@jmruthers/pace-core 0.2.7 → 0.5.1

package/src/rbac/__tests__/README.md

@@ -1,170 +0,0 @@
-# RBAC Test Suite
-
-This directory contains comprehensive tests for the RBAC system covering all critical functionality and edge cases.
-
-## Test Files Overview
-
-### Core Engine Tests
-- **`engine.test.ts`** - Basic engine functionality tests
-- **`engine.comprehensive.test.ts`** - Comprehensive engine tests covering all scenarios
-- **`engine.unit.test.ts`** - Unit tests for core logic
-
-### Component Tests
-- **`cache.test.ts`** - Cache system tests including TTL, invalidation, and performance
-- **`audit.test.ts`** - Audit event system tests
-- **`secureClient.test.ts`** - Secure client and RLS enforcement tests
-- **`hooks.comprehensive.test.tsx`** - React hooks tests
-- **`adapters.comprehensive.test.tsx`** - React components and server adapters tests
-
-### Integration Tests
-- **`integration.test.ts`** - Basic integration tests
-- **`integration.comprehensive.test.ts`** - End-to-end integration tests
-
-## Test Coverage
-
-### Core Permission Logic ✅
-- **Super Admin Bypass**: Tests that super_admin role bypasses all permission checks
-- **Permission Precedence**: Tests page → eventApp → organisation → global precedence
-- **Deny Override**: Tests that explicit denies override allows
-- **Time-bound Grants**: Tests valid_from/valid_to date validation
-- **Permission Matching**: Tests exact and wildcard permission matching
-
-### Scope Isolation ✅
-- **Organisation Isolation**: Tests that users can only access their organisation's data
-- **Event-App Isolation**: Tests that users can only access their event/app context
-- **Cross-org Access**: Tests that cross-organisation access is denied
-- **Cross-event Access**: Tests that cross-event access is denied
-
-### Secure Client & RLS ✅
-- **Organisation Context**: Tests that organisation context is enforced
-- **Event Context**: Tests that event context is enforced when required
-- **App Context**: Tests that app context is enforced when required
-- **Query Filtering**: Tests that queries are automatically filtered by context
-
-### Cache & Realtime ✅
-- **TTL Management**: Tests 60-second TTL functionality
-- **Cache Invalidation**: Tests pattern-based cache invalidation
-- **Performance**: Tests high-volume caching scenarios
-- **Memory Management**: Tests memory cleanup and leak prevention
-
-### Adapters & Hooks ✅
-- **React Hooks**: Tests usePermissions, useCan, useAccessLevel, etc.
-- **React Components**: Tests PermissionGuard, AccessLevelGuard
-- **Server Adapters**: Tests withPermissionGuard, withAccessLevelGuard
-- **Middleware**: Tests Next.js and Express middleware
-
-### Audit & Observability ✅
-- **Event Emission**: Tests that all operations emit audit events
-- **Event Types**: Tests permission_check, permission_denied, role_granted, etc.
-- **Metadata**: Tests complex metadata handling
-- **Error Handling**: Tests graceful handling of audit failures
-
-### Edge Cases ✅
-- **Expired Grants**: Tests handling of expired time-bound grants
-- **Future-dated Grants**: Tests handling of future-dated grants
-- **Duplicate Roles**: Tests handling of duplicate role assignments
-- **Null/Undefined**: Tests graceful handling of null/undefined values
-- **Invalid Inputs**: Tests handling of invalid permission formats
-- **Database Errors**: Tests graceful handling of database errors
-
-## Test Statistics
-
-### Total Tests: 200+ tests across 8 files
-- **Unit Tests**: 50+ tests for individual components
-- **Integration Tests**: 30+ tests for component interactions
-- **Performance Tests**: 20+ tests for performance validation
-- **Edge Case Tests**: 40+ tests for boundary conditions
-- **Error Handling Tests**: 30+ tests for error scenarios
-- **Security Tests**: 30+ tests for security validation
-
-### Coverage Areas
-- **Core Permission Logic**: 100% coverage of isPermitted, getAccessLevel, getPermissionMap
-- **Scope Isolation**: 100% coverage of organisation and event-app isolation
-- **Caching**: 100% coverage of cache operations and invalidation
-- **Audit System**: 100% coverage of audit event emission
-- **Secure Client**: 100% coverage of RLS enforcement
-- **React Hooks**: 100% coverage of all hook functionality
-- **Server Adapters**: 100% coverage of middleware and guards
-
-## Running Tests
-
-### Run All RBAC Tests
-```bash
-npm run test -- packages/core/src/rbac/__tests__/
-```
-
-### Run Specific Test Categories
-```bash
-# Core engine tests
-npm run test -- packages/core/src/rbac/__tests__/engine*.test.ts
-
-# Component tests
-npm run test -- packages/core/src/rbac/__tests__/cache.test.ts
-npm run test -- packages/core/src/rbac/__tests__/audit.test.ts
-npm run test -- packages/core/src/rbac/__tests__/secureClient.test.ts
-
-# React tests
-npm run test -- packages/core/src/rbac/__tests__/hooks*.test.tsx
-npm run test -- packages/core/src/rbac/__tests__/adapters*.test.tsx
-
-# Integration tests
-npm run test -- packages/core/src/rbac/__tests__/integration*.test.ts
-```
-
-### Run with Coverage
-```bash
-npm run test:coverage -- packages/core/src/rbac/__tests__/
-```
-
-## Test Quality Metrics
-
-### Performance Benchmarks
-- **Permission Checks**: < 10ms per check
-- **Cache Operations**: < 1ms per operation
-- **High Volume**: 1000+ operations in < 5 seconds
-- **Memory Usage**: No memory leaks detected
-
-### Security Validation
-- **Organisation Isolation**: 100% verified
-- **Event Isolation**: 100% verified
-- **RLS Enforcement**: 100% verified
-- **Audit Coverage**: 100% of operations logged
-
-### Error Handling
-- **Database Errors**: Gracefully handled
-- **Network Errors**: Gracefully handled
-- **Invalid Inputs**: Properly validated
-- **Missing Context**: Properly rejected
-
-## Test Maintenance
-
-### Adding New Tests
-1. Follow the existing naming convention: `component.category.test.ts`
-2. Include comprehensive test cases for all scenarios
-3. Add performance tests for critical paths
-4. Include edge cases and error conditions
-5. Update this README with new test statistics
-
-### Test Updates
-- Update tests when RBAC logic changes
-- Maintain 90%+ coverage requirement
-- Keep performance benchmarks current
-- Update security validation as needed
-
-## Dependencies
-
-### Test Framework
-- **Vitest**: Primary testing framework
-- **@testing-library/react**: React component testing
-- **@testing-library/user-event**: User interaction testing
-
-### Mocking
-- **vi.mock()**: Function mocking
-- **Mock Supabase Client**: Database operation mocking
-- **Mock Cache**: Cache operation mocking
-
-### Test Data
-- **Test Users**: Various user roles and permissions
-- **Test Organisations**: Multiple organisation contexts
-- **Test Events**: Multiple event contexts
-- **Test Apps**: Multiple app contexts