@jmruthers/pace-core 0.5.109 → 0.5.111

package/src/components/PaceAppLayout/__tests__/PaceAppLayout.security.test.tsx

@@ -91,11 +91,20 @@ const mockOrganisationContext = {
   isOrganisationSecure: vi.fn().mockReturnValue(true)
 };
 
-vi.mock('../../../providers/OrganisationProvider', () => ({
-  OrganisationProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+vi.mock('../../../hooks/useOrganisations', () => ({
   useOrganisations: () => mockOrganisationContext
 }));
 
+// Mock useEvents hook (optional - wrapped in try/catch in component)
+vi.mock('../../../providers/EventsProvider', () => ({
+  useEvents: vi.fn(() => ({
+    selectedEvent: { event_id: 'event-123' },
+    events: [],
+    isLoading: false,
+    error: null,
+  })),
+}));
+
 // Mock the new RBAC system for security testing
 const mockIsPermitted = vi.fn().mockResolvedValue(true);
 const mockCheckPermission = vi.fn().mockResolvedValue(true);
@@ -108,6 +117,38 @@ vi.mock('../../../rbac/api', () => ({
   setupRBAC: vi.fn()
 }));
 
+// Mock RBAC hooks
+const mockHasPermissionRBAC = vi.fn().mockResolvedValue(true);
+const mockUseRBAC = vi.fn(() => ({
+  hasPermission: mockHasPermissionRBAC,
+  isLoading: false,
+  error: null,
+  hasGlobalPermission: vi.fn().mockResolvedValue(true),
+  hasOrganisationPermission: vi.fn().mockResolvedValue(true),
+  hasEventPermission: vi.fn().mockResolvedValue(true),
+  globalRole: null,
+  organisationRoles: [],
+  eventRoles: [],
+  permissionMap: {},
+}));
+
+const mockUseCan = vi.fn(() => ({
+  can: true,
+  isLoading: false,
+  error: null,
+  refetch: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../../rbac/hooks', () => ({
+  useRBAC: () => mockUseRBAC(),
+  useCan: (...args: any[]) => mockUseCan(...args),
+  useResolvedScope: vi.fn(() => ({
+    resolvedScope: { organisationId: 'org-123', eventId: 'event-123', appId: 'app-123' },
+    isLoading: false,
+    error: null,
+  })),
+}));
+
 // Mock child components
 vi.mock('../../Header', () => ({
   Header: vi.fn(({ appName, user, onSignOut, onChangePassword, onNavigate, currentPath, logo, userMenu, actions }) => (
@@ -186,6 +227,28 @@ describe('PaceAppLayout Security', () => {
     mockIsPermitted.mockClear();
     mockIsPermitted.mockResolvedValue(true);
     
+    // Reset RBAC hook mocks
+    mockHasPermissionRBAC.mockClear();
+    mockHasPermissionRBAC.mockResolvedValue(true);
+    mockUseCan.mockReturnValue({
+      can: true,
+      isLoading: false,
+      error: null,
+      refetch: vi.fn().mockResolvedValue(undefined),
+    });
+    mockUseRBAC.mockReturnValue({
+      hasPermission: mockHasPermissionRBAC,
+      isLoading: false,
+      error: null,
+      hasGlobalPermission: vi.fn().mockResolvedValue(true),
+      hasOrganisationPermission: vi.fn().mockResolvedValue(true),
+      hasEventPermission: vi.fn().mockResolvedValue(true),
+      globalRole: null,
+      organisationRoles: [],
+      eventRoles: [],
+      permissionMap: {},
+    });
+    
     // Reset the mocked function
     const { isPermitted } = await import('../../../rbac/api');
     vi.mocked(isPermitted).mockClear();
@@ -221,9 +284,13 @@ describe('PaceAppLayout Security', () => {
     });
 
     it('prevents access when user lacks permission', async () => {
-      // Mock the RBAC system to deny permission
-      const { isPermitted } = await import('../../../rbac/api');
-      vi.mocked(isPermitted).mockResolvedValue(false);
+      // Mock useCan to return false (deny access)
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -235,8 +302,8 @@ describe('PaceAppLayout Security', () => {
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.getByText("You don't have permission to access this page.")).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('enforces route-specific permissions', async () => {
       const routePermissions: Record<string, Operation> = {
@@ -263,9 +330,13 @@ describe('PaceAppLayout Security', () => {
     });
 
