@jmruthers/pace-core 0.2.7 → 0.5.1

package/src/rbac/__tests__/api.test.ts

@@ -1,620 +0,0 @@
-/**
- * RBAC API Tests
- * @package @jmruthers/pace-core
- * @module RBAC/API
- * @since 1.0.0
- * 
- * Tests for the main RBAC API functions.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { createClient } from '@supabase/supabase-js';
-import { Database } from '../../types/database';
-import {
-  setupRBAC,
-  getAccessLevel,
-  getPermissionMap,
-  isPermitted,
-  isPermittedCached,
-  hasPermission,
-  hasAnyPermission,
-  hasAllPermissions,
-  isSuperAdmin,
-  getAppConfig,
-  isOrganisationAdmin,
-  isEventAdmin,
-  invalidateUserCache,
-  invalidateOrganisationCache,
-  invalidateEventCache,
-  invalidateAppCache,
-  clearCache,
-} from '../api';
-import { createRBACConfig } from '../config';
-import { createRBACEngine } from '../engine';
-import { createAuditManager, setGlobalAuditManager } from '../audit';
-import { RBACNotInitializedError } from '../types';
-import { rbacCache } from '../cache';
-
-// Mock Supabase client
-const mockSupabase = createClient<Database>('https://test.supabase.co', 'test-key');
-
-// Mock the engine module
-const mockEngine = {
-  getAccessLevel: vi.fn(),
-  getPermissionMap: vi.fn(),
-  isPermitted: vi.fn(),
-  'checkSuperAdmin': vi.fn(),
-  'getAppConfig': vi.fn(),
-};
-
-vi.mock('../engine', () => ({
-  createRBACEngine: vi.fn(() => mockEngine),
-}));
-
-vi.mock('../audit', () => ({
-  createAuditManager: vi.fn(() => ({
-    logEvent: vi.fn(),
-    setContext: vi.fn(),
-    getContext: vi.fn(),
-  })),
-  setGlobalAuditManager: vi.fn(),
-}));
-
-vi.mock('../config', () => ({
-  createRBACConfig: vi.fn((config) => config),
-  getRBACLogger: vi.fn(() => ({
-    error: vi.fn(),
-    warn: vi.fn(),
-    info: vi.fn(),
-    debug: vi.fn(),
-  })),
-}));
-
-vi.mock('../cache', () => ({
-  rbacCache: {
-    get: vi.fn(),
-    set: vi.fn(),
-    invalidate: vi.fn(),
-    clear: vi.fn(),
-  },
-  RBACCache: {
-    generatePermissionKey: vi.fn(({ userId, organisationId }) => `perm:${userId}:${organisationId}`),
-  },
-  CACHE_PATTERNS: {
-    PERMISSION: vi.fn((userId, organisationId) => `perm:${userId}:${organisationId}`),
-    USER: vi.fn((userId) => `user:${userId}`),
-    ORGANISATION: vi.fn((organisationId) => `org:${organisationId}`),
-    EVENT: vi.fn((eventId) => `event:${eventId}`),
-    APP: vi.fn((appId) => `app:${appId}`),
-  },
-}));
-
-describe('RBAC API', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    setupRBAC(mockSupabase);
-  });
-
-  afterEach(() => {
-    vi.clearAllMocks();
-  });
-
-  describe('setupRBAC', () => {
-    it('should initialize RBAC system with default config', () => {
-      setupRBAC(mockSupabase);
-
-      expect(createRBACConfig).toHaveBeenCalledWith({
-        supabase: mockSupabase,
-        debug: false,
-        logLevel: 'warn',
-        developmentMode: false,
-      });
-      expect(createRBACEngine).toHaveBeenCalledWith(mockSupabase);
-      expect(createAuditManager).toHaveBeenCalledWith(mockSupabase);
-      expect(setGlobalAuditManager).toHaveBeenCalled();
-    });
-
-    it('should initialize RBAC system with custom config', () => {
-      const customConfig = {
-        debug: true,
-        logLevel: 'debug' as const,
-        developmentMode: true,
-      };
-
-      setupRBAC(mockSupabase, customConfig);
-
-      expect(createRBACConfig).toHaveBeenCalledWith({
-        supabase: mockSupabase,
-        debug: true,
-        logLevel: 'debug',
-        developmentMode: true,
-      });
-    });
-
-    it('should handle development environment detection', () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = 'development';
-
-      setupRBAC(mockSupabase);
-
-      // Should detect development environment
-      expect(createRBACConfig).toHaveBeenCalledWith(
-        expect.objectContaining({
-          supabase: mockSupabase,
-          developmentMode: true,
-        })
-      );
-
-      process.env.NODE_ENV = originalEnv;
-    });
-  });
-
-  describe('getAccessLevel', () => {
-    it('should call engine getAccessLevel method', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('admin');
-
-      const result = await getAccessLevel({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(result).toBe('admin');
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { getAccessLevel: freshGetAccessLevel } = await import('../api');
-      
-      await expect(
-        freshGetAccessLevel({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('getPermissionMap', () => {
-    it('should call engine getPermissionMap method', async () => {
-      const mockPermissionMap = { 'read:events': true };
-      mockEngine.getPermissionMap.mockResolvedValue(mockPermissionMap);
-
-      const result = await getPermissionMap({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(mockEngine.getPermissionMap).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(result).toEqual(mockPermissionMap);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { getPermissionMap: freshGetPermissionMap } = await import('../api');
-      
-      await expect(
-        freshGetPermissionMap({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('isPermitted', () => {
-    it('should call engine isPermitted method', async () => {
-      mockEngine.isPermitted.mockResolvedValue(true);
-
