refactor(access-control): Update permissions for 'water.locations' to restrict access for AMP.Editor and allow for Geothermal.Admin

Author: jirhiker

src/test/utils/accessControl.test.ts

@@ -101,7 +101,7 @@ const expectedAccessByScenario: Scenario[] = [
   {
     name: 'Geothermal.Admin',
     groups: ['Geothermal.Admin'],
-    allowedResources: [],
+    allowedResources: ['water.locations'],
   },
   {
     name: 'AMP.Viewer + Geothermal.Editor',
@@ -178,18 +178,32 @@ const specialResourceExpectations: Array<{
     expected: true,
   },
   {
-    name: 'AMP editor can list water.locations',
+    name: 'AMP editor cannot list water.locations',
     groups: ['AMP.Editor'],
     resource: 'water.locations',
     action: 'list',
+    expected: false,
+  },
+  {
+    name: 'AMP admin can list water.locations',
+    groups: ['AMP.Admin'],
+    resource: 'water.locations',
+    action: 'list',
     expected: true,
   },
   {
-    name: 'AMP editor can create water.locations',
+    name: 'Geothermal admin can show water.locations',
+    groups: ['Geothermal.Admin'],
+    resource: 'water.locations',
+    action: 'show',
+    expected: true,
+  },
+  {
+    name: 'AMP editor cannot create water.locations',
     groups: ['AMP.Editor'],
     resource: 'water.locations',
     action: 'create',
-    expected: true,
+    expected: false,
   },
   {
     name: 'AMP editor can manage water.wellinventoryform',

src/utils/accessControl.ts

@@ -102,12 +102,12 @@ const resourcePolicies: Record<string, ResourcePolicy> = {
   Sandbox: { list: adminRoles, show: adminRoles },
   geothermal: { list: geothermalViewerRoles, show: geothermalViewerRoles },
   'water.locations': {
-    list: editorRoles,
-    show: editorRoles,
-    edit: editorRoles,
-    create: editorRoles,
-    delete: editorRoles,
-    manage: editorRoles,
+    list: ['AMP.Admin', 'Geothermal.Admin'],
+    show: ['AMP.Admin', 'Geothermal.Admin'],
+    edit: ['AMP.Admin', 'Geothermal.Admin'],
+    create: ['AMP.Admin', 'Geothermal.Admin'],
+    delete: ['AMP.Admin', 'Geothermal.Admin'],
+    manage: ['AMP.Admin', 'Geothermal.Admin'],
   },
   'water.wellinventoryform': {
     list: editorRoles,