@jmruthers/pace-core 0.5.135 → 0.5.137

package/src/rbac/components/__tests__/SecureDataProvider.fixed.test.tsx

@@ -15,6 +15,29 @@ import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { renderWithProviders } from '../../../__tests__/helpers';
 
+// Mock the RBAC logger - define inside factory to avoid hoisting issues
+const mockLogger = {
+  debug: vi.fn(),
+  error: vi.fn(),
+  warn: vi.fn(),
+  info: vi.fn(),
+};
+
+vi.mock('../../config', () => ({
+  getRBACLogger: vi.fn(() => mockLogger),
+  getRBACConfig: vi.fn(() => ({
+    debug: true,
+    logLevel: 'debug',
+    developmentMode: true,
+    audit: {
+      enabled: true,
+      logLevel: 'debug'
+    }
+  })),
+  isDebugMode: vi.fn(() => true),
+  isDevelopmentMode: vi.fn(() => true),
+}));
+
 import { 
   SecureDataProvider, 
   SecureDataProviderProps, 
@@ -97,18 +120,14 @@ const TestWrapper: React.FC<{
 };
 
 describe('SecureDataProvider', () => {
-  let consoleSpy: any;
-
   beforeEach(() => {
-    consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    vi.spyOn(console, 'error').mockImplementation(() => {});
+    vi.clearAllMocks();
     
     mockUseUnifiedAuth.mockReturnValue(mockUser);
     mockValidateContext.mockImplementation(() => {});
   });
 
   afterEach(() => {
-    consoleSpy.mockRestore();
     vi.clearAllMocks();
   });
 
@@ -284,40 +303,47 @@ describe('SecureDataProvider', () => {
   });
 
   describe('Audit Logging', () => {
-    it('should log strict mode status when enabled', () => {
+    it('should log strict mode status when enabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ strictMode: true, auditLog: true }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] Strict mode enabled')
-      );
+      await waitFor(() => {
+        expect(mockLogger.debug).toHaveBeenCalledWith(
+          'Strict mode enabled - all data access attempts will be logged and enforced'
+        );
+      });
     });
 
-    it('should log RLS enforcement when enabled', () => {
+    it('should log RLS enforcement when enabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ enforceRLS: true, auditLog: true }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] RLS enforcement enabled')
-      );
+      await waitFor(() => {
+        expect(mockLogger.debug).toHaveBeenCalledWith(
+          'RLS enforcement enabled - all queries will include organisation context'
+        );
+      });
     });
 
-    it('should not log when audit logging is disabled', () => {
+    it('should not log when audit logging is disabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ strictMode: true, auditLog: false }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] Strict mode enabled')
-      );
+      // Wait a bit to ensure useEffect has run
+      await waitFor(() => {
+        expect(mockLogger.debug).not.toHaveBeenCalledWith(
+          'Strict mode enabled - all data access attempts will be logged and enforced'
+        );
+      }, { timeout: 100 });
     });
   });
 

package/src/rbac/components/__tests__/SecureDataProvider.test.tsx

@@ -15,6 +15,29 @@ import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { renderWithProviders } from '../../../__tests__/helpers';
 
+// Mock the RBAC logger - define inside factory to avoid hoisting issues
+const mockLogger = {
+  debug: vi.fn(),
+  error: vi.fn(),
+  warn: vi.fn(),
+  info: vi.fn(),
+};
+
+vi.mock('../../config', () => ({
+  getRBACLogger: vi.fn(() => mockLogger),
+  getRBACConfig: vi.fn(() => ({
+    debug: true,
+    logLevel: 'debug',
+    developmentMode: true,
+    audit: {
+      enabled: true,
+      logLevel: 'debug'
+    }
+  })),
+  isDebugMode: vi.fn(() => true),
+  isDevelopmentMode: vi.fn(() => true),
+}));
+
 import { 
   SecureDataProvider, 
   SecureDataProviderProps, 
@@ -97,18 +120,14 @@ const TestWrapper: React.FC<{
 };
 
 describe('SecureDataProvider', () => {
-  let consoleSpy: any;
-
   beforeEach(() => {
-    consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    vi.spyOn(console, 'error').mockImplementation(() => {});
+    vi.clearAllMocks();
     
     mockUseUnifiedAuth.mockReturnValue(mockUser);
     mockValidateContext.mockImplementation(() => {});
   });
 
   afterEach(() => {
-    consoleSpy.mockRestore();
     vi.clearAllMocks();
   });
 
