@jmruthers/pace-core 0.5.188 → 0.5.190

package/dist/{chunk-3GOZZZYH.js → chunk-HQVPB5MZ.js}

@@ -1,4 +1,15 @@
 import {
+  useAppConfig,
+  useEvents,
+  useResolvedScope,
+  useSuperAdminBypass
+} from "./chunk-Y4BUBBHD.js";
+import {
+  useOrganisations,
+  useUnifiedAuth
+} from "./chunk-J2XXC7R5.js";
+import {
+  ContextValidator,
   OrganisationContextRequiredError,
   getAccessLevel,
   getPermissionMap,
@@ -7,32 +18,22 @@ import {
   isPermitted,
   isPermittedCached,
   resolveAppContext
-} from "./chunk-HEHYGYOX.js";
-import {
-  useEvents,
-  useOrganisations
-} from "./chunk-E7UAOUMY.js";
-import {
-  useUnifiedAuth
-} from "./chunk-VGZZXKBR.js";
-import {
-  getCurrentAppName
-} from "./chunk-F2IMUDXZ.js";
+} from "./chunk-RUYZKXOD.js";
 import {
-  createLogger,
   logger
 } from "./chunk-PWLANIRT.js";
 
 // src/rbac/secureClient.ts
 import { createClient } from "@supabase/supabase-js";
 var SecureSupabaseClient = class _SecureSupabaseClient {
-  constructor(supabaseUrl, supabaseKey, organisationId, eventId, appId) {
+  constructor(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin = false) {
     this.edgeFunctionClient = null;
     this.supabaseUrl = supabaseUrl;
     this.supabaseKey = supabaseKey;
     this.organisationId = organisationId;
     this.eventId = eventId;
     this.appId = appId;
+    this.isSuperAdmin = isSuperAdmin;
     this.supabase = createClient(supabaseUrl, supabaseKey, {
       global: {
         headers: {
@@ -53,7 +54,8 @@ var SecureSupabaseClient = class _SecureSupabaseClient {
     this.supabase.from = (table) => {
       this.validateContext();
       const query = originalFrom(table);
-      return this.injectContext(query);
+      query._tableName = table;
+      return this.injectContext(query, table);
     };
     const originalRpc = this.supabase.rpc.bind(this.supabase);
     this.supabase.rpc = (fn, args, options) => {
@@ -90,33 +92,60 @@ var SecureSupabaseClient = class _SecureSupabaseClient {
   /**
    * Inject organisation context into a query
    */
-  injectContext(query) {
+  injectContext(query, tableName) {
     const originalSelect = query.select.bind(query);
     const originalInsert = query.insert.bind(query);
     const originalUpdate = query.update.bind(query);
     const originalDelete = query.delete.bind(query);
     query.select = (columns) => {
       const result = originalSelect(columns);
-      return this.addOrganisationFilter(result);
+      return this.addOrganisationFilter(result, tableName);
     };
     query.insert = (values) => {
+      if (tableName === "rbac_user_profiles") {
+        if (this.isSuperAdmin) {
+          return originalInsert(values);
+        }
+        const contextValues2 = Array.isArray(values) ? values.map((v) => ({ ...v, organisation_id: this.organisationId })) : { ...values, organisation_id: this.organisationId };
+        return originalInsert(contextValues2);
+      }
       const contextValues = Array.isArray(values) ? values.map((v) => ({ ...v, organisation_id: this.organisationId })) : { ...values, organisation_id: this.organisationId };
       return originalInsert(contextValues);
     };
     query.update = (values) => {
       const result = originalUpdate(values);
-      return this.addOrganisationFilter(result);
+      return this.addOrganisationFilter(result, tableName);
     };
     query.delete = () => {
       const result = originalDelete();
-      return this.addOrganisationFilter(result);
+      return this.addOrganisationFilter(result, tableName);
     };
     return query;
   }
   /**
    * Add organisation filter to a query
+   * 
+   * Defense in depth strategy:
+   * - RLS policies are the primary security layer (cannot be bypassed)
+   * - Application-level filtering adds an additional layer of protection
+   * 
+   * For rbac_user_profiles:
+   * - Super admins: No org filter (see all users) - RLS will allow access
+   * - Non-super-admins: Apply org filter as defense in depth - RLS will also filter
+   * 
+   * For other tables:
+   * - Always apply org filter unless super admin bypasses it
    */
-  addOrganisationFilter(query) {
+  addOrganisationFilter(query, tableName) {
+    if (tableName === "rbac_user_profiles") {
+      if (this.isSuperAdmin) {
+        return query;
+      }
+      return query.eq("organisation_id", this.organisationId);
+    }
+    if (this.isSuperAdmin) {
+      return query.eq("organisation_id", this.organisationId);
+    }
     return query.eq("organisation_id", this.organisationId);
   }
   /**
@@ -154,7 +183,8 @@ var SecureSupabaseClient = class _SecureSupabaseClient {
       this.supabaseKey,
       updates.organisationId || this.organisationId,
       updates.eventId !== void 0 ? updates.eventId : this.eventId,
