@jmruthers/pace-core 0.5.180 → 0.5.182

package/src/providers/services/AuthServiceProvider.tsx

@@ -8,7 +8,7 @@
  * Provides authentication service instance to React components.
  */
 
-import React, { createContext, useContext, useMemo, useEffect, useState } from 'react';
+import React, { createContext, useMemo, useEffect, useState } from 'react';
 import { type SupabaseClient } from '@supabase/supabase-js';
 import { AuthService } from '../../services/AuthService';
 import type { SessionRestorationState } from '../../types/auth';
@@ -44,11 +44,6 @@ export function AuthServiceProvider({ children, supabaseClient, appName }: AuthS
     const unsubscribe = authService.subscribe(() => {
       const restorationState = authService.getSessionRestorationState();
       setSessionRestoration(restorationState);
-
-      const isDev = typeof import.meta !== 'undefined' && (import.meta.env.DEV || import.meta.env.MODE === 'development');
-      if (isDev) {
-        logger.debug('AuthServiceProvider', 'Session restoration state updated', restorationState);
-      }
     });
 
     return () => {
@@ -78,14 +73,4 @@ export function AuthServiceProvider({ children, supabaseClient, appName }: AuthS
       {children}
     </AuthServiceContext.Provider>
   );
-}
-
-export const useAuthService = (): AuthService => {
-  const context = useContext(AuthServiceContext);
-  
-  if (!context) {
-    throw new Error('useAuthService must be used within AuthServiceProvider');
-  }
-  
-  return context.authService;
-};
+}

package/src/providers/services/EventServiceProvider.tsx

@@ -8,19 +8,17 @@
  * Provides event service instance to React components.
  */
 
-import React, { createContext, useContext, useMemo, useEffect, useRef } from 'react';
+import React, { createContext, useMemo, useEffect, useRef } from 'react';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import { EventService } from '../../services/EventService';
 import { logger } from '../../utils/core/logger';
+import type { Organisation } from '../../types/organisation';
 
 // Context type
 export interface EventServiceContextType {
   eventService: EventService;
 }
 
-// Backward compatibility type alias
-export type EventContextType = EventServiceContextType;
-
 export const EventServiceContext = createContext<EventServiceContextType | null>(null);
 
 export interface EventServiceProviderProps {
@@ -29,7 +27,7 @@ export interface EventServiceProviderProps {
   user: User | null;
   session: Session | null;
   appName: string;
-  selectedOrganisation: any;
+  selectedOrganisation: Organisation | null;
   setSelectedEventId: (eventId: string | null) => void;
 }
 
@@ -76,6 +74,13 @@ export function EventServiceProvider({
     };
   }, [eventService, supabaseClient, user, session, appName, selectedOrganisation, setSelectedEventId]);
 
+  // Cleanup service on unmount only
+  useEffect(() => {
+    return () => {
+      eventService.cleanup();
+    };
+  }, [eventService]);
+
   const contextValue = useMemo(() => ({
     eventService
   }), [eventService]);
@@ -85,14 +90,4 @@ export function EventServiceProvider({
       {children}
     </EventServiceContext.Provider>
   );
-}
-
-export const useEventService = (): EventService => {
-  const context = useContext(EventServiceContext);
-  
-  if (!context) {
-    throw new Error('useEventService must be used within EventServiceProvider');
-  }
-  
-  return context.eventService;
-};
+}

package/src/providers/services/InactivityServiceProvider.tsx

@@ -8,7 +8,7 @@
  * Provides inactivity service instance to React components.
  */
 
-import React, { createContext, useContext, useMemo, useEffect, useRef } from 'react';
+import React, { createContext, useMemo, useEffect, useRef } from 'react';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import { InactivityService } from '../../services/InactivityService';
 import { logger } from '../../utils/core/logger';
@@ -66,6 +66,13 @@ export function InactivityServiceProvider({
     };
   }, [inactivityService, supabaseClient, user, session, idleTimeoutMs, warnBeforeMs, onIdleLogout]);
 
+  // Cleanup service on unmount only
+  useEffect(() => {
+    return () => {
+      inactivityService.cleanup();
+    };
+  }, [inactivityService]);
+
   const contextValue = useMemo(() => ({
     inactivityService
   }), [inactivityService]);
@@ -75,14 +82,4 @@ export function InactivityServiceProvider({
       {children}
     </InactivityServiceContext.Provider>
   );
-}
-
-export const useInactivityService = (): InactivityService => {
-  const context = useContext(InactivityServiceContext);
-  
-  if (!context) {
-    throw new Error('useInactivityService must be used within InactivityServiceProvider');
-  }
-  
-  return context.inactivityService;
-};
+}

package/src/providers/services/OrganisationServiceProvider.tsx

@@ -8,7 +8,7 @@
  * Provides organisation service instance to React components.
  */
 
