@jmruthers/pace-core 0.5.139 → 0.5.141

package/src/rbac/hooks/useResourcePermissions.test.ts

@@ -0,0 +1,633 @@
+/**
+ * @file useResourcePermissions Hook Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Hooks
+ * @since 1.0.0
+ * 
+ * Comprehensive tests for the useResourcePermissions hook covering all critical functionality.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { useResourcePermissions } from './useResourcePermissions';
+import type { Scope } from '../types';
+
+// Mock dependencies
+vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: vi.fn(),
+}));
+
+vi.mock('../../hooks/useOrganisations', () => ({
+  useOrganisations: vi.fn(),
+}));
+
+vi.mock('../../hooks/useEvents', () => ({
+  useEvents: vi.fn(),
+}));
+
+vi.mock('./useResolvedScope', () => ({
+  useResolvedScope: vi.fn(),
+}));
+
+vi.mock('./usePermissions', () => ({
+  useCan: vi.fn(),
+}));
+
+import { useUnifiedAuth } from '../../providers/services/UnifiedAuthProvider';
+import { useOrganisations } from '../../hooks/useOrganisations';
+import { useEvents } from '../../hooks/useEvents';
+import { useResolvedScope } from './useResolvedScope';
+import { useCan } from './usePermissions';
+
+describe('useResourcePermissions Hook', () => {
+  const mockUseUnifiedAuth = vi.mocked(useUnifiedAuth);
+  const mockUseOrganisations = vi.mocked(useOrganisations);
+  const mockUseEvents = vi.mocked(useEvents);
+  const mockUseResolvedScope = vi.mocked(useResolvedScope);
+  const mockUseCan = vi.mocked(useCan);
+
+  const mockUser = {
+    id: 'user-123',
+    email: 'test@example.com',
+  };
+
+  const mockSupabase = {
+    from: vi.fn(),
+  } as any;
+
+  const mockSelectedOrganisation = {
+    id: 'org-123',
+    name: 'Test Organisation',
+  };
+
+  const mockSelectedEvent = {
+    event_id: 'event-123',
+    event_name: 'Test Event',
+  };
+
+  const mockScope: Scope = {
+    organisationId: 'org-123',
+    eventId: 'event-123',
+    appId: 'app-123',
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Default mock implementations
+    mockUseUnifiedAuth.mockReturnValue({
+      user: mockUser,
+      supabase: mockSupabase,
+    } as any);
+
+    mockUseOrganisations.mockReturnValue({
+      selectedOrganisation: mockSelectedOrganisation,
+    } as any);
+
+    mockUseEvents.mockReturnValue({
+      selectedEvent: mockSelectedEvent,
+    } as any);
+
+    mockUseResolvedScope.mockReturnValue({
+      resolvedScope: mockScope,
+      isLoading: false,
+      error: null,
+    });
+
+    // Default useCan mocks - all permissions allowed
+    mockUseCan.mockReturnValue({
+      can: true,
+      isLoading: false,
+      error: null,
+      refetch: vi.fn(),
+    } as any);
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Basic Functionality', () => {
+    it('returns permission check functions', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canCreate).toBeTypeOf('function');
+      expect(result.current.canUpdate).toBeTypeOf('function');
+      expect(result.current.canDelete).toBeTypeOf('function');
+      expect(result.current.canRead).toBeTypeOf('function');
+    });
+
+    it('returns scope object', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.scope).toEqual(mockScope);
+    });
+
+    it('calls useResolvedScope with correct parameters', () => {
+      renderHook(() => useResourcePermissions('contacts'));
+
+      expect(mockUseResolvedScope).toHaveBeenCalledWith({
+        supabase: mockSupabase,
+        selectedOrganisationId: 'org-123',
+        selectedEventId: 'event-123',
+      });
+    });
+
+    it('calls useCan for each permission type', () => {
+      renderHook(() => useResourcePermissions('contacts'));
+
+      expect(mockUseCan).toHaveBeenCalledTimes(4); // create, update, delete, read
+      expect(mockUseCan).toHaveBeenCalledWith(
+        'user-123',
+        mockScope,
+        'create:contacts',
+        undefined,
+        true
+      );
+      expect(mockUseCan).toHaveBeenCalledWith(
+        'user-123',
+        mockScope,
+        'update:contacts',
+        undefined,
+        true
+      );
+      expect(mockUseCan).toHaveBeenCalledWith(
+        'user-123',
+        mockScope,
+        'delete:contacts',
+        undefined,
+        true
+      );
+      expect(mockUseCan).toHaveBeenCalledWith(
+        'user-123',
+        mockScope,
+        'read:contacts',
+        undefined,
+        true
+      );
+    });
+  });
+
+  describe('Permission Checking', () => {
+    it('returns true when user can create resource', () => {
+      mockUseCan.mockReturnValue({
+        can: true,
+        isLoading: false,
+        error: null,
+        refetch: vi.fn(),
+      } as any);
