@jmruthers/pace-core 0.2.4

package/src/rbac/__tests__/cache-invalidation-comprehensive.test.ts

@@ -0,0 +1,889 @@
+/**
+ * Comprehensive Cache & Realtime Invalidation Tests
+ * 
+ * Tests that cached results match cold computations:
+ * - Cache hit/miss behavior
+ * - Realtime invalidation updates permissions
+ * - TTL expiration handling
+ * - Pattern-based invalidation
+ * - Cache statistics and performance
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { RBACCache } from '../cache';
+import { createRBACEngine, RBACEngine } from '../engine';
+import { Scope, Permission } from '../types';
+
+// Mock dependencies
+vi.mock('../audit');
+
+// Create a comprehensive mock for Supabase queries
+function createSupabaseMock() {
+  const mockQuery = {
+    select: vi.fn().mockReturnThis(),
+    eq: vi.fn().mockReturnThis(),
+    is: vi.fn().mockReturnThis(),
+    lte: vi.fn().mockReturnThis(),
+    gte: vi.fn().mockReturnThis(),
+    or: vi.fn().mockReturnThis(),
+    and: vi.fn().mockReturnThis(),
+    order: vi.fn().mockReturnThis(),
+    in: vi.fn().mockReturnThis(),
+    single: vi.fn().mockResolvedValue({ data: null, error: null }),
+    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+    insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+  };
+
+  return {
+    from: vi.fn().mockReturnValue(mockQuery),
+    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+  };
+}
+
+describe('Cache & Realtime Invalidation - Comprehensive', () => {
+  let engine: RBACEngine;
+  let mockSupabase: ReturnType<typeof createSupabaseMock>;
+  let cache: RBACCache;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockSupabase = createSupabaseMock();
+    engine = createRBACEngine(mockSupabase as any);
+    cache = new RBACCache();
+  });
+
+  describe('Cache Hit/Miss Behavior', () => {
+    it('should return cached result on cache hit', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+
+      // Test getAccessLevel which uses caching
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.getAccessLevel({
+        userId,
+        scope
+      });
+
+      expect(result1).toBe('viewer'); // Should return access level
+      expect(callCount).toBe(2); // Should check: organisation (super admin check is cached)
+
+      // Second call - should hit cache
+      callCount = 0;
+      const result2 = await engine.getAccessLevel({
+        userId,
+        scope
+      });
+
+      expect(result2).toBe('viewer'); // Should return cached result
+      expect(callCount).toBe(0); // Should not check database again
+    });
+
+    it('should miss cache and compute fresh result on cache miss', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Clear cache to ensure miss
+      cache.clear();
+
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+    });
+  });
+
+  describe('Realtime Invalidation', () => {
+    it('should invalidate cache when role is granted', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // First call - should miss cache and store result
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result1).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+
+      // Simulate role grant - invalidate cache
+      cache.invalidate(`permission:${userId}:*`);
+
+      // Second call - should miss cache due to invalidation
+      callCount = 0;
+      const result2 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result2).toBe(true); // Should still allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
+    });
+
+    it('should invalidate cache when role is revoked', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // First call - should miss cache and store result
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result1).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+
+      // Simulate role revocation - invalidate cache
+      cache.invalidate(`permission:${userId}:*`);
+
+      // Second call - should miss cache due to invalidation
+      callCount = 0;
+      const result2 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result2).toBe(true); // Should still allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
+    });
+
+    it('should invalidate cache when permissions change', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // First call - should miss cache and store result
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result1).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+
+      // Simulate permission change - invalidate cache
+      cache.invalidate(`permission:${userId}:*`);
+
+      // Second call - should miss cache due to invalidation
+      callCount = 0;
+      const result2 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result2).toBe(true); // Should still allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
+    });
+  });
+
+  describe('TTL Expiration', () => {
+    it('should expire cached entries after TTL', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Set a very short TTL for testing
+      const shortTTL = 100; // 100ms
+      // TTL is set per entry, not globally
+
+      // First call - should miss cache and store result
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result1).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+
+      // Wait for TTL to expire
+      await new Promise(resolve => setTimeout(resolve, shortTTL + 50));
+
