@jmruthers/pace-core 0.2.7 → 0.4.1

package/dist/chunk-XI7QFSSC.js

@@ -0,0 +1,790 @@
+import {
+  createAuditManager,
+  emitAuditEvent,
+  setGlobalAuditManager
+} from "./chunk-YNU5QJ4S.js";
+
+// src/rbac/types.ts
+var RBACError = class extends Error {
+  constructor(message, code, context) {
+    super(message);
+    this.code = code;
+    this.context = context;
+    this.name = "RBACError";
+  }
+};
+var OrganisationContextRequiredError = class extends RBACError {
+  constructor() {
+    super(
+      "Organisation context is required for this operation",
+      "ORGANISATION_CONTEXT_REQUIRED"
+    );
+    this.name = "OrganisationContextRequiredError";
+  }
+};
+var RBACNotInitializedError = class extends RBACError {
+  constructor() {
+    super(
+      "RBAC system not initialized. Please call setupRBAC(supabase) before using any RBAC components or hooks. See: https://docs.pace-core.dev/rbac/setup",
+      "RBAC_NOT_INITIALIZED"
+    );
+    this.name = "RBACNotInitializedError";
+  }
+};
+
+// src/rbac/cache.ts
+var RBACCache = class {
+  constructor() {
+    this.cache = /* @__PURE__ */ new Map();
+    this.TTL = 60 * 1e3;
+    // 60 seconds
+    this.invalidationCallbacks = /* @__PURE__ */ new Set();
+  }
+  /**
+   * Get a value from the cache
+   * 
+   * @param key - Cache key
+   * @returns Cached value or null if not found/expired
+   */
+  get(key) {
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return null;
+    }
+    if (Date.now() > entry.expires) {
+      this.cache.delete(key);
+      return null;
+    }
+    return entry.data;
+  }
+  /**
+   * Set a value in the cache
+   * 
+   * @param key - Cache key
+   * @param data - Data to cache
+   * @param ttl - Time to live in milliseconds (defaults to 60s)
+   */
+  set(key, data, ttl = this.TTL) {
+    const expires = ttl <= 0 ? Date.now() - 1 : Date.now() + ttl;
+    this.cache.set(key, {
+      data,
+      expires
+    });
+  }
+  /**
+   * Delete a specific key from the cache
+   * 
+   * @param key - Cache key to delete
+   */
+  delete(key) {
+    this.cache.delete(key);
+  }
+  /**
+   * Invalidate cache entries matching a pattern
+   * 
+   * @param pattern - Pattern to match against cache keys
+   */
+  invalidate(pattern) {
+    const keysToDelete = [];
+    for (const key of this.cache.keys()) {
+      if (key.includes(pattern)) {
+        keysToDelete.push(key);
+      }
+    }
+    keysToDelete.forEach((key) => this.cache.delete(key));
+    this.invalidationCallbacks.forEach((callback) => callback(pattern));
+  }
+  /**
+   * Clear all cache entries
+   */
+  clear() {
+    this.cache.clear();
+  }
+  /**
+   * Get cache statistics
+   */
+  getStats() {
+    return {
+      size: this.cache.size,
+      ttl: this.TTL,
+      keys: Array.from(this.cache.keys())
+    };
+  }
+  /**
+   * Add an invalidation callback
+   * 
+   * @param callback - Function to call when cache is invalidated
+   */
+  onInvalidate(callback) {
+    this.invalidationCallbacks.add(callback);
+    return () => {
+      this.invalidationCallbacks.delete(callback);
+    };
+  }
+  /**
+   * Generate cache key for permission check
+   * 
+   * @param key - Permission cache key object
+   * @returns String cache key
+   */
+  static generatePermissionKey(key) {
+    const parts = [
+      "perm",
+      key.userId,
+      key.organisationId || "null",
+      key.eventId || "null",
+      key.appId || "null"
+    ];
+    return parts.join(":");
+  }
+  /**
+   * Generate cache key for access level
+   * 
+   * @param userId - User ID
+   * @param organisationId - Organisation ID
+   * @param eventId - Event ID (optional)
+   * @param appId - App ID (optional)
+   * @returns String cache key
+   */
+  static generateAccessLevelKey(userId, organisationId, eventId, appId) {
+    const parts = [
+      "access",
+      userId,
+      organisationId,
+      eventId || "null",
+      appId || "null"
+    ];
+    return parts.join(":");
+  }
