@jmruthers/pace-core 0.5.188 → 0.5.190

package/src/rbac/utils/contextValidator.ts

@@ -0,0 +1,288 @@
+/**
+ * Context Validator for RBAC
+ * @package @jmruthers/pace-core
+ * @module RBAC/ContextValidator
+ * @since 1.0.0
+ * 
+ * Centralized validation for RBAC context requirements based on app configuration.
+ * Enforces app-specific context rules with single primary context:
+ * - requires_event = TRUE: Event is PRIMARY context, org derived from event (org not required in input)
+ * - requires_event = FALSE: Organisation is PRIMARY context, event optional
+ * - PORTAL/ADMIN apps: Both contexts optional (allows users to view/edit own profiles, super admin access)
+ * 
+ * Key principle: Only one primary context is required based on app config. The other is derived or optional.
+ */
+
+import { SupabaseClient } from '@supabase/supabase-js';
+import { Database } from '../../types/database';
+import { UUID, Scope } from '../types';
+import { EventContextRequiredError, OrganisationContextRequiredError } from '../types';
+import { getOrganisationFromEvent } from './eventContext';
+import { createLogger } from '../../utils/core/logger';
+
+const log = createLogger('ContextValidator');
+
+export interface AppConfig {
+  requires_event: boolean;
+}
+
+/**
+ * Check if an app allows optional contexts (both organisation and event optional)
+ * @param appName - App name to check
+ * @returns True if app allows optional contexts
+ */
+function allowsOptionalContexts(appName?: string): boolean {
+  return appName === 'PORTAL' || appName === 'ADMIN';
+}
+
+export interface ContextValidationResult {
+  isValid: boolean;
+  resolvedScope: Scope | null;
+  error: Error | null;
+}
+
+/**
+ * Context Validator class
+ * 
+ * Validates and resolves RBAC scope based on app configuration requirements.
+ */
+export class ContextValidator {
+  /**
+   * Validate scope against app requirements
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration (requires_event flag)
+   * @param appName - App name (for PORTAL/ADMIN special case)
+   * @returns Validation result with resolved scope
+   */
+  static async validateScope(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string
+  ): Promise<ContextValidationResult> {
+    // PORTAL/ADMIN special case: both contexts optional
+    if (allowsOptionalContexts(appName)) {
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId: scope.organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      if (!scope.organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Event-required apps: must have eventId, derive org from event
+    if (appConfig.requires_event) {
+      if (!scope.eventId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new EventContextRequiredError()
+        };
+      }
+
+      // If org is not provided, we'll need to derive it from event
+      // But for validation, we just check that eventId exists
+      // The actual derivation happens in resolveRequiredContext
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Org-required apps: must have organisationId, eventId optional
+    if (!scope.organisationId) {
+      return {
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      };
+    }
+
+    return {
+      isValid: true,
+      resolvedScope: scope,
+      error: null
+    };
+  }
+
+  /**
+   * Resolve required context and derive missing values
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration
+   * @param appName - App name (for PORTAL/ADMIN special case)
+   * @param supabase - Supabase client (for deriving org from event)
+   * @returns Resolved scope with all required context
+   */
+  static async resolveRequiredContext(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string,
+    supabase?: SupabaseClient<Database> | null
+  ): Promise<ContextValidationResult> {
+    // PORTAL/ADMIN special case: both contexts optional
+    if (allowsOptionalContexts(appName)) {
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId: scope.organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      if (!scope.organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Event-required apps: must have eventId, derive org from event
+    if (appConfig.requires_event) {
+      if (!scope.eventId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new EventContextRequiredError()
+        };
+      }
+
+      // Derive organisationId from event if not provided
+      let organisationId: UUID | undefined = scope.organisationId;
+      if (!organisationId && supabase && scope.eventId) {
+        try {
+          const derivedOrgId = await this.deriveOrgFromEvent(supabase, scope.eventId);
+          organisationId = derivedOrgId || undefined;
+          if (!organisationId) {
+            return {
+              isValid: false,
+              resolvedScope: null,
+              error: new Error('Could not resolve organisation from event context')
+            };
+          }
+        } catch (error) {
+          log.error('Failed to derive org from event:', error);
+          return {
+            isValid: false,
+            resolvedScope: null,
+            error: error instanceof Error ? error : new Error('Failed to derive organisation from event')
+          };
+        }
+      } else if (!organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new Error('Event context requires organisationId but it could not be derived (supabase client not available)')
+        };
+      }
+
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // Org-required apps: must have organisationId, eventId optional
+    if (!scope.organisationId) {
+      return {
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      };
+    }
+
+    return {
+      isValid: true,
+      resolvedScope: scope,
+      error: null
+    };
+  }
+
+  /**
+   * Derive organisation ID from event ID
+   * 
+   * @param supabase - Supabase client
+   * @param eventId - Event ID
+   * @returns Organisation ID or null
+   */
+  static async deriveOrgFromEvent(
+    supabase: SupabaseClient<Database>,
+    eventId: string
+  ): Promise<UUID | null> {
+    return getOrganisationFromEvent(supabase, eventId);
+  }
+
+  /**
+   * Check if context is ready for permission checks
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration
+   * @param appName - App name
+   * @param hasSelectedEvent - Whether event is selected
+   * @param hasSelectedOrganisation - Whether organisation is selected
+   * @returns True if context is ready
+   */
+  static isContextReady(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string,
+    hasSelectedEvent?: boolean,
+    hasSelectedOrganisation?: boolean
+  ): boolean {
+    // PORTAL/ADMIN special case: context is always ready
+    if (allowsOptionalContexts(appName)) {
+      return true;
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      return !!hasSelectedOrganisation || !!scope.organisationId;
+    }
+
+    // Event-required apps: need event context
+    if (appConfig.requires_event) {
+      return !!hasSelectedEvent || !!scope.eventId;
+    }
+
+    // Org-required apps: need org context
+    return !!hasSelectedOrganisation || !!scope.organisationId;
+  }
+}
+

