@jmruthers/pace-core 0.2.4

package/src/utils/security.ts

@@ -0,0 +1,156 @@
+
+import type { SupabaseClient } from '@supabase/supabase-js';
+
+export interface SecurityEvent {
+  type: string;
+  timestamp: Date;
+  userId?: string;
+  details: Record<string, unknown>;
+}
+
+export function logSecurityEvent(event: SecurityEvent): void {
+  // In production, this should log to your security monitoring system
+  // For now, we'll log to console.warn for testing purposes
+  console.warn('[SECURITY EVENT]', {
+    ...event,
+    timestamp: event.timestamp.toISOString()
+  });
+}
+
+export function validateUserSession(userId: string, sessionToken?: string): Promise<boolean> {
+  // Mock implementation - replace with actual session validation
+  if (!userId || typeof userId !== 'string') {
+    logSecurityEvent({
+      type: 'invalid_session_validation',
+      timestamp: new Date(),
+      details: { reason: 'Invalid userId provided' }
+    });
+    return Promise.resolve(false);
+  }
+  
+  if (sessionToken && sessionToken.length < 10) {
+    logSecurityEvent({
+      type: 'suspicious_session_token',
+      timestamp: new Date(),
+      userId,
+      details: { reason: 'Session token too short' }
+    });
+    return Promise.resolve(false);
+  }
+  
+  return Promise.resolve(true);
+}
+
+export function createSecureSession(
+  _supabaseClient: SupabaseClient,
+  sessionData: { userId: string; deviceFingerprint?: string }
+): Promise<string> {
+  // Mock implementation - in production, create actual secure session
+  const sessionId = `sess_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+  
+  logSecurityEvent({
+    type: 'session_created',
+    timestamp: new Date(),
+    userId: sessionData.userId,
+    details: { 
+      sessionId,
+      hasDeviceFingerprint: !!sessionData.deviceFingerprint
+    }
+  });
+  
+  return Promise.resolve(sessionId);
+}
+
+export function invalidateSession(
+  _supabaseClient: SupabaseClient,
+  sessionId: string
+): Promise<void> {
+  // Mock implementation - in production, invalidate actual session
+  logSecurityEvent({
+    type: 'session_invalidated',
+    timestamp: new Date(),
+    details: { sessionId }
+  });
+  
+  return Promise.resolve();
+}
+
+export function getSecurityHeaders(): Record<string, string> {
+  return {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'X-XSS-Protection': '1; mode=block',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
+  };
+}
+
+export function validateSecurityHeaders(headers: Record<string, string>): boolean {
+  const requiredHeaders = ['X-Content-Type-Options', 'X-Frame-Options'];
+  const missingHeaders = requiredHeaders.filter(header => !headers[header]);
+  
+  if (missingHeaders.length > 0) {
+    logSecurityEvent({
+      type: 'missing_security_headers',
+      timestamp: new Date(),
+      details: { missingHeaders }
+    });
+    return false;
+  }
+  
+  return true;
+}
+
+export function generateDeviceFingerprint(): string {
+  // Basic device fingerprinting - in production, use more sophisticated methods
+  const canvas = document.createElement('canvas');
+  const ctx = canvas.getContext('2d');
+  if (ctx) {
+    ctx.textBaseline = 'top';
+    ctx.font = '14px Arial';
+    ctx.fillText('Device fingerprint', 2, 2);
+  }
+  
+  const fingerprint = [
+    navigator.userAgent,
+    navigator.language,
+    screen.width + 'x' + screen.height,
+    new Date().getTimezoneOffset(),
+    canvas.toDataURL()
+  ].join('|');
+  
+  // Simple hash function for demonstration
+  let hash = 0;
+  for (let i = 0; i < fingerprint.length; i++) {
+    const char = fingerprint.charCodeAt(i);
+    hash = ((hash << 5) - hash) + char;
+    hash = hash & hash; // Convert to 32-bit integer
+  }
+  
+  return Math.abs(hash).toString(16);
+}
+
+export function validateDeviceFingerprint(fingerprint: string, expectedFingerprint?: string): boolean {
+  if (!fingerprint || typeof fingerprint !== 'string') {
+    logSecurityEvent({
+      type: 'invalid_device_fingerprint',
