memberships row
        // points at a role_uuid AND custom roles are enabled AND we have the
        // role's scopes, build CASL from those scopes (same path as
        // project-level custom roles below). Falls back to the system role
        // path otherwise.
        const orgCustomRoleScopes = customRolesEnabled && user.roleUuid
            ? customRoleScopes?.[user.roleUuid]
            : undefined;
        if (orgCustomRoleScopes) {
            invalidScopes.push(...(0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                organizationUuid: user.organizationUuid,
                userUuid: user.userUuid,
                scopes: orgCustomRoleScopes,
                isEnterprise,
                organizationRole: user.role,
                permissionsConfig,
            }, builder));
        }
        else {
            (0, organizationMemberAbility_1.default)({
                role: user.role,
                member: {
                    organizationUuid: user.organizationUuid,
                    userUuid: user.userUuid,
                },
                builder,
                permissionsConfig,
            });
        }
        projectProfiles.forEach((projectProfile) => {
            if (projectProfile.roleUuid && customRolesEnabled) {
                if (!user.organizationUuid) {
                    throw new errors_1.NotFoundError(`Organization with uuid ${user.organizationUuid} was not found`);
                }
                const scopes = customRoleScopes?.[projectProfile.roleUuid];
                if (!scopes) {
                    // eslint-disable-next-line no-console
                    console.error(`Custom role with uuid ${projectProfile.roleUuid} was not found`);
                    return;
                }
                invalidScopes.push(...(0, scopeAbilityBuilder_1.buildAbilityFromScopes)({
                    projectUuid: projectProfile.projectUuid,
                    projectType: projectProfile.projectType,
                    projectCreatedByUserUuid: projectProfile.projectCreatedByUserUuid,
                    userUuid: user.userUuid,
                    scopes,
                    isEnterprise,
                    organizationRole: user.role,
                    permissionsConfig,
                }, builder));
            }
            else {
                projectMemberAbility_1.projectMemberAbilities[projectProfile.role](projectProfile, builder);
            }
        });
    }
    // Collapse per-project rules into `{ $in: [...] }` so the rule set (and the
    // serialized `abilityRules` payload) scales with role tiers, not project count.
    builder.rules = (0, collapseAbilityRules_1.collapseAbilityRules)(builder.rules);
    return { builder, invalidScopes };
};
exports.getUserAbilityBuilder = getUserAbilityBuilder;
// Defines user ability for test purposes
const defineUserAbility = (user, projectProfiles, customRoleScopes) => {
    const { builder } = (0, exports.getUserAbilityBuilder)({
        user,
        projectProfiles,
        permissionsConfig: {
            pat: {
                enabled: false,
                allowedOrgRoles: [],
            },
        },
        customRoleScopes,
    });
    return builder.build();
};
exports.defineUserAbility = defineUserAbility;
//# sourceMappingURL=index.js.map