@jmruthers/pace-core 0.5.189 → 0.5.190

package/dist/{chunk-IM4QE42D.js → chunk-73HSNNOQ.js}

@@ -1,23 +1,25 @@
 import {
-  createScopeFromEvent,
   scopeEqual,
   useAccessLevel,
   useCan,
   useMultiplePermissions
-} from "./chunk-3GOZZZYH.js";
+} from "./chunk-HQVPB5MZ.js";
+import {
+  useSecureDataAccess
+} from "./chunk-4QYC5L4K.js";
+import {
+  useResolvedScope
+} from "./chunk-Y4BUBBHD.js";
+import {
+  useUnifiedAuth
+} from "./chunk-J2XXC7R5.js";
 import {
   RBACCache,
   RBACNotInitializedError,
   getRBACConfig,
   getRBACLogger,
   rbacCache
-} from "./chunk-HEHYGYOX.js";
-import {
-  useSecureDataAccess
-} from "./chunk-DDM4CCYT.js";
-import {
-  useUnifiedAuth
-} from "./chunk-VGZZXKBR.js";
+} from "./chunk-RUYZKXOD.js";
 import {
   createLogger,
   logger
@@ -74,17 +76,15 @@ function PagePermissionProvider({
   onStrictModeViolation,
   maxHistorySize = 1e3
 }) {
-  const { user, selectedOrganisation, selectedEvent } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const [pageAccessHistory, setPageAccessHistory] = useState([]);
   const [isEnabled, setIsEnabled] = useState(true);
-  const currentScope = useMemo(() => {
-    if (!selectedOrganisation) return null;
-    return {
-      organisationId: selectedOrganisation.id,
-      eventId: selectedEvent?.event_id || void 0,
-      appId: void 0
-    };
-  }, [selectedOrganisation, selectedEvent]);
+  const { resolvedScope } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const currentScope = resolvedScope;
   const hasPagePermission = useCallback((pageName, operation, pageId, scope) => {
     if (!isEnabled) return true;
     if (!user?.id) return false;
@@ -175,156 +175,28 @@ var PagePermissionGuardComponent = ({
   const renderCountRef = useRef(0);
   renderCountRef.current += 1;
   const instanceId = useMemo2(() => Math.random().toString(36).substr(2, 9), []);
-  const { user, selectedOrganisation, selectedEvent, supabase, appId: contextAppId } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase, appId: contextAppId, appName } = useUnifiedAuth();
   const [hasChecked, setHasChecked] = useState2(false);
-  const [checkError, setCheckError] = useState2(null);
-  const [resolvedScope, setResolvedScope] = useState2(null);
-  const scopeResolutionAbortRef = useRef(null);
-  const supabaseRef = useRef(supabase);
-  supabaseRef.current = supabase;
-  useEffect2(() => {
-    const abortController = new AbortController();
-    scopeResolutionAbortRef.current?.abort();
-    scopeResolutionAbortRef.current = abortController;
-    const { signal } = abortController;
-    const safeSetResolvedScope = (value) => {
-      if (!signal.aborted) {
-        setResolvedScope(value);
-      }
-    };
-    const safeSetCheckError = (value) => {
-      if (!signal.aborted) {
-        setCheckError(value);
-      }
-    };
-    const resolveScope = async () => {
-      if (signal.aborted) {
-        return;
-      }
-      if (scope) {
-        safeSetResolvedScope(scope);
-        safeSetCheckError(null);
-        return;
-      }
-      const appId = contextAppId;
-      if (signal.aborted) {
-        return;
-      }
-      if (selectedOrganisation && selectedEvent) {
-        if (!appId) {
-          const logger3 = getRBACLogger();
-          if (import.meta.env.MODE === "test") {
-            logger3.warn("App ID not resolved in test environment, proceeding without it");
-          } else {
-            logger3.error("CRITICAL: App ID not resolved. Check console for details.");
-            safeSetCheckError(new Error("App ID not resolved. Check console for database errors."));
-            safeSetResolvedScope(null);
-            return;
-          }
-        }
-        if (import.meta.env.MODE === "production" && appId) {
-          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-          if (!uuidRegex.test(appId)) {
-            const logger3 = getRBACLogger();
-            logger3.error("CRITICAL: App ID is not a valid UUID:", appId);
-            safeSetCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));
-            safeSetResolvedScope(null);
-            return;
-          }
-        }
-        const resolvedContext = {
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent.event_id,
-          appId
-        };
-        safeSetResolvedScope(resolvedContext);
-        safeSetCheckError(null);
-        return;
-      }
-      if (signal.aborted) {
-        return;
-      }
-      if (selectedOrganisation) {
-        if (!appId) {
-          const logger3 = getRBACLogger();
-          if (import.meta.env.MODE === "test") {
-            logger3.warn("App ID not resolved in test environment, proceeding without it");
-          } else {
-            logger3.error("CRITICAL: App ID not resolved. Check console for details.");