+  /**
+   * Generate cache key for permission map
+   * 
+   * @param userId - User ID
+   * @param organisationId - Organisation ID
+   * @param eventId - Event ID (optional)
+   * @param appId - App ID (optional)
+   * @returns String cache key
+   */
+  static generatePermissionMapKey(userId, organisationId, eventId, appId) {
+    const parts = [
+      "map",
+      userId,
+      organisationId,
+      eventId || "null",
+      appId || "null"
+    ];
+    return parts.join(":");
+  }
+};
+var rbacCache = new RBACCache();
+var CACHE_PATTERNS = {
+  USER: (userId) => `user:${userId}`,
+  ORGANISATION: (organisationId) => `org:${organisationId}`,
+  EVENT: (eventId) => `event:${eventId}`,
+  APP: (appId) => `app:${appId}`,
+  PERMISSION: (userId, organisationId) => `perm:${userId}:${organisationId}`
+};
+
+// src/rbac/engine.ts
+var RBACEngine = class {
+  constructor(supabase) {
+    this.supabase = supabase;
+  }
+  /**
+   * Check if a user has a specific permission
+   * 
+   * @param input - Permission check input
+   * @returns Promise resolving to permission result
+   */
+  async isPermitted(input) {
+    const startTime = Date.now();
+    const { userId, permission, scope, pageId } = input;
+    try {
+      const isSuperAdmin2 = await this.checkSuperAdmin(userId);
+      if (isSuperAdmin2) {
+        const duration = Date.now() - startTime;
+        await emitAuditEvent({
+          type: "permission_check",
+          userId,
+          organisationId: scope.organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId,
+          pageId,
+          permission,
+          decision: true,
+          source: "api",
+          bypass: true,
+          duration_ms: duration
+        });
+        return true;
+      }
+      const grants = await this.collectActiveGrants(userId, scope, pageId);
+      const denies = grants.filter((g) => g.type === "deny");
+      for (const deny of denies) {
+        if (this.permissionMatches(deny.permission, permission)) {
+          const duration = Date.now() - startTime;
+          await emitAuditEvent({
+            type: "permission_denied",
+            userId,
+            organisationId: scope.organisationId,
+            eventId: scope.eventId,
+            appId: scope.appId,
+            pageId,
+            permission,
+            source: "api"
+          });
+          return false;
+        }
+      }
+      const allows = grants.filter((g) => g.type === "allow");
+      let hasPermission2 = false;
+      const scopeOrder = ["page", "eventApp", "organisation", "global"];
+      for (const scopeType of scopeOrder) {
+        const scopeAllows = allows.filter((g) => g.scope === scopeType);
+        for (const allow of scopeAllows) {
+          const matches = this.permissionMatches(allow.permission, permission);
+          if (matches) {
+            hasPermission2 = true;
+            break;
+          }
+        }
+        if (hasPermission2) break;
+      }
+      const finalDecision = hasPermission2;
+      const _duration = Date.now() - startTime;
+      await emitAuditEvent({
+        type: "permission_check",
+        userId,
+        organisationId: scope.organisationId,
+        eventId: scope.eventId,
+        appId: scope.appId,
+        pageId,
+        permission,
+        decision: finalDecision,
+        source: "api",
+        duration_ms: _duration
+      });
+      return finalDecision;
+    } catch (_error) {
+      return false;
+    }
+  }
+  /**
+   * Get user's access level in a scope
+   * 
+   * @param input - Access level input
+   * @returns Promise resolving to access level
+   */
+  async getAccessLevel(input) {
+    const { userId, scope } = input;
+    const cacheKey = RBACCache.generateAccessLevelKey(
+      userId,
+      scope.organisationId,
+      scope.eventId,
+      scope.appId
+    );
+    const cached = rbacCache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
+    const isSuperAdmin2 = await this.checkSuperAdmin(userId);
