@jmruthers/pace-core 0.2.7 → 0.5.1

package/src/rbac/__tests__/edge-cases.test.ts

@@ -1,654 +0,0 @@
-/**
- * Edge Cases Tests
- * 
- * Tests edge cases and error conditions:
- * - Expired or future-dated grants
- * - Duplicate role assignments
- * - Missing or invalid scope rejected gracefully
- * - Database errors handled properly
- * - Invalid permission strings
- * - Concurrent access scenarios
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { createRBACEngine, RBACEngine } from '../engine';
-import { Scope, Permission } from '../types';
-
-// Mock dependencies
-vi.mock('../cache');
-vi.mock('../audit');
-
-// Create a comprehensive mock for Supabase queries
-function createMockQuery(tableName: string, data: any[] = [], error: any = null) {
-  return {
-    select: vi.fn().mockReturnThis(),
-    eq: vi.fn().mockReturnThis(),
-    is: vi.fn().mockReturnThis(),
-    lte: vi.fn().mockReturnThis(),
-    gte: vi.fn().mockReturnThis(),
-    or: vi.fn().mockResolvedValue({ data, error }), // Crucial fix: .or() now resolves with data
-    and: vi.fn().mockReturnThis(),
-    order: vi.fn().mockReturnThis(),
-    in: vi.fn().mockReturnThis(),
-    single: vi.fn().mockResolvedValue({
-      data: data[0] || null,
-      error: data.length === 0 ? { code: 'PGRST116' } : null
-    }),
-    maybeSingle: vi.fn().mockResolvedValue({ data: data[0] || null, error: null }),
-    insert: vi.fn().mockResolvedValue({ data: null, error: null })
-  };
-}
-
-function createSupabaseMock() {
-  return {
-    from: vi.fn().mockImplementation((tableName: string) => createMockQuery(tableName)),
-    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
-  };
-}
-
-describe('Edge Cases', () => {
-  let engine: RBACEngine;
-  let mockSupabase: ReturnType<typeof createSupabaseMock>;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSupabase = createSupabaseMock();
-    engine = createRBACEngine(mockSupabase as any);
-  });
-
-  describe('Expired and Future-dated Grants', () => {
-    it('should handle grants that expired in the past', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            const expiredDate = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString(); // Yesterday
-            return createMockQuery(tableName, [{ 
-              role: 'org_admin', 
-              status: 'active', 
-              valid_from: '2024-01-01T00:00:00Z', 
-              valid_to: expiredDate 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny for expired grants
-    });
-
-    it('should handle grants that are valid in the future', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            const futureDate = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(); // Tomorrow
-            return createMockQuery(tableName, [{ 
-              role: 'org_admin', 
-              status: 'active', 
-              valid_from: futureDate, 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny for future-dated grants
-    });
-
-    it('should handle grants with null valid_to (never expires)', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'manage:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            const pastDate = new Date(Date.now() - 60 * 1000).toISOString(); // 1 minute ago
-            return createMockQuery(tableName, [{ 
-              role: 'org_admin', 
-              status: 'active', 
-              valid_from: pastDate, 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow for never-expiring grants
-    });
-  });
-
-  describe('Duplicate Role Assignments', () => {
-    it('should handle duplicate organisation roles gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [
-              { role: 'member', status: 'active', valid_from: '2024-01-01T00:00:00Z', valid_to: null },
-              { role: 'member', status: 'active', valid_from: '2024-01-02T00:00:00Z', valid_to: null },
-              { role: 'leader', status: 'active', valid_from: '2024-01-03T00:00:00Z', valid_to: null }
-            ]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should still work with duplicates
-    });
-
-    it('should handle duplicate event-app roles gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { 
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: 'app-101'
-      };
-      const permission: Permission = 'read:event.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_apps': return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': {
-            return createMockQuery(tableName, [
-              { role: 'participant', valid_from: '2024-01-01T00:00:00Z', valid_to: null },
-              { role: 'participant', valid_from: '2024-01-02T00:00:00Z', valid_to: null },
-              { role: 'planner', valid_from: '2024-01-03T00:00:00Z', valid_to: null }
-            ]);
-          }
-          case 'rbac_organisation_roles': return createMockQuery(tableName, []);
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should still work with duplicates
-    });
-  });
-
-  describe('Missing or Invalid Scope', () => {
-    it('should handle missing organisationId gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {}; // Missing organisationId
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': return createMockQuery(tableName, []);
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny without organisation context
-    });
-
-    it('should handle invalid eventId gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { 
-        organisationId: 'org-456',
-        eventId: '', // Invalid eventId
-        appId: 'app-101'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_apps': return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [{ 
-              role: 'member', 
-              status: 'active', 
-              valid_from: '2024-01-01T00:00:00Z', 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-    });
-
-    it('should handle invalid appId gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { 
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: '' // Invalid appId
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [{ 