+      // Second call - should miss cache due to expiration
+      callCount = 0;
+      const result2 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result2).toBe(true); // Should still allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
+    });
+
+    it('should handle zero TTL (no caching)', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Set zero TTL (no caching)
+      // TTL is set per entry, not globally
+
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result1 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result1).toBe(true); // Should allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
+
+      // Second call - should miss cache due to zero TTL
+      callCount = 0;
+      const result2 = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result2).toBe(true); // Should still allow
+      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
+    });
+  });
+
+  describe('Pattern-based Invalidation', () => {
+    it('should invalidate entries matching pattern', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Store some entries
+      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
+      cache.set(`permission:${userId}:${scope.organisationId}:other`, true);
+      cache.set(`permission:other:${scope.organisationId}:${permission}`, true);
+
+      // Invalidate pattern (using includes matching, not wildcards)
+      cache.invalidate(`permission:${userId}:`);
+
+      // Check that matching entries are invalidated
+      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBeNull();
+      expect(cache.get(`permission:${userId}:${scope.organisationId}:other`)).toBeNull();
+      expect(cache.get(`permission:other:${scope.organisationId}:${permission}`)).toBe(true); // Should still exist
+    });
+
+    it('should handle empty pattern gracefully', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Store some entries
+      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
+
+      // Invalidate with empty pattern (matches all keys)
+      cache.invalidate('');
+
+      // Check that entries are deleted (empty pattern matches all)
+      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBeNull();
+    });
+
+    it('should handle invalid pattern gracefully', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Store some entries
+      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
+
+      // Invalidate with invalid pattern
+      cache.invalidate('invalid[pattern');
+
+      // Check that entries still exist
+      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBe(true);
+    });
+  });
+
+  describe('Cache Statistics', () => {
+    it('should track cache hits and misses', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Store an entry
+      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
+
+      // Get the entry (hit)
+      const result1 = cache.get(`permission:${userId}:${scope.organisationId}:${permission}`);
+      expect(result1).toBe(true);
+
+      // Get non-existent entry (miss)
+      const result2 = cache.get(`permission:${userId}:${scope.organisationId}:other`);
+      expect(result2).toBeNull();
+
+      // Check statistics (cache doesn't track hits/misses)
+      const stats = cache.getStats();
+      expect(stats.size).toBe(1);
+      expect(stats.ttl).toBe(60000); // 60 seconds
+      expect(stats.keys).toContain(`permission:${userId}:${scope.organisationId}:${permission}`);
+    });
+
+    it('should reset statistics', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Store an entry
+      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
+
+      // Get the entry (hit)
+      cache.get(`permission:${userId}:${scope.organisationId}:${permission}`);
+
+      // Reset statistics
+      // No resetStats method - just clear cache
+      cache.clear();
+
+      // Check statistics (cache doesn't track hits/misses)
+      const stats = cache.getStats();
+      expect(stats.size).toBe(0); // Cache was cleared
+      expect(stats.ttl).toBe(60000); // 60 seconds
+      expect(stats.keys).toHaveLength(0);
+    });
+  });
+
+  describe('Performance', () => {
+    it('should handle large datasets efficiently', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+
+      // Store many entries
+      for (let i = 0; i < 1000; i++) {
+        cache.set(`permission:${userId}:${scope.organisationId}:permission${i}`, true);
+      }
+
+      // Check that we can retrieve entries efficiently
+      const start = Date.now();
+      for (let i = 0; i < 1000; i++) {
+        cache.get(`permission:${userId}:${scope.organisationId}:permission${i}`);
+      }
+      const end = Date.now();
+
+      // Should complete quickly (less than 100ms)
+      expect(end - start).toBeLessThan(100);
+    });
+
+    it('should handle frequent invalidations efficiently', () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+
+      // Store many entries
+      for (let i = 0; i < 1000; i++) {
+        cache.set(`permission:${userId}:${scope.organisationId}:permission${i}`, true);
+      }
+
+      // Invalidate frequently
+      const start = Date.now();
+      for (let i = 0; i < 100; i++) {
+        cache.invalidate(`permission:${userId}:*`);
+      }
+      const end = Date.now();
+
+      // Should complete quickly (less than 200ms)
+      expect(end - start).toBeLessThan(200);
+    });
+  });
+});