-      updates.appId !== void 0 ? updates.appId : this.appId
+      updates.appId !== void 0 ? updates.appId : this.appId,
+      updates.isSuperAdmin !== void 0 ? updates.isSuperAdmin : this.isSuperAdmin
     );
   }
   /**
@@ -172,8 +202,8 @@ var SecureSupabaseClient = class _SecureSupabaseClient {
     });
   }
 };
-function createSecureClient(supabaseUrl, supabaseKey, organisationId, eventId, appId) {
-  return new SecureSupabaseClient(supabaseUrl, supabaseKey, organisationId, eventId, appId);
+function createSecureClient(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin = false) {
+  return new SecureSupabaseClient(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin);
 }
 function fromSupabaseClient(client, organisationId, eventId, appId) {
   throw new Error("fromSupabaseClient is not supported. Use createSecureClient instead.");
@@ -201,15 +231,16 @@ function useRBAC(pageId) {
   const {
     user,
     session,
+    supabase,
     appName,
     appConfig,
+    appId: contextAppId,
     selectedOrganisation,
     isContextReady: orgContextReady,
     organisationLoading: orgLoading,
     selectedEvent,
     eventLoading
   } = useUnifiedAuth();
-  const requiresEvent = appConfig?.requires_event ?? (appConfig === null ? true : false);
   const [globalRole, setGlobalRole] = useState(null);
   const [organisationRole, setOrganisationRole] = useState(null);
   const [eventAppRole, setEventAppRole] = useState(null);
@@ -230,59 +261,91 @@ function useRBAC(pageId) {
       setIsLoading(false);
       return;
     }
-    if (orgLoading || !orgContextReady || !selectedOrganisation?.id) {
+    const initialScope = {
+      organisationId: appConfig?.requires_event ? selectedEvent?.organisation_id || selectedOrganisation?.id : selectedOrganisation?.id,
+      eventId: selectedEvent?.event_id || void 0,
+      appId: void 0
+    };
+    const contextReady = ContextValidator.isContextReady(
+      initialScope,
+      appConfig,
+      appName,
+      !!selectedEvent,
+      !!selectedOrganisation
+    );
+    if (appName !== "PORTAL" && appName !== "ADMIN" && !contextReady) {
       setIsLoading(true);
       return;
     }
-    if (requiresEvent) {
-      if (eventLoading || !selectedEvent) {
-        setIsLoading(true);
-        return;
-      }
-    }
     setIsLoading(true);
     setError(null);
     logger2.debug("[useRBAC] Loading RBAC context", {
       appName,
-      requiresEvent,
+      appConfig,
       hasSelectedEvent: !!selectedEvent,
       selectedEventId: selectedEvent?.event_id,
       organisationId: selectedOrganisation?.id
     });
     try {
-      let appId;
-      if (appName) {
+      let appId = contextAppId;
+      if (appName && !appId) {
         try {
           const resolved = await resolveAppContext({ userId: user.id, appName });
-          if (!resolved || !resolved.hasAccess) {
+          if (!resolved) {
+            if (appName === "PORTAL" || appName === "ADMIN") {
+              logger2.debug(`[useRBAC] ${appName} app context not resolved, attempting direct lookup`);
+              try {
+                const { getAppConfigByName } = await import("./api-I6UCQ5S6.js");
+                const config = await getAppConfigByName(appName);
+                logger2.debug(`[useRBAC] ${appName} app - proceeding without appId for page-level permissions`);
+              } catch (err) {
+                logger2.debug(`[useRBAC] ${appName} app - proceeding without appId for page-level permissions`);
+              }
+            } else {
+              throw new Error(`User does not have access to app "${appName}"`);
+            }
+          } else if (!resolved.hasAccess && appName !== "PORTAL" && appName !== "ADMIN") {
             throw new Error(`User does not have access to app "${appName}"`);
+          } else {
+            appId = resolved.appId;
           }
-          appId = resolved.appId;
         } catch (rpcError) {
           if (rpcError?.message?.includes("NetworkError") || rpcError?.message?.includes("fetch")) {
             logger2.warn("[useRBAC] NetworkError resolving app context - may be timing issue, will retry when context is ready", {
               appName,
               error: rpcError.message,
-              requiresEvent,
               eventLoading,
               hasSelectedEvent: !!selectedEvent
             });
             setIsLoading(false);
             return;
           }
-          throw rpcError;
+          if (appName === "PORTAL" || appName === "ADMIN") {
+            logger2.debug(`[useRBAC] ${appName} app - allowing access despite app context resolution failure`);
+          } else {
+            throw rpcError;
+          }
         }
       }
       const scope = {
