@jmruthers/pace-core 0.2.7 → 0.5.1

package/src/rbac/__tests__/cache-invalidation-comprehensive.test.ts

@@ -1,889 +0,0 @@
-/**
- * Comprehensive Cache & Realtime Invalidation Tests
- * 
- * Tests that cached results match cold computations:
- * - Cache hit/miss behavior
- * - Realtime invalidation updates permissions
- * - TTL expiration handling
- * - Pattern-based invalidation
- * - Cache statistics and performance
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { RBACCache } from '../cache';
-import { createRBACEngine, RBACEngine } from '../engine';
-import { Scope, Permission } from '../types';
-
-// Mock dependencies
-vi.mock('../audit');
-
-// Create a comprehensive mock for Supabase queries
-function createSupabaseMock() {
-  const mockQuery = {
-    select: vi.fn().mockReturnThis(),
-    eq: vi.fn().mockReturnThis(),
-    is: vi.fn().mockReturnThis(),
-    lte: vi.fn().mockReturnThis(),
-    gte: vi.fn().mockReturnThis(),
-    or: vi.fn().mockReturnThis(),
-    and: vi.fn().mockReturnThis(),
-    order: vi.fn().mockReturnThis(),
-    in: vi.fn().mockReturnThis(),
-    single: vi.fn().mockResolvedValue({ data: null, error: null }),
-    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-    insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-  };
-
-  return {
-    from: vi.fn().mockReturnValue(mockQuery),
-    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
-  };
-}
-
-describe('Cache & Realtime Invalidation - Comprehensive', () => {
-  let engine: RBACEngine;
-  let mockSupabase: ReturnType<typeof createSupabaseMock>;
-  let cache: RBACCache;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSupabase = createSupabaseMock();
-    engine = createRBACEngine(mockSupabase as any);
-    cache = new RBACCache();
-  });
-
-  describe('Cache Hit/Miss Behavior', () => {
-    it('should return cached result on cache hit', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-
-      // Test getAccessLevel which uses caching
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.getAccessLevel({
-        userId,
-        scope
-      });
-
-      expect(result1).toBe('viewer'); // Should return access level
-      expect(callCount).toBe(2); // Should check: organisation (super admin check is cached)
-
-      // Second call - should hit cache
-      callCount = 0;
-      const result2 = await engine.getAccessLevel({
-        userId,
-        scope
-      });
-
-      expect(result2).toBe('viewer'); // Should return cached result
-      expect(callCount).toBe(0); // Should not check database again
-    });
-
-    it('should miss cache and compute fresh result on cache miss', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Clear cache to ensure miss
-      cache.clear();
-
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-    });
-  });
-
-  describe('Realtime Invalidation', () => {
-    it('should invalidate cache when role is granted', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // First call - should miss cache and store result
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result1).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-
-      // Simulate role grant - invalidate cache
-      cache.invalidate(`permission:${userId}:*`);
-
-      // Second call - should miss cache due to invalidation
-      callCount = 0;
-      const result2 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result2).toBe(true); // Should still allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
-    });
-
-    it('should invalidate cache when role is revoked', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // First call - should miss cache and store result
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result1).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-
-      // Simulate role revocation - invalidate cache
-      cache.invalidate(`permission:${userId}:*`);
-
-      // Second call - should miss cache due to invalidation
-      callCount = 0;
-      const result2 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result2).toBe(true); // Should still allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
-    });
-
-    it('should invalidate cache when permissions change', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // First call - should miss cache and store result
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result1).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-
-      // Simulate permission change - invalidate cache
-      cache.invalidate(`permission:${userId}:*`);
-
-      // Second call - should miss cache due to invalidation
-      callCount = 0;
-      const result2 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result2).toBe(true); // Should still allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
-    });
-  });
-
-  describe('TTL Expiration', () => {
-    it('should expire cached entries after TTL', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Set a very short TTL for testing
-      const shortTTL = 100; // 100ms
-      // TTL is set per entry, not globally
-
-      // First call - should miss cache and store result
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result1).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-
-      // Wait for TTL to expire
-      await new Promise(resolve => setTimeout(resolve, shortTTL + 50));
-
-      // Second call - should miss cache due to expiration
-      callCount = 0;
-      const result2 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result2).toBe(true); // Should still allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
-    });
-
-    it('should handle zero TTL (no caching)', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Set zero TTL (no caching)
-      // TTL is set per entry, not globally
-
-      let callCount = 0;
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        const mockQuery = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          is: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          gte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          and: vi.fn().mockReturnThis(),
-          order: vi.fn().mockReturnThis(),
-          in: vi.fn().mockReturnThis(),
-          single: vi.fn().mockResolvedValue({ data: null, error: null }),