+      timestamp: new Date(),
+      details: { reason: 'Invalid fingerprint format' }
+    });
+    return false;
+  }
+  
+  if (expectedFingerprint && fingerprint !== expectedFingerprint) {
+    logSecurityEvent({
+      type: 'device_fingerprint_mismatch',
+      timestamp: new Date(),
+      details: { 
+        provided: fingerprint,
+        expected: expectedFingerprint
+      }
+    });
+    return false;
+  }
+  
+  return true;
+}

package/src/utils/securityMonitor.ts

@@ -0,0 +1,45 @@
+
+interface SecurityEvent {
+  id?: string;
+  action: string;
+  details: Record<string, any>;
+  timestamp?: number;
+}
+
+interface SecurityAlert {
+  id: string;
+  type: string;
+  message: string;
+  timestamp: Date;
+}
+
+class SecurityMonitor {
+  private events: SecurityEvent[] = [];
+
+  logEvent(event: SecurityEvent) {
+    const eventWithId = {
+      ...event,
+      id: Math.random().toString(36).substr(2, 9),
+      timestamp: Date.now()
+    };
+    this.events.push(eventWithId);
+  }
+
+  getEvents(): SecurityEvent[] {
+    return [...this.events];
+  }
+
+  clearEvents() {
+    this.events = [];
+  }
+
+  createAlert(alert: Omit<SecurityAlert, 'id' | 'timestamp'>): SecurityAlert {
+    return {
+      ...alert,
+      id: Math.random().toString(36).substr(2, 9),
+      timestamp: new Date()
+    };
+  }
+}
+
+export const securityMonitor = new SecurityMonitor();

package/src/utils/sessionTracking.ts

@@ -0,0 +1,170 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+
+// Define the tracking parameters locally since old RBAC types are removed
+interface TrackUserSessionParams {
+  p_session_type: 'login' | 'logout' | 'event_switch' | 'session_expired';
+  p_event_id?: string;
+  p_app_id?: string;
+}
+
+/**
+ * Hook for tracking user sessions and event interactions using the new RBAC system
+ * @param supabaseClient - Supabase client instance
+ * @param appName - Optional application name for tracking
+ * @returns Object containing tracking functions
+ */
+export function useSessionTracking(supabaseClient: SupabaseClient, appName?: string) {
+  // Resolve app name to app_id
+  const resolveAppId = async (): Promise<string | undefined> => {
+    if (!appName) return undefined;
+    
+    try {
+      const { data, error } = await supabaseClient
+        .from('rbac_apps')
+        .select('id')
+        .eq('name', appName)
+        .eq('is_active', true)
+        .single();
+      
+      if (error || !data) {
+        console.warn('App not found or inactive:', appName);
+        return undefined;
+      }
+      
+      return data.id;
+    } catch (error) {
+      console.error('Failed to resolve app ID:', error);
+      return undefined;
+    }
+  };
+  /**
+   * Track a user login event
+   * @param eventId - Optional event ID to associate with the login
+   */
+  const trackLogin = async (eventId?: string) => {
+    try {
+      const { data: { user } } = await supabaseClient.auth.getUser();
+      if (!user) {
+        console.warn('No authenticated user found for session tracking');
+        return;
+      }
+
+      const appId = await resolveAppId();
+
+      const params: TrackUserSessionParams = {
+        p_session_type: 'login',
+        p_event_id: eventId,
+        p_app_id: appId
+      };
+
+      const { error } = await supabaseClient.rpc('track_user_session', params);
+      
+      if (error) {
+        console.error('Failed to track login session:', error);
+      } else {
+        console.log('Login session tracked successfully');
+      }
+    } catch (error) {
+      console.error('Failed to track login:', error);
+    }
+  };
+
+  /**
+   * Track an event switch
+   * @param eventId - ID of the event being switched to
+   */
+  const trackEventSwitch = async (eventId: string) => {
+    try {
+      const { data: { user } } = await supabaseClient.auth.getUser();
+      if (!user) {
+        console.warn('No authenticated user found for session tracking');
+        return;
+      }
+
+      const appId = await resolveAppId();
