@jmruthers/pace-core 0.5.181 → 0.5.182

package/src/components/NavigationMenu/NavigationMenu.test.tsx

@@ -10,7 +10,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { NavigationMenu } from './NavigationMenu';
 import { NavigationItem } from './types';
 import { renderWithProviders } from '../../__tests__/helpers/test-utils';
-import { AccessLevel } from '../../types/unified';
+// AccessLevel removed - use AccessLevel type from rbac/types.ts if needed
 import { Logger, LogLevel } from '../../utils/core/logger';
 
 // Mock the UnifiedAuthProvider
@@ -37,9 +37,11 @@ const mockAuthContext = {
   inactivityError: null,
 };
 
-// Mock the useUnifiedAuth hook
-vi.mock('../../providers/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: vi.fn(() => mockAuthContext),
+// Mock the useUnifiedAuth hook with a hoisted mock for per-test control
+const mockUseUnifiedAuthFn = vi.fn(() => mockAuthContext);
+vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: () => mockUseUnifiedAuthFn(),
+  UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
 }));
 
 // Mock RBAC hooks with hoisted mocks so they can be controlled per test
@@ -249,6 +251,29 @@ describe('NavigationMenu Component', () => {
 
       expect(screen.getByLabelText('Custom Navigation')).toBeInTheDocument();
     });
+
+    it('omits items marked as hidden via metadata', async () => {
+      const user = userEvent.setup();
+      const hiddenItems: NavigationItem[] = [
+        { id: 'home', label: 'Home', href: '/' },
+        { id: 'secret', label: 'Secret', href: '/secret', meta: { hidden: true } },
+      ];
+
+      renderWithProviders(
+        <NavigationMenu
+          items={hiddenItems}
+          onNavigate={mockNavigate}
+          buttonText="Menu"
+        />
+      );
+
+      await user.click(screen.getByRole('combobox'));
+      await waitFor(() => {
+        expect(screen.getByText('Home')).toBeInTheDocument();
+      }, { interval: 10 });
+
+      expect(screen.queryByText('Secret')).not.toBeInTheDocument();
+    });
   });
 
   // Dropdown mode tests
@@ -528,7 +553,6 @@ describe('NavigationMenu Component', () => {
         <NavigationMenu
           items={permissionBasedNavItems}
           onNavigate={mockNavigate}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -549,7 +573,6 @@ describe('NavigationMenu Component', () => {
         <NavigationMenu
           items={permissionBasedNavItems}
           onNavigate={mockNavigate}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -562,13 +585,69 @@ describe('NavigationMenu Component', () => {
       }, { interval: 10 });
     });
 
