@jmruthers/pace-core 0.5.1 → 0.5.4

package/src/rbac/api.test.ts

@@ -0,0 +1,952 @@
+/**
+ * @file RBAC API Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/API
+ * @since 1.0.0
+ * 
+ * Comprehensive tests for the RBAC API functions covering all critical functionality.
+ */
+
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { setupRBAC } from './api';
+import { createRBACEngine } from './engine';
+import { createAuditManager, setGlobalAuditManager } from './audit';
+import { rbacCache } from './cache';
+import { createRBACConfig, getRBACLogger } from './config';
+
+// Mock dependencies
+vi.mock('./engine', () => ({
+  createRBACEngine: vi.fn()
+}));
+
+vi.mock('./audit', () => ({
+  createAuditManager: vi.fn(),
+  setGlobalAuditManager: vi.fn()
+}));
+
+vi.mock('./cache', () => ({
+  rbacCache: {
+    clear: vi.fn(),
+    invalidate: vi.fn(),
+    get: vi.fn(),
+    set: vi.fn()
+  },
+  RBACCache: {
+    generatePermissionKey: vi.fn(({ userId, organisationId, eventId, appId, permission }) => 
+      `permission:${userId}:${organisationId}:${eventId || 'null'}:${appId || 'null'}:${permission}`
+    )
+  },
+  CACHE_PATTERNS: {
+    PERMISSION: vi.fn((userId, organisationId) => `permission:${userId}:${organisationId}:*`),
+    USER: vi.fn((userId) => `permission:${userId}:*`),
+    ORGANISATION: vi.fn((organisationId) => `permission:*:${organisationId}:*`),
+    EVENT: vi.fn((eventId) => `permission:*:*:${eventId}:*`),
+    APP: vi.fn((appId) => `permission:*:*:*:${appId}`)
+  }
+}));
+
+vi.mock('./config', () => ({
+  createRBACConfig: vi.fn(),
+  getRBACLogger: vi.fn(() => ({
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn()
+  }))
+}));
+
+// Mock Supabase client
+const mockSupabase = {
+  from: vi.fn(() => ({
+    select: vi.fn(() => ({
+      eq: vi.fn(() => ({
+        eq: vi.fn(() => ({
+          single: vi.fn()
+        }))
+      }))
+    })),
+    insert: vi.fn(() => ({
+      select: vi.fn()
+    })),
+    update: vi.fn(() => ({
+      eq: vi.fn(() => ({
+        select: vi.fn()
+      }))
+    })),
+    delete: vi.fn(() => ({
+      eq: vi.fn()
+    })),
+    rpc: vi.fn()
+  })),
+  auth: {
+    getUser: vi.fn()
+  }
+};
+
+describe('RBAC API', () => {
+  const mockCreateRBACEngine = vi.mocked(createRBACEngine);
+  const mockCreateAuditManager = vi.mocked(createAuditManager);
+  const mockSetGlobalAuditManager = vi.mocked(setGlobalAuditManager);
+  const mockCreateRBACConfig = vi.mocked(createRBACConfig);
+  const mockGetRBACLogger = vi.mocked(getRBACLogger);
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('setupRBAC', () => {
+    it('initializes RBAC system correctly', () => {
+      const originalEnv = process.env.NODE_ENV;
+      process.env.NODE_ENV = 'production';
+      
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any);
+
+      expect(mockCreateRBACConfig).toHaveBeenCalledWith({
+        supabase: mockSupabase,
+        debug: false,
+        logLevel: 'warn',
+        developmentMode: false
+      });
+      
+      process.env.NODE_ENV = originalEnv;
+
+      expect(mockCreateRBACEngine).toHaveBeenCalledWith(mockSupabase);
+      expect(mockCreateAuditManager).toHaveBeenCalledWith(mockSupabase);
+      expect(mockSetGlobalAuditManager).toHaveBeenCalledWith(mockAuditManager);
+      expect(mockLogger.info).toHaveBeenCalledWith('RBAC system initialized successfully');
+    });
+
+    it('handles custom configuration', () => {
+      const customConfig = {
+        debug: false,
+        logLevel: 'error' as const,
+        developmentMode: false
+      };
+
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any, customConfig);
+
+      expect(mockCreateRBACConfig).toHaveBeenCalledWith({
+        supabase: mockSupabase,
+        debug: false,
+        logLevel: 'error',
+        developmentMode: false
+      });
+    });
+
+    it('handles configuration errors gracefully', () => {
+      const error = new Error('Configuration error');
+      mockCreateRBACConfig.mockImplementation(() => {
+        throw error;
+      });
+
+      expect(() => {
+        setupRBAC(mockSupabase as any);
+      }).toThrow('Configuration error');
+    });
+
+    it('handles engine creation errors gracefully', () => {
+      const error = new Error('Engine creation error');
+      mockCreateRBACEngine.mockImplementation(() => {
+        throw error;
+      });
+
+      expect(() => {
+        setupRBAC(mockSupabase as any);
+      }).toThrow('Engine creation error');
+    });
+
+    it('handles audit manager creation errors gracefully', () => {
+      const error = new Error('Audit manager creation error');
+      mockCreateAuditManager.mockImplementation(() => {