-import React, { createContext, useContext, useMemo, useEffect, useRef } from 'react';
+import React, { createContext, useMemo, useEffect, useRef } from 'react';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import { OrganisationService } from '../../services/OrganisationService';
 import { logger } from '../../utils/core/logger';
@@ -60,6 +60,13 @@ export function OrganisationServiceProvider({
     };
   }, [organisationService, user, session]);
 
+  // Cleanup service on unmount only
+  useEffect(() => {
+    return () => {
+      organisationService.cleanup();
+    };
+  }, [organisationService]);
+
   const contextValue = useMemo(() => ({
     organisationService
   }), [organisationService]);
@@ -69,14 +76,4 @@ export function OrganisationServiceProvider({
       {children}
     </OrganisationServiceContext.Provider>
   );
-}
-
-export const useOrganisationService = (): OrganisationService => {
-  const context = useContext(OrganisationServiceContext);
-  
-  if (!context) {
-    throw new Error('useOrganisationService must be used within OrganisationServiceProvider');
-  }
-  
-  return context.organisationService;
-};
+}

package/src/providers/services/UnifiedAuthProvider.tsx

@@ -8,7 +8,7 @@
  * Note: RBAC functionality is available via useRBAC() hook from '@jmruthers/pace-core/rbac'
  */
 
-import React, { createContext, useContext, useMemo, useCallback, useRef } from 'react';
+import React, { createContext, useContext, useMemo, useCallback, useRef, useEffect, useState } from 'react';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import { AuthServiceProvider } from './AuthServiceProvider';
 import { OrganisationServiceProvider } from './OrganisationServiceProvider';
@@ -20,7 +20,7 @@ import { useEventService } from '../../hooks/services/useEventService';
 import { useInactivityService } from '../../hooks/services/useInactivityService';
 import { useSessionRestoration } from '../../hooks/useSessionRestoration';
 import type { Organisation, OrganisationMembership } from '../../types/organisation';
-import type { Event } from '../../types/unified';
+import type { Event } from '../../types/event';
 import type { AuthError } from '@supabase/supabase-js';
 import type { SessionRestorationState } from '../../types/auth';
 import { logger } from '../../utils/core/logger';
@@ -47,9 +47,12 @@ export interface UnifiedAuthContextType {
   isAuthenticated: boolean;
   authLoading: boolean;
   authError: AuthError | null;
-  error: AuthError | null; // Alias for authError for backward compatibility
   supabase: SupabaseClient | null;
   
+  // App context (resolved immediately on login)
+  appName: string;
+  appId: string | undefined; // Resolved from appName when user logs in
+  
   // Auth methods
   signIn: (email: string, password?: string) => Promise<{ error: AuthError | null }>;
   signUp: (email: string, password: string) => Promise<{ error: AuthError | null }>;
@@ -103,7 +106,6 @@ export interface UnifiedAuthContextType {
   handleSignOutNow: () => Promise<void>;
 