     it('handles permission check failures securely', async () => {
-      // Mock the RBAC system to throw an error
-      const { isPermitted } = await import('../../../rbac/api');
-      vi.mocked(isPermitted).mockRejectedValue(new Error('Permission check failed'));
+      // Mock useCan to return an error state
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: new Error('Permission check failed'),
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -277,8 +348,8 @@ describe('PaceAppLayout Security', () => {
         // When permission check throws an error, should show Permission Error page
         expect(screen.getByText('Permission Error')).toBeInTheDocument();
         expect(screen.getByText('Permission check failed')).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('prevents bypassing permission checks', async () => {
       // Test that permission checks cannot be bypassed by manipulating props
@@ -309,12 +380,8 @@ describe('PaceAppLayout Security', () => {
 
   describe('Navigation Security', () => {
     it('filters navigation items based on permissions', async () => {
-      // Mock permission check to deny access to admin
-      mockIsPermitted.mockImplementation((userId, scope, operation, pageId) => {
-        if (pageId === 'admin') return Promise.resolve(false);
-        return Promise.resolve(true);
-      });
-      
+      // Mock permission check to allow all permissions for navigation filtering
+      // The navigation filtering uses getPermissionMap which is already mocked
       render(
         <TestWrapper>
           <PaceAppLayout 
@@ -333,8 +400,8 @@ describe('PaceAppLayout Security', () => {
         // With permission enforcement enabled, the component should render normally
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('prevents navigation to unauthorized routes', () => {
       render(
@@ -596,9 +663,13 @@ describe('PaceAppLayout Security', () => {
     });
 
     it('handles permission errors securely', async () => {
-      // Mock the RBAC system to deny permission (secure behavior)
-      const { isPermitted } = await import('../../../rbac/api');
-      vi.mocked(isPermitted).mockResolvedValue(false);
+      // Mock useCan to return false (deny access)
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -608,15 +679,18 @@ describe('PaceAppLayout Security', () => {
       
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('prevents information leakage in error messages', async () => {
-      // Mock the RBAC system to throw an error with sensitive information
-      const { isPermitted } = await import('../../../rbac/api');
+      // Mock useCan to return an error with sensitive information
       const sensitiveError = new Error('Database connection failed: password=secret123');
-      vi.mocked(isPermitted).mockClear();
-      vi.mocked(isPermitted).mockRejectedValue(sensitiveError);
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: sensitiveError,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -634,8 +708,8 @@ describe('PaceAppLayout Security', () => {
         expect(screen.getByText('Permission Error')).toBeInTheDocument();
         // Should not expose sensitive information
         expect(screen.queryByText('password=secret123')).not.toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
   });
 
   describe('Session Security', () => {
@@ -712,16 +786,6 @@ describe('PaceAppLayout Security', () => {
 
     it('prevents privilege escalation', async () => {
       // Test that users cannot escalate their privileges
-      const { isPermitted } = await import('../../../rbac/api');
-      vi.mocked(isPermitted).mockImplementation(({ userId, scope, permission, pageId }) => {
-        // Simulate user trying to access admin with read permission
-        // Permission is now formatted as "operation:page.pageId"
-        if (pageId === 'admin' && permission === 'read:page.admin') {
-          return Promise.resolve(false);
-        }
-        return Promise.resolve(true);
-      });
-      
       // Create a test wrapper with admin path for privilege escalation test
       const AdminTestWrapper = ({ children }: { children: React.ReactNode }) => (
         <BrowserRouter>
@@ -734,6 +798,14 @@ describe('PaceAppLayout Security', () => {
       // Mock the location to be /admin for this test
       mockLocation.pathname = '/admin';
       
+      // Mock useCan to return false (deny admin access)
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
+      
       render(
         <AdminTestWrapper>
           <PaceAppLayout 

package/src/components/PaceAppLayout/__tests__/PaceAppLayout.unit.test.tsx

@@ -78,11 +78,20 @@ const mockOrganisationContext = {
   isOrganisationSecure: vi.fn().mockReturnValue(true)
 };
 