-      const result = await isPermitted({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(result).toBe(true);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { isPermitted: freshIsPermitted } = await import('../api');
-      
-      await expect(
-        freshIsPermitted({
-          userId: 'user-123',
-          permission: 'read:events',
-          scope: { organisationId: 'org-456' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('isPermittedCached', () => {
-    it('should return cached result when available', async () => {
-      const cacheKey = 'perm:user-123:org-456:read:events';
-      vi.mocked(rbacCache.get).mockReturnValue(false);
-
-      const result = await isPermittedCached({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(false);
-      expect(mockEngine.isPermitted).not.toHaveBeenCalled();
-    });
-
-    it('should call engine and cache result when not cached', async () => {
-      // Mock cache to return null (not cached)
-      vi.mocked(rbacCache.get).mockReturnValue(null);
-      mockEngine.isPermitted.mockResolvedValue(true);
-
-      const result = await isPermittedCached({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(true);
-      expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(rbacCache.set).toHaveBeenCalled();
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Ensure cache returns null (not cached)
-      vi.mocked(rbacCache.get).mockReturnValue(null);
-      
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { isPermittedCached: freshIsPermittedCached } = await import('../api');
-      
-      await expect(
-        freshIsPermittedCached({
-          userId: '123e4567-e89b-12d3-a456-426614174000',
-          permission: 'read:events',
-          scope: { organisationId: '123e4567-e89b-12d3-a456-426614174001' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('hasPermission', () => {
-    it('should call isPermitted method', async () => {
-      mockEngine.isPermitted.mockResolvedValue(true);
-
-      const result = await hasPermission({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-        userId: 'user-123',
-        permission: 'read:events',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(result).toBe(true);
-    });
-  });
-
-  describe('hasAnyPermission', () => {
-    it('should return true when user has any permission', async () => {
-      mockEngine.isPermitted
-        .mockResolvedValueOnce(false)
-        .mockResolvedValueOnce(true);
-
-      const result = await hasAnyPermission({
-        userId: 'user-123',
-        permissions: ['read:events', 'write:events'],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false when user has no permissions', async () => {
-      mockEngine.isPermitted.mockResolvedValue(false);
-
-      const result = await hasAnyPermission({
-        userId: 'user-123',
-        permissions: ['read:events', 'write:events'],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when permissions array is empty', async () => {
-      const result = await hasAnyPermission({
-        userId: 'user-123',
-        permissions: [],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(false);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { hasAnyPermission: freshHasAnyPermission } = await import('../api');
-      
-      await expect(
-        freshHasAnyPermission({
-          userId: 'user-123',
-          permissions: ['read:events'],
-          scope: { organisationId: 'org-456' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('hasAllPermissions', () => {
-    it('should return true when user has all permissions', async () => {
-      mockEngine.isPermitted.mockResolvedValue(true);
-
-      const result = await hasAllPermissions({
-        userId: 'user-123',
-        permissions: ['read:events', 'write:events'],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false when user lacks any permission', async () => {
-      mockEngine.isPermitted
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(false);
-
-      const result = await hasAllPermissions({
-        userId: 'user-123',
-        permissions: ['read:events', 'write:events'],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(false);
-    });
-
-    it('should return true when permissions array is empty', async () => {
-      const result = await hasAllPermissions({
-        userId: 'user-123',
-        permissions: [],
-        scope: { organisationId: 'org-456' },
-      });
-
-      expect(result).toBe(true);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { hasAllPermissions: freshHasAllPermissions } = await import('../api');
-      
-      await expect(
-        freshHasAllPermissions({
-          userId: 'user-123',
-          permissions: ['read:events'],
-          scope: { organisationId: 'org-456' },
-        })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('isSuperAdmin', () => {
-    it('should call engine checkSuperAdmin method', async () => {
-      mockEngine['checkSuperAdmin'].mockResolvedValue(true);
-
-      const result = await isSuperAdmin('user-123');
-
-      expect(mockEngine['checkSuperAdmin']).toHaveBeenCalledWith('user-123');
-      expect(result).toBe(true);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { isSuperAdmin: freshIsSuperAdmin } = await import('../api');
-      
-      await expect(freshIsSuperAdmin('user-123')).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('getAppConfig', () => {