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canCreate('contacts')).toBe(true);
+    });
+
+    it('returns false when user cannot create resource', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'create:contacts') {
+          return {
+            can: false,
+            isLoading: false,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: true,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canCreate('contacts')).toBe(false);
+      expect(result.current.canUpdate('contacts')).toBe(true);
+      expect(result.current.canDelete('contacts')).toBe(true);
+    });
+
+    it('returns false for different resource name', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canCreate('risks')).toBe(false);
+      expect(result.current.canUpdate('risks')).toBe(false);
+      expect(result.current.canDelete('risks')).toBe(false);
+    });
+  });
+
+  describe('Read Permissions', () => {
+    it('returns true for canRead when enableRead is false (default)', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canRead('contacts')).toBe(true);
+    });
+
+    it('checks read permissions when enableRead is true', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'read:contacts') {
+          return {
+            can: true,
+            isLoading: false,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() =>
+        useResourcePermissions('contacts', { enableRead: true })
+      );
+
+      expect(result.current.canRead('contacts')).toBe(true);
+    });
+
+    it('returns false for read when permission is denied and enableRead is true', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'read:contacts') {
+          return {
+            can: false,
+            isLoading: false,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: true,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() =>
+        useResourcePermissions('contacts', { enableRead: true })
+      );
+
+      expect(result.current.canRead('contacts')).toBe(false);
+    });
+  });
+
+  describe('Scope Resolution', () => {
+    it('uses resolved scope when available', () => {
+      const resolvedScope: Scope = {
+        organisationId: 'org-resolved',
+        eventId: 'event-resolved',
+        appId: 'app-resolved',
+      };
+
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope,
+        isLoading: false,
+        error: null,
+      });
+
+      renderHook(() => useResourcePermissions('contacts'));
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        resolvedScope,
+        expect.any(String),
+        undefined,
+        true
+      );
+    });
+
+    it('uses fallback scope when resolvedScope is null', () => {
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: null,
+      });
+
+      renderHook(() => useResourcePermissions('contacts'));
+
+      const fallbackScope: Scope = {
+        organisationId: 'org-123',
+        eventId: 'event-123',
+        appId: undefined,
+      };
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        fallbackScope,
+        expect.any(String),
+        undefined,
+        true
+      );
+    });
+
+    it('handles missing organisation gracefully', () => {
+      mockUseOrganisations.mockReturnValue({
+        selectedOrganisation: null,
+      } as any);
+
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: null,
+      });
+
+      renderHook(() => useResourcePermissions('contacts'));
+
+      const fallbackScope: Scope = {
+        organisationId: '',
+        eventId: 'event-123',
+        appId: undefined,
+      };
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        fallbackScope,
+        expect.any(String),
+        undefined,
+        true
+      );
+    });
+
+    it('handles missing event gracefully', () => {
+      mockUseEvents.mockReturnValue({
+        selectedEvent: null,
+      } as any);
+
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: null,
+      });
+
+      renderHook(() => useResourcePermissions('contacts'));
+
+      const fallbackScope: Scope = {
+        organisationId: 'org-123',
+        eventId: undefined,
+        appId: undefined,
+      };
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        fallbackScope,
+        expect.any(String),
+        undefined,
+        true
+      );
+    });
+  });
+
+  describe('Missing User Context', () => {
+    it('handles missing user gracefully', () => {
+      mockUseUnifiedAuth.mockReturnValue({
+        user: null,
+        supabase: mockSupabase,
+      } as any);
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        '',
+        expect.any(Object),
+        expect.any(String),
+        undefined,
+        true
+      );
+    });
+  });
+
+  describe('Optional Event Provider', () => {
