@jmruthers/pace-core 0.2.7 → 0.5.1

package/src/rbac/__tests__/scope-isolation.test.ts

@@ -1,755 +0,0 @@
-/**
- * Scope Isolation Tests
- * 
- * Tests that users can only access data within their assigned scopes:
- * - Organisation isolation (users only see their org's data)
- * - Event-App isolation (roles restricted to specific event-app pairs)
- * - Cross-org and cross-event access denied by default
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { createRBACEngine, RBACEngine } from '../engine';
-import { Scope, Permission } from '../types';
-
-// Mock dependencies
-vi.mock('../cache');
-vi.mock('../audit');
-
-// Create a comprehensive mock for Supabase queries
-function createSupabaseMock() {
-  const mockQuery = {
-    select: vi.fn().mockReturnThis(),
-    eq: vi.fn().mockReturnThis(),
-    is: vi.fn().mockReturnThis(),
-    lte: vi.fn().mockReturnThis(),
-    gte: vi.fn().mockReturnThis(),
-    or: vi.fn().mockReturnThis(),
-    and: vi.fn().mockReturnThis(),
-    order: vi.fn().mockReturnThis(),
-    in: vi.fn().mockReturnThis(),
-    single: vi.fn().mockResolvedValue({ data: null, error: null }),
-    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
-  };
-
-  return {
-    from: vi.fn().mockReturnValue(mockQuery),
-    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
-  };
-}
-
-describe('Scope Isolation', () => {
-  let engine: RBACEngine;
-  let mockSupabase: ReturnType<typeof createSupabaseMock>;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSupabase = createSupabaseMock();
-    engine = createRBACEngine(mockSupabase as any);
-  });
-
-  describe('Organisation Isolation', () => {
-    it('should allow access within the same organisation', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - organisation permission should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - member role
-            return createMockQuery(tableName, [{ 
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow within same org
-    });
-
-    it('should deny access when checking different organisation', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-999' // Different org
-      };
-      const permission: Permission = 'read:event.events';
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Organisation permission for DIFFERENT org (should return empty)
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [], // No roles for different org
-          error: null
-        })
-      });
-
-      // Mock: Global permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny for different org
-    });
-
-    it('should verify organisation context is required', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {}; // No organisationId
-      const permission: Permission = 'read:event.events';
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Organisation permission (should not be called without orgId)
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Global permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny without organisation context
-    });
-  });
-
-  describe('Event-App Isolation', () => {
-    it('should allow access within the same event-app pair', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: 'app-101'
-      };
-      const permission: Permission = 'read:event.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - event-app permission should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - participant role
-            return createMockQuery(tableName, [{ 
-              role: 'participant',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow within same event-app pair
-    });
-
-    it('should deny access when checking different event', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-999', // Different event
-        appId: 'app-101'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - event-app should fail, org should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - empty (different event)
-            return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - member role
-            return createMockQuery(tableName, [{ 
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-    });
-
-    it('should deny access when checking different app', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: 'app-999' // Different app
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - event-app should fail, org should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - empty (different app)
-            return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - member role
-            return createMockQuery(tableName, [{ 
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-    });
-
-    it('should require both eventId and appId for event-app permissions', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-789'
-        // Missing appId
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - event-app should fail, org should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - empty (missing appId)
-            return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - member role
-            return createMockQuery(tableName, [{ 
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-    });
-  });
-
-  describe('Cross-Organisation Access Prevention', () => {
-    it('should not leak permissions between organisations', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:event.events';
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: Organisation permission query should include organisationId filter
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [], // No roles for this org
-          error: null
-        })
-      });
-
-      // Mock: Global permission
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny when no roles for this org
-
-      // Verify that the organisation query was called with the correct organisationId
-      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_organisation_roles');
-    });
-
-    it('should isolate event-app permissions by organisation', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: 'app-101'
-      };
-      const permission: Permission = 'read:organisation.events';
-
-      // Create a comprehensive mock that handles all database calls
-      const createMockQuery = (tableName: string, data: any[] = [], error: any = null) => ({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        is: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        gte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockResolvedValue({ data, error }),
-        single: vi.fn().mockResolvedValue({ 
-          data: data[0] || null, 
-          error: data.length === 0 ? { code: 'PGRST116' } : null 
-        }),
-        insert: vi.fn().mockResolvedValue({ data: null, error: null })
-      });
-
-      // Mock all database calls - event-app should fail, org should allow
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        switch (tableName) {
-          case 'rbac_global_roles':
-            // Super admin check - no super admin
-            return createMockQuery(tableName, []);
-          case 'rbac_apps':
-            // App configuration - default to requires_event: false
-            return createMockQuery(tableName, [{ requires_event: false }]);
-          case 'rbac_page_permissions':
-            // Page permissions - empty
-            return createMockQuery(tableName, []);
-          case 'rbac_event_app_roles':
-            // Event-app permissions - empty (no roles for this org's event-app)
-            return createMockQuery(tableName, []);
-          case 'rbac_organisation_roles':
-            // Organisation permissions - member role
-            return createMockQuery(tableName, [{ 
-              role: 'member',
-              status: 'active',
-              valid_from: '2024-01-01T00:00:00Z',
-              valid_to: null
-            }]);
-          case 'rbac_audit_events':
-            // Audit events
-            return createMockQuery(tableName, []);
-          default:
-            // Default mock for any other table
-            return createMockQuery(tableName, []);
-        }
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(true); // Should allow via organisation permission
-
-      // Verify that the event-app query was called with the correct filters
-      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_event_app_roles');
-    });
-  });
-
-  describe('Default Deny Posture', () => {
-    it('should deny access by default when no permissions exist', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456'
-      };
-      const permission: Permission = 'read:event.events';
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No organisation permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No global permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny by default
-    });
-
-    it('should deny access when user has no roles in any scope', async () => {
-      const userId = 'user-123';
-      const scope: Scope = {
-        organisationId: 'org-456',
-        eventId: 'event-789',
-        appId: 'app-101'
-      };
-      const permission: Permission = 'manage:everything';
-
-      // Mock: No super admin
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        single: vi.fn().mockResolvedValue({
-          data: null,
-          error: { code: 'PGRST116' }
-        })
-      });
-
-      // Mock: No page permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No event-app permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No organisation permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      // Mock: No global permissions
-      mockSupabase.from.mockReturnValueOnce({
-        ...mockSupabase.from(),
-        or: vi.fn().mockResolvedValue({
-          data: [],
-          error: null
-        })
-      });
-
-      const result = await engine.isPermitted({
-        userId,
-        scope,
-        permission
-      });
-
-      expect(result).toBe(false); // Should deny when no roles exist
-    });
-  });
-});