+
+      const params: TrackUserSessionParams = {
+        p_session_type: 'event_switch',
+        p_event_id: eventId,
+        p_app_id: appId
+      };
+
+      const { error } = await supabaseClient.rpc('track_user_session', params);
+      
+      if (error) {
+        console.error('Failed to track event switch session:', error);
+      } else {
+        console.log('Event switch session tracked successfully');
+      }
+    } catch (error) {
+      console.error('Failed to track event switch:', error);
+    }
+  };
+
+  /**
+   * Track a user logout event
+   */
+  const trackLogout = async () => {
+    try {
+      const { data: { user } } = await supabaseClient.auth.getUser();
+      if (!user) {
+        console.warn('No authenticated user found for session tracking');
+        return;
+      }
+
+      const appId = await resolveAppId();
+
+      const params: TrackUserSessionParams = {
+        p_session_type: 'logout',
+        p_app_id: appId
+      };
+
+      const { error } = await supabaseClient.rpc('track_user_session', params);
+      
+      if (error) {
+        console.error('Failed to track logout session:', error);
+      } else {
+        console.log('Logout session tracked successfully');
+      }
+    } catch (error) {
+      console.error('Failed to track logout:', error);
+    }
+  };
+
+  /**
+   * Track a session expiration
+   */
+  const trackSessionExpired = async () => {
+    try {
+      const { data: { user } } = await supabaseClient.auth.getUser();
+      if (!user) {
+        console.warn('No authenticated user found for session tracking');
+        return;
+      }
+
+      const appId = await resolveAppId();
+
+      const params: TrackUserSessionParams = {
+        p_session_type: 'session_expired',
+        p_app_id: appId
+      };
+
+      const { error } = await supabaseClient.rpc('track_user_session', params);
+      
+      if (error) {
+        console.error('Failed to track session expiration:', error);
+      } else {
+        console.log('Session expiration tracked successfully');
+      }
+    } catch (error) {
+      console.error('Failed to track session expiration:', error);
+    }
+  };
+
+  return {
+    trackLogin,
+    trackEventSwitch,
+    trackLogout,
+    trackSessionExpired
+  };
+} 

package/src/utils/storage/README.md

@@ -0,0 +1,348 @@
+# Storage System
+
+A simple, secure file storage system with organization-scoped access control.
+
+## Quick Start
+
+```typescript
+import { useStorage, FileUpload } from '@jmruthers/pace-core';
+
+// Basic usage
+const { uploadFile, files, isUploading } = useStorage({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+
+// File upload component
+<FileUpload
+  supabase={supabase}
+  appName="TRAC"
+  orgId="your-org-id"
+  onUploadComplete={(result) => console.log(result)}
+/>
+```
+
+## API Reference
+
+### Hooks
+
+#### `useStorage(options)`
+
+Main hook for storage operations.
+
+**Parameters:**
+- `supabase: SupabaseClient` - Supabase client instance
+- `appName: string` - Application name (TRAC, CAKE, PACE, etc.)
+- `orgId: string` - Organization ID
+- `debug?: boolean` - Enable debug logging (optional)
+
+**Returns:**
+```typescript
+{
+  // Upload
+  uploadFile: (file: File, options?: StorageUploadOptions) => Promise<StorageUploadResult>;
+  isUploading: boolean;
+  uploadError: string | null;
+  
+  // URLs
+  getPublicUrl: (path: string) => string;
+  getSignedUrl: (path: string, expiresIn?: number) => Promise<string | null>;
+  
+  // File management
+  deleteFile: (path: string) => Promise<{ success: boolean; error?: string }>;
+  archiveFile: (path: string) => Promise<{ success: boolean; error?: string }>;
+  listFiles: (options?: StorageListOptions) => Promise<StorageListResult>;
+  
+  // State
+  files: StorageFileInfo[];
+  refreshFiles: () => Promise<void>;
+  isLoading: boolean;
+  error: string | null;
+}
+```
+
+#### `useFileUpload(options)`
+
+Simplified hook for uploads with progress tracking.
