"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const organizationMemberProfile_1 = require("../../types/organizationMemberProfile");
const projectMemberRole_1 = require("../../types/projectMemberRole");
const space_1 = require("../../types/space");
const spaceAccessResolver_1 = require("./spaceAccessResolver");
describe('resolveSpaceAccess', () => {
    const makeChainInput = (overrides = {}) => ({
        spaceUuid: 'child-space',
        inheritsFromOrgOrProject: true,
        chainDirectAccess: [],
        projectAccess: [],
        organizationAccess: [],
        ...overrides,
    });
    it('returns empty array for empty inputs', () => {
        const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput());
        expect(result).toEqual([]);
    });
    describe('single-space chain (backward compat)', () => {
        it('org admin gets space ADMIN', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.ADMIN,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.ADMIN);
        });
        it('direct user access on single space resolves correctly', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
            expect(result[0].hasDirectAccess).toBe(true);
        });
    });
    describe('most permissive wins across chain', () => {
        it('USER_ACCESS EDITOR on parent beats USER_ACCESS VIEWER on child', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
            expect(result[0].hasDirectAccess).toBe(true);
        });
        it('GROUP_ACCESS EDITOR on parent beats USER_ACCESS VIEWER on child', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: 'group-1',
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
        });
        it('USER_ACCESS EDITOR on child already wins (child is higher)', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
        });
        it('three-level chain: grandparent ADMIN wins over child VIEWER', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [],
                    },
                    {
                        spaceUuid: 'grandparent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'grandparent-space',
                                role: space_1.SpaceMemberRole.ADMIN,
                                groupUuid: 'group-1',
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.ADMIN);
        });
    });
    describe('hasDirectAccess', () => {
        it('is false when user has direct access only on parent (inherited)', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].hasDirectAccess).toBe(false);
        });
        it('is true when user has direct access on the leaf space', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].hasDirectAccess).toBe(true);
        });
        it('is false when user has group access only on parent', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: 'group-1',
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].hasDirectAccess).toBe(false);
            expect(result[0].inheritedFrom).toBe('parent_space');
        });
        it('is false when user has only project/org access', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.EDITOR,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].hasDirectAccess).toBe(false);
        });
    });
    describe('inheritedFrom metadata', () => {
        it('reports parent_space when winning role is from ancestor', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].inheritedFrom).toBe('parent_space');
        });
        it('reports parent_space when group access is from ancestor', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: 'group-1',
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].inheritedFrom).toBe('parent_space');
            expect(result[0].hasDirectAccess).toBe(false);
        });
        it('does not report parent_space when winning role is from leaf', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].inheritedFrom).not.toBe('parent_space');
        });
    });
    describe('private chain', () => {
        it('no access without direct access on private chain', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
                projectAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: projectMemberRole_1.ProjectMemberRole.EDITOR,
                        from: space_1.ProjectSpaceAccessOrigin.PROJECT_MEMBERSHIP,
                    },
                ],
            }));
            expect(result).toHaveLength(0);
        });
        it('admin without direct access is excluded (CASL handles admin access)', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.ADMIN,
                    },
                ],
            }));
            expect(result).toHaveLength(0);
        });
        it('direct access on parent grants access on private child', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    { spaceUuid: 'child-space', directAccess: [] },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
        });
    });
    describe('multiple users', () => {
        it('resolves each user independently', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-2',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                    {
                        userUuid: 'user-2',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(2);
            const user1 = result.find((r) => r.userUuid === 'user-1');
            const user2 = result.find((r) => r.userUuid === 'user-2');
            expect(user1?.role).toBe(space_1.SpaceMemberRole.VIEWER);
            expect(user2?.role).toBe(space_1.SpaceMemberRole.EDITOR);
            expect(user2?.inheritedFrom).toBe('parent_space');
        });
    });
    describe('project member access (via GROUP_ACCESS on space column)', () => {
        // These tests simulate what happens when a space has
        // project_member_access_role set and the DB UNION expands
        // project members as GROUP_ACCESS entries.
        it('grants access to project member on private space', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.VIEWER);
            expect(result[0].hasDirectAccess).toBe(true);
        });
        it('project member access coexists with explicit user access — highest wins', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            // Explicit user access as EDITOR
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.EDITOR,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.USER_ACCESS,
                            },
                            // Project member access as VIEWER
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            // USER_ACCESS takes priority over GROUP_ACCESS
            expect(result[0].role).toBe(space_1.SpaceMemberRole.EDITOR);
            expect(result[0].hasDirectAccess).toBe(true);
        });
        it('without project member access, user has no access to private space', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            // Non-admin user without direct access on private space = no access
            expect(result).toHaveLength(0);
        });
        it('multiple project members all get access on private space', () => {
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                            {
                                userUuid: 'user-2',
                                spaceUuid: 'child-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                    {
                        userUuid: 'user-2',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.EDITOR,
                    },
                ],
            }));
            expect(result).toHaveLength(2);
            expect(result.find((r) => r.userUuid === 'user-1')?.role).toBe(space_1.SpaceMemberRole.VIEWER);
            expect(result.find((r) => r.userUuid === 'user-2')?.role).toBe(space_1.SpaceMemberRole.VIEWER);
        });
        it('child inheriting from restricted parent with project member access', () => {
            // parent = restricted with project_member_access_role
            // child = inherits from parent
            // The UNION returns access on the parent, which the child inherits
            const result = (0, spaceAccessResolver_1.resolveSpaceAccess)(makeChainInput({
                inheritsFromOrgOrProject: false,
                chainDirectAccess: [
                    {
                        spaceUuid: 'child-space',
                        directAccess: [],
                    },
                    {
                        spaceUuid: 'parent-space',
                        directAccess: [
                            {
                                userUuid: 'user-1',
                                spaceUuid: 'parent-space',
                                role: space_1.SpaceMemberRole.VIEWER,
                                groupUuid: null,
                                from: space_1.DirectSpaceAccessOrigin.GROUP_ACCESS,
                            },
                        ],
                    },
                ],
                organizationAccess: [
                    {
                        userUuid: 'user-1',
                        spaceUuid: 'child-space',
                        role: organizationMemberProfile_1.OrganizationMemberRole.VIEWER,
                    },
                ],
            }));
            expect(result).toHaveLength(1);
            expect(result[0].role).toBe(space_1.SpaceMemberRole.VIEWER);
            expect(result[0].inheritedFrom).toBe('parent_space');
        });
    });
});
//# sourceMappingURL=spaceAccessResolver.test.js.map