-vi.mock('../../../providers/OrganisationProvider', () => ({
-  OrganisationProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+vi.mock('../../../hooks/useOrganisations', () => ({
   useOrganisations: () => mockOrganisationContext
 }));
 
+// Mock useEvents hook (optional - wrapped in try/catch in component)
+vi.mock('../../../providers/EventsProvider', () => ({
+  useEvents: vi.fn(() => ({
+    selectedEvent: { event_id: 'event-123' },
+    events: [],
+    isLoading: false,
+    error: null,
+  })),
+}));
+
 // Mock the new RBAC system
 const mockIsPermitted = vi.fn().mockImplementation((input) => {
   console.log('[PaceAppLayout] Page access attempt:', {
@@ -104,6 +113,38 @@ vi.mock('../../../rbac/api', () => ({
   setupRBAC: vi.fn()
 }));
 
+// Mock RBAC hooks
+const mockHasPermissionRBAC = vi.fn().mockResolvedValue(true);
+const mockUseRBAC = vi.fn(() => ({
+  hasPermission: mockHasPermissionRBAC,
+  isLoading: false,
+  error: null,
+  hasGlobalPermission: vi.fn().mockResolvedValue(true),
+  hasOrganisationPermission: vi.fn().mockResolvedValue(true),
+  hasEventPermission: vi.fn().mockResolvedValue(true),
+  globalRole: null,
+  organisationRoles: [],
+  eventRoles: [],
+  permissionMap: {},
+}));
+
+const mockUseCan = vi.fn(() => ({
+  can: true,
+  isLoading: false,
+  error: null,
+  refetch: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../../rbac/hooks', () => ({
+  useRBAC: () => mockUseRBAC(),
+  useCan: (...args: any[]) => mockUseCan(...args),
+  useResolvedScope: vi.fn(() => ({
+    resolvedScope: { organisationId: 'org-123', eventId: 'event-123', appId: 'app-123' },
+    isLoading: false,
+    error: null,
+  })),
+}));
+
 // Mock Footer (static, doesn't depend on props)
 vi.mock('../../Footer', () => ({
   Footer: vi.fn(() => <footer data-testid="mock-footer" role="contentinfo">Mock Footer</footer>)
@@ -194,6 +235,27 @@ describe('PaceAppLayout Component', () => {
     // Explicitly re-mock updatePassword to always return { error: null }
     mockUpdatePassword.mockResolvedValue({ error: null });
     
+    // Reset RBAC mocks to default state
+    mockHasPermissionRBAC.mockResolvedValue(true);
+    mockUseCan.mockReturnValue({
+      can: true,
+      isLoading: false,
+      error: null,
+      refetch: vi.fn().mockResolvedValue(undefined),
+    });
+    mockUseRBAC.mockReturnValue({
+      hasPermission: mockHasPermissionRBAC,
+      isLoading: false,
+      error: null,
+      hasGlobalPermission: vi.fn().mockResolvedValue(true),
+      hasOrganisationPermission: vi.fn().mockResolvedValue(true),
+      hasEventPermission: vi.fn().mockResolvedValue(true),
+      globalRole: null,
+      organisationRoles: [],
+      eventRoles: [],
+      permissionMap: {},
+    });
+    
     // Reset location mock
     Object.defineProperty(window, 'location', {
       value: { pathname: '/test-path' },
@@ -519,7 +581,11 @@ describe('PaceAppLayout Component', () => {
         </TestWrapper>
       );
       