-        organisationId: selectedOrganisation?.id,
-        eventId: selectedEvent?.event_id || void 0,
-        appId
+        ...initialScope,
+        appId: appId || contextAppId
       };
-      setCurrentScope(scope);
+      const validation = await ContextValidator.resolveRequiredContext(
+        scope,
+        appConfig,
+        appName,
+        supabase || null
+      );
+      if (!validation.isValid || !validation.resolvedScope) {
+        throw validation.error || new Error("Context validation failed");
+      }
+      const resolvedScope = validation.resolvedScope;
+      setCurrentScope(resolvedScope);
       const [map, roleContext, accessLevel] = await Promise.all([
-        getPermissionMap({ userId: user.id, scope }),
-        getRoleContext({ userId: user.id, scope }),
-        getAccessLevel({ userId: user.id, scope })
+        getPermissionMap({ userId: user.id, scope: resolvedScope }, appConfig, appName),
+        getRoleContext({ userId: user.id, scope: resolvedScope }, appConfig, appName),
+        getAccessLevel({ userId: user.id, scope: resolvedScope }, appConfig, appName)
       ]);
       setPermissionMap(map);
       setGlobalRole(roleContext.globalRole);
@@ -292,8 +355,8 @@ function useRBAC(pageId) {
       if (permissionCount === 0) {
         logger2.warn("[useRBAC] RBAC context loaded but returned 0 permissions", {
           appName,
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent?.event_id
+          organisationId: resolvedScope.organisationId,
+          eventId: resolvedScope.eventId
         });
       }
     } catch (err) {
@@ -304,7 +367,7 @@ function useRBAC(pageId) {
     } finally {
       setIsLoading(false);
     }
-  }, [appName, logger2, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, requiresEvent, eventLoading, appConfig, orgContextReady, orgLoading]);
+  }, [appName, logger2, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, eventLoading, appConfig, orgContextReady, orgLoading]);
   const hasGlobalPermission = useCallback(
     (permission) => {
       if (globalRole === "super_admin" || permissionMap["*"]) {
@@ -327,7 +390,7 @@ function useRBAC(pageId) {
   const canManageEvent = useMemo(() => isSuperAdmin || eventAppRole === "event_admin", [isSuperAdmin, eventAppRole]);
   useEffect(() => {
     loadRBACContext();
-  }, [loadRBACContext, appName, requiresEvent, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
+  }, [loadRBACContext, appName, appConfig, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
   return {
     user,
     globalRole,
@@ -344,176 +407,8 @@ function useRBAC(pageId) {
   };
 }
 
-// src/rbac/hooks/useResolvedScope.ts
-import { useEffect as useEffect2, useState as useState2, useRef } from "react";
-
-// src/rbac/utils/eventContext.ts
-async function getOrganisationFromEvent(supabase, eventId) {
-  const { data, error } = await supabase.from("event").select("organisation_id").eq("event_id", eventId).single();
-  if (error || !data) {
-    return null;
-  }
-  return data.organisation_id;
-}
-async function createScopeFromEvent(supabase, eventId, appId) {
-  const organisationId = await getOrganisationFromEvent(supabase, eventId);
-  if (!organisationId) {
-    return null;
-  }
-  return {
-    organisationId,
-    eventId,
-    appId
-  };
-}
-
-// src/rbac/hooks/useResolvedScope.ts
-var log = createLogger("useResolvedScope");
-function useResolvedScope({
-  supabase,
-  selectedOrganisationId,
-  selectedEventId
-}) {
-  const [resolvedScope, setResolvedScope] = useState2(null);
-  const [isLoading, setIsLoading] = useState2(true);
-  const [error, setError] = useState2(null);
-  const stableScopeRef = useRef({
-    organisationId: "",
-    appId: "",
-    eventId: void 0
-  });
-  useEffect2(() => {
-    if (resolvedScope && resolvedScope.organisationId) {
-      const newScope = {
-        organisationId: resolvedScope.organisationId,
-        appId: resolvedScope.appId,
-        eventId: resolvedScope.eventId
-      };
-      if (stableScopeRef.current.organisationId !== newScope.organisationId || stableScopeRef.current.eventId !== newScope.eventId || stableScopeRef.current.appId !== newScope.appId) {
-        stableScopeRef.current = {
-          organisationId: newScope.organisationId,
-          appId: newScope.appId || "",
-          eventId: newScope.eventId
-        };
-      }
-    } else if (!resolvedScope) {
-      stableScopeRef.current = { organisationId: "", appId: "", eventId: void 0 };
-    }
-  }, [resolvedScope]);
-  const stableScope = stableScopeRef.current;
-  useEffect2(() => {
-    let cancelled = false;
-    const resolveScope = async () => {
-      if (!supabase && !selectedOrganisationId && !selectedEventId) {
-        if (!cancelled) {