+
+```typescript
+const { uploadWithProgress, uploadProgress, isUploading, uploadError } = useFileUpload({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+```
+
+### Components
+
+#### `FileUpload`
+
+React component for file uploads with drag-and-drop.
+
+```typescript
+<FileUpload
+  supabase={supabase}
+  appName="TRAC"
+  orgId="your-org-id"
+  accept="image/*,.pdf"
+  maxSize={10 * 1024 * 1024} // 10MB
+  multiple={true}
+  onUploadComplete={(result) => {
+    if (result.success) {
+      console.log('File uploaded:', result.path);
+    }
+  }}
+/>
+```
+
+### Utility Functions
+
+```typescript
+import { uploadFile, getPublicUrl, getSignedUrl, deleteFile, archiveFile } from '@jmruthers/pace-core';
+
+// Upload file
+const result = await uploadFile(supabase, file, {
+  appName: 'TRAC',
+  orgId: 'your-org-id',
+  metadata: { uploadedBy: userId }
+});
+
+// Get URLs (using hooks)
+const { getPublicUrl, getSignedUrl } = useStorage({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+
+const publicUrl = getPublicUrl('org-id/category/filename.pdf');
+const signedUrl = await getSignedUrl('org-id/category/private.pdf', 3600);
+
+// File management
+const deleteResult = await deleteFile(supabase, 'org-id/category/filename.pdf');
+const archiveResult = await archiveFile(supabase, 'org-id/category/filename.pdf', {
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+```
+
+## File Structure
+
+Files are organized by organization and category in the `files` bucket:
+
+```
+files/
+├── {org_id}/
+│   ├── trac_accommodation/     # TRAC accommodation files
+│   ├── trac_activity/          # TRAC activity files
+│   ├── trac_transport/         # TRAC transport files
+│   ├── trac_journal/           # TRAC journal images
+│   ├── event_logos/            # PACE event logos (public)
+│   └── documents/              # Generic documents
+```
+
+**Note:** The actual file paths in storage are `{org_id}/category/filename` (without the `files/` prefix).
+
+### Current File Distribution
+
+Based on the implemented system, files are distributed as follows:
+- **documents**: 73 files (generic documents)
+- **event_logos**: 27 files (PACE event logos, public)
+- **trac_journal**: 24 files (TRAC journal images)
+- **trac_transport**: 16 files (TRAC transport files)
+- **trac_activity**: 11 files (TRAC activity files)
+- **trac_accommodation**: 7 files (TRAC accommodation files)
+
+## Security
+
+- **Organization Segregation**: Users can only access files from their organization
+- **RLS Policies**: Database-level security enforcement with `org_scoped_file_access` policy
+- **Path-based Access Control**: Organization ID in path enables easy access control
+- **App Access Control**: Users must have access to the specific application
+- **File References Table**: Centralized metadata tracking in `file_references` table
+
+### RLS Policy Details
+
+The system uses the following RLS policies on `storage.objects`:
+- `org_scoped_file_access`: Read access for users with organization membership
+- `app_org_scoped_file_upload`: Upload access with path validation
+- `app_org_scoped_file_update`: Update access for owned files
+- `app_org_scoped_file_delete`: Delete access for owned files
+
+### Database Structure
+
+The system uses a centralized `file_references` table for metadata:
+
+```sql
+CREATE TABLE file_references (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  app_name TEXT NOT NULL,
+  table_name TEXT NOT NULL,
+  record_id UUID NOT NULL,
+  file_path TEXT NOT NULL,
+  file_metadata JSONB,
+  organisation_id UUID NOT NULL,
+  is_public BOOLEAN DEFAULT false,
+  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+```
+
+This replaces individual file reference columns in various tables, providing centralized file management.