package/src/rbac/utils/eventContext.ts

@@ -12,9 +12,35 @@ import { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../../types/database';
 import { UUID, Scope } from '../types';
 
+/**
+ * Cache for organisation derivation from event
+ * Key: eventId, Value: organisationId | null
+ * Maximum cache size to prevent memory leaks
+ */
+const orgDerivationCache = new Map<string, UUID | null>();
+const MAX_CACHE_SIZE = 100; // Limit cache to 100 entries
+
+/**
+ * Clear cache entry for a specific event (useful if event's org changes)
+ * @param eventId - Event ID to clear from cache
+ */
+export function clearOrgDerivationCache(eventId: string): void {
+  orgDerivationCache.delete(eventId);
+}
+
+/**
+ * Clear all cached organisation derivations
+ */
+export function clearAllOrgDerivationCache(): void {
+  orgDerivationCache.clear();
+}
+
 /**
  * Get organization ID from event ID
  * 
+ * Uses caching to avoid repeated database queries for the same event.
+ * Cache is limited to prevent memory leaks.
+ * 
  * @param supabase - Supabase client
  * @param eventId - Event ID
  * @returns Promise resolving to organization ID or null
@@ -23,17 +49,37 @@ export async function getOrganisationFromEvent(
   supabase: SupabaseClient<Database>,
   eventId: string
 ): Promise<UUID | null> {
+  // Check cache first
+  if (orgDerivationCache.has(eventId)) {
+    return orgDerivationCache.get(eventId) ?? null;
+  }
+
+  // Query database
   const { data, error } = await supabase
     .from('event')
     .select('organisation_id')
     .eq('event_id', eventId)
     .single() as { data: { organisation_id: string } | null; error: any };
 