-          setResolvedScope(null);
-          setIsLoading(false);
-          setError(null);
-        }
-        return;
-      }
-      setIsLoading(true);
-      setError(null);
-      try {
-        let appId = void 0;
-        if (supabase) {
-          const appName = getCurrentAppName();
-          if (appName) {
-            try {
-              const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName).eq("is_active", true).single();
-              if (error2) {
-                const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName).single();
-                if (inactiveApp) {
-                  log.error(`App "${appName}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
-                } else {
-                  log.error(`App "${appName}" not found in rbac_apps table`);
-                }
-              } else if (app) {
-                appId = app.id;
-              }
-            } catch (error2) {
-              log.error("Unexpected error resolving app ID:", error2);
-            }
-          }
-        }
-        if (selectedOrganisationId && selectedEventId) {
-          if (!cancelled) {
-            setResolvedScope({
-              organisationId: selectedOrganisationId,
-              eventId: selectedEventId,
-              appId
-            });
-            setIsLoading(false);
-          }
-          return;
-        }
-        if (selectedOrganisationId) {
-          if (!cancelled) {
-            setResolvedScope({
-              organisationId: selectedOrganisationId,
-              eventId: selectedEventId || void 0,
-              appId
-            });
-            setIsLoading(false);
-          }
-          return;
-        }
-        if (selectedEventId && supabase) {
-          try {
-            const eventScope = await createScopeFromEvent(supabase, selectedEventId, appId);
-            if (!eventScope) {
-              log.error("Could not resolve organization from event context");
-              if (!cancelled) {
-                setResolvedScope(null);
-                setError(new Error("Could not resolve organisation from event context"));
-                setIsLoading(false);
-              }
-              return;
-            }
-            if (!cancelled) {
-              setResolvedScope({
-                ...eventScope,
-                appId: appId || eventScope.appId
-              });
-              setIsLoading(false);
-            }
-          } catch (err) {
-            log.error("Error resolving scope from event:", err);
-            if (!cancelled) {
-              setResolvedScope(null);
-              setError(err);
-              setIsLoading(false);
-            }
-          }
-          return;
-        }
-        log.error("No organisation or event context available");
-        if (!cancelled) {
-          setResolvedScope(null);
-          setError(new Error("No organisation or event context available"));
-          setIsLoading(false);
-        }
-      } catch (err) {
-        if (!cancelled) {
-          setError(err);
-          setIsLoading(false);
-        }
-      }
-    };
-    resolveScope();
-    return () => {
-      cancelled = true;
-    };
-  }, [selectedOrganisationId, selectedEventId, supabase]);
-  return {
-    resolvedScope: stableScope.organisationId ? stableScope : null,
-    isLoading,
-    error
-  };
-}
-
 // src/rbac/hooks/usePermissions.ts
-import { useState as useState3, useEffect as useEffect3, useCallback as useCallback2, useMemo as useMemo2, useRef as useRef2 } from "react";
+import { useState as useState2, useEffect as useEffect2, useCallback as useCallback2, useMemo as useMemo2, useRef } from "react";
 
 // src/rbac/utils/deep-equal.ts
 function scopeEqual(a, b) {
@@ -528,15 +423,15 @@ function scopeEqual(a, b) {
 
 // src/rbac/hooks/usePermissions.ts
 function usePermissions(userId, organisationId, eventId, appId) {
-  const [permissions, setPermissions] = useState3({});
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
-  const [fetchTrigger, setFetchTrigger] = useState3(0);
-  const isFetchingRef = useRef2(false);
+  const [permissions, setPermissions] = useState2({});
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
+  const [fetchTrigger, setFetchTrigger] = useState2(0);
+  const isFetchingRef = useRef(false);
   const logger2 = getRBACLogger();
-  const prevValuesRef = useRef2({ userId, organisationId, eventId, appId });
+  const prevValuesRef = useRef({ userId, organisationId, eventId, appId });
   const orgId = organisationId || "";
-  useEffect3(() => {
+  useEffect2(() => {
     if (!userId) {
       return;
     }
@@ -550,19 +445,21 @@ function usePermissions(userId, organisationId, eventId, appId) {