+        throw error;
+      });
+
+      expect(() => {
+        setupRBAC(mockSupabase as any);
+      }).toThrow('Audit manager creation error');
+    });
+  });
+
+  describe('Global Engine Management', () => {
+    it('creates global engine when initialized', () => {
+      const mockEngine = { id: 'test-engine' };
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+
+      expect(mockCreateRBACEngine).toHaveBeenCalledWith(mockSupabase);
+    });
+
+    it('handles multiple initialization calls', () => {
+      const mockEngine = { id: 'test-engine' };
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+      setupRBAC(mockSupabase as any);
+
+      expect(mockCreateRBACEngine).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('Environment Detection', () => {
+    it('detects development environment correctly', () => {
+      const originalEnv = process.env.NODE_ENV;
+      process.env.NODE_ENV = 'development';
+
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any);
+
+      expect(mockCreateRBACConfig).toHaveBeenCalledWith({
+        supabase: mockSupabase,
+        debug: true,
+        logLevel: 'warn',
+        developmentMode: true
+      });
+
+      process.env.NODE_ENV = originalEnv;
+    });
+
+    it('detects production environment correctly', () => {
+      const originalEnv = process.env.NODE_ENV;
+      process.env.NODE_ENV = 'production';
+
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any);
+
+      expect(mockCreateRBACConfig).toHaveBeenCalledWith({
+        supabase: mockSupabase,
+        debug: false,
+        logLevel: 'warn',
+        developmentMode: false
+      });
+
+      process.env.NODE_ENV = originalEnv;
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('handles missing supabase client', () => {
+      // The function doesn't throw, it just creates config with null
+      expect(() => {
+        setupRBAC(null as any);
+      }).not.toThrow();
+    });
+
+    it('handles invalid supabase client', () => {
+      const invalidSupabase = { invalid: 'client' };
+      
+      // The function doesn't throw, it just creates config with invalid client
+      expect(() => {
+        setupRBAC(invalidSupabase as any);
+      }).not.toThrow();
+    });
+  });
+
+  describe('Multiple Initialization', () => {
+    it('handles multiple setupRBAC calls gracefully', () => {
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      // First call
+      setupRBAC(mockSupabase as any);
+      
+      // Second call should not throw
+      expect(() => {
+        setupRBAC(mockSupabase as any);
+      }).not.toThrow();
+
+      expect(mockCreateRBACEngine).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('Configuration Validation', () => {
+    it('validates required supabase client', () => {
+      // The function doesn't throw, it just creates config with undefined
+      expect(() => {
+        setupRBAC(undefined as any);
+      }).not.toThrow();
+    });
+
+    it('validates supabase client structure', () => {
+      const invalidSupabase = {
+        from: 'not-a-function',
+        auth: 'not-an-object'
+      };
+
+      // The function doesn't throw, it just creates config with invalid client
+      expect(() => {
+        setupRBAC(invalidSupabase as any);
+      }).not.toThrow();
+    });
+  });
+
+  describe('Logging Integration', () => {
+    it('logs initialization success', () => {
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue({} as any);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any);
+
+      expect(mockLogger.info).toHaveBeenCalledWith('RBAC system initialized successfully');
+    });
+
+    it('logs configuration details in development', () => {
+      const originalEnv = process.env.NODE_ENV;
+      process.env.NODE_ENV = 'development';
+
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue({} as any);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any, { debug: true });
+
+      // The function may or may not call debug, so we just check it was called
+      expect(mockGetRBACLogger).toHaveBeenCalled();
+
+      process.env.NODE_ENV = originalEnv;
+    });
+  });
+
+  describe('Cache Integration', () => {
+    it('initializes cache correctly', () => {
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      setupRBAC(mockSupabase as any);
+
+      // Cache should be available
+      expect(rbacCache).toBeDefined();
+    });
+  });
+
+  describe('Type Safety', () => {
+    it('accepts valid Supabase client types', () => {
+      const validSupabase = {
+        from: vi.fn(),
+        auth: {
+          getUser: vi.fn()
+        },
+        rpc: vi.fn()
+      };
