@jmruthers/pace-core 0.5.115 → 0.5.116

package/src/rbac/audit.test.ts

@@ -349,6 +349,212 @@ describe('RBACAuditManager', () => {
     });
   });
 
+  describe('Fallback Logging', () => {
+    let consoleLogSpy: any;
+    let consoleWarnSpy: any;
+
+    beforeEach(() => {
+      consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    });
+
+    afterEach(() => {
+      consoleLogSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+    });
+
+    it('uses fallback logging when database insert fails', async () => {
+      const dbError = {
+        message: 'Database connection failed',
+        code: 'PGRST116',
+        details: 'Connection timeout',
+        hint: 'Check network connectivity'
+      };
+
+      mockSupabase.from().insert.mockResolvedValue({
+        data: null,
+        error: dbError
+      });
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Verify fallback logging was called
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        '[RBAC Audit Fallback]',
+        expect.objectContaining({
+          timestamp: expect.any(String),
+          event: expect.objectContaining({
+            type: 'permission_check',
+            userId: 'user-123',
+            organisationId: 'org-456',
+            permission: 'read:users'
+          }),
+          error: 'Database connection failed',
+          note: 'Database audit logging failed, using console fallback'
+        })
+      );
+    });
+
+    it('uses fallback logging when exception occurs', async () => {
+      const networkError = new Error('Network error');
+      mockSupabase.from().insert.mockRejectedValue(networkError);
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Verify fallback logging was called
+      expect(consoleLogSpy).toHaveBeenCalledWith(
+        '[RBAC Audit Fallback]',
+        expect.objectContaining({
+          timestamp: expect.any(String),
+          event: expect.objectContaining({
+            type: 'permission_check',
+            userId: 'user-123',
+            organisationId: 'org-456',
+            permission: 'read:users',
+            decision: true,
+            source: 'api',
+            duration_ms: 100
+          }),
+          error: 'Network error', // Error is converted to string message
+          note: 'Database audit logging failed, using console fallback'
+        })
+      );
+    });
+
+    it('can disable fallback logging', async () => {
+      auditManager.setFallbackEnabled(false);
+
+      const dbError = {
+        message: 'Database error',
+        code: 'PGRST116'
+      };
+
+      mockSupabase.from().insert.mockResolvedValue({
+        data: null,
+        error: dbError
+      });
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Verify fallback logging was NOT called
+      expect(consoleLogSpy).not.toHaveBeenCalled();
+      
+      // But warning should still be logged
+      expect(consoleWarnSpy).toHaveBeenCalled();
+    });
+
+    it('can re-enable fallback logging', async () => {
+      auditManager.setFallbackEnabled(false);
+      auditManager.setFallbackEnabled(true);
+
+      const dbError = {
+        message: 'Database error',
+        code: 'PGRST116'
+      };
+
+      mockSupabase.from().insert.mockResolvedValue({
+        data: null,
+        error: dbError
+      });
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Verify fallback logging was called after re-enabling
+      expect(consoleLogSpy).toHaveBeenCalled();
+    });
+
+    it('fallback logging includes correct event data', async () => {
+      const dbError = {
+        message: 'Database error'
+      };
+
+      mockSupabase.from().insert.mockResolvedValue({
+        data: null,
+        error: dbError
+      });
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        permission: 'read:users',
+        decision: false,
+        source: 'ui' as AuditEventSource,
+        bypass: true,
+        duration_ms: 250,
+        cache_hit: true,
+        cache_source: 'memory',
+        metadata: { test: 'data' }
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      const fallbackCall = consoleLogSpy.mock.calls[0];
+      expect(fallbackCall[0]).toBe('[RBAC Audit Fallback]');
+      expect(fallbackCall[1]).toMatchObject({
+        event: {
+          type: 'permission_check',
+          userId: 'user-123',
+          organisationId: 'org-456',
+          eventId: 'event-789',
+          appId: 'app-101',
+          permission: 'read:users',
+          decision: false,
+          source: 'ui',
+          bypass: true,
+          duration_ms: 250,
+          cache_hit: true,
+          cache_source: 'memory',
+          metadata: { test: 'data' }
+        },
+        error: 'Database error',
+        note: 'Database audit logging failed, using console fallback'
+      });
+    });
+  });
+
   describe('Event Retrieval', () => {
     it('retrieves audit events for user', async () => {
       const mockEvents = [

package/src/rbac/audit.ts

@@ -108,6 +108,7 @@ export type AuditEventPayload =
 export class RBACAuditManager {
   private supabase: SupabaseClient<Database>;
   private enabled: boolean = true;
+  private fallbackEnabled: boolean = true;
 
   constructor(supabase: SupabaseClient<Database>) {
     this.supabase = supabase;
@@ -131,6 +132,15 @@ export class RBACAuditManager {
     return this.enabled;
   }
 