     if (error?.message === "Organisation context is required for permission checks") {
       setError(null);
     }
-  }, [userId, organisationId, error]);
-  const paramsChanged = prevValuesRef.current.userId !== userId || prevValuesRef.current.organisationId !== organisationId || prevValuesRef.current.eventId !== eventId || prevValuesRef.current.appId !== appId;
-  if (paramsChanged) {
-    if (prevValuesRef.current.appId !== appId) {
-      logger2.debug("[usePermissions] AppId changed - triggering fetch", {
-        prevAppId: prevValuesRef.current.appId,
-        newAppId: appId
-      });
+  }, [userId, organisationId, error, orgId]);
+  useEffect2(() => {
+    const paramsChanged = prevValuesRef.current.userId !== userId || prevValuesRef.current.organisationId !== organisationId || prevValuesRef.current.eventId !== eventId || prevValuesRef.current.appId !== appId;
+    if (paramsChanged) {
+      if (prevValuesRef.current.appId !== appId) {
+        logger2.debug("[usePermissions] AppId changed - triggering fetch", {
+          prevAppId: prevValuesRef.current.appId,
+          newAppId: appId
+        });
+      }
+      prevValuesRef.current = { userId, organisationId, eventId, appId };
+      setFetchTrigger((prev) => prev + 1);
     }
-    prevValuesRef.current = { userId, organisationId, eventId, appId };
-    setFetchTrigger((prev) => prev + 1);
-  }
-  useEffect3(() => {
+  }, [userId, organisationId, eventId, appId, logger2]);
+  useEffect2(() => {
     const fetchPermissions = async () => {
       if (isFetchingRef.current) {
         return;
@@ -671,16 +568,18 @@ function usePermissions(userId, organisationId, eventId, appId) {
     refetch
   }), [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]);
 }
-function useCan(userId, scope, permission, pageId, useCache = true) {
-  const [can, setCan] = useState3(false);
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+function useCan(userId, scope, permission, pageId, useCache = true, appName) {
+  const [can, setCan] = useState2(false);
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
   const isValidScope = scope && typeof scope === "object";
   const organisationId = isValidScope ? scope.organisationId : void 0;
   const eventId = isValidScope ? scope.eventId : void 0;
   const appId = isValidScope ? scope.appId : void 0;
-  useEffect3(() => {
-    if (!isValidScope || !organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "") {
+  useEffect2(() => {
+    const isPagePermission = permission.includes(":page.") || !!pageId;
+    const requiresOrgId = !isPagePermission;
+    if (requiresOrgId && (!isValidScope || !organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
       const timeoutId = setTimeout(() => {
         setError(new Error("Organisation context is required for permission checks"));
         setIsLoading(false);
@@ -691,12 +590,12 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
     if (error?.message === "Organisation context is required for permission checks") {
       setError(null);
     }
-  }, [isValidScope, organisationId, error]);
-  const lastUserIdRef = useRef2(null);
-  const lastScopeRef = useRef2(null);
-  const lastPermissionRef = useRef2(null);
-  const lastPageIdRef = useRef2(null);
-  const lastUseCacheRef = useRef2(null);
+  }, [isValidScope, organisationId, error, permission, pageId]);
+  const lastUserIdRef = useRef(null);
+  const lastScopeRef = useRef(null);
+  const lastPermissionRef = useRef(null);
+  const lastPageIdRef = useRef(null);
+  const lastUseCacheRef = useRef(null);
   const stableScope = useMemo2(() => {
     if (!isValidScope) {
       return null;
@@ -707,8 +606,8 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
       appId
     };
   }, [isValidScope, organisationId, eventId, appId]);
-  const prevScopeRef = useRef2(null);
-  useEffect3(() => {
+  const prevScopeRef = useRef(null);
+  useEffect2(() => {
     const scopeChanged = !scopeEqual(prevScopeRef.current, stableScope);
     if (lastUserIdRef.current !== userId || scopeChanged || lastPermissionRef.current !== permission || lastPageIdRef.current !== pageId || lastUseCacheRef.current !== useCache) {
       lastUserIdRef.current = userId;
@@ -728,7 +627,17 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
           setError(null);
           return;
         }
-        if (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "") {
+        const isPagePermission = permission.includes(":page.") || !!pageId;
+        const requiresOrgId = !isPagePermission;
+        const isPageName = pageId && typeof pageId === "string" && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(pageId);
+        const needsAppIdForPageName = isPagePermission && isPageName;