   // Additional unified properties
-  appName: string;
   appConfig: { requires_event: boolean } | null;
   isLoading: boolean;
   hasErrors: boolean;
@@ -191,6 +193,68 @@ function UnifiedAuthContextProvider({
   const currentUser = authService.getUser();
   const currentSession = authService.getSession();
   const isAuth = !!(currentUser && currentSession);
+  
+  // Get supabase client early so we can use it in useEffect
+  const supabase = authService.getSupabaseClient();
+  
+  // Resolve appId immediately when user logs in (don't wait for organisation/event)
+  // This makes appId available early for navigation menu filtering
+  const [appId, setAppId] = useState<string | undefined>(undefined);
+  const isResolvingAppIdRef = useRef(false);
+  
+  useEffect(() => {
+    // Resolve appId as soon as we have user + supabase + appName
+    // Don't wait for organisation or event - appId resolution only needs user + appName
+    if (
+      isAuth &&
+      currentUser?.id &&
+      supabase &&
+      appName &&
+      !appId &&
+      !isResolvingAppIdRef.current
+    ) {
+      isResolvingAppIdRef.current = true;
+      const userId = currentUser.id;
+      const appNameValue = appName;
+      
+      // Resolve appId immediately
+      import('../../rbac/api').then(async ({ resolveAppContext, setupRBAC }) => {
+        try {
+          // Ensure RBAC is initialized (idempotent - safe to call multiple times)
+          setupRBAC(supabase);
+          
+          const result = await resolveAppContext({
+            userId,
+            appName: appNameValue
+          });
+          
+          if (result?.appId) {
+            setAppId(result.appId);
+            logger.debug('UnifiedAuthProvider', 'appId resolved on login', {
+              appId: result.appId,
+              appName: appNameValue
+            });
+          }
+        } catch (error) {
+          logger.error('UnifiedAuthProvider', 'Failed to resolve appId on login', {
+            error: error instanceof Error ? error.message : String(error),
+            appName: appNameValue,
+            userId
+          });
+        } finally {
+          isResolvingAppIdRef.current = false;
+        }
+      }).catch((importError) => {
+        logger.error('UnifiedAuthProvider', 'Failed to import RBAC API', importError);
+        isResolvingAppIdRef.current = false;
+      });
+    }
+    
+    // Clear appId when user logs out
+    if (!isAuth) {
+      setAppId(undefined);
+    }
+  }, [isAuth, currentUser?.id, supabase, appName, appId]);
 
   // Get loading states - these will trigger re-renders when services change
   const authLoading = authService.isLoading();
@@ -201,7 +265,7 @@ function UnifiedAuthContextProvider({
   
   // Extract all primitive values from services to use in dependencies
   const authError = authService.getError();
-  const supabase = authService.getSupabaseClient();
+  // supabase is already declared above (line 198)
   const selectedOrganisation = organisationService.getSelectedOrganisation();
   const organisations = organisationService.getOrganisations();
   const userMemberships = organisationService.getUserMemberships();
@@ -266,18 +330,7 @@ function UnifiedAuthContextProvider({
         prevState.isAuthenticated !== currentState.isAuthenticated ||
         prevState.userEmail !== currentState.userEmail ||
         prevState.totalLoading !== currentState.totalLoading) {
-      logger.debug('UnifiedAuthContext', 'Auth state changed:', {
-        isAuthenticated: isAuth,
-        user: currentUser?.email,
-        session: currentSession ? 'exists' : 'null',
-        totalLoading,
-        authLoading,
-        orgLoading,
-        eventLoading,
-        orgContextReady: isContextReady,
-        sessionRestoration,
-        sessionRestorationTimedOut,
-      });
+      // State change detected, notify subscribers
       prevStateRef.current = currentState;
     }
   }
@@ -291,7 +344,6 @@ function UnifiedAuthContextProvider({
     isAuthenticated: isAuth,
     authLoading: authLoading,
     authError: authError,
-    error: authError, // Alias for backward compatibility
     supabase: supabase,
     
     // Auth methods
@@ -348,6 +400,7 @@ function UnifiedAuthContextProvider({
 
     // Additional unified properties
     appName,
+    appId, // Resolved immediately on login
     appConfig: appConfig,
     isLoading: totalLoading,
     hasErrors: hasErrors,
@@ -384,6 +437,7 @@ function UnifiedAuthContextProvider({
     totalLoading,
     hasErrors,
     appName,
+    appId,
     appConfig,
     sessionRestoration,
     sessionRestorationTimedOut,
@@ -526,6 +580,19 @@ export function UnifiedAuthProvider({
   renderInactivityWarning,
   dangerouslyDisableInactivity = false
 }: UnifiedAuthProviderProps) {
+  // Warn if supabaseClient reference changes (indicates multiple client instances)
+  const clientRef = useRef(supabaseClient);
+  useEffect(() => {
+    if (clientRef.current !== supabaseClient) {
+      logger.warn('UnifiedAuthProvider', 'Supabase client reference changed - this may indicate multiple client instances are being created', {
+        previousClient: clientRef.current,
+        newClient: supabaseClient,
+        note: 'Ensure you create the Supabase client once and reuse it. Creating multiple clients can cause performance issues and the "Multiple GoTrueClient instances" warning.'
+      });
+      clientRef.current = supabaseClient;
+    }
+  }, [supabaseClient]);
+
   return (
     <AuthServiceProvider supabaseClient={supabaseClient} appName={appName}>
       <ServiceAwareProviders

package/src/providers/services/__tests__/AuthServiceProvider.integration.test.tsx