@@ -284,40 +303,46 @@ describe('SecureDataProvider', () => {
   });
 
   describe('Audit Logging', () => {
-    it('should log strict mode status when enabled', () => {
+    it('should log strict mode status when enabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ strictMode: true, auditLog: true }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] Strict mode enabled')
-      );
+      await waitFor(() => {
+        expect(mockLogger.debug).toHaveBeenCalledWith(
+          'Strict mode enabled - all data access attempts will be logged and enforced'
+        );
+      });
     });
 
-    it('should log RLS enforcement when enabled', () => {
+    it('should log RLS enforcement when enabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ enforceRLS: true, auditLog: true }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] RLS enforcement enabled')
-      );
+      await waitFor(() => {
+        expect(mockLogger.debug).toHaveBeenCalledWith(
+          'RLS enforcement enabled - all queries will include organisation context'
+        );
+      });
     });
 
-    it('should not log when audit logging is disabled', () => {
+    it('should not log when audit logging is disabled', async () => {
       renderWithProviders(
         <TestWrapper providerProps={{ strictMode: true, auditLog: false }}>
           <TestComponent />
         </TestWrapper>
       );
 
-      expect(consoleSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining('[SecureDataProvider] Strict mode enabled')
-      );
+      await waitFor(() => {
+        expect(mockLogger.debug).not.toHaveBeenCalledWith(
+          'Strict mode enabled - all data access attempts will be logged and enforced'
+        );
+      });
     });
   });
 

package/src/rbac/engine.ts

@@ -39,6 +39,7 @@ import {
   DEFAULT_SECURITY_CONFIG,
   RBACSecurityConfig
 } from './security';
+import { getRBACLogger } from './config';
 
 /**
  * Simplified RBAC Engine
@@ -199,7 +200,8 @@ export class RBACEngine {
       });
 
       if (error) {
-        console.error('[RBACEngine] RPC error:', error);
+        const logger = getRBACLogger();
+        logger.error('RPC error:', error);
 
         const category = categorizeError(error);
         const eventType = mapErrorCategoryToSecurityEventType(category);
@@ -272,7 +274,8 @@ export class RBACEngine {
       });
 
       // Fail securely - deny access on error
-      console.error('[RBACEngine] Permission check failed:', error);
+      const logger = getRBACLogger();
+      logger.error('Permission check failed:', error);
       return false;
     }
   }
@@ -460,7 +463,8 @@ export class RBACEngine {
       });
 
       if (error) {
-        console.error('[RBACEngine] Failed to resolve app context:', error);
+        const logger = getRBACLogger();
+        logger.error('Failed to resolve app context:', error);
         return null;
       }
 
@@ -478,7 +482,8 @@ export class RBACEngine {
         hasAccess: appData.has_access !== false,
       };
     } catch (error) {
-      console.error('[RBACEngine] Unexpected error resolving app context:', error);
+      const logger = getRBACLogger();
+      logger.error('Unexpected error resolving app context:', error);
       return null;
     }
   }
@@ -502,7 +507,8 @@ export class RBACEngine {
       });
 
       if (error) {
-        console.error('[RBACEngine] Failed to load role context:', error);
+        const logger = getRBACLogger();
+        logger.error('Failed to load role context:', error);
         return result;
       }
 
@@ -526,7 +532,8 @@ export class RBACEngine {
 
       return result;
     } catch (error) {
-      console.error('[RBACEngine] Unexpected error loading role context:', error);
+      const logger = getRBACLogger();
+      logger.error('Unexpected error loading role context:', error);
       return result;
     }
   }
@@ -597,7 +604,8 @@ export class RBACEngine {
       
       return page?.id || pageId;
     } catch (error) {
-      console.warn('[RBAC Engine] Failed to resolve page name to UUID:', { pageId, appId, error });
+      const logger = getRBACLogger();
+      logger.warn('Failed to resolve page name to UUID:', { pageId, appId, error });
       return pageId;
     }
   }

package/src/rbac/hooks/usePermissions.ts

@@ -21,6 +21,7 @@ import {
   isPermitted,
   isPermittedCached 
 } from '../api';
+import { getRBACLogger } from '../config';
 