+
+      const mockEngine = { id: 'test-engine' };
+      const mockAuditManager = { id: 'test-audit' };
+      const mockLogger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
+      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
+      mockGetRBACLogger.mockReturnValue(mockLogger);
+
+      expect(() => {
+        setupRBAC(validSupabase as any);
+      }).not.toThrow();
+    });
+  });
+
+  describe('Permission Functions', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        getAppConfig: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    describe('getAccessLevel', () => {
+      it('returns access level for user', async () => {
+        const { getAccessLevel } = await import('./api');
+        
+        const mockAccessLevel = 'admin';
+        mockEngine.getAccessLevel.mockResolvedValue(mockAccessLevel);
+
+        const result = await getAccessLevel({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        });
+
+        expect(result).toBe(mockAccessLevel);
+        expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        });
+      });
+
+      it('handles engine errors', async () => {
+        const { getAccessLevel } = await import('./api');
+        
+        const error = new Error('Engine error');
+        mockEngine.getAccessLevel.mockRejectedValue(error);
+
+        await expect(getAccessLevel({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        })).rejects.toThrow('Engine error');
+      });
+    });
+
+    describe('getPermissionMap', () => {
+      it('returns permission map for user', async () => {
+        const { getPermissionMap } = await import('./api');
+        
+        const mockPermissionMap = {
+          'read:users': true,
+          'write:users': false
+        };
+        mockEngine.getPermissionMap.mockResolvedValue(mockPermissionMap);
+
+        const result = await getPermissionMap({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        });
+
+        expect(result).toEqual(mockPermissionMap);
+        expect(mockEngine.getPermissionMap).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        });
+      });
+
+      it('handles engine errors', async () => {
+        const { getPermissionMap } = await import('./api');
+        
+        const error = new Error('Engine error');
+        mockEngine.getPermissionMap.mockRejectedValue(error);
+
+        await expect(getPermissionMap({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        })).rejects.toThrow('Engine error');
+      });
+    });
+
+    describe('isPermitted', () => {
+      it('returns permission result', async () => {
+        const { isPermitted } = await import('./api');
+        
+        mockEngine.isPermitted.mockResolvedValue(true);
+
+        const result = await isPermitted({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users',
+          pageId: 'page-789'
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users',
+          pageId: 'page-789'
+        });
+      });
+
+      it('handles engine errors', async () => {
+        const { isPermitted } = await import('./api');
+        
+        const error = new Error('Engine error');
+        mockEngine.isPermitted.mockRejectedValue(error);
+
+        await expect(isPermitted({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users'
+        })).rejects.toThrow('Engine error');
+      });
+    });
+
+    describe('isPermittedCached', () => {
+      it('returns cached result when available', async () => {
+        const { isPermittedCached } = await import('./api');
+        
+        const cacheKey = 'permission:user-123:org-456:null:null:read:users';
+        rbacCache.get.mockReturnValue(true);
+
+        const result = await isPermittedCached({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users',
+          pageId: 'page-789'
+        });
+
+        expect(result).toBe(true);
+        expect(rbacCache.get).toHaveBeenCalledWith(cacheKey);
+        expect(mockEngine.isPermitted).not.toHaveBeenCalled();
+      });
+
+      it('checks permission and caches result when not cached', async () => {
+        const { isPermittedCached } = await import('./api');
+        
+        rbacCache.get.mockReturnValue(null);
+        mockEngine.isPermitted.mockResolvedValue(true);
+
+        const result = await isPermittedCached({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users',
+          pageId: 'page-789'
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users',
+          pageId: 'page-789'
+        });
+        expect(rbacCache.set).toHaveBeenCalledWith(
+          expect.any(String),
+          true
+        );
+      });
+    });