@@ -11,7 +11,8 @@
 import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
 import { render, screen, waitFor } from '@testing-library/react';
 import React from 'react';
-import { AuthServiceProvider, useAuthService } from '../AuthServiceProvider';
+import { AuthServiceProvider } from '../AuthServiceProvider';
+import { useAuthService } from '../../../hooks/services/useAuthService';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import { Logger, LogLevel } from '../../../utils/core/logger';
 
@@ -131,7 +132,9 @@ describe('AuthServiceProvider Integration', () => {
   describe('Service Integration', () => {
     it('should initialize service on mount', async () => {
       const mockSubscription = { unsubscribe: vi.fn() };
-      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue(mockSubscription);
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue({
+        data: { subscription: mockSubscription }
+      } as any);
 
       render(
         <AuthServiceProvider supabaseClient={mockSupabase}>
@@ -147,7 +150,9 @@ describe('AuthServiceProvider Integration', () => {
 
     it('should cleanup service on unmount', async () => {
       const mockSubscription = { unsubscribe: vi.fn() };
-      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue(mockSubscription);
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue({
+        data: { subscription: mockSubscription }
+      } as any);
 
       const { unmount } = render(
         <AuthServiceProvider supabaseClient={mockSupabase}>
@@ -173,7 +178,9 @@ describe('AuthServiceProvider Integration', () => {
       
       vi.mocked(mockSupabase.auth.onAuthStateChange).mockImplementation((callback) => {
         capturedCallback = callback;
-        return mockSubscription;
+        return {
+          data: { subscription: mockSubscription }
+        } as any;
       });
 
       render(

package/src/rbac/__tests__/scenarios.user-role.test.tsx

@@ -3,8 +3,69 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { render, screen, waitFor, act } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { createMemoryRouter, RouterProvider } from 'react-router-dom';
-import { UnifiedAuthProvider } from '../../providers/UnifiedAuthProvider';
-import { OrganisationProvider } from '../../providers/OrganisationProvider';
+import { UnifiedAuthProvider } from '../../providers/services/UnifiedAuthProvider';
+import { OrganisationServiceProvider } from '../../providers/services/OrganisationServiceProvider';
+import type { SupabaseClient } from '@supabase/supabase-js';
+
+// Hoist mockSupabaseClient before mocks that reference it
+const mockSupabaseClient = vi.hoisted(() => ({
+  auth: {
+    getUser: vi.fn(),
+  },
+  from: vi.fn(),
+  rpc: vi.fn(),
+} as unknown as SupabaseClient));
+
+// Mock all service hooks used by UnifiedAuthProvider
+vi.mock('../../hooks/services/useAuthService', () => ({
+  useAuthService: () => ({
+    getUser: vi.fn(() => ({ id: 'user-123', email: 'test@example.com' })),
+    getSession: vi.fn(() => ({ access_token: 'token' })),
+    isLoading: vi.fn(() => false),
+    getError: vi.fn(() => null),
+    getSupabaseClient: vi.fn(() => mockSupabaseClient),
+    signIn: vi.fn(),
+    signUp: vi.fn(),
+    signOut: vi.fn(),
+    resetPassword: vi.fn(),
+    updatePassword: vi.fn(),
+    refreshSession: vi.fn(),
+  }),
+}));
+
+vi.mock('../../hooks/services/useEventService', () => ({
+  useEventService: () => ({
+    getEvents: vi.fn(() => []),
+    getSelectedEvent: vi.fn(() => null),
+    isLoading: vi.fn(() => false),
+    getError: vi.fn(() => null),
+    setSelectedEvent: vi.fn(),
+    refreshEvents: vi.fn(),
+  }),
+}));
+
+vi.mock('../../hooks/services/useInactivityService', () => ({
+  useInactivityService: () => ({
+    getShowInactivityWarning: vi.fn(() => false),
+    getInactivityTimeRemaining: vi.fn(() => 0),
+    isIdle: vi.fn(() => false),
+    getTimeRemaining: vi.fn(() => 0),
+    isWarningShown: vi.fn(() => false),
+    isTracking: vi.fn(() => false),
+    resetActivity: vi.fn(),
+    startTracking: vi.fn(),
+    stopTracking: vi.fn(),
+    handleIdleLogout: vi.fn(),
+  }),
+}));
+
+vi.mock('../../hooks/useSessionRestoration', () => ({
+  useSessionRestoration: () => ({
+    isRestoring: false,
+    restorationError: null,
+  }),
+}));
+
 // Note: RBACProvider was removed as part of Phase 1 - use useRBAC() hook instead
 vi.mock('../hooks/useRBAC', () => ({
   useRBAC: () => ({
@@ -27,7 +88,7 @@ import { useCan, useAccessLevel, useHasAnyPermission, useHasAllPermissions } fro
 import { useCachedPermissions } from '../hooks';
 import { usePermissionCache } from '../../hooks/usePermissionCache';
 import { useOrganisationPermissions } from '../../hooks/useOrganisationPermissions';
-import type { SupabaseClient, User } from '@supabase/supabase-js';
+import type { User } from '@supabase/supabase-js';
 import type { Organisation } from '../../types/organisation';
 import type { AccessLevel } from '../types/access';
 