-            safeSetCheckError(new Error("App ID not resolved. Check console for database errors."));
-            safeSetResolvedScope(null);
-            return;
-          }
-        }
-        if (import.meta.env.MODE === "production" && appId) {
-          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-          if (!uuidRegex.test(appId)) {
-            const logger3 = getRBACLogger();
-            logger3.error("CRITICAL: App ID is not a valid UUID:", appId);
-            safeSetCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));
-            safeSetResolvedScope(null);
-            return;
-          }
-        }
-        const resolvedContext = {
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent?.event_id || void 0,
-          appId
-        };
-        safeSetResolvedScope(resolvedContext);
-        safeSetCheckError(null);
-        return;
-      }
-      if (signal.aborted) {
-        return;
-      }
-      if (selectedEvent && supabaseRef.current) {
-        try {
-          const eventScope = await createScopeFromEvent(supabaseRef.current, selectedEvent.event_id);
-          if (signal.aborted) {
-            return;
-          }
-          if (!eventScope) {
-            safeSetCheckError(new Error("Could not resolve organization from event context"));
-            safeSetResolvedScope(null);
-            return;
-          }
-          safeSetResolvedScope({
-            ...eventScope,
-            appId: appId || eventScope.appId
-          });
-          safeSetCheckError(null);
-        } catch (error2) {
-          if (signal.aborted) {
-            return;
-          }
-          safeSetCheckError(error2);
-          safeSetResolvedScope(null);
-        }
-        return;
-      }
-      if (signal.aborted) {
-        return;
-      }
-      const errorMessage = !selectedOrganisation && !selectedEvent ? "Either organisation context or event context is required for page permission checking" : "Insufficient context for permission checking. Please ensure you are properly authenticated and have selected an organisation or event.";
-      const logger2 = getRBACLogger();
-      logger2.error("Context resolution failed:", {
-        selectedOrganisation: selectedOrganisation ? selectedOrganisation.id : null,
-        selectedEvent: selectedEvent ? selectedEvent.event_id : null,
-        appId,
-        error: errorMessage
-      });
-      safeSetCheckError(new Error(errorMessage));
-      safeSetResolvedScope(null);
-    };
-    resolveScope();
-    return () => {
-      abortController.abort();
-      if (scopeResolutionAbortRef.current === abortController) {
-        scopeResolutionAbortRef.current = null;
-      }
-    };
-  }, [scope, selectedOrganisation, selectedEvent]);
+  const { resolvedScope: hookResolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const allowsOptionalContexts = appName === "PORTAL" || appName === "ADMIN";
+  const effectiveScope = scope || (hookResolvedScope ? {
+    ...hookResolvedScope,
+    appId: hookResolvedScope.appId || (allowsOptionalContexts ? contextAppId : void 0)
+  } : allowsOptionalContexts && contextAppId ? {
+    organisationId: void 0,
+    eventId: void 0,
+    appId: contextAppId
+  } : selectedEvent?.event_id ? {
+    organisationId: void 0,
+    // Will be derived from event
+    eventId: selectedEvent.event_id,
+    appId: contextAppId || void 0
+  } : null);
+  const checkError = scopeError;
   const effectivePageId = useMemo2(() => {
     return pageId || pageName;
   }, [pageId, pageName]);
@@ -333,36 +205,52 @@ var PagePermissionGuardComponent = ({
   }, [operation, pageName]);
   const prevScopeRef = useRef(null);
   const stableScope = useMemo2(() => {
-    const newScope = resolvedScope && resolvedScope.organisationId ? {
-      organisationId: resolvedScope.organisationId,
-      appId: resolvedScope.appId || void 0,
-      eventId: resolvedScope.eventId || void 0
-    } : { organisationId: void 0, appId: void 0, eventId: void 0 };
+    if (allowsOptionalContexts && effectiveScope) {
+      const newScope2 = {
+        organisationId: effectiveScope.organisationId,
+        appId: effectiveScope.appId || contextAppId || void 0,
+        eventId: effectiveScope.eventId
+      };
+      if (scopeEqual(prevScopeRef.current, newScope2)) {
+        return prevScopeRef.current;
+      }
+      prevScopeRef.current = newScope2;
+      return newScope2;
+    }
+    const newScope = effectiveScope && effectiveScope.organisationId ? {
+      organisationId: effectiveScope.organisationId,
+      appId: effectiveScope.appId || contextAppId || void 0,
+      eventId: effectiveScope.eventId || void 0
+    } : {
+      organisationId: effectiveScope?.organisationId || void 0,
