@jmruthers/pace-core 0.5.188 → 0.5.190

package/src/services/OrganisationService.ts

@@ -71,6 +71,21 @@ export class OrganisationService extends BaseService implements IOrganisationSer
 
   // Additional methods for testing
   setSelectedOrganisation(organisation: Organisation | null): void {
+    // SECURITY: Validate organisation is in user's accessible organisations (only if orgs are loaded)
+    if (organisation && this._organisations.length > 0) {
+      const isValidOrg = this._organisations.some(org => org.id === organisation.id);
+      if (!isValidOrg) {
+        logger.warn('OrganisationService', 'Attempted to set invalid organisation - not in user\'s accessible organisations', {
+          organisationId: organisation.id,
+          organisationName: organisation.name,
+          accessibleOrgIds: this._organisations.map(o => o.id)
+        });
+        // Don't set invalid organisation - this prevents security issues
+        // If organisations haven't loaded yet, validation will happen in loadUserOrganisations()
+        return;
+      }
+    }
+    
     this._selectedOrganisation = organisation;
     if (organisation) {
       localStorage.setItem('pace-core-selected-organisation', JSON.stringify(organisation));
@@ -570,6 +585,16 @@ export class OrganisationService extends BaseService implements IOrganisationSer
         throw new Error('No valid organisation found for user') as OrganisationSecurityError;
       }
 
+      // SECURITY: Validate current selected organisation is still valid (in case it was set before orgs loaded)
+      const currentSelectedOrg = this._selectedOrganisation;
+      if (currentSelectedOrg && !activeOrgs.some(org => org.id === currentSelectedOrg.id)) {
+        logger.warn('OrganisationService', 'Current selected organisation is no longer valid, resetting', {
+          invalidOrgId: currentSelectedOrg.id,
+          validOrgIds: activeOrgs.map(o => o.id)
+        });
+        this._selectedOrganisation = null;
+      }
+
       this._selectedOrganisation = initialOrg;
       
       // Persist selection
@@ -583,14 +608,24 @@ export class OrganisationService extends BaseService implements IOrganisationSer
       this.hasFailedRef = false;
       
     } catch (err) {
-      logger.error("OrganisationService", "Failed to load organisations:", err);
-      this._error = err as Error;
+      const error = err as Error;
+      // "User has no access to active organisations" is a valid state for users without orgs (e.g., profile pages)
+      // Log it as a warning instead of an error to reduce noise
+      if (error.message === 'User has no access to active organisations') {
+        logger.warn("OrganisationService", "User has no active organisations (this is expected for users without organisation access):", error);
+      } else {
+        logger.error("OrganisationService", "Failed to load organisations:", err);
+      }
+      this._error = error;
       // Increment retry count on error
       this.retryCount = this.retryCount + 1;
       // Set failed flag to prevent further attempts
       this.hasFailedRef = true;
       // Clear all cached data on error to prevent corruption
       this.clearAllCachedData();
+      // Mark context as ready even on error - this allows the app to proceed
+      // The app can check hasValidOrganisationContext() to determine if org context is available
+      this._isContextReady = true;
     } finally {
       // Always cleanup refs and abort controller
       this.isLoadingRef = false;

package/src/services/__tests__/EventService.test.ts

@@ -40,6 +40,16 @@ vi.mock('../../utils/security/secureStorage', () => {
 import { secureStorage } from '../../utils/security/secureStorage';
 const mockSecureStorage = secureStorage as any;
 
+// Mock getAppConfigByName to return org-required app config by default
+vi.mock('../../rbac/api', async () => {
+  const actual = await vi.importActual('../../rbac/api');
+  return {
+    ...actual,
+    getAppConfigByName: vi.fn().mockResolvedValue({ requires_event: false }),
+    isSuperAdmin: vi.fn().mockResolvedValue(false),
+  };
+});
+
 // Mock Supabase client
 const createMockSupabaseClient = () => ({
   rpc: vi.fn(),
@@ -175,9 +185,11 @@ describe('EventService', () => {
 
       await eventService.initialize();
 
+      // For org-required apps: uses selectedOrganisation.id
+      // For event-required apps: uses selectedEvent.organisation_id or null for super admins
       expect(mockSupabase.rpc).toHaveBeenCalledWith('data_user_events_get', {
         p_user_id: mockUser.id,
-        p_organisation_id: mockOrganisation.id,
+        p_organisation_id: mockOrganisation.id, // Org-required app uses selectedOrganisation
         p_app_name: 'test-app'
       });
 
@@ -229,7 +241,7 @@ describe('EventService', () => {
       expect(mockSetSelectedEventId).toHaveBeenCalledWith(null);
     });
 
-    it('should validate event organisation before selection', () => {
+    it('should allow selecting event from any organisation (no validation)', () => {
       // Clear any auto-selected event first
       eventService.setSelectedEvent(null);
       
@@ -240,8 +252,8 @@ describe('EventService', () => {
 
       eventService.setSelectedEvent(eventFromDifferentOrg);
 
-      // Should not select event from different organisation
-      expect(eventService.getSelectedEvent()).toBeNull();
+      // Should allow selection - org validation removed (org derived from event for event-required apps)
+      expect(eventService.getSelectedEvent()).toEqual(eventFromDifferentOrg);
     });
 
     it('should refresh events', async () => {
@@ -976,8 +988,8 @@ describe('EventService', () => {
     });
   });
 