@@ -61,23 +122,46 @@ vi.mock('../../hooks/useOrganisationSecurity', () => ({
     isOrganisationLoaded: true,
   })
 }));
-vi.mock('../../providers/OrganisationProvider', () => ({
-  OrganisationProvider: ({ children }: any) => children,
-  useOrganisations: () => ({
-    selectedOrganisation: { id: 'org-123', name: 'Test Organisation' },
-    isOrganisationLoaded: true,
-    isLoading: false,
-    error: null,
-  })
+
+// Hoist mockOrganisationService before mocks that reference it
+const mockOrganisationService = vi.hoisted(() => ({
+  getSelectedOrganisation: vi.fn(() => ({ id: 'org-123', name: 'Test Organisation' })),
+  getOrganisations: vi.fn(() => [{ id: 'org-123', name: 'Test Organisation' }]),
+  getUserMemberships: vi.fn(() => []),
+  isLoading: vi.fn(() => false),
+  getError: vi.fn(() => null),
+  hasValidOrganisationContext: vi.fn(() => true),
+  isContextReady: vi.fn(() => true),
+  setSelectedOrganisation: vi.fn(),
+  switchOrganisation: vi.fn().mockResolvedValue(undefined),
+  getUserRole: vi.fn(() => 'member'),
+  validateOrganisationAccess: vi.fn(() => true),
+  ensureOrganisationContext: vi.fn(() => ({ id: 'org-123', name: 'Test Organisation' })),
+  refreshOrganisations: vi.fn().mockResolvedValue(undefined),
+  getPrimaryOrganisation: vi.fn(() => ({ id: 'org-123', name: 'Test Organisation' })),
+  isOrganisationSecure: vi.fn(() => true),
+  subscribe: vi.fn(() => () => {}),
+  initialize: vi.fn().mockResolvedValue(undefined),
+  cleanup: vi.fn(),
+  updateDependencies: vi.fn(),
 }));
 
-const mockSupabaseClient = {
-  auth: {
-    getUser: vi.fn(),
-  },
-  from: vi.fn(),
-  rpc: vi.fn(),
-} as unknown as SupabaseClient;
+vi.mock('../../hooks/services/useOrganisationService', () => ({
+  useOrganisationService: () => mockOrganisationService,
+}));
+
+// Mock OrganisationServiceProvider with context
+vi.mock('../../providers/services/OrganisationServiceProvider', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../providers/services/OrganisationServiceProvider')>();
+  return {
+    ...actual,
+    OrganisationServiceProvider: ({ children }: any) => (
+      <actual.OrganisationServiceContext.Provider value={{ organisationService: mockOrganisationService }}>
+        {children}
+      </actual.OrganisationServiceContext.Provider>
+    ),
+  };
+});
 
 const mockUser: User = {
   id: 'user-123',
@@ -142,10 +226,10 @@ const Wrapper = ({ children }: { children: React.ReactNode }) => {
   });
   return (
     <QueryClientProvider client={queryClient}>
-      <UnifiedAuthProvider supabase={mockSupabaseClient}>
-        <OrganisationProvider>
+      <UnifiedAuthProvider supabaseClient={mockSupabaseClient} appName="TEST_APP" idleTimeoutMs={30000} warnBeforeMs={5000} onIdleLogout={() => {}}>
+        <OrganisationServiceProvider supabaseClient={mockSupabaseClient} user={null} session={null}>
           {children}
-        </OrganisationProvider>
+        </OrganisationServiceProvider>
       </UnifiedAuthProvider>
     </QueryClientProvider>
   );

package/src/rbac/adapters.tsx

@@ -12,7 +12,7 @@ import { UUID, Permission } from './types';
 import { useCan } from './hooks';
 import { rbacCache, RBACCache } from './cache';
 import { getRBACLogger } from './config';
-import { useUnifiedAuth } from '../providers/UnifiedAuthProvider';
+import { useUnifiedAuth } from '../providers/services/UnifiedAuthProvider';
 