-    it('should call engine getAppConfig method', async () => {
-      const mockAppConfig = { requires_event: true };
-      mockEngine['getAppConfig'].mockResolvedValue(mockAppConfig);
-
-      const result = await getAppConfig('app-123');
-
-      expect(mockEngine['getAppConfig']).toHaveBeenCalledWith('app-123');
-      expect(result).toEqual(mockAppConfig);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { getAppConfig: freshGetAppConfig } = await import('../api');
-      
-      await expect(freshGetAppConfig('app-123')).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('isOrganisationAdmin', () => {
-    it('should return true for admin access level', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('admin');
-
-      const result = await isOrganisationAdmin('user-123', 'org-456');
-
-      expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' },
-      });
-      expect(result).toBe(true);
-    });
-
-    it('should return true for super access level', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('super');
-
-      const result = await isOrganisationAdmin('user-123', 'org-456');
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false for other access levels', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('viewer');
-
-      const result = await isOrganisationAdmin('user-123', 'org-456');
-
-      expect(result).toBe(false);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { isOrganisationAdmin: freshIsOrganisationAdmin } = await import('../api');
-      
-      await expect(
-        freshIsOrganisationAdmin('user-123', 'org-456')
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('isEventAdmin', () => {
-    it('should return true for admin access level with event and app', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('admin');
-
-      const result = await isEventAdmin('user-123', {
-        eventId: 'event-789',
-        appId: 'app-101',
-      });
-
-      expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: { eventId: 'event-789', appId: 'app-101' },
-      });
-      expect(result).toBe(true);
-    });
-
-    it('should return true for super access level', async () => {
-      mockEngine.getAccessLevel.mockResolvedValue('super');
-
-      const result = await isEventAdmin('user-123', {
-        eventId: 'event-789',
-        appId: 'app-101',
-      });
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false when eventId is missing', async () => {
-      const result = await isEventAdmin('user-123', {
-        appId: 'app-101',
-      });
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when appId is missing', async () => {
-      const result = await isEventAdmin('user-123', {
-        eventId: 'event-789',
-      });
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when both eventId and appId are missing', async () => {
-      const result = await isEventAdmin('user-123', {});
-
-      expect(result).toBe(false);
-    });
-
-    it('should throw error when RBAC not initialized', async () => {
-      // Reset modules to get fresh API functions without setupRBAC called
-      vi.resetModules();
-      const { isEventAdmin: freshIsEventAdmin } = await import('../api');
-      
-      await expect(
-        freshIsEventAdmin('user-123', { eventId: 'event-789', appId: 'app-101' })
-      ).rejects.toThrow('RBAC system not initialized');
-    });
-  });
-
-  describe('Cache invalidation functions', () => {
-    describe('invalidateUserCache', () => {
-      it('should invalidate user cache with organisation pattern when organisationId provided', () => {
-        const invalidateSpy = vi.spyOn(rbacCache, 'invalidate');
-        
-        invalidateUserCache('user-123', 'org-456');
-
-        expect(invalidateSpy).toHaveBeenCalledWith('perm:user-123:org-456');
-      });
-
-      it('should invalidate user cache with user pattern when organisationId not provided', () => {
-        const invalidateSpy = vi.spyOn(rbacCache, 'invalidate');
-        
-        invalidateUserCache('user-123');
-
-        expect(invalidateSpy).toHaveBeenCalledWith('user:user-123');
-      });
-    });
-
-    describe('invalidateOrganisationCache', () => {
-      it('should invalidate organisation cache', () => {
-        const invalidateSpy = vi.spyOn(rbacCache, 'invalidate');
-        
-        invalidateOrganisationCache('org-456');
-
-        expect(invalidateSpy).toHaveBeenCalledWith('org:org-456');
-      });
-    });
-
-    describe('invalidateEventCache', () => {
-      it('should invalidate event cache', () => {
-        const invalidateSpy = vi.spyOn(rbacCache, 'invalidate');
-        
-        invalidateEventCache('event-789');
-
-        expect(invalidateSpy).toHaveBeenCalledWith('event:event-789');
-      });
-    });
-
-    describe('invalidateAppCache', () => {
-      it('should invalidate app cache', () => {
-        const invalidateSpy = vi.spyOn(rbacCache, 'invalidate');
-        
-        invalidateAppCache('app-101');
-
-        expect(invalidateSpy).toHaveBeenCalledWith('app:app-101');
-      });
-    });
-
-    describe('clearCache', () => {
-      it('should clear all cache', () => {
-        const clearSpy = vi.spyOn(rbacCache, 'clear');
-        
-        clearCache();
-
-        expect(clearSpy).toHaveBeenCalled();
-      });
-    });
-  });
-});