+  let organisationId: UUID | null = null;
+
   if (error || !data) {
-    return null;
+    organisationId = null;
+  } else {
+    organisationId = data.organisation_id;
+  }
+
+  // Cache the result (with size limit to prevent memory leaks)
+  if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
+    // Remove oldest entry (first key in Map)
+    const firstKey = orgDerivationCache.keys().next().value;
+    if (firstKey) {
+      orgDerivationCache.delete(firstKey);
+    }
   }
+  orgDerivationCache.set(eventId, organisationId);
 
-  return data.organisation_id;
+  return organisationId;
 }
 
 /**

package/src/services/EventService.ts

@@ -16,6 +16,9 @@ import { Organisation } from '../types/organisation';
 import { assertOrganisationId } from '../types/core';
 import { logger } from '../utils/core/logger';
 import { secureStorage } from '../utils/security/secureStorage';
+import { isSuperAdmin, getAppConfigByName } from '../rbac/api';
+import type { UUID } from '../rbac/types';
+import type { AppConfig } from '../rbac/utils/contextValidator';
 
 export class EventService extends BaseService implements IEventService {
   private events: Event[] = [];
@@ -30,6 +33,8 @@ export class EventService extends BaseService implements IEventService {
   private appName: string = '';
   private selectedOrganisation: Organisation | null = null;
   private setSelectedEventId: ((eventId: string | null) => void) | null = null;
+  private isSuperAdmin: boolean = false; // Track super admin status for conditional validation
+  private appConfig: AppConfig | null = null; // Cache app config to avoid repeated lookups
 
   // Internal state management
   private isInitializedRef = false;
@@ -76,6 +81,7 @@ export class EventService extends BaseService implements IEventService {
     const newOrgId = selectedOrganisation?.id;
     const previousUserId = this.user?.id || null;
     const newUserId = user?.id || null;
+    const previousAppName = this.appName;
     
     // If user changed, clear previous user's event selection from storage
     if (previousUserId !== newUserId) {
@@ -87,6 +93,10 @@ export class EventService extends BaseService implements IEventService {
         this.selectedEvent = null;
         this.setSelectedEventId?.(null);
       }
+      // Reset initialization when user changes
+      this.resetInitialization();
+      this.isInitializedRef = false;
+      this.isFetchingRef = false;
     }
     
     this.supabaseClient = supabaseClient;
@@ -96,8 +106,31 @@ export class EventService extends BaseService implements IEventService {
     this.selectedOrganisation = selectedOrganisation;
     this.setSelectedEventId = setSelectedEventId;
     
-    // If organisation changed (from null to value, or different org), reset initialization
-    // This ensures events are re-fetched when organisation context becomes available
+    // Clear app config cache when app name changes
+    if (previousAppName !== appName) {
+      this.appConfig = null;
+    }
+    
+    // Update super admin status when user changes
+    // This allows super admins to select events from any organisation
+    if (user?.id) {
+      try {
+        this.isSuperAdmin = await isSuperAdmin(user.id as UUID);
+        logger.debug('EventService', 'Updated super admin status', {
+          userId: user.id,
+          isSuperAdmin: this.isSuperAdmin
+        });
+      } catch (error) {
+        logger.warn('EventService', 'Failed to check super admin status', { error });
+        this.isSuperAdmin = false; // Default to false on error
+      }
+    } else {
+      this.isSuperAdmin = false;
+    }
+    
+    // If organisation changed (from null to value, or different org, or value to null), reset initialization
+    // This ensures events are re-fetched when organisation context changes
+    // For event-required apps, selectedOrganisation will be null, so we need to reset when it changes from undefined/null to null
     if (previousOrgId !== newOrgId) {
       this.resetInitialization(); // Reset BaseService's isInitialized flag
       this.isInitializedRef = false;
@@ -138,20 +171,9 @@ export class EventService extends BaseService implements IEventService {
   // Event methods
   setSelectedEvent(event: Event | null): void {
     if (event) {
-      // SECURITY: Validate event belongs to current organisation
-      try {
-        if (this.selectedOrganisation && event.organisation_id !== this.selectedOrganisation.id) {
-          logger.error('EventService', 'Event organisation_id does not match selected organisation', {
-            eventOrganisationId: event.organisation_id,
-            selectedOrganisationId: this.selectedOrganisation.id,
-            eventName: event.event_name
-          });
-          return;
-        }
-      } catch (error) {
-        logger.error('EventService', 'Error during event validation:', error);
-      }
-
+      // No validation needed: For event-required apps, org is derived from event
+      // For org-required apps, event is optional and doesn't need validation
+      // RLS policies handle security at the database level
       this.selectedEvent = event;
       this.setSelectedEventId?.(event.event_id);
       // Persist asynchronously (don't await to avoid blocking)
@@ -286,6 +308,12 @@ export class EventService extends BaseService implements IEventService {
   async initialize(): Promise<void> {
     // Only call super.initialize() which will call doInitialize() and fetchEvents()
     // Don't call fetchEvents() again here to avoid double-fetching
+    logger.debug('EventService', 'initialize() called', {
+      isInitializedRef: this.isInitializedRef,
+      hasUser: !!this.user,
+      hasSession: !!this.session,
+      appName: this.appName
+    });
     await super.initialize();
   }
 
