import { ProjectType } from '../types/projects';
import { SpaceMemberRole } from '../types/space';
const applyOrganizationMemberDynamicAbilities = ({ role, builder: { can }, permissionsConfig, }) => {
    if (permissionsConfig.pat.enabled &&
        permissionsConfig.pat.allowedOrgRoles.includes(role)) {
        can('manage', 'PersonalAccessToken', {});
    }
};
export const applyOrganizationMemberStaticAbilities = {
    member(member, { can }) {
        can('view', 'OrganizationMemberProfile', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'JobStatus', {
            createdByUserUuid: member.userUuid,
        });
        can('view', 'PinnedItems', {
            organizationUuid: member.organizationUuid,
        });
    },
    viewer(member, { can }) {
        applyOrganizationMemberStaticAbilities.member(member, { can });
        can('view', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            inheritsFromOrgOrProject: true,
        });
        can('view', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            inheritsFromOrgOrProject: true,
        });
        can('view', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: { userUuid: member.userUuid },
            },
        });
        can('view', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: { userUuid: member.userUuid },
            },
        });
        can('view', 'Space', {
            organizationUuid: member.organizationUuid,
            inheritsFromOrgOrProject: true,
        });
        can('view', 'Space', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: { userUuid: member.userUuid },
            },
        });
        can('view', 'OrganizationDesign', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'Project', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'Organization', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ExportCsv', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'DashboardComments', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'Tags', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'MetricsTree', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'SpotlightTableConfig', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'AiAgentThread', {
            organizationUuid: member.organizationUuid,
            userUuid: member.userUuid,
        });
    },
    interactive_viewer(member, { can }) {
        applyOrganizationMemberStaticAbilities.viewer(member, { can });
        can('create', 'Job');
        can('view', 'Job', { userUuid: member.userUuid });
        can('view', 'UnderlyingData', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'SemanticViewer', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ChangeCsvResults', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Explore', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'ScheduledDeliveries', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ScheduledDeliveries', {
            organizationUuid: member.organizationUuid,
            userUuid: member.userUuid,
        });
        can('manage', 'GoogleSheets', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'DashboardComments', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('manage', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('manage', 'SemanticViewer', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('manage', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        can('manage', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        can('manage', 'DataApp', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('manage', 'DataApp', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        // View data apps shared org/project-wide or in spaces the user can
        // access. Gated at interactive-viewer (not viewer) for parity with
        // manage:Explore — plain viewers don't get data app access.
        can('view', 'DataApp', {
            organizationUuid: member.organizationUuid,
            inheritsFromOrgOrProject: true,
        });
        can('view', 'DataApp', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: { userUuid: member.userUuid },
            },
        });
        can('view', 'DataApp', {
            organizationUuid: member.organizationUuid,
            createdByUserUuid: member.userUuid,
        });
        can('manage', 'DataApp', {
            organizationUuid: member.organizationUuid,
            createdByUserUuid: member.userUuid,
        });
        // View external connections to select and link them when building a
        // data app. Managing (create/edit/delete) stays admin-only.
        can('view', 'ExternalConnection', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Space', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        can('view', 'AiAgent', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'OrganizationAiAgent', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'AiAgentDocument', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'AiAgentThread', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'ContentVerification', {
            organizationUuid: member.organizationUuid,
        });
    },
    editor(member, { can }) {
        applyOrganizationMemberStaticAbilities.interactive_viewer(member, {
            can,
        });
        can('create', 'DataApp', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Space', {
            organizationUuid: member.organizationUuid,
            inheritsFromOrgOrProject: true,
        });
        can('create', 'Space', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Job');
        can('manage', 'PinnedItems', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'DashboardComments', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'SemanticViewer', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Tags', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'MetricsTree', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'OrganizationWarehouseCredentials', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'ContentAsCode', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'ContentAsCode', {
            organizationUuid: member.organizationUuid,
        });
    },
    developer(member, { can }) {
        applyOrganizationMemberStaticAbilities.editor(member, { can });
        can('manage', 'PreAggregation', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'VirtualView', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'CustomSql', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'CustomFields', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'CompiledSql', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'CustomSqlTableCalculations', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'SqlRunner', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Validation', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'SourceCode', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'SourceCode', {
            organizationUuid: member.organizationUuid,
        });
        can('promote', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('promote', 'SavedChart', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        can('promote', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.EDITOR,
                },
            },
        });
        can('promote', 'Dashboard', {
            organizationUuid: member.organizationUuid,
            access: {
                $elemMatch: {
                    userUuid: member.userUuid,
                    role: SpaceMemberRole.ADMIN,
                },
            },
        });
        can('manage', 'CompileProject', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'Project', {
            organizationUuid: member.organizationUuid,
            type: ProjectType.PREVIEW,
        });
        can('update', 'Project', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'DeployProject', {
            organizationUuid: member.organizationUuid,
            type: ProjectType.PREVIEW,
            createdByUserUuid: member.userUuid,
        });
        can('delete', 'Project', {
            organizationUuid: member.organizationUuid,
            type: ProjectType.PREVIEW,
        });
        can('manage', 'SpotlightTableConfig', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ContentAsCode', {
            organizationUuid: member.organizationUuid,
        });
        // Redundant with the broad grant above, but kept so the system
        // role mirrors the `manage:ContentAsCode@self` scope a custom role
        // would carry without full `manage:ContentAsCode`.
        can('manage', 'ContentAsCode', {
            organizationUuid: member.organizationUuid,
            type: ProjectType.PREVIEW,
            createdByUserUuid: member.userUuid,
        });
        can('view', 'JobStatus', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'AiAgent', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'OrganizationAiAgent', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'AiAgentDocument', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'AiAgentThread', {
            organizationUuid: member.organizationUuid,
            userUuid: member.userUuid,
        });
        can('manage', 'ContentVerification', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'AiDeepResearch', {
            organizationUuid: member.organizationUuid,
        });
    },
    admin(member, { can }) {
        applyOrganizationMemberStaticAbilities.developer(member, { can });
        can('manage', 'DataApp', {
            organizationUuid: member.organizationUuid,
        });
        // Adding custom npm dependencies is a supply-chain capability gated
        // above ordinary data-app management — admins only by default.
        can('manage', 'DataAppDependency', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ExternalConnection', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'OrganizationDesign', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Dashboard', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Space', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'SavedChart', {
            organizationUuid: member.organizationUuid,
        });
        can('create', 'Project', {
            organizationUuid: member.organizationUuid,
            type: { $in: [ProjectType.DEFAULT, ProjectType.PREVIEW] },
        });
        can('delete', 'Project', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Project', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'InviteLink', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Organization', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'Analytics', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'OrganizationMemberProfile', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'PinnedItems', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ProjectHomepage', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'Group', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'OrganizationWarehouseCredentials', {
            organizationUuid: member.organizationUuid,
        });
        can('view', 'AiAgentThread', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'AiAgentThread', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'ScheduledDeliveries', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'DeletedContent', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'GitIntegration', {
            organizationUuid: member.organizationUuid,
        });
        can('manage', 'DeployProject', {
            organizationUuid: member.organizationUuid,
        });
        can('impersonate', 'User', {
            organizationUuid: member.organizationUuid,
            isActive: true,
        });
    },
};
export default function applyOrganizationMemberAbilities({ role, member, builder, permissionsConfig, }) {
    applyOrganizationMemberStaticAbilities[role](member, builder);
    applyOrganizationMemberDynamicAbilities({
        role,
        member,
        builder,
        permissionsConfig,
    });
}
//# sourceMappingURL=organizationMemberAbility.js.map