+        if (requiresOrgId && (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
+          setIsLoading(true);
+          setCan(false);
+          setError(null);
+          return;
+        }
+        if (needsAppIdForPageName && (!appId || appId === null || typeof appId === "string" && appId.trim() === "")) {
           setIsLoading(true);
           setCan(false);
           setError(null);
@@ -738,11 +647,11 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
           setIsLoading(true);
           setError(null);
           const validScope = {
-            organisationId,
+            ...organisationId ? { organisationId } : {},
             ...eventId ? { eventId } : {},
             ...appId ? { appId } : {}
           };
-          const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }) : await isPermitted({ userId, scope: validScope, permission, pageId });
+          const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, void 0, appName) : await isPermitted({ userId, scope: validScope, permission, pageId }, void 0, appName);
           setCan(result);
         } catch (err) {
           const logger2 = getRBACLogger();
@@ -755,7 +664,7 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
       };
       checkPermission();
     }
-  }, [userId, stableScope, permission, pageId, useCache]);
+  }, [userId, stableScope, permission, pageId, useCache, appName]);
   const refetch = useCallback2(async () => {
     if (!userId) {
       setCan(false);
@@ -768,7 +677,9 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
       setError(null);
       return;
     }
-    if (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "") {
+    const isPagePermission = permission.includes(":page.") || !!pageId;
+    const requiresOrgId = !isPagePermission;
+    if (requiresOrgId && (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
       setCan(false);
       setIsLoading(true);
       setError(null);
@@ -778,11 +689,11 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
       setIsLoading(true);
       setError(null);
       const validScope = {
-        organisationId,
+        ...organisationId ? { organisationId } : {},
         ...eventId ? { eventId } : {},
         ...appId ? { appId } : {}
       };
-      const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }) : await isPermitted({ userId, scope: validScope, permission, pageId });
+      const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, void 0, appName) : await isPermitted({ userId, scope: validScope, permission, pageId }, void 0, appName);
       setCan(result);
     } catch (err) {
       setError(err instanceof Error ? err : new Error("Failed to check permission"));
@@ -790,7 +701,7 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
     } finally {
       setIsLoading(false);
     }
-  }, [userId, isValidScope, organisationId, eventId, appId, permission, pageId, useCache]);
+  }, [userId, isValidScope, organisationId, eventId, appId, permission, pageId, useCache, appName]);
   return useMemo2(() => ({
     can,
     isLoading,
@@ -799,9 +710,15 @@ function useCan(userId, scope, permission, pageId, useCache = true) {
   }), [can, isLoading, error, refetch]);
 }
 function useAccessLevel(userId, scope) {
-  const [accessLevel, setAccessLevel] = useState3("viewer");
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+  const [accessLevel, setAccessLevel] = useState2("viewer");
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
+  let appName;
+  try {
+    const { appName: contextAppName } = useAppConfig();
+    appName = contextAppName;
+  } catch {
+  }
   const fetchAccessLevel = useCallback2(async () => {
     if (!userId) {
       setAccessLevel("viewer");
@@ -811,16 +728,31 @@ function useAccessLevel(userId, scope) {
     try {
       setIsLoading(true);
       setError(null);
-      const level = await getAccessLevel({ userId, scope });
+      const { isSuperAdmin: checkSuperAdmin } = await import("./api-I6UCQ5S6.js");
+      const isSuperAdminUser = await checkSuperAdmin(userId);
+      if (isSuperAdminUser) {
+        setAccessLevel("super");
+        setIsLoading(false);
+        return;
+      }
+      if (appName !== "PORTAL" && appName !== "ADMIN" && !scope.organisationId && !scope.eventId) {
+        const orgError = new OrganisationContextRequiredError();
+        setError(orgError);
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      const level = await getAccessLevel({ userId, scope }, null, appName);
       setAccessLevel(level);
     } catch (err) {
-      setError(err instanceof Error ? err : new Error("Failed to fetch access level"));
+      const error2 = err instanceof Error ? err : new Error("Failed to fetch access level");
+      setError(error2);