+    if (isSuperAdmin2) {
+      rbacCache.set(cacheKey, "super");
+      return "super";
+    }
+    const orgRole = await this.getOrganisationRole(userId, scope.organisationId);
+    if (orgRole === "org_admin") {
+      rbacCache.set(cacheKey, "admin");
+      return "admin";
+    }
+    if (scope.eventId && scope.appId) {
+      const eventRole = await this.getEventAppRole(userId, scope.eventId, scope.appId);
+      if (eventRole === "event_admin") {
+        rbacCache.set(cacheKey, "admin");
+        return "admin";
+      }
+      if (eventRole === "planner") {
+        rbacCache.set(cacheKey, "planner");
+        return "planner";
+      }
+      if (eventRole === "participant") {
+        rbacCache.set(cacheKey, "participant");
+        return "participant";
+      }
+    }
+    rbacCache.set(cacheKey, "viewer");
+    return "viewer";
+  }
+  /**
+   * Get user's permission map for a scope
+   * 
+   * @param input - Permission map input
+   * @returns Promise resolving to permission map
+   */
+  async getPermissionMap(input) {
+    const { userId, scope } = input;
+    const cacheKey = RBACCache.generatePermissionMapKey(
+      userId,
+      scope.organisationId,
+      scope.eventId,
+      scope.appId
+    );
+    const cached = rbacCache.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
+    const permissionMap = {};
+    if (scope.appId) {
+      const { data: pages } = await this.supabase.from("rbac_app_pages").select("id, page_name").eq("app_id", scope.appId);
+      if (pages) {
+        for (const page of pages) {
+          const operations = [];
+          for (const operation of ["read", "create", "update", "delete", "manage"]) {
+            const hasPermission2 = await this.isPermitted({
+              userId,
+              scope,
+              permission: `${operation}:${page.page_name}`,
+              pageId: page.id
+            });
+            if (hasPermission2) {
+              operations.push(operation);
+            }
+          }
+          permissionMap[page.id] = operations;
+        }
+      }
+    }
+    rbacCache.set(cacheKey, permissionMap);
+    return permissionMap;
+  }
+  /**
+   * Check if user is super admin
+   * 
+   * @param userId - User ID
+   * @returns Promise resolving to super admin status
+   */
+  async checkSuperAdmin(userId) {
+    const { data, error } = await this.supabase.from("rbac_global_roles").select("id").eq("user_id", userId).eq("role", "super_admin").is("valid_to", null).single();
+    return !error && !!data;
+  }
+  /**
+   * Collect active grants for a user in a scope
+   * 
+   * @param userId - User ID
+   * @param scope - Permission scope
+   * @param pageId - Optional page ID
+   * @returns Promise resolving to grants array
+   * 
+   * PRECEDENCE ORDER (closest scope first): page → eventApp → organisation → global
+   */
+  async collectActiveGrants(userId, scope, pageId) {
+    const grants = [];
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (pageId) {
+      const { data: pagePermissions } = await this.supabase.from("rbac_page_permissions").select("operation, role_name, allowed").eq("app_page_id", pageId);
+      if (pagePermissions) {
+        for (const perm of pagePermissions) {
+          grants.push({
+            type: perm.allowed ? "allow" : "deny",
+            permission: `${perm.operation}:*`,
+            scope: "page",
+            source: "rbac_page_permissions"
+          });
+        }
+      }
+    }
+    if (scope.eventId && scope.appId) {
+      const { data: eventRoles } = await this.supabase.from("rbac_event_app_roles").select("role, status, valid_from, valid_to").eq("user_id", userId).eq("event_id", scope.eventId).eq("app_id", scope.appId).eq("status", "active").lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`);
+      if (eventRoles) {
+        for (const role of eventRoles) {
+          grants.push({
+            type: "allow",