-      expect(mockIsPermitted).not.toHaveBeenCalled();
+      // useCan is always called for consistency, but when enforcePermissions is false,
+      // the result is ignored (hasPermission = enforcePermissions ? can : true)
+      // So the component should render normally regardless of permission check result
+      expect(screen.getByTestId('mock-header')).toBeInTheDocument();
+      expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
     });
 
     it('enables permission enforcement when enforcePermissions is true', async () => {
@@ -569,13 +635,15 @@ describe('PaceAppLayout Component', () => {
       );
       
       await waitFor(() => {
-        expect(mockIsPermitted).toHaveBeenCalledWith({
-          userId: 'test-user-id',
-          scope: expect.objectContaining({ organisationId: 'test-org-123' }),
-          permission: 'delete:page.test-path',
-          pageId: 'test-path'
-        });
-      });
+        // useCan is called with userId, scope, permission, pageId, useCache
+        expect(mockUseCan).toHaveBeenCalledWith(
+          'test-user-id',
+          expect.objectContaining({ organisationId: 'org-123' }),
+          'delete:page.test-path',
+          'test-path',
+          true
+        );
+      }, { timeout: 2000 });
     });
 
     it('uses custom page ID mapping when provided', async () => {
@@ -594,18 +662,25 @@ describe('PaceAppLayout Component', () => {
       );
       
       await waitFor(() => {
-        expect(mockIsPermitted).toHaveBeenCalledWith({
-          userId: 'test-user-id',
-          scope: expect.objectContaining({ organisationId: 'test-org-123' }),
-          permission: 'read:page.custom-page-id',
-          pageId: 'custom-page-id'
-        });
-      });
+        // useCan is called with userId, scope, permission, pageId, useCache
+        expect(mockUseCan).toHaveBeenCalledWith(
+          'test-user-id',
+          expect.objectContaining({ organisationId: 'org-123' }),
+          'read:page.custom-page-id',
+          'custom-page-id',
+          true
+        );
+      }, { timeout: 2000 });
     });
 
     it('shows loading state while checking permissions', async () => {
-      // Make permission check take time
-      mockIsPermitted.mockImplementation((input) => new Promise(resolve => setTimeout(() => resolve(true), 100)));
+      // Mock useCan to return loading state
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: true,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -618,7 +693,14 @@ describe('PaceAppLayout Component', () => {
 
     it('shows permission error when checkPermission throws', async () => {
       const mockError = new Error('Permission check failed');
-      mockIsPermitted.mockRejectedValue(mockError);
+      
+      // Mock useCan to return an error state
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: mockError,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -629,11 +711,17 @@ describe('PaceAppLayout Component', () => {
       await waitFor(() => {
         expect(screen.getByText('Permission Error')).toBeInTheDocument();
         expect(screen.getByText('Permission check failed')).toBeInTheDocument();
-      }, { timeout: 2000 });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('shows access denied when user lacks permission', async () => {
-      mockIsPermitted.mockResolvedValue(false);
+      // Mock useCan to return false (user lacks permission)
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -644,11 +732,18 @@ describe('PaceAppLayout Component', () => {
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.getByText("You don't have permission to access this page.")).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('shows custom permission fallback when provided', async () => {
-      mockIsPermitted.mockResolvedValue(false);
+      // Mock useCan to return false
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
+      
       const CustomFallback = () => <div data-testid="custom-fallback">Custom Access Denied</div>;
       
       render(
@@ -663,11 +758,17 @@ describe('PaceAppLayout Component', () => {
       
       await waitFor(() => {
         expect(screen.getByTestId('custom-fallback')).toBeInTheDocument();
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('provides go home button in access denied state', async () => {
-      mockIsPermitted.mockResolvedValue(false);
+      // Mock useCan to return false
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -681,12 +782,19 @@ describe('PaceAppLayout Component', () => {
         
         fireEvent.click(goHomeButton);
         expect(mockNavigate).toHaveBeenCalledWith('/');
-      }, { timeout: 2000 });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
 
     it('provides go home button in permission error state', async () => {
       const mockError = new Error('Permission check failed');
-      mockIsPermitted.mockRejectedValue(mockError);
+      
+      // Mock useCan to return an error state
+      mockUseCan.mockReturnValueOnce({
+        can: false,
+        isLoading: false,
+        error: mockError,
+        refetch: vi.fn().mockResolvedValue(undefined),
+      });
       
       render(
         <TestWrapper>
@@ -700,8 +808,8 @@ describe('PaceAppLayout Component', () => {
         
         fireEvent.click(goHomeButton);
         expect(mockNavigate).toHaveBeenCalledWith('/');
-      });
-    });
+      }, { timeout: 5000 });
+    }, { timeout: 6000 });
   });
 
   describe('Navigation Filtering by Permissions', () => {
@@ -736,9 +844,9 @@ describe('PaceAppLayout Component', () => {
       // Wait a bit to see if the component renders
       await new Promise(resolve => setTimeout(resolve, 100));
       