+
+    describe('hasPermission', () => {
+      it('calls isPermitted', async () => {
+        const { hasPermission } = await import('./api');
+        
+        mockEngine.isPermitted.mockResolvedValue(true);
+
+        const result = await hasPermission({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users'
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permission: 'read:users'
+        });
+      });
+    });
+
+    describe('hasAnyPermission', () => {
+      it('returns true if user has any permission', async () => {
+        const { hasAnyPermission } = await import('./api');
+        
+        mockEngine.isPermitted
+          .mockResolvedValueOnce(false) // First permission denied
+          .mockResolvedValueOnce(true); // Second permission granted
+
+        const result = await hasAnyPermission({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permissions: ['read:users', 'write:users']
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
+      });
+
+      it('returns false if user has no permissions', async () => {
+        const { hasAnyPermission } = await import('./api');
+        
+        mockEngine.isPermitted.mockResolvedValue(false);
+
+        const result = await hasAnyPermission({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permissions: ['read:users', 'write:users']
+        });
+
+        expect(result).toBe(false);
+        expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
+      });
+    });
+
+    describe('hasAllPermissions', () => {
+      it('returns true if user has all permissions', async () => {
+        const { hasAllPermissions } = await import('./api');
+        
+        mockEngine.isPermitted.mockResolvedValue(true);
+
+        const result = await hasAllPermissions({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permissions: ['read:users', 'write:users']
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
+      });
+
+      it('returns false if user lacks any permission', async () => {
+        const { hasAllPermissions } = await import('./api');
+        
+        mockEngine.isPermitted
+          .mockResolvedValueOnce(true) // First permission granted
+          .mockResolvedValueOnce(false); // Second permission denied
+
+        const result = await hasAllPermissions({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+          permissions: ['read:users', 'write:users']
+        });
+
+        expect(result).toBe(false);
+        expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
+      });
+    });
+
+    describe('isSuperAdmin', () => {
+      it('returns super admin status', async () => {
+        const { isSuperAdmin } = await import('./api');
+        
+        mockEngine.checkSuperAdmin.mockResolvedValue(true);
+
+        const result = await isSuperAdmin('user-123');
+
+        expect(result).toBe(true);
+        expect(mockEngine.checkSuperAdmin).toHaveBeenCalledWith('user-123');
+      });
+
+      it('handles engine errors', async () => {
+        const { isSuperAdmin } = await import('./api');
+        
+        const error = new Error('Engine error');
+        mockEngine.checkSuperAdmin.mockRejectedValue(error);
+
+        await expect(isSuperAdmin('user-123')).rejects.toThrow('Engine error');
+      });
+    });
+
+    describe('getAppConfig', () => {
+      it('returns app configuration', async () => {
+        const { getAppConfig } = await import('./api');
+        
+        const mockConfig = { requires_event: true };
+        mockEngine.getAppConfig.mockResolvedValue(mockConfig);
+
+        const result = await getAppConfig('app-123');
+
+        expect(result).toEqual(mockConfig);
+        expect(mockEngine.getAppConfig).toHaveBeenCalledWith('app-123');
+      });
+
+      it('handles engine errors', async () => {
+        const { getAppConfig } = await import('./api');
+        
+        const error = new Error('Engine error');
+        mockEngine.getAppConfig.mockRejectedValue(error);
+
+        await expect(getAppConfig('app-123')).rejects.toThrow('Engine error');
+      });
+    });
+
+    describe('isOrganisationAdmin', () => {
+      it('returns true for admin access level', async () => {
+        const { isOrganisationAdmin } = await import('./api');
+        
+        mockEngine.getAccessLevel.mockResolvedValue('admin');
+
+        const result = await isOrganisationAdmin('user-123', 'org-456');
+
+        expect(result).toBe(true);
+        expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' }
+        });
+      });
+
+      it('returns true for super access level', async () => {
+        const { isOrganisationAdmin } = await import('./api');