-    it('shows all items when filterByPermissions is false', async () => {
+    it('always filters items by permissions (filtering cannot be disabled)', async () => {
       const user = userEvent.setup();
+      
+      // Mock permission map to grant page permissions for all items with hrefs
+      // NavigationMenu checks read:page.{pageId} for items with href
+      mockUsePermissions.mockReturnValue({
+        permissions: {
+          '*': true, // Super admin access
+          'read:page.dashboard': true,
+          'read:page.users': true,
+          'read:page.settings': true,
+        } as any,
+        isLoading: false,
+        error: null,
+        hasPermission: vi.fn((p: any) => {
+          return p === 'read:page.dashboard' || 
+                 p === 'read:page.users' || 
+                 p === 'read:page.settings' ||
+                 p === '*';
+        }),
+        hasAnyPermission: vi.fn((ps: any[]) => ps.some((p: any) => {
+          return p === 'read:page.dashboard' || 
+                 p === 'read:page.users' || 
+                 p === 'read:page.settings' ||
+                 p === '*';
+        })),
+        hasAllPermissions: vi.fn(() => true),
+        refetch: vi.fn(),
+      });
+      
+      // Mock RBAC to grant admin role for Users item (which has roles: ['admin'])
+      mockUseRBAC.mockReturnValue({
+        user: { id: 'test-user', email: 'test@example.com' },
+        globalRole: null,
+        organisationRole: 'org_admin' as any,
+        eventAppRole: 'event_admin' as any,
+        hasPermission: vi.fn(),
+        hasGlobalPermission: vi.fn(),
+        isSuperAdmin: false,
+        isOrgAdmin: true,
+        isEventAdmin: true,
+        canManageOrganisation: true,
+        canManageEvent: true,
+        isLoading: false,
+        error: null,
+      });
+      
+      // Mock resolved scope with appId (required for permission checks)
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: { 
+          organisationId: 'test-org-1', 
+          eventId: undefined, 
+          appId: 'test-app' // Required for permission map to work
+        },
+        isLoading: false,
+        error: null,
+      });
+      
+      // Permission filtering is always enabled - this test verifies that items with proper permissions are shown
       renderWithProviders(
         <NavigationMenu
           items={permissionBasedNavItems}
           onNavigate={mockNavigate}
-          filterByPermissions={false}
           buttonText="Menu"
         />
       );
@@ -692,7 +771,6 @@ describe('NavigationMenu Component', () => {
           items={permissionBasedNavItems}
           onNavigate={mockNavigate}
           onNavigationAccessDenied={mockOnNavigationAccessDenied}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -771,7 +849,6 @@ describe('NavigationMenu Component', () => {
           onNavigate={mockNavigate}
           onStrictModeViolation={mockOnStrictModeViolation}
           strictMode={true}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -793,6 +870,67 @@ describe('NavigationMenu Component', () => {
       // Should not trigger strict mode violation since user has permissions
       expect(mockOnStrictModeViolation).not.toHaveBeenCalled();
     });
+
+    it('reports strict mode violations when navigation is blocked', async () => {
+      const user = userEvent.setup();
+
+      const restrictedItems: NavigationItem[] = [
+        { id: 'reports', label: 'Reports', href: '/reports', permissions: ['reports:read'] }
+      ];
+
+      mockUsePermissions.mockReturnValue({
+        permissions: { 'read:page.reports': true } as any,
+        isLoading: false,
+        error: null,
+        hasPermission: vi.fn(() => false),
+        hasAnyPermission: vi.fn((permissions: string[]) => permissions.includes('reports:read') ? false : true),
+        hasAllPermissions: vi.fn(() => false),
+        refetch: vi.fn(),
+      });
+
+      mockUseRBAC.mockReturnValue({
+        user: { id: 'test-user', email: 'test@example.com' },
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+        hasPermission: vi.fn(),
+        hasGlobalPermission: vi.fn(),
+        isSuperAdmin: false,
+        isOrgAdmin: false,
+        isEventAdmin: false,
+        canManageOrganisation: false,
+        canManageEvent: false,
+        isLoading: false,
+        error: null,
+      });
+
+      renderWithProviders(
+        <NavigationMenu
+          items={restrictedItems}
+          onNavigate={mockNavigate}
+          onNavigationAccessDenied={mockOnNavigationAccessDenied}
+          onStrictModeViolation={mockOnStrictModeViolation}
+          strictMode={true}
+          buttonText="Restricted"
+        />
+      );
+
+      const trigger = screen.getByRole('combobox');
+      await user.click(trigger);
+
+      await waitFor(() => {
+        expect(screen.getByText('Reports')).toBeInTheDocument();
+      }, { interval: 10 });
+
+      await user.click(screen.getByText('Reports'));
+
+      expect(mockNavigate).not.toHaveBeenCalled();
+      expect(mockOnNavigationAccessDenied).toHaveBeenCalledWith(expect.objectContaining({ id: 'reports' }));
+      expect(mockOnStrictModeViolation).toHaveBeenCalledWith(
+        expect.objectContaining({ id: 'reports', label: 'Reports' }),
+        expect.stringContaining('Insufficient permissions')
+      );
+    });
   });
 
   // Accessibility tests
@@ -969,7 +1107,6 @@ describe('NavigationMenu Component', () => {
         <NavigationMenu
           items={invalidPermissionItems}
           onNavigate={mockNavigate}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -998,7 +1135,6 @@ describe('NavigationMenu Component', () => {
         <NavigationMenu
           items={invalidRoleItems}
           onNavigate={mockNavigate}
-          filterByPermissions={true}
           buttonText="Menu"
         />
       );
@@ -1050,18 +1186,15 @@ describe('NavigationMenu Component', () => {
       expect(mockOpen).toHaveBeenCalledWith('https://example.com', '_blank');
     });
 