+            permission: this.getPermissionForEventRole(role.role),
+            scope: "eventApp",
+            source: "rbac_event_app_roles"
+          });
+        }
+      }
+    }
+    if (scope.organisationId) {
+      const { data: orgRoles } = await this.supabase.from("rbac_organisation_roles").select("role, status, valid_from, valid_to").eq("user_id", userId).eq("organisation_id", scope.organisationId).eq("status", "active").lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`);
+      if (orgRoles) {
+        for (const role of orgRoles) {
+          grants.push({
+            type: "allow",
+            permission: this.getPermissionForOrgRole(role.role),
+            scope: "organisation",
+            source: "rbac_organisation_roles"
+          });
+        }
+      }
+    }
+    const { data: globalRoles } = await this.supabase.from("rbac_global_roles").select("role, valid_from, valid_to").eq("user_id", userId).lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`);
+    if (globalRoles) {
+      for (const role of globalRoles) {
+        if (role.role === "super_admin") {
+          grants.push({
+            type: "allow",
+            permission: "manage:*",
+            scope: "global",
+            source: "rbac_global_roles"
+          });
+        }
+      }
+    }
+    return grants;
+  }
+  /**
+   * Check page-specific permissions
+   * 
+   * @param userId - User ID
+   * @param pageId - Page ID
+   * @param permission - Permission to check
+   * @param scope - Permission scope
+   * @returns Promise resolving to page permission result
+   */
+  async checkPagePermissions(userId, pageId, permission, scope) {
+    if (!pageId) {
+      return true;
+    }
+    const [operation] = permission.split(":");
+    const userRoles = [];
+    if (scope.organisationId) {
+      const orgRole = await this.getOrganisationRole(userId, scope.organisationId);
+      if (orgRole) {
+        userRoles.push(orgRole);
+      }
+    }
+    if (scope.eventId && scope.appId) {
+      const eventRole = await this.getEventAppRole(userId, scope.eventId, scope.appId);
+      if (eventRole) {
+        userRoles.push(eventRole);
+      }
+    }
+    const { data: pagePermissions } = await this.supabase.from("rbac_page_permissions").select("allowed").eq("app_page_id", pageId).eq("operation", operation).in("role_name", userRoles).single();
+    return pagePermissions?.allowed ?? false;
+  }
+  /**
+   * Get organisation role for a user
+   * 
+   * @param userId - User ID
+   * @param organisationId - Organisation ID
+   * @returns Promise resolving to organisation role
+   */
+  async getOrganisationRole(userId, organisationId) {
+    const { data, error } = await this.supabase.from("rbac_organisation_roles").select("role").eq("user_id", userId).eq("organisation_id", organisationId).eq("status", "active").single();
+    return error ? null : data?.role || null;
+  }
+  /**
+   * Get event-app role for a user
+   * 
+   * @param userId - User ID
+   * @param eventId - Event ID
+   * @param appId - App ID
+   * @returns Promise resolving to event-app role
+   */
+  async getEventAppRole(userId, eventId, appId) {
+    const { data, error } = await this.supabase.from("rbac_event_app_roles").select("role, status, valid_from, valid_to").eq("user_id", userId).eq("event_id", eventId).eq("app_id", appId).eq("status", "active").lte("valid_from", (/* @__PURE__ */ new Date()).toISOString()).or(`valid_to.is.null,valid_to.gte.${(/* @__PURE__ */ new Date()).toISOString()}`).single();
+    return error ? null : data?.role || null;
+  }
+  /**
+   * Get permission for organisation role
+   * 
+   * @param role - Organisation role
+   * @returns Permission string
+   */
+  getPermissionForOrgRole(role) {
+    switch (role) {
+      case "org_admin":
+        return "manage:*";
+      case "leader":
+        return "manage:organisation.*";
+      case "member":
+        return "read:organisation.*";
+      case "supporter":
+        return "read:organisation.public";