-  describe('Event Validation', () => {
-    it('should handle validation error gracefully', () => {
+  describe('Event Selection', () => {
+    it('should allow selecting event without organisation validation', () => {
       vi.clearAllMocks();
 
       const eventFromDifferentOrg: Event = {
@@ -985,22 +997,16 @@ describe('EventService', () => {
         organisation_id: 'org-2'
       };
 
-      // Should not throw error
+      // Should not throw error - validation removed (org derived from event for event-required apps)
       eventService.setSelectedEvent(eventFromDifferentOrg);
 
-      // The logger should be called synchronously when validation fails
-      expect(mockLoggerFunctions.error).toHaveBeenCalledWith(
-        'EventService',
-        'Event organisation_id does not match selected organisation',
-        expect.objectContaining({
-          eventOrganisationId: 'org-2',
-          selectedOrganisationId: 'org-1',
-          eventName: expect.any(String)
-        })
-      );
+      // Event should be selected successfully
+      expect(eventService.getSelectedEvent()).toEqual(eventFromDifferentOrg);
+      // No error should be logged
+      expect(mockLoggerFunctions.error).not.toHaveBeenCalled();
     });
 
-    it('should handle missing organisation during validation', () => {
+    it('should allow selecting event when organisation is null (event-required apps)', () => {
       const serviceWithoutOrg = new EventService(
         mockSupabase as any,
         mockUser,
@@ -1010,11 +1016,10 @@ describe('EventService', () => {
         mockSetSelectedEventId
       );
 
-      // Should not throw error
+      // Should not throw error - org is derived from event for event-required apps
       serviceWithoutOrg.setSelectedEvent(mockEvent);
 
-      // When organisation is null, validation is skipped (only validates when organisation exists)
-      // So the event can still be selected
+      // Event should be selected successfully
       expect(serviceWithoutOrg.getSelectedEvent()).toEqual(mockEvent);
     });
   });

package/src/types/file-reference.ts

@@ -9,7 +9,7 @@ export interface FileReference {
   record_id: string;
   file_path: string;
   file_metadata: FileMetadata;
-  organisation_id: string;
+  organisation_id: string | null; // Nullable for user-scoped files (e.g., profile photos)
   app_id: AppId;
   is_public: boolean;
   created_at: string;
@@ -56,11 +56,13 @@ export enum FileCategory {
  * @property pageContext - The page context where the file upload occurs (e.g., 'configuration', 'forms', 'applications')
  *                          Used for context-aware permission checks. Required to check appropriate page-level permissions.
  * @property event_id - Optional event ID for event-scoped permission checks. Required for event-based apps.
+ * @property organisation_id - Optional organisation ID. If not provided, the file is user-owned (record_id must match user_id).
+ *                              For user-owned files, users can only access their own files.
  */
 export interface FileUploadOptions {
   table_name: string;
   record_id: string;
-  organisation_id: string;
+  organisation_id: string | null; // Nullable for user-scoped files (e.g., profile photos)
   app_id: AppId;
   category: FileCategory;
   folder: string; // Folder name in storage bucket (e.g., 'profile_photos', 'documents')
@@ -68,20 +70,21 @@ export interface FileUploadOptions {
   event_id?: string;
   is_public?: boolean;
   custom_metadata?: Record<string, unknown>;
+  userId?: string; // Optional userId for user-scoped files
 }
 
 
 export interface FileReferenceService {
   createFileReference(options: FileUploadOptions, file: File): Promise<FileReference>;
-  getFileReference(table_name: string, record_id: string, organisation_id: string): Promise<FileReference | null>;
-  getFileReferenceById(id: string, organisation_id: string): Promise<FileReference | null>;
-  getFileUrl(table_name: string, record_id: string, organisation_id: string): Promise<string | null>;
-  getSignedUrl(table_name: string, record_id: string, organisation_id: string, expires_in?: number): Promise<string | null>;
+  getFileReference(table_name: string, record_id: string, organisation_id?: string): Promise<FileReference | null>;
+  getFileReferenceById(id: string, organisation_id?: string): Promise<FileReference | null>;
+  getFileUrl(table_name: string, record_id: string, organisation_id?: string): Promise<string | null>;
+  getSignedUrl(table_name: string, record_id: string, organisation_id?: string, expires_in?: number): Promise<string | null>;
   updateFileReference(id: string, updates: Partial<FileReference>): Promise<FileReference>;
-  deleteFileReference(table_name: string, record_id: string, organisation_id: string, delete_file?: boolean): Promise<boolean>;
-  listFileReferences(table_name: string, record_id: string, organisation_id: string): Promise<FileReference[]>;
-  getFilesByCategory(table_name: string, record_id: string, category: FileCategory, organisation_id: string): Promise<FileReference[]>;
-  getFileCount(table_name: string, record_id: string, organisation_id: string): Promise<number>;
+  deleteFileReference(table_name: string, record_id: string, organisation_id?: string, delete_file?: boolean): Promise<boolean>;
+  listFileReferences(table_name: string, record_id: string, organisation_id?: string): Promise<FileReference[]>;
+  getFilesByCategory(table_name: string, record_id: string, category: FileCategory, organisation_id?: string): Promise<FileReference[]>;
+  getFileCount(table_name: string, record_id: string, organisation_id?: string): Promise<number>;
   uploadMultipleFiles(options: FileUploadOptions, files: File[]): Promise<BulkUploadResult>;
 }