       setAccessLevel("viewer");
     } finally {
       setIsLoading(false);
     }
-  }, [userId, scope.organisationId, scope.eventId, scope.appId]);
-  useEffect3(() => {
+  }, [userId, scope.organisationId, scope.eventId, scope.appId, appName]);
+  useEffect2(() => {
     fetchAccessLevel();
   }, [fetchAccessLevel]);
   return useMemo2(() => ({
@@ -831,9 +763,9 @@ function useAccessLevel(userId, scope) {
   }), [accessLevel, isLoading, error, fetchAccessLevel]);
 }
 function useMultiplePermissions(userId, scope, permissions, useCache = true) {
-  const [results, setResults] = useState3({});
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+  const [results, setResults] = useState2({});
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
   const checkPermissions = useCallback2(async () => {
     if (!userId || permissions.length === 0) {
       setResults({});
@@ -856,7 +788,7 @@ function useMultiplePermissions(userId, scope, permissions, useCache = true) {
       setIsLoading(false);
     }
   }, [userId, scope.organisationId, scope.eventId, scope.appId, permissions, useCache]);
-  useEffect3(() => {
+  useEffect2(() => {
     checkPermissions();
   }, [checkPermissions]);
   return useMemo2(() => ({
@@ -867,9 +799,9 @@ function useMultiplePermissions(userId, scope, permissions, useCache = true) {
   }), [results, isLoading, error, checkPermissions]);
 }
 function useHasAnyPermission(userId, scope, permissions, useCache = true) {
-  const [hasAny, setHasAny] = useState3(false);
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+  const [hasAny, setHasAny] = useState2(false);
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
   const checkAnyPermission = useCallback2(async () => {
     if (!userId || permissions.length === 0) {
       setHasAny(false);
@@ -895,7 +827,7 @@ function useHasAnyPermission(userId, scope, permissions, useCache = true) {
       setIsLoading(false);
     }
   }, [userId, scope.organisationId, scope.eventId, scope.appId, permissions, useCache]);
-  useEffect3(() => {
+  useEffect2(() => {
     checkAnyPermission();
   }, [checkAnyPermission]);
   return useMemo2(() => ({
@@ -906,9 +838,9 @@ function useHasAnyPermission(userId, scope, permissions, useCache = true) {
   }), [hasAny, isLoading, error, checkAnyPermission]);
 }
 function useHasAllPermissions(userId, scope, permissions, useCache = true) {
-  const [hasAll, setHasAll] = useState3(false);
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+  const [hasAll, setHasAll] = useState2(false);
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
   const checkAllPermissions = useCallback2(async () => {
     if (!userId || permissions.length === 0) {
       setHasAll(false);
@@ -934,7 +866,7 @@ function useHasAllPermissions(userId, scope, permissions, useCache = true) {
       setIsLoading(false);
     }
   }, [userId, scope.organisationId, scope.eventId, scope.appId, permissions, useCache]);
-  useEffect3(() => {
+  useEffect2(() => {
     checkAllPermissions();
   }, [checkAllPermissions]);
   return useMemo2(() => ({
@@ -945,9 +877,9 @@ function useHasAllPermissions(userId, scope, permissions, useCache = true) {
   }), [hasAll, isLoading, error, checkAllPermissions]);
 }
 function useCachedPermissions(userId, scope) {
-  const [permissions, setPermissions] = useState3({});
-  const [isLoading, setIsLoading] = useState3(true);
-  const [error, setError] = useState3(null);
+  const [permissions, setPermissions] = useState2({});
+  const [isLoading, setIsLoading] = useState2(true);
+  const [error, setError] = useState2(null);
   const fetchCachedPermissions = useCallback2(async () => {
     if (!userId) {
       setPermissions({});
@@ -968,7 +900,7 @@ function useCachedPermissions(userId, scope) {
   const invalidateCache = useCallback2(() => {
     fetchCachedPermissions();
   }, [fetchCachedPermissions]);
-  useEffect3(() => {
+  useEffect2(() => {
     fetchCachedPermissions();
   }, [fetchCachedPermissions]);
   return useMemo2(() => ({
@@ -1095,11 +1027,11 @@ function useResourcePermissions(resource, options = {}) {
 }
 
 // src/rbac/hooks/useRoleManagement.ts
-import { useState as useState4, useCallback as useCallback3 } from "react";
+import { useState as useState3, useCallback as useCallback3 } from "react";
 function useRoleManagement() {
   const { user, supabase } = useUnifiedAuth();
-  const [isLoading, setIsLoading] = useState4(false);
-  const [error, setError] = useState4(null);
+  const [isLoading, setIsLoading] = useState3(false);
+  const [error, setError] = useState3(null);
   if (!supabase) {
     throw new Error("useRoleManagement requires a Supabase client. Ensure UnifiedAuthProvider is configured.");
   }
@@ -1369,11 +1301,11 @@ function useRoleManagement() {
