"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const ability_1 = require("@casl/ability");
const index_1 = require("./index");
const index_mock_1 = require("./index.mock");
describe('Lightdash member permissions', () => {
    let ability = (0, index_1.defineUserAbility)(index_mock_1.orgProfile, [index_mock_1.projectProfile]);
    let conditions = index_mock_1.conditions;
    describe('when user not in an org', () => {
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.userWithoutOrg, []);
        });
        it('can not view org and project', async () => {
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(false);
        });
    });
    describe('when user is an org viewer and project viewer', () => {
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.orgProfile, [index_mock_1.projectProfile]);
        });
        it('can view org and project', async () => {
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
        it('cannot view another org or another project', async () => {
            conditions = {
                projectUuid: 'another-project',
                organizationUuid: 'another-org',
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(false);
        });
        it('cannot view another org', async () => {
            conditions = {
                ...index_mock_1.conditions,
                organizationUuid: 'another-org',
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
        it('cannot view another project', async () => {
            conditions = {
                ...index_mock_1.conditions,
                projectUuid: 'another-project',
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
        it('cannot manage org or project', async () => {
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(false);
        });
    });
    describe('when user is an org admin and project viewer', () => {
        // org admins and editors have `manage` permissions over all projects
        // within the org
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.adminOrgProfile, [index_mock_1.projectProfile]);
            conditions = {
                organizationUuid: index_mock_1.adminOrgProfile.organizationUuid,
                projectUuid: index_mock_1.projectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
        });
        it('can view org and project', async () => {
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
        it('cannot view another org and or another project', async () => {
            conditions = {
                organizationUuid: 'another-org',
                projectUuid: 'another-project',
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(false);
        });
        it('can manage org AND project', async () => {
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
    });
    describe('when user is an org viewer and project admin', () => {
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.orgProfile, [index_mock_1.adminProjectProfile]);
            conditions = {
                organizationUuid: index_mock_1.orgProfile.organizationUuid,
                projectUuid: index_mock_1.adminProjectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
        });
        it('can view org and project', async () => {
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
        });
        it('cannot view another org and or another project', async () => {
            conditions = {
                organizationUuid: 'another-org',
                projectUuid: 'another-project',
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(false);
        });
        it('cannot manage org alone but can manage project', async () => {
            // Combined
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...conditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...conditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...conditions }))).toEqual(true);
            // Org specific
            const orgConditions = {
                organizationUuid: conditions.organizationUuid,
            };
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...orgConditions }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...orgConditions }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...orgConditions }))).toEqual(false);
            // Project specific
            const projectConditions = {
                projectUuid: conditions.projectUuid,
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...projectConditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...projectConditions }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...projectConditions }))).toEqual(true);
        });
    });
    describe('when user is viewer in one project but admin in another', () => {
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.orgProfile, [
                index_mock_1.projectProfile,
                index_mock_1.adminProjectProfile,
            ]);
            conditions = {
                organizationUuid: index_mock_1.orgProfile.organizationUuid,
                projectUuid: index_mock_1.projectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
        });
        it('can view org and project', async () => {
            const conditionsProjectView = {
                projectUuid: index_mock_1.projectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditionsProjectView }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditionsProjectView }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditionsProjectView }))).toEqual(true);
            const conditionsProjectAdmin = {
                projectUuid: index_mock_1.adminProjectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...conditionsProjectAdmin }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...conditionsProjectAdmin }))).toEqual(true);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...conditionsProjectAdmin }))).toEqual(true);
        });
        it('cannot view another project', async () => {
            const projectConditions = {
                projectUuid: 'another-project',
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('view', (0, ability_1.subject)('SavedChart', { ...projectConditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Dashboard', { ...projectConditions }))).toEqual(false);
            expect(ability.can('view', (0, ability_1.subject)('Project', { ...projectConditions }))).toEqual(false);
        });
        it('can manage admin project but cannot manage view project', async () => {
            const conditionsProjectView = {
                projectUuid: index_mock_1.projectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...conditionsProjectView }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...conditionsProjectView }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...conditionsProjectView }))).toEqual(false);
            const conditionsProjectAdmin = {
                projectUuid: index_mock_1.adminProjectProfile.projectUuid,
                inheritsFromOrgOrProject: true,
            };
            expect(ability.can('manage', (0, ability_1.subject)('SavedChart', { ...conditionsProjectAdmin }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Dashboard', { ...conditionsProjectAdmin }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', { ...conditionsProjectAdmin }))).toEqual(true);
        });
    });
    describe('when user is an org admin and has no project roles', () => {
        // org admins and editors have `manage` permissions over all projects
        // within the org
        beforeEach(() => {
            ability = (0, index_1.defineUserAbility)(index_mock_1.adminOrgProfile, []);
        });
        it('can view project', async () => {
            expect(ability.rules).toContainEqual({
                action: 'manage',
                subject: 'Project',
                conditions: {
                    organizationUuid: index_mock_1.adminOrgProfile.organizationUuid,
                },
            });
            expect(ability.can('manage', 'Project')).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', {
                organizationUuid: index_mock_1.adminOrgProfile.organizationUuid,
            }))).toEqual(true);
            expect(ability.can('manage', (0, ability_1.subject)('Project', {
                projectUuid: index_mock_1.projectProfile.projectUuid,
            }))).toEqual(false);
            expect(ability.can('manage', (0, ability_1.subject)('Project', {
                organizationUuid: index_mock_1.adminOrgProfile.organizationUuid,
                projectUuid: index_mock_1.projectProfile.projectUuid,
            }))).toEqual(true);
        });
    });
});
//# sourceMappingURL=index.test.js.map