@@ -294,13 +322,23 @@ export class EventService extends BaseService implements IEventService {
   }
 
   protected async doInitialize(): Promise<void> {
+    logger.debug('EventService', 'doInitialize() called', {
+      isInitializedRef: this.isInitializedRef,
+      isFetchingRef: this.isFetchingRef,
+      hasUser: !!this.user,
+      hasSession: !!this.session,
+      appName: this.appName
+    });
+    
     // Skip if already initialized
     if (this.isInitializedRef) {
+      logger.debug('EventService', 'Skipping initialization - already initialized');
       return;
     }
     
     // Skip if already fetching
     if (this.isFetchingRef) {
+      logger.debug('EventService', 'Skipping initialization - already fetching');
       return;
     }
     
@@ -313,13 +351,25 @@ export class EventService extends BaseService implements IEventService {
       logger.warn('EventService', 'Failed to clean up old storage keys:', error);
     }
     
-    // Skip if no user or organisation
-    if (!this.user || !this.selectedOrganisation) {
+    // Skip if no user
+    // For event-required apps, selectedOrganisation may be null (org derived from event)
+    // For org-required apps, selectedOrganisation is required
+    if (!this.user) {
+      logger.debug('EventService', 'Skipping initialization - missing user');
       return;
     }
     
+    logger.debug('EventService', 'Initializing - fetching events', {
+      userId: this.user.id,
+      organisationId: this.selectedOrganisation?.id || 'derived-from-event',
+      appName: this.appName
+    });
+    
     // Initial setup - fetch events on initialization
     await this.fetchEvents(false);
+    
+    // Mark as initialized after successful fetch
+    this.isInitializedRef = true;
   }
 
   protected doCleanup(): void {
@@ -327,7 +377,15 @@ export class EventService extends BaseService implements IEventService {
   }
 
   private async fetchEvents(skipLoadPersisted: boolean = false): Promise<void> {
-    if (!this.user || !this.session || !this.supabaseClient || !this.appName || !this.selectedOrganisation) {
+    // For event-required apps, selectedOrganisation may be null (org derived from event)
+    // For org-required apps, selectedOrganisation is required
+    if (!this.user || !this.session || !this.supabaseClient || !this.appName) {
+      logger.debug('EventService', 'Skipping fetchEvents - missing dependencies', {
+        hasUser: !!this.user,
+        hasSession: !!this.session,
+        hasSupabaseClient: !!this.supabaseClient,
+        appName: this.appName
+      });
       // Already false from initialization, just notify
       this.notify();
       return;
@@ -339,6 +397,7 @@ export class EventService extends BaseService implements IEventService {
 
     // Prevent multiple simultaneous fetches
     if (this.isFetchingRef) {
+      logger.debug('EventService', 'Skipping fetchEvents - already fetching');
       return;
     }
 