-              role: 'member', 
-              status: 'active', 
-              valid_from: '2024-01-01T00:00:00Z', 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-    });
-  });
-
-  describe('Database Errors', () => {
-    it('should handle database connection errors gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:events';
-
-      // Mock: Database error
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockRejectedValue(new Error('Database connection failed'))
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny on database error
-    });
-
-    it('should handle query timeout errors gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:events';
-
-      // Mock: Query timeout
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockRejectedValue(new Error('Query timeout'))
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny on timeout
-    });
-
-    it('should handle partial query failures gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking with partial failures
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': {
-            const mockQuery = createMockQuery(tableName, []);
-            mockQuery.or = vi.fn().mockRejectedValue(new Error('Page query failed'));
-            return mockQuery;
-          }
-          case 'rbac_event_app_roles': {
-            const mockQuery = createMockQuery(tableName, []);
-            mockQuery.or = vi.fn().mockRejectedValue(new Error('Event-app query failed'));
-            return mockQuery;
-          }
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [{ 
-              role: 'member', 
-              status: 'active', 
-              valid_from: '2024-01-01T00:00:00Z', 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should still work with partial failures
-    });
-  });
-
-  describe('Invalid Permission Strings', () => {
-    it('should handle malformed permission strings gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission = 'invalid-permission' as Permission; // Invalid format
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Organisation permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [{ 
-            role: 'org_admin', 
-            status: 'active', 
-            valid_from: '2024-01-01T00:00:00Z', 
-            valid_to: null 
-          }],
-          error: null
-        })
-      });
-
-      // Mock: Global permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny for invalid permission format
-    });
-
-    it('should handle empty permission strings gracefully', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission = '' as Permission; // Empty string
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Organisation permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [{ 
-            role: 'org_admin', 
-            status: 'active', 
-            valid_from: '2024-01-01T00:00:00Z', 
-            valid_to: null 
-          }],
-          error: null
-        })
-      });
-
-      // Mock: Global permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny for empty permission
-    });
-  });
-
-  describe('Concurrent Access', () => {
-    it('should handle concurrent permission checks safely', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking for concurrent access
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [{ 
-              role: 'member', 
-              status: 'active', 
-              valid_from: '2024-01-01T00:00:00Z', 
-              valid_to: null 
-            }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      // Run multiple concurrent permission checks
-      const promises = Array.from({ length: 10 }, () =>
-        engine.isPermitted({ userId, scope, permission })
-      );
-
-      const results = await Promise.all(promises);
-
-      // All results should be the same
-      expect(results.every(result => result === results[0])).toBe(true);
-      expect(results[0]).toBe(true); // Should allow based on org permission
-    });
-
-    it('should handle concurrent access level checks safely', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-
-      // Apply flexible mocking for access level checks
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            return createMockQuery(tableName, [{ role: 'org_admin' }]);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      // Run multiple concurrent access level checks
-      const promises = Array.from({ length: 5 }, () =>
-        engine.getAccessLevel({ userId, scope })
-      );
-
-      const results = await Promise.all(promises);
-
-      // All results should be the same
-      expect(results.every(result => result === results[0])).toBe(true);
-      expect(results[0]).toBe('admin'); // Should return admin level
-    });
-  });
-
-  describe('Memory and Performance', () => {
-    it('should handle large numbers of roles efficiently', async () => {
-      const userId = 'user-123';
-      const scope: Scope = { organisationId: 'org-456' };
-      const permission: Permission = 'read:organisation.events';
-
-      // Apply flexible mocking with large role set
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles': return createMockQuery(tableName, []);
-          case 'rbac_page_permissions': return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles': return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles': {
-            const largeRoleSet = Array.from({ length: 1000 }, (_, i) => ({
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }));
-            return createMockQuery(tableName, largeRoleSet);
-          }
-          case 'rbac_audit_events': return createMockQuery(tableName, []);
-          default: return createMockQuery(tableName, []);
-        }
-      });
-
-      const startTime = Date.now();
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-      const endTime = Date.now();
-
-      expect(result).toBe(true); // Should still work with large role sets
-      expect(endTime - startTime).toBeLessThan(1000); // Should complete within 1 second
-    });
-  });
-});