+      default:
+        return "read:organisation.public";
+    }
+  }
+  /**
+   * Get permission for event-app role
+   * 
+   * @param role - Event-app role
+   * @returns Permission string
+   */
+  getPermissionForEventRole(role) {
+    switch (role) {
+      case "event_admin":
+        return "manage:event.*";
+      case "planner":
+        return "manage:event.planning";
+      case "participant":
+        return "read:event.*";
+      case "viewer":
+        return "read:event.public";
+      default:
+        return "read:event.public";
+    }
+  }
+  /**
+   * Check if a permission matches another permission
+   * 
+   * @param grantPermission - Permission from grant
+   * @param requestedPermission - Requested permission
+   * @returns True if permissions match
+   */
+  permissionMatches(grantPermission, requestedPermission) {
+    if (grantPermission === requestedPermission) {
+      return true;
+    }
+    if (grantPermission.endsWith(":*") || grantPermission.endsWith(".*")) {
+      const [grantOp, grantResource] = grantPermission.split(":");
+      const [requestedOp, requestedResource] = requestedPermission.split(":");
+      if (grantOp === requestedOp) {
+        const prefix = grantResource.slice(0, -1);
+        return prefix === "" || requestedResource.startsWith(prefix);
+      }
+    }
+    if (grantPermission.includes("*")) {
+      const [grantOp, grantResource] = grantPermission.split(":");
+      const [requestedOp, requestedResource] = requestedPermission.split(":");
+      if (grantOp === requestedOp) {
+        const prefix = grantResource.replace("*", "");
+        return requestedResource.startsWith(prefix);
+      }
+    }
+    return false;
+  }
+};
+function createRBACEngine(supabase) {
+  return new RBACEngine(supabase);
+}
+
+// src/rbac/config.ts
+var RBACConfigManager = class {
+  constructor() {
+    this.config = null;
+    this.logger = null;
+  }
+  setConfig(config) {
+    this.config = config;
+    this.setupLogger();
+  }
+  getConfig() {
+    return this.config;
+  }
+  getLogger() {
+    if (!this.logger) {
+      this.logger = this.createDefaultLogger();
+    }
+    return this.logger;
+  }
+  setupLogger() {
+    if (!this.config) return;
+    const { debug = false, logLevel = "warn" } = this.config;
+    this.logger = {
+      error: (message, ...args) => {
+        console.error(`[RBAC ERROR] ${message}`, ...args);
+      },
+      warn: (message, ...args) => {
+        if (logLevel === "warn" || logLevel === "info" || logLevel === "debug") {
+          console.warn(`[RBAC WARN] ${message}`, ...args);
+        }
+      },
+      info: (message, ...args) => {
+        if (logLevel === "info" || logLevel === "debug") {
+          console.info(`[RBAC INFO] ${message}`, ...args);
+        }
+      },
+      debug: (message, ...args) => {
+        if (debug && logLevel === "debug") {
+          console.debug(`[RBAC DEBUG] ${message}`, ...args);
+        }
+      }
+    };
+  }
+  createDefaultLogger() {
+    return {
+      error: (message, ...args) => console.error(`[RBAC ERROR] ${message}`, ...args),
+      warn: (message, ...args) => console.warn(`[RBAC WARN] ${message}`, ...args),
+      info: (message, ...args) => console.info(`[RBAC INFO] ${message}`, ...args),
+      debug: (message, ...args) => console.debug(`[RBAC DEBUG] ${message}`, ...args)
+    };
+  }
+  isDebugMode() {
+    return this.config?.debug ?? false;
+  }
+  isDevelopmentMode() {
+    return this.config?.developmentMode ?? false;
+  }
+  getMockPermissions() {
+    return this.config?.mockPermissions ?? null;
+  }
+};
+var configManager = new RBACConfigManager();
+function createRBACConfig(config) {
+  configManager.setConfig(config);
+  return config;
+}
+function getRBACConfig() {
+  return configManager.getConfig();
+}
+function getRBACLogger() {
+  return configManager.getLogger();
+}
+function isDebugMode() {
+  return configManager.isDebugMode();
+}