-    it('works with action items (no href)', async () => {
+    it('marks action items without href as disabled options', async () => {
       const user = userEvent.setup();
       const actionItems: NavigationItem[] = [
         { id: 'logout', label: 'Sign Out' }, // No href
       ];
 
-      const handleAction = vi.fn();
-
       renderWithProviders(
         <NavigationMenu
           items={actionItems}
-          onNavigate={handleAction}
           buttonText="Menu"
         />
       );
@@ -1074,10 +1207,7 @@ describe('NavigationMenu Component', () => {
       }, { interval: 10 });
 
       const logoutItem = screen.getByText('Sign Out');
-      await user.click(logoutItem);
-
-      // The item should be present and clickable
-      expect(logoutItem).toBeInTheDocument();
+      expect(logoutItem.closest('[role="option"]')).toHaveAttribute('data-disabled', 'true');
     });
 
     it('forwards ref correctly', () => {
@@ -1095,6 +1225,88 @@ describe('NavigationMenu Component', () => {
     });
   });
 
+  describe('Resilience & Fallback Behavior', () => {
+    it('keeps previously filtered items visible while permissions reload', async () => {
+      const user = userEvent.setup();
+      const stablePermissions = {
+        permissions: { '*': true } as any,
+        isLoading: false,
+        error: null,
+        hasPermission: vi.fn(() => true),
+        hasAnyPermission: vi.fn(() => true),
+        hasAllPermissions: vi.fn(() => true),
+        refetch: vi.fn(),
+      };
+
+      const loadingPermissions = {
+        ...stablePermissions,
+        isLoading: true,
+      };
+
+      mockUsePermissions
+        .mockImplementationOnce(() => stablePermissions)
+        .mockImplementationOnce(() => loadingPermissions);
+
+      const view = renderWithProviders(
+        <NavigationMenu
+          items={basicNavItems}
+          onNavigate={mockNavigate}
+          buttonText="Menu"
+        />
+      );
+
+      const openMenu = async () => {
+        await user.click(screen.getByRole('combobox'));
+        await waitFor(() => {
+          expect(screen.getByText('Home')).toBeInTheDocument();
+        }, { interval: 10 });
+      };
+
+      await openMenu();
+
+      await view.rerender(
+        <NavigationMenu
+          items={basicNavItems}
+          onNavigate={mockNavigate}
+          buttonText="Menu"
+        />
+      );
+
+      await openMenu();
+    });
+
+    it('renders no selectable items when auth and RBAC providers are unavailable', async () => {
+      const user = userEvent.setup();
+
+      mockUseUnifiedAuthFn.mockImplementation(() => { throw new Error('no auth'); });
+      mockUseRBAC.mockImplementation(() => { throw new Error('no rbac'); });
+
+      mockUsePermissions.mockReturnValue({
+        permissions: { '*': true } as any,
+        isLoading: false,
+        error: null,
+        hasPermission: vi.fn(() => true),
+        hasAnyPermission: vi.fn(() => true),
+        hasAllPermissions: vi.fn(() => true),
+        refetch: vi.fn(),
+      });
+
+      renderWithProviders(
+        <NavigationMenu
+          items={basicNavItems}
+          onNavigate={mockNavigate}
+          buttonText="Menu"
+        />
+      );
+
+      const trigger = screen.getByRole('combobox');
+      await user.click(trigger);
+
+      const listbox = screen.getByRole('listbox');
+      expect(listbox.childNodes.length).toBe(0);
+    });
+  });
+
   // Audit logging tests
   describe('Audit Logging', () => {
     it('logs navigation access attempts when auditLog is enabled', async () => {
@@ -1157,3 +1369,4 @@ describe('NavigationMenu Component', () => {
     });
   });
 });
+    mockUseUnifiedAuthFn.mockImplementation(() => mockAuthContext);