-      // Note: The filtering is async, so we need to wait with a timeout
+      // Note: The filtering uses getPermissionMap which is mocked, so just verify rendering
       await waitFor(() => {
-        expect(mockIsPermitted).toHaveBeenCalled();
+        expect(screen.getByTestId('mock-header')).toBeInTheDocument();
       }, { timeout: 2000 });
       
       // Verify the component rendered successfully
@@ -826,13 +934,15 @@ describe('PaceAppLayout Component', () => {
       );
       
       await waitFor(() => {
-        expect(mockIsPermitted).toHaveBeenCalledWith({
-          userId: 'test-user-id',
-          scope: expect.objectContaining({ organisationId: 'test-org-123' }),
-          permission: 'read:page.new-path',
-          pageId: 'new-path'
-        });
-      });
+        // useCan is called with userId, scope, permission, pageId, useCache
+        expect(mockUseCan).toHaveBeenCalledWith(
+          'test-user-id',
+          expect.objectContaining({ organisationId: 'org-123' }),
+          'read:page.new-path',
+          'new-path',
+          true
+        );
+      }, { timeout: 2000 });
       
       // Reset for other tests
       mockLocation.pathname = '/test-path';
@@ -894,8 +1004,8 @@ describe('PaceAppLayout Component', () => {
       );
       
       await waitFor(() => {
-        expect(mockIsPermitted).toHaveBeenCalledTimes(1);
-      });
+        expect(mockUseCan).toHaveBeenCalled();
+      }, { timeout: 2000 });
     });
   });
 }); 

package/src/components/PaceLoginPage/PaceLoginPage.tsx

@@ -121,13 +121,14 @@
  * - Tailwind CSS - Styling
  */
 
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useState, useContext } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { useUnifiedAuth } from '../../providers';
 import { isSuperAdmin } from '../../rbac/api';
 import { LoginForm } from '../LoginForm';
 import { Button, Input, Label } from '..';
 import { clearPalette } from '../../theming/runtime';
+import { EventServiceContext } from '../../providers/services/EventServiceProvider';
 
 export interface PaceLoginPageProps {
   /** The name of the application to be displayed on the login form. */
@@ -174,12 +175,40 @@ export const PaceLoginPage: React.FC<PaceLoginPageProps> = ({
   const [accessError, setAccessError] = useState<string | null>(null);
   const [isCheckingAccess, setIsCheckingAccess] = useState(false);
 
+  // Get event service context (may not be available if outside EventServiceProvider)
+  // Using useContext directly allows graceful handling when provider is not available
+  const eventServiceContext = useContext(EventServiceContext);
+  const eventService = eventServiceContext?.eventService || null;
+
   // Clear any active event theme when login page mounts
   // This ensures the login screen always uses default colors
   useEffect(() => {
     clearPalette();
   }, []);
 
+  // Restore persisted event after login screen has rendered
+  // This happens after the login page is fully rendered, allowing events to be loaded first
+  useEffect(() => {
+    const restoreEvent = async () => {
+      try {
+        const isOnLoginPage = window.location.pathname === '/login' || window.location.pathname.startsWith('/login');
+        if (isOnLoginPage && eventService) {
+          await eventService.restorePersistedEvent();
+        }
+      } catch (error) {
+        // Service may not be available yet or events not loaded - that's okay
+        console.debug('[PaceLoginPage] Could not restore persisted event (service may not be ready):', error);
+      }
+    };
+    
+    // Small delay to ensure login page is fully rendered before restoring
+    const timeoutId = setTimeout(() => {
+      restoreEvent();
+    }, 100);
+    
+    return () => clearTimeout(timeoutId);
+  }, [eventService]);
+
   // Check app access after authentication using RBAC
   useEffect(() => {
     if (!requireAppAccess || !isAuthenticated || isLoading || !user || !supabase) {