+function isDevelopmentMode() {
+  return configManager.isDevelopmentMode();
+}
+
+// src/rbac/api.ts
+var globalEngine = null;
+function setupRBAC(supabase, config) {
+  const logger = getRBACLogger();
+  const fullConfig = {
+    supabase,
+    debug: false,
+    logLevel: "warn",
+    developmentMode: false,
+    ...config
+  };
+  createRBACConfig(fullConfig);
+  globalEngine = createRBACEngine(supabase);
+  const auditManager = createAuditManager(supabase);
+  setGlobalAuditManager(auditManager);
+  logger.info("RBAC system initialized successfully");
+}
+function getEngine() {
+  if (!globalEngine) {
+    throw new RBACNotInitializedError();
+  }
+  return globalEngine;
+}
+async function getAccessLevel(input) {
+  const engine = getEngine();
+  return engine.getAccessLevel(input);
+}
+async function getPermissionMap(input) {
+  const engine = getEngine();
+  return engine.getPermissionMap(input);
+}
+async function isPermitted(input) {
+  const engine = getEngine();
+  return engine.isPermitted(input);
+}
+async function isPermittedCached(input) {
+  const { userId, scope, permission, pageId } = input;
+  const cacheKey = RBACCache.generatePermissionKey({
+    userId,
+    organisationId: scope.organisationId,
+    eventId: scope.eventId,
+    appId: scope.appId
+  });
+  const cached = rbacCache.get(cacheKey);
+  if (cached !== null) {
+    return cached;
+  }
+  const result = await isPermitted(input);
+  rbacCache.set(cacheKey, result);
+  return result;
+}
+async function hasPermission(input) {
+  return isPermitted(input);
+}
+async function hasAnyPermission(input) {
+  const { permissions, ...baseInput } = input;
+  for (const permission of permissions) {
+    const hasPermission2 = await isPermitted({
+      ...baseInput,
+      permission
+    });
+    if (hasPermission2) {
+      return true;
+    }
+  }
+  return false;
+}
+async function hasAllPermissions(input) {
+  const { permissions, ...baseInput } = input;
+  for (const permission of permissions) {
+    const hasPermission2 = await isPermitted({
+      ...baseInput,
+      permission
+    });
+    if (!hasPermission2) {
+      return false;
+    }
+  }
+  return true;
+}
+async function isSuperAdmin(userId) {
+  const engine = getEngine();
+  return engine["checkSuperAdmin"](userId);
+}
+async function isOrganisationAdmin(userId, organisationId) {
+  const accessLevel = await getAccessLevel({
+    userId,
+    scope: { organisationId }
+  });
+  return accessLevel === "admin" || accessLevel === "super";
+}
+async function isEventAdmin(userId, scope) {
+  if (!scope.eventId || !scope.appId) {
+    return false;
+  }
+  const accessLevel = await getAccessLevel({ userId, scope });
+  return accessLevel === "admin" || accessLevel === "super";
+}
+function invalidateUserCache(userId, organisationId) {
+  if (organisationId) {
+    rbacCache.invalidate(CACHE_PATTERNS.PERMISSION(userId, organisationId));
+  } else {
+    rbacCache.invalidate(CACHE_PATTERNS.USER(userId));
+  }
+}
+function invalidateOrganisationCache(organisationId) {
+  rbacCache.invalidate(CACHE_PATTERNS.ORGANISATION(organisationId));
+}
+function invalidateEventCache(eventId) {
+  rbacCache.invalidate(CACHE_PATTERNS.EVENT(eventId));
+}
+function invalidateAppCache(appId) {
+  rbacCache.invalidate(CACHE_PATTERNS.APP(appId));
+}
+function clearCache() {
+  rbacCache.clear();
+}
+
+export {
+  OrganisationContextRequiredError,
+  RBACCache,
+  rbacCache,
+  CACHE_PATTERNS,
+  RBACEngine,
+  createRBACEngine,
+  createRBACConfig,
+  getRBACConfig,
+  getRBACLogger,
+  isDebugMode,
+  isDevelopmentMode,
+  setupRBAC,
+  getAccessLevel,
+  getPermissionMap,
+  isPermitted,
+  isPermittedCached,
+  hasPermission,
+  hasAnyPermission,
+  hasAllPermissions,
+  isSuperAdmin,
+  isOrganisationAdmin,
+  isEventAdmin,
+  invalidateUserCache,
+  invalidateOrganisationCache,
+  invalidateEventCache,
+  invalidateAppCache,
+  clearCache
+};
+//# sourceMappingURL=chunk-XI7QFSSC.js.map