+
+## File Size Limits
+
+| Type | Limit |
+|------|-------|
+| Images (JPEG, PNG, WebP) | 5MB |
+| GIF | 10MB |
+| SVG | 1MB |
+| PDF | 50MB |
+| Office Documents | 25MB |
+| Archives (ZIP, RAR) | 100MB |
+| Default | 10MB |
+
+## Best Practices
+
+### 1. Use Descriptive Paths
+```typescript
+// Good: Descriptive, organized paths
+const path = `org-id/documents/2024/reports/quarterly-report.pdf`;
+
+// Avoid: Generic, flat structure
+const path = `org-id/files/file.pdf`;
+```
+
+### 2. Validate File Types
+```typescript
+const allowedTypes = ['image/jpeg', 'image/png', 'application/pdf'];
+if (!allowedTypes.includes(file.type)) {
+  throw new Error('File type not allowed');
+}
+```
+
+### 3. Handle Errors Gracefully
+```typescript
+const handleUpload = async (file: File) => {
+  try {
+    const result = await uploadFile(file);
+    if (result.success) {
+      showSuccess('File uploaded successfully');
+    } else {
+      showError(result.error);
+    }
+  } catch (error) {
+    showError('Upload failed. Please try again.');
+  }
+};
+```
+
+### 4. Use Signed URLs for Private Files
+```typescript
+// For private files, always use signed URLs
+const { getSignedUrl } = useStorage({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+
+const signedUrl = await getSignedUrl(filePath, 3600); // 1 hour expiry
+```
+
+## Migration from Legacy Storage
+
+**Code Migration:**
+```typescript
+// Before (Legacy)
+const { data, error } = await supabase.storage
+  .from('trac_attachments')
+  .upload('file.pdf', file);
+
+// After (New System)
+const { uploadFile } = useStorage({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+const result = await uploadFile(file);
+```
+
+**Note:** Migration scripts have been completed. All files have been moved to the new organization-first structure.
+
+## Troubleshooting
+
+### Common Issues
+
+1. **"supabase is undefined"** - Ensure Supabase client is passed as prop
+2. **Upload permission denied** - Check user has organization access
+3. **File not found** - Verify file path and user permissions
+4. **RLS policy errors** - Check organization membership and app access
+
+### Debug Mode
+
+```typescript
+const { uploadFile } = useStorage({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id',
+  debug: true // Enable debug logging
+});
+```
+
+## Examples
+
+### File Upload with Progress
+```typescript
+const { uploadWithProgress, uploadProgress, isUploading } = useFileUpload({
+  supabase,
+  appName: 'TRAC',
+  orgId: 'your-org-id'
+});
+
+const handleUpload = async (file: File) => {
+  const result = await uploadWithProgress(file);
+  
+  if (result.success) {
+    console.log('Uploaded:', result.path);
+    // uploadProgress is automatically tracked
+  }
+};
+```
+
+### File List with Pagination
+```typescript
+const [files, setFiles] = useState([]);
+const [page, setPage] = useState(0);
+
+const loadFiles = async (pageNum = 0) => {
+  const result = await listFiles({
+    appName: 'TRAC',
+    orgId: 'your-org-id',
+    limit: 50,
+    offset: pageNum * 50
+  });
+  
+  setFiles(prev => pageNum === 0 ? result.files : [...prev, ...result.files]);
+};
+```
+
+### Error Handling
+```typescript
+const handleUpload = async (file: File) => {
+  try {
+    const result = await uploadFile(file);
+    
+    if (result.success) {
+      showSuccess('File uploaded successfully');
+    } else {
+      showError(result.error);
+    }
+  } catch (error) {
+    showError('Upload failed. Please try again.');
+  }
+};
+```
+
+---
+
+This storage system provides a simple, secure way to manage files with organization-scoped access control. For more complex use cases, refer to the Supabase Storage documentation.