+    it('handles missing event provider gracefully', () => {
+      mockUseEvents.mockImplementation(() => {
+        throw new Error('Event provider not available');
+      });
+
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: mockScope,
+        isLoading: false,
+        error: null,
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.canCreate).toBeTypeOf('function');
+      expect(result.current.scope).toEqual(mockScope);
+    });
+  });
+
+  describe('Loading States', () => {
+    it('aggregates loading states from scope resolution and permission checks', () => {
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: mockScope,
+        isLoading: true,
+        error: null,
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.isLoading).toBe(true);
+    });
+
+    it('aggregates loading states from permission checks', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'create:contacts') {
+          return {
+            can: false,
+            isLoading: true,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.isLoading).toBe(true);
+    });
+
+    it('includes read loading state when enableRead is true', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'read:contacts') {
+          return {
+            can: false,
+            isLoading: true,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() =>
+        useResourcePermissions('contacts', { enableRead: true })
+      );
+
+      expect(result.current.isLoading).toBe(true);
+    });
+
+    it('excludes read loading state when enableRead is false', () => {
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'read:contacts') {
+          return {
+            can: false,
+            isLoading: true,
+            error: null,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.isLoading).toBe(false);
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('aggregates errors from scope resolution', () => {
+      const scopeError = new Error('Scope resolution failed');
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: scopeError,
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.error).toEqual(scopeError);
+    });
+
+    it('aggregates errors from permission checks', () => {
+      const permissionError = new Error('Permission check failed');
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'create:contacts') {
+          return {
+            can: false,
+            isLoading: false,
+            error: permissionError,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.error).toEqual(permissionError);
+    });
+
+    it('prefers scope error over permission errors', () => {
+      const scopeError = new Error('Scope resolution failed');
+      const permissionError = new Error('Permission check failed');
+
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: scopeError,
+      });
+
+      mockUseCan.mockImplementation((userId, scope, permission) => {
+        if (permission === 'create:contacts') {
+          return {
+            can: false,
+            isLoading: false,
+            error: permissionError,
+            refetch: vi.fn(),
+          } as any;
+        }
+        return {
+          can: false,
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        } as any;
+      });
+
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.error).toEqual(scopeError);
+    });
+
+    it('returns null error when no errors occur', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      expect(result.current.error).toBeNull();
+    });
+  });
+
+  describe('Options', () => {
+    it('respects enableRead option', () => {
+      renderHook(() => useResourcePermissions('contacts', { enableRead: true }));
+
+      // Should still call useCan for read permission
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(Object),
+        'read:contacts',
+        undefined,
+        true
+      );
+    });
+
+    it('defaults enableRead to false', () => {
+      const { result } = renderHook(() => useResourcePermissions('contacts'));
+
+      // canRead should return true when enableRead is false
+      expect(result.current.canRead('contacts')).toBe(true);
+    });
+  });
+
+  describe('Different Resources', () => {
+    it('works with different resource names', () => {
+      renderHook(() => useResourcePermissions('risks'));
+
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(Object),
+        'create:risks',
+        undefined,
+        true
+      );
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(Object),
+        'update:risks',
+        undefined,
+        true
+      );
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(Object),
+        'delete:risks',
+        undefined,
+        true
+      );
+    });
+  });
+});
+