+  /**
+   * Enable or disable fallback logging (console logging when database fails)
+   * 
+   * @param enabled - Whether to enable fallback logging
+   */
+  setFallbackEnabled(enabled: boolean): void {
+    this.fallbackEnabled = enabled;
+  }
+
   /**
    * Emit an audit event
    * 
@@ -211,7 +221,7 @@ export class RBACAuditManager {
         .insert([auditEvent]);
 
       if (error) {
-        // Log the error for debugging but don't throw
+        // Log the error for debugging
         console.warn('[RBAC Audit] Failed to insert audit event:', {
           error: error.message,
           code: error.code,
@@ -219,13 +229,38 @@ export class RBACAuditManager {
           hint: error.hint,
           event: auditEvent
         });
+
+        // Use fallback logging if enabled
+        if (this.fallbackEnabled) {
+          this.logFallbackEvent(event, error);
+        }
       }
     } catch (error) {
-      // Log unexpected errors but don't throw
+      // Log unexpected errors
       console.error('[RBAC Audit] Unexpected error during audit logging:', error);
+      
+      // Use fallback logging if enabled
+      if (this.fallbackEnabled) {
+        this.logFallbackEvent(event, error);
+      }
     }
   }
 
+  /**
+   * Log event to console as fallback when database logging fails
+   * 
+   * @param event - Audit event payload
+   * @param error - The error that occurred
+   */
+  private logFallbackEvent(event: AuditEventPayload, error: any): void {
+    console.log('[RBAC Audit Fallback]', {
+      timestamp: new Date().toISOString(),
+      event,
+      error: error?.message || error,
+      note: 'Database audit logging failed, using console fallback'
+    });
+  }
+
   /**
    * Emit a permission check audit event
    * 

package/src/rbac/components/__tests__/PagePermissionGuard.test.tsx

@@ -711,9 +711,10 @@ describe('PagePermissionGuard Component', () => {
   });
 
   describe('Security Features', () => {
-    it('prevents bypassing in strict mode', async () => {
+    it('invokes onDenied callback when strict mode blocks access', async () => {
       const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-      
+      const onDenied = vi.fn();
+
       mockUseCan.mockReturnValue({
         can: false,
         isLoading: false,
@@ -726,61 +727,63 @@ describe('PagePermissionGuard Component', () => {
           operation={mockOperation}
           strictMode={true}
           fallback={<TestFallback />}
+          onDenied={onDenied}
         >
           <TestComponent>Protected Page</TestComponent>
         </PagePermissionGuard>
       );
 
       await waitFor(() => {
-        expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
+        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
       }, { interval: 10 });
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('STRICT MODE VIOLATION'),
-        expect.objectContaining({
-          pageName: mockPageName,
-          operation: mockOperation,
-          userId: 'user-123'
-        })
-      );
+      expect(onDenied).toHaveBeenCalledWith(mockPageName, mockOperation);
 
       consoleSpy.mockRestore();
     });
 
-    it('logs page access attempts for audit', async () => {
+    it('does not call onDenied multiple times when audit logging rerenders', async () => {
       const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      
+      const onDenied = vi.fn();
+
       mockUseCan.mockReturnValue({
         can: false,
         isLoading: false,
         error: null
       });
 
-      render(
+      const { rerender } = render(
         <PagePermissionGuard
           pageName={mockPageName}
           operation={mockOperation}
           auditLog={true}
           fallback={<TestFallback />}
+          onDenied={onDenied}
         >
           <TestComponent>Protected Page</TestComponent>
         </PagePermissionGuard>
       );
 
       await waitFor(() => {
-        expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
+        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
       }, { interval: 10 });
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('Page access attempt'),
-        expect.objectContaining({
-          pageName: mockPageName,
-          operation: mockOperation,
-          userId: 'user-123',
-          allowed: false
-        })
+      rerender(
+        <PagePermissionGuard
+          pageName={mockPageName}
+          operation={mockOperation}
+          auditLog={true}
+          fallback={<TestFallback />}
+          onDenied={onDenied}
+        >
+          <TestComponent>Protected Page</TestComponent>
+        </PagePermissionGuard>
       );
 
+      await waitFor(() => {
+        expect(onDenied).toHaveBeenCalledTimes(1);
+      }, { interval: 10 });
+
       consoleSpy.mockRestore();
     });