 /**
  * Hook to get user's permissions in a scope
@@ -104,7 +105,8 @@ export function usePermissions(userId: UUID, scope: Scope) {
       } catch (err) {
         // On error, keep existing permissions but set error state
         // This prevents the UI from losing all items when there's a transient error
-        console.error('[usePermissions] Failed to fetch permissions:', err);
+        const logger = getRBACLogger();
+        logger.error('Failed to fetch permissions:', err);
         setError(err instanceof Error ? err : new Error('Failed to fetch permissions'));
         // Don't clear permissions on error - keep what we had
       } finally {
@@ -171,7 +173,8 @@ export function usePermissions(userId: UUID, scope: Scope) {
     } catch (err) {
       // On error, keep existing permissions but set error state
       // This prevents the UI from losing all items when there's a transient error
-      console.error('[usePermissions] Failed to refetch permissions:', err);
+      const logger = getRBACLogger();
+      logger.error('Failed to refetch permissions:', err);
       setError(err instanceof Error ? err : new Error('Failed to fetch permissions'));
       // Don't clear permissions on error - keep what we had
     } finally {
@@ -295,7 +298,8 @@ export function useCan(
           
           setCan(result);
         } catch (err) {
-          console.error('[useCan] Permission check error:', { permission, error: err });
+          const logger = getRBACLogger();
+          logger.error('Permission check error:', { permission, error: err });
           setError(err instanceof Error ? err : new Error('Failed to check permission'));
           setCan(false);
         } finally {

package/src/rbac/hooks/useResolvedScope.test.ts

@@ -19,12 +19,12 @@ vi.mock('../utils/eventContext', () => ({
   createScopeFromEvent: vi.fn(),
 }));
 
-vi.mock('../../utils/appNameResolver', () => ({
+vi.mock('../../utils/app/appNameResolver', () => ({
   getCurrentAppName: vi.fn(),
 }));
 
 import { createScopeFromEvent } from '../utils/eventContext';
-import { getCurrentAppName } from '../../utils/appNameResolver';
+import { getCurrentAppName } from '../../utils/app/appNameResolver';
 import { createMockSupabaseClient } from '../../__tests__/helpers/supabaseMock';
 
 describe('useResolvedScope Hook', () => {

package/src/rbac/hooks/useResolvedScope.ts

@@ -14,7 +14,10 @@ import { SupabaseClient } from '@supabase/supabase-js';
 import type { Database } from '../../types/database';
 import type { Scope } from '../types';
 import { createScopeFromEvent } from '../utils/eventContext';
-import { getCurrentAppName } from '../../utils/appNameResolver';
+import { getCurrentAppName } from '../../utils/app/appNameResolver';
+import { createLogger } from '../../utils/core/logger';
+
+const log = createLogger('useResolvedScope');
 
 export interface UseResolvedScopeOptions {
   /** Supabase client instance */
@@ -133,15 +136,15 @@ export function useResolvedScope({
                   .single() as { data: { id: string; name: string; is_active: boolean } | null };
                 
                 if (inactiveApp) {
-                  console.error(`[useResolvedScope] App "${appName}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
+                  log.error(`App "${appName}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
                 } else {
-                  console.error(`[useResolvedScope] App "${appName}" not found in rbac_apps table`);
+                  log.error(`App "${appName}" not found in rbac_apps table`);
                 }
               } else if (app) {
                 appId = app.id;
               }
             } catch (error) {
-              console.error('[useResolvedScope] Unexpected error resolving app ID:', error);
+              log.error('Unexpected error resolving app ID:', error);
             }
           }
         }
@@ -179,7 +182,7 @@ export function useResolvedScope({
           try {
             const eventScope = await createScopeFromEvent(supabase, selectedEventId, appId);
             if (!eventScope) {
-              console.error('[useResolvedScope] Could not resolve organization from event context');
+              log.error('Could not resolve organization from event context');
               if (!cancelled) {
                 setResolvedScope(null);
                 setError(new Error('Could not resolve organisation from event context'));
@@ -196,7 +199,7 @@ export function useResolvedScope({
               setIsLoading(false);
             }
           } catch (err) {
-            console.error('[useResolvedScope] Error resolving scope from event:', err);
+            log.error('Error resolving scope from event:', err);
             if (!cancelled) {
               setResolvedScope(null);
               setError(err as Error);
@@ -207,7 +210,7 @@ export function useResolvedScope({
         }
 
         // No context available
-        console.error('[useResolvedScope] No organisation or event context available');
+        log.error('No organisation or event context available');
         if (!cancelled) {
           setResolvedScope(null);
           setError(new Error('No organisation or event context available'));

package/src/rbac/permissions.ts

@@ -9,6 +9,9 @@
  */
 
 import { Permission } from './types';
+import { createLogger } from '../utils/core/logger';
+
+const log = createLogger('RBACPermissions');
 
 // ============================================================================
 // GLOBAL PERMISSIONS
@@ -186,8 +189,8 @@ export function isValidPermission(permission: string): permission is Permission
  * @returns Empty array (function deprecated)
  */
 export function getPermissionsForRole(role: string): Permission[] {
-  console.warn(
-    '[RBAC] getPermissionsForRole() is deprecated. ' +
+  log.warn(
+    'getPermissionsForRole() is deprecated. ' +
     'Permissions must be queried from rbac_page_permissions table. ' +
     `Called with role: ${role}`
   );

package/src/rbac/security.test.ts

@@ -15,6 +15,20 @@ import {
 } from './security';
 import { UUID, Scope, Permission } from './types';
 
