@jmruthers/pace-core 0.2.4

package/src/rbac/__tests__/edge-cases-comprehensive.test.ts

@@ -0,0 +1,988 @@
+/**
+ * Comprehensive Edge Cases Tests
+ * 
+ * Tests edge cases and error scenarios:
+ * - Expired or future-dated grants
+ * - Duplicate role assignments
+ * - Missing or invalid scope rejected gracefully
+ * - Malformed permissions
+ * - Database errors
+ * - Network timeouts
+ * - Invalid user context
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { createRBACEngine, RBACEngine } from '../engine';
+import { Scope, Permission } from '../types';
+
+// Mock dependencies
+vi.mock('../cache');
+vi.mock('../audit');
+
+// Create a comprehensive mock for Supabase queries
+function createSupabaseMock() {
+  const mockQuery = {
+    select: vi.fn().mockReturnThis(),
+    eq: vi.fn().mockReturnThis(),
+    is: vi.fn().mockReturnThis(),
+    lte: vi.fn().mockReturnThis(),
+    gte: vi.fn().mockReturnThis(),
+    or: vi.fn().mockReturnThis(),
+    and: vi.fn().mockReturnThis(),
+    order: vi.fn().mockReturnThis(),
+    in: vi.fn().mockReturnThis(),
+    single: vi.fn().mockResolvedValue({ data: null, error: null }),
+    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+    insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+  };
+
+  return {
+    from: vi.fn().mockReturnValue(mockQuery),
+    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+  };
+}
+
+describe('Edge Cases - Comprehensive', () => {
+  let engine: RBACEngine;
+  let mockSupabase: ReturnType<typeof createSupabaseMock>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockSupabase = createSupabaseMock();
+    engine = createRBACEngine(mockSupabase as any);
+  });
+
+  describe('Expired and Future-dated Grants', () => {
+    it('should handle expired grants gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [], // Empty because expired grants should be filtered out
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(false); // Should deny for expired grants
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+
+    it('should handle future-dated grants gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [], // Empty because future-dated grants should be filtered out
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(false); // Should deny for future-dated grants
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+
+    it('should handle grants with null valid_to gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [{ 
+                  role: 'member',
+                  status: 'active',
+                  valid_from: '2024-01-01T00:00:00Z',
+                  valid_to: null // No expiration
+                }],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(true); // Should allow for grants with no expiration
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+  });
+
+  describe('Duplicate Role Assignments', () => {
+    it('should handle duplicate role assignments gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [
+                  { 
+                    role: 'member',
+                    status: 'active',
+                    valid_from: '2024-01-01T00:00:00Z',
+                    valid_to: null
+                  },
+                  { 
+                    role: 'member', // Duplicate role
+                    status: 'active',
+                    valid_from: '2024-01-02T00:00:00Z',
+                    valid_to: null
+                  }
+                ],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(true); // Should allow despite duplicates
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+
+    it('should handle conflicting role assignments gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'manage:organisation.events';
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [
+                  { 
+                    role: 'member',
+                    status: 'active',
+                    valid_from: '2024-01-01T00:00:00Z',
+                    valid_to: null
+                  },
+                  { 
+                    role: 'org_admin',
+                    status: 'active',
+                    valid_from: '2024-01-02T00:00:00Z',
+                    valid_to: null
+                  }
+                ],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(true); // Should allow due to org_admin role
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+  });
+
+  describe('Missing or Invalid Scope', () => {
+    it('should handle missing organisation context gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {}; // Missing organisationId
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle missing user context gracefully', async () => {
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId: '', // Empty user ID
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle invalid user ID gracefully', async () => {
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId: null as any, // Invalid user ID
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle invalid organisation ID gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: '' // Empty organisation ID
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('Malformed Permissions', () => {
+    it('should handle empty permission gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = '' as any; // Empty permission
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle null permission gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = null as any; // Null permission
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle undefined permission gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = undefined as any; // Undefined permission
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle malformed permission format gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'invalid-permission-format' as any; // Malformed permission
+
+      // Mock all database calls with proper sequencing
+      let callCount = 0;
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { code: 'PGRST116' }
+              })
+            };
+          case 'rbac_page_permissions':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_event_app_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_organisation_roles':
+            callCount++;
+            return {
+              ...mockQuery,
+              or: vi.fn().mockResolvedValue({
+                data: [],
+                error: null
+              })
+            };
+          case 'rbac_audit_events':
+            callCount++;
+            return {
+              ...mockQuery,
+              insert: vi.fn().mockResolvedValue({ data: null, error: null })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(false); // Should deny for malformed permission
+      expect(callCount).toBe(2); // Should check all scopes
+    });
+  });
+
+  describe('Database Errors', () => {
+    it('should handle database connection errors gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock database to return connection error
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { message: 'Connection failed', code: 'CONNECTION_ERROR' }
+              })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle database timeout errors gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock database to return timeout error
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { message: 'Request timeout', code: 'TIMEOUT_ERROR' }
+              })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle database permission errors gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock database to return permission error
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            return {
+              ...mockQuery,
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { message: 'Insufficient privileges', code: 'PGRST301' }
+              })
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('Network Issues', () => {
+    it('should handle network timeout gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock database to simulate network timeout
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            return {
+              ...mockQuery,
+              single: vi.fn().mockRejectedValue(new Error('Network timeout'))
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle network unreachable gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Mock database to simulate network unreachable
+      mockSupabase.from.mockImplementation((tableName: string) => {
+        const mockQuery = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          gte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          and: vi.fn().mockReturnThis(),
+          order: vi.fn().mockReturnThis(),
+          in: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null }),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
+        };
+
+        switch (tableName) {
+          case 'rbac_global_roles':
+            return {
+              ...mockQuery,
+              single: vi.fn().mockRejectedValue(new Error('Network unreachable'))
+            };
+          default:
+            return mockQuery;
+        }
+      });
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('Invalid Data Types', () => {
+    it('should handle invalid user ID types gracefully', async () => {
+      const scope: Scope = {
+        organisationId: 'org-456'
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId: 123 as any, // Invalid type
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle invalid organisation ID types gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 123 as any // Invalid type
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+      expect(result).toBe(false);
+    });
+
+    it('should handle invalid event ID types gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456',
+        eventId: 123 as any // Invalid type
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Should not throw error, but should handle gracefully
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(false); // Should deny due to invalid context
+    });
+
+    it('should handle invalid app ID types gracefully', async () => {
+      const userId = 'user-123';
+      const scope: Scope = {
+        organisationId: 'org-456',
+        eventId: 'event-789',
+        appId: 123 as any // Invalid type
+      };
+      const permission: Permission = 'read:organisation.events';
+
+      // Should not throw error, but should handle gracefully
+      const result = await engine.isPermitted({
+        userId,
+        scope,
+        permission
+      });
+
+      expect(result).toBe(false); // Should deny due to invalid context
+    });
+  });
+});