+        
+        mockEngine.getAccessLevel.mockResolvedValue('super');
+
+        const result = await isOrganisationAdmin('user-123', 'org-456');
+
+        expect(result).toBe(true);
+      });
+
+      it('returns false for other access levels', async () => {
+        const { isOrganisationAdmin } = await import('./api');
+        
+        mockEngine.getAccessLevel.mockResolvedValue('user');
+
+        const result = await isOrganisationAdmin('user-123', 'org-456');
+
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('isEventAdmin', () => {
+      it('returns true for admin access level', async () => {
+        const { isEventAdmin } = await import('./api');
+        
+        mockEngine.getAccessLevel.mockResolvedValue('admin');
+
+        const result = await isEventAdmin('user-123', {
+          organisationId: 'org-456',
+          eventId: 'event-789',
+          appId: 'app-101'
+        });
+
+        expect(result).toBe(true);
+        expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: {
+            organisationId: 'org-456',
+            eventId: 'event-789',
+            appId: 'app-101'
+          }
+        });
+      });
+
+      it('returns false when eventId is missing', async () => {
+        const { isEventAdmin } = await import('./api');
+        
+        const result = await isEventAdmin('user-123', {
+          organisationId: 'org-456',
+          eventId: undefined,
+          appId: 'app-101'
+        });
+
+        expect(result).toBe(false);
+        expect(mockEngine.getAccessLevel).not.toHaveBeenCalled();
+      });
+
+      it('returns false when appId is missing', async () => {
+        const { isEventAdmin } = await import('./api');
+        
+        const result = await isEventAdmin('user-123', {
+          organisationId: 'org-456',
+          eventId: 'event-789',
+          appId: undefined
+        });
+
+        expect(result).toBe(false);
+        expect(mockEngine.getAccessLevel).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('Cache Management', () => {
+    beforeEach(() => {
+      const mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        getAppConfig: vi.fn()
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    describe('invalidateUserCache', () => {
+      it('invalidates user cache with organisation', async () => {
+        const { invalidateUserCache } = await import('./api');
+        
+        invalidateUserCache('user-123', 'org-456');
+
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(
+          expect.stringContaining('user-123')
+        );
+      });
+
+      it('invalidates user cache without organisation', async () => {
+        const { invalidateUserCache } = await import('./api');
+        
+        invalidateUserCache('user-123');
+
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(
+          expect.stringContaining('user-123')
+        );
+      });
+    });
+
+    describe('invalidateOrganisationCache', () => {
+      it('invalidates organisation cache', async () => {
+        const { invalidateOrganisationCache } = await import('./api');
+        
+        invalidateOrganisationCache('org-456');
+
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(
+          expect.stringContaining('org-456')
+        );
+      });
+    });
+
+    describe('invalidateEventCache', () => {
+      it('invalidates event cache', async () => {
+        const { invalidateEventCache } = await import('./api');
+        
+        invalidateEventCache('event-789');
+
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(
+          expect.stringContaining('event-789')
+        );
+      });
+    });
+
+    describe('invalidateAppCache', () => {
+      it('invalidates app cache', async () => {
+        const { invalidateAppCache } = await import('./api');
+        
+        invalidateAppCache('app-101');
+
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(
+          expect.stringContaining('app-101')
+        );
+      });
+    });
+
+    describe('clearCache', () => {
+      it('clears all cache', async () => {
+        const { clearCache } = await import('./api');
+        
+        clearCache();
+
+        expect(rbacCache.clear).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('throws RBACNotInitializedError when engine not available', async () => {
+      // Reset global engine by clearing the module cache
+      vi.resetModules();
+      
+      const { getAccessLevel } = await import('./api');
+      
+      await expect(getAccessLevel({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456' }
+      })).rejects.toThrow('RBAC system not initialized');
+    });
+  });
+});