 }
 
 // src/rbac/hooks/useSecureSupabase.ts
-import { useMemo as useMemo4, useRef as useRef3 } from "react";
+import { useMemo as useMemo4, useRef as useRef2 } from "react";
 var secureClientCache = /* @__PURE__ */ new Map();
 var MAX_CACHE_SIZE = 5;
-function getCacheKey(organisationId, eventId, appId) {
-  return `${organisationId}-${eventId || "no-event"}-${appId || "no-app"}`;
+function getCacheKey(organisationId, eventId, appId, isSuperAdmin) {
+  return `${organisationId}-${eventId || "no-event"}-${appId || "no-app"}-${isSuperAdmin ? "super" : "regular"}`;
 }
 function getSupabaseConfig() {
   const getEnvVar = (key) => {
@@ -1386,7 +1318,7 @@ function getSupabaseConfig() {
     return void 0;
   };
   const supabaseUrl = getEnvVar("VITE_SUPABASE_URL") || getEnvVar("NEXT_PUBLIC_SUPABASE_URL") || null;
-  const supabaseKey = getEnvVar("VITE_SUPABASE_ANON_KEY") || getEnvVar("NEXT_PUBLIC_SUPABASE_ANON_KEY") || null;
+  const supabaseKey = getEnvVar("VITE_SUPABASE_PUBLISHABLE_KEY") || getEnvVar("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY") || null;
   if (!supabaseUrl || !supabaseKey) {
     return null;
   }
@@ -1398,12 +1330,15 @@ function useSecureSupabase(baseClient) {
   const eventsContext = useEvents();
   const { selectedEvent } = eventsContext;
   const eventLoading = "eventLoading" in eventsContext ? eventsContext.eventLoading : false;
+  const { isSuperAdmin: verifiedIsSuperAdmin, isLoading: isVerifyingSuperAdmin } = useSuperAdminBypass();
+  const metadataHint = Boolean(user?.app_metadata?.is_super_admin) || Boolean(user?.user_metadata?.is_super_admin);
+  const isSuperAdmin = verifiedIsSuperAdmin || isVerifyingSuperAdmin && metadataHint;
   const { resolvedScope } = useResolvedScope({
     supabase: authSupabase || null,
     selectedOrganisationId: selectedOrganisation?.id || null,
     selectedEventId: selectedEvent?.event_id || null
   });
-  const prevContextRef = useRef3({
+  const prevContextRef = useRef2({
     organisationId: void 0,
     eventId: void 0,
     appId: void 0
@@ -1412,12 +1347,12 @@ function useSecureSupabase(baseClient) {
     if (eventLoading) {
       return baseClient || authSupabase || null;
     }
-    if (selectedOrganisation?.id && user?.id) {
-      const organisationId = selectedOrganisation.id;
-      const eventId = selectedEvent?.event_id;
-      const appId = resolvedScope?.appId;
+    const organisationId = resolvedScope?.organisationId;
+    const eventId = resolvedScope?.eventId || selectedEvent?.event_id;
+    const appId = resolvedScope?.appId;
+    if (organisationId && user?.id) {
       prevContextRef.current = { organisationId, eventId, appId };
-      const cacheKey = getCacheKey(organisationId, eventId, appId);
+      const cacheKey = getCacheKey(organisationId, eventId, appId, isSuperAdmin);
       const cachedClient = secureClientCache.get(cacheKey);
       if (cachedClient) {
         return cachedClient.getClient();
@@ -1425,7 +1360,7 @@ function useSecureSupabase(baseClient) {
       const config = getSupabaseConfig();
       if (!config || !config.url || !config.key) {
         logger.warn("useSecureSupabase", "Missing Supabase environment variables. Falling back to base client.", {
-          note: "Ensure VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY are set in your environment."
+          note: "Ensure VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY are set in your environment."
         });
         return baseClient || authSupabase || null;
       }
@@ -1436,8 +1371,10 @@ function useSecureSupabase(baseClient) {
           organisationId,
           // organisationId is string, UUID is string alias
           eventId,
-          appId
+          appId,
           // appId is string | undefined, UUID is string alias
+          isSuperAdmin
+          // Pass super admin status for conditional filtering
         );
         secureClientCache.set(cacheKey, secureClient);
         if (secureClientCache.size > MAX_CACHE_SIZE) {
@@ -1454,11 +1391,13 @@ function useSecureSupabase(baseClient) {
     }
     return baseClient || authSupabase || null;
   }, [
-    selectedOrganisation?.id,
+    resolvedScope?.organisationId,
+    resolvedScope?.eventId,
+    resolvedScope?.appId,
     selectedEvent?.event_id,
     user?.id,
     eventLoading,
-    resolvedScope?.appId,
+    isSuperAdmin,
     baseClient,
     authSupabase
   ]);
@@ -1469,8 +1408,6 @@ export {
   createSecureClient,
   fromSupabaseClient,
   useRBAC,
-  createScopeFromEvent,
-  useResolvedScope,
   scopeEqual,
   usePermissions,
   useCan,
@@ -1483,4 +1420,4 @@ export {
   useRoleManagement,
   useSecureSupabase
 };
-//# sourceMappingURL=chunk-3GOZZZYH.js.map
+//# sourceMappingURL=chunk-HQVPB5MZ.js.map