-          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-          insert: vi.fn().mockResolvedValue({ data: null, error: null }),
-        };
-
-        switch (tableName) {
-          case 'rbac_global_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { code: 'PGRST116' }
-              })
-            };
-          case 'rbac_page_permissions':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_event_app_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [],
-                error: null
-              })
-            };
-          case 'rbac_organisation_roles':
-            callCount++;
-            return {
-              ...mockQuery,
-              or: vi.fn().mockResolvedValue({
-                data: [{ 
-                  role: 'member',
-                  status: 'active',
-                  valid_from: '2024-01-01T00:00:00Z',
-                  valid_to: null
-                }],
-                error: null
-              })
-            };
-          case 'rbac_audit_events':
-            callCount++;
-            return {
-              ...mockQuery,
-              insert: vi.fn().mockResolvedValue({ data: null, error: null })
-            };
-          default:
-            return mockQuery;
-        }
-      });
-
-      const result1 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result1).toBe(true); // Should allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached)
-
-      // Second call - should miss cache due to zero TTL
-      callCount = 0;
-      const result2 = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result2).toBe(true); // Should still allow
-      expect(callCount).toBe(2); // Should check: organisation, audit (super admin check is cached) again
-    });
-  });
-
-  describe('Pattern-based Invalidation', () => {
-    it('should invalidate entries matching pattern', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Store some entries
-      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
-      cache.set(`permission:${userId}:${scope.organisationId}:other`, true);
-      cache.set(`permission:other:${scope.organisationId}:${permission}`, true);
-
-      // Invalidate pattern (using includes matching, not wildcards)
-      cache.invalidate(`permission:${userId}:`);
-
-      // Check that matching entries are invalidated
-      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBeNull();
-      expect(cache.get(`permission:${userId}:${scope.organisationId}:other`)).toBeNull();
-      expect(cache.get(`permission:other:${scope.organisationId}:${permission}`)).toBe(true); // Should still exist
-    });
-
-    it('should handle empty pattern gracefully', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Store some entries
-      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
-
-      // Invalidate with empty pattern (matches all keys)
-      cache.invalidate('');
-
-      // Check that entries are deleted (empty pattern matches all)
-      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBeNull();
-    });
-
-    it('should handle invalid pattern gracefully', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Store some entries
-      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
-
-      // Invalidate with invalid pattern
-      cache.invalidate('invalid[pattern');
-
-      // Check that entries still exist
-      expect(cache.get(`permission:${userId}:${scope.organisationId}:${permission}`)).toBe(true);
-    });
-  });
-
-  describe('Cache Statistics', () => {
-    it('should track cache hits and misses', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Store an entry
-      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
-
-      // Get the entry (hit)
-      const result1 = cache.get(`permission:${userId}:${scope.organisationId}:${permission}`);
-      expect(result1).toBe(true);
-
-      // Get non-existent entry (miss)
-      const result2 = cache.get(`permission:${userId}:${scope.organisationId}:other`);
-      expect(result2).toBeNull();
-
-      // Check statistics (cache doesn't track hits/misses)
-      const stats = cache.getStats();
-      expect(stats.size).toBe(1);
-      expect(stats.ttl).toBe(60000); // 60 seconds
-      expect(stats.keys).toContain(`permission:${userId}:${scope.organisationId}:${permission}`);
-    });
-
-    it('should reset statistics', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Store an entry
-      cache.set(`permission:${userId}:${scope.organisationId}:${permission}`, true);
-
-      // Get the entry (hit)
-      cache.get(`permission:${userId}:${scope.organisationId}:${permission}`);
-
-      // Reset statistics
-      // No resetStats method - just clear cache
-      cache.clear();
-
-      // Check statistics (cache doesn't track hits/misses)
-      const stats = cache.getStats();
-      expect(stats.size).toBe(0); // Cache was cleared
-      expect(stats.ttl).toBe(60000); // 60 seconds
-      expect(stats.keys).toHaveLength(0);
-    });
-  });
-
-  describe('Performance', () => {
-    it('should handle large datasets efficiently', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-
-      // Store many entries
-      for (let i = 0; i < 1000; i++) {
-        cache.set(`permission:${userId}:${scope.organisationId}:permission${i}`, true);
-      }
-
-      // Check that we can retrieve entries efficiently
-      const start = Date.now();
-      for (let i = 0; i < 1000; i++) {
-        cache.get(`permission:${userId}:${scope.organisationId}:permission${i}`);
-      }
-      const end = Date.now();
-
-      // Should complete quickly (less than 100ms)
-      expect(end - start).toBeLessThan(100);
-    });
-
-    it('should handle frequent invalidations efficiently', () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-
-      // Store many entries
-      for (let i = 0; i < 1000; i++) {
-        cache.set(`permission:${userId}:${scope.organisationId}:permission${i}`, true);
-      }
-
-      // Invalidate frequently
-      const start = Date.now();
-      for (let i = 0; i < 100; i++) {
-        cache.invalidate(`permission:${userId}:*`);
-      }
-      const end = Date.now();
-
-      // Should complete quickly (less than 200ms)
-      expect(end - start).toBeLessThan(200);
-    });
-  });
-});