@@ -346,12 +405,97 @@ export class EventService extends BaseService implements IEventService {
     let isMounted = true;
 
     try {
+      // Load app config if not already cached (only once per app)
+      if (!this.appConfig && this.appName) {
+        try {
+          this.appConfig = await getAppConfigByName(this.appName);
+        } catch (configError) {
+          logger.warn('EventService', 'Failed to load app config, defaulting to event-required', {
+            error: configError
+          });
+          // Default to event-required for safety
+          this.appConfig = { requires_event: true };
+        }
+      }
+
+      // Determine organisationId for RPC call
+      // For event-required apps: org is derived from selectedEvent (if available), or null to get all accessible events
+      // For org-required apps: org comes from selectedOrganisation
+      // Super admins: pass null to see all events
+      let organisationIdForRpc: string | null = null;
+      
+      // Check if user is super admin first
+      let userIsSuperAdmin = false;
+      try {
+        userIsSuperAdmin = await isSuperAdmin(this.user.id as UUID);
+        if (userIsSuperAdmin) {
+          // Super admin: Pass null to see all events across all organisations
+          organisationIdForRpc = null;
+          logger.debug('EventService', 'Super admin detected - fetching all events', {
+            userId: this.user.id
+          });
+        } else {
+          // Not super admin: determine org from context based on app type
+          if (this.selectedEvent) {
+            // If event is already selected, use its organisation
+            organisationIdForRpc = this.selectedEvent.organisation_id;
+          } else if (this.appConfig?.requires_event === true) {
+            // Event-required app with no selected event yet: pass null to get all accessible events
+            // The RPC will filter by event app roles, returning all events the user has access to
+            organisationIdForRpc = null;
+            logger.debug('EventService', 'Event-required app: fetching all accessible events (no event selected yet)', {
+              userId: this.user.id,
+              appName: this.appName
+            });
+          } else if (this.selectedOrganisation) {
+            // Org-required app: use selected organisation
+            organisationIdForRpc = this.selectedOrganisation.id;
+          } else {
+            // No context available - this shouldn't happen for authenticated users
+            logger.warn('EventService', 'No organisation context available for event fetch', {
+              hasSelectedEvent: !!this.selectedEvent,
+              hasSelectedOrganisation: !!this.selectedOrganisation,
+              appRequiresEvent: this.appConfig?.requires_event
+            });
+            organisationIdForRpc = null; // Will return empty list
+          }
+        }
+      } catch (superAdminCheckError) {
+        // If super admin check fails, fall back to organisation-scoped query
+        logger.warn('EventService', 'Failed to check super admin status, using organisation-scoped query', {
+          error: superAdminCheckError
+        });
+        // Fallback: use available context
+        if (this.selectedEvent) {
+          organisationIdForRpc = this.selectedEvent.organisation_id;
+        } else if (this.appConfig?.requires_event === true) {
+          // Event-required app: pass null to get all accessible events
+          organisationIdForRpc = null;
+        } else if (this.selectedOrganisation) {
+          organisationIdForRpc = this.selectedOrganisation.id;
+        }
+      }
+      
+      logger.debug('EventService', 'Fetching events via RPC', {
+        userId: this.user.id,
+        organisationId: organisationIdForRpc,
+        appName: this.appName
+      });
+      
       // Call the RPC function following the established pattern
-      const { data, error: rpcError } = await this.supabaseClient.rpc('data_user_events_get', {
+      // For super admins, pass null for p_organisation_id to see all events
+      let { data, error: rpcError } = await this.supabaseClient.rpc('data_user_events_get', {
         p_user_id: this.user.id,
-        p_organisation_id: this.selectedOrganisation.id,
+        p_organisation_id: organisationIdForRpc,
         p_app_name: this.appName
       });
+      
+      logger.debug('EventService', 'RPC response received', {
+        hasData: !!data,
+        dataLength: Array.isArray(data) ? data.length : 'not array',
+        hasError: !!rpcError,
+        error: rpcError
+      });
 
       if (rpcError) {
         logger.error('EventService', 'RPC error fetching events:', rpcError);