+// Mock the Logger module
+vi.mock('../utils/core/logger', () => {
+  const mockLoggerInstance = {
+    warn: vi.fn(),
+  };
+  return {
+    createLogger: vi.fn(() => mockLoggerInstance),
+  };
+});
+
+// Get the mock instance after mock is set up
+import { createLogger } from '../utils/core/logger';
+const getMockLogger = () => createLogger('test');
+
 describe('RBACSecurityValidator', () => {
   describe('Permission Validation', () => {
     it('validates correct permission format', () => {
@@ -177,7 +191,7 @@ describe('RBACSecurityValidator', () => {
       // Mock import.meta.env.MODE for development using vi.stubEnv
       vi.stubEnv('MODE', 'development');
       
-      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      vi.clearAllMocks();
       
       RBACSecurityValidator.logSecurityEvent({
         type: 'invalid_input',
@@ -185,8 +199,9 @@ describe('RBACSecurityValidator', () => {
         details: { reason: 'Invalid permission format' }
       });
 
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('[RBAC Security]'),
+      const logger = getMockLogger();
+      expect(vi.mocked(logger.warn)).toHaveBeenCalledWith(
+        'Security event:',
         expect.objectContaining({
           type: 'invalid_input',
           userId: 'user-123',
@@ -194,23 +209,21 @@ describe('RBACSecurityValidator', () => {
         })
       );
 
-      consoleSpy.mockRestore();
       vi.unstubAllEnvs();
     });
 
     it('handles missing details gracefully', () => {
       // Mock import.meta.env.MODE for development using vi.stubEnv
       vi.stubEnv('MODE', 'development');
-      
-      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      vi.clearAllMocks();
       
       RBACSecurityValidator.logSecurityEvent({
         type: 'suspicious_activity',
         userId: 'user-123' as UUID
       });
 
-      expect(consoleSpy).toHaveBeenCalled();
-      consoleSpy.mockRestore();
+      const logger = getMockLogger();
+      expect(vi.mocked(logger.warn)).toHaveBeenCalled();
       vi.unstubAllEnvs();
     });
   });
@@ -334,7 +347,7 @@ describe('RBACSecurityMiddleware', () => {
         timestamp: new Date()
       };
 
-      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      vi.clearAllMocks();
 
       // Make many rapid requests
       for (let i = 0; i < 50; i++) {
@@ -343,9 +356,8 @@ describe('RBACSecurityMiddleware', () => {
 
       // Note: Suspicious activity detection is not implemented yet
       // The middleware only validates input, it doesn't detect patterns
-      expect(consoleSpy).not.toHaveBeenCalled();
-
-      consoleSpy.mockRestore();
+      const logger = getMockLogger();
+      expect(vi.mocked(logger.warn)).not.toHaveBeenCalled();
     });
 
     it('detects unusual permission patterns', async () => {
@@ -363,7 +375,7 @@ describe('RBACSecurityMiddleware', () => {
         timestamp: new Date()
       };
 
-      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      vi.clearAllMocks();
 
       // Make requests with high-privilege permissions
       for (let i = 0; i < 20; i++) {
@@ -372,9 +384,8 @@ describe('RBACSecurityMiddleware', () => {
 
       // Note: Suspicious activity detection is not implemented yet
       // The middleware only validates input, it doesn't detect patterns
-      expect(consoleSpy).not.toHaveBeenCalled();
-
-      consoleSpy.mockRestore();
+      const logger = getMockLogger();
+      expect(vi.mocked(logger.warn)).not.toHaveBeenCalled();
     });
   });
 });

package/src/rbac/security.ts

@@ -8,6 +8,9 @@
  */
 
 import { UUID, Permission, Scope } from './types';
+import { createLogger } from '../utils/core/logger';
+
+const log = createLogger('RBACSecurity');
 
 /**
  * Security validation utilities for RBAC operations
@@ -206,10 +209,8 @@ export class RBACSecurityValidator {
       severity: this.getEventSeverity(event.type),
     };
 
-    // Log to console in development, could be sent to security monitoring service in production
-    if (import.meta.env.MODE === 'development') {
-      console.warn('[RBAC Security]', securityEvent);
-    }
+    // Log security event - could be sent to security monitoring service in production
+    log.warn('Security event:', securityEvent);
 
     // TODO: Send to security monitoring service
   }