 // ============================================================================
 // REACT COMPONENTS

package/src/rbac/api.ts

@@ -43,18 +43,34 @@ export function setupRBAC(supabase: SupabaseClient<Database>, config?: Partial<R
   const logger = getRBACLogger();
   
   // Create full config
+  const isDevelopment = import.meta.env.MODE === 'development';
   const fullConfig: RBACConfig = {
     supabase,
-    debug: import.meta.env.MODE === 'development',
+    debug: isDevelopment,
     logLevel: 'warn',
-    developmentMode: import.meta.env.MODE === 'development',
+    developmentMode: isDevelopment,
     ...config,
   };
   
   createRBACConfig(fullConfig);
   
-  // Pass security config to engine if provided
-  globalEngine = createRBACEngine(supabase, config?.security);
+  // Automatically disable rate limiting in development mode unless explicitly overridden
+  // Apply default first, then let explicit config override it
+  // Pass undefined if no config provided and not in development, otherwise create security config
+  const securityConfig = 
+    config === undefined && !isDevelopment
+      ? undefined
+      : {
+          // Default: disable rate limiting in development
+          ...(isDevelopment && config?.security?.enableRateLimiting === undefined
+            ? { enableRateLimiting: false }
+            : {}),
+          // Explicit config overrides defaults
+          ...config?.security,
+        };
+  
+  // Pass security config to engine
+  globalEngine = createRBACEngine(supabase, securityConfig);
   
   // Setup audit manager
   const auditManager = createAuditManager(supabase);

package/src/rbac/audit-enhanced.ts

@@ -15,6 +15,7 @@ import {
   AuditEventSource, 
   RBACAuditEvent 
 } from './types';
+import type { AuditEventType } from './types/functions';
 import { logger } from '../utils/core/logger';
 
 /**
@@ -299,10 +300,32 @@ export class EnhancedRBACAuditManager {
       .limit(limit);
 
     if (error) {
+      // Detect CORS errors (they typically have null status or specific error codes)
+      const isCorsError = 
+        error.message?.toLowerCase().includes('cors') ||
+        error.message?.toLowerCase().includes('cross-origin') ||
+        error.code === null ||
+        (error as any).status === null;
+      
+      if (isCorsError) {
+        const corsError = new Error(
+          `CORS error when querying audit events. This is a Supabase configuration issue. ` +
+          `Please configure CORS in your Supabase Dashboard: Settings → API → CORS. ` +
+          `Add your app's origin (e.g., http://localhost:8087) to the allowed origins list. ` +
+          `Original error: ${error.message || 'CORS request did not succeed'}`
+        );
+        (corsError as any).isCorsError = true;
+        (corsError as any).originalError = error;
+        throw corsError;
+      }
+      
       throw new Error(`Failed to get audit events: ${error.message}`);
     }
 
-    return data || [];
+    return (data || []).map(event => ({
+      ...event,
+      event_type: event.event_type as AuditEventType
+    })) as RBACAuditEvent[];
   }
 
   /**
@@ -321,10 +344,32 @@ export class EnhancedRBACAuditManager {
       .limit(limit);
 
     if (error) {
+      // Detect CORS errors (they typically have null status or specific error codes)
+      const isCorsError = 
+        error.message?.toLowerCase().includes('cors') ||
+        error.message?.toLowerCase().includes('cross-origin') ||
+        error.code === null ||
+        (error as any).status === null;
+      
+      if (isCorsError) {
+        const corsError = new Error(
+          `CORS error when querying audit events. This is a Supabase configuration issue. ` +
+          `Please configure CORS in your Supabase Dashboard: Settings → API → CORS. ` +
+          `Add your app's origin (e.g., http://localhost:8087) to the allowed origins list. ` +
+          `Original error: ${error.message || 'CORS request did not succeed'}`
+        );
+        (corsError as any).isCorsError = true;
+        (corsError as any).originalError = error;
+        throw corsError;
+      }
+      
       throw new Error(`Failed to get audit events: ${error.message}`);
     }
 
-    return data || [];
+    return (data || []).map(event => ({
+      ...event,
+      event_type: event.event_type as AuditEventType
+    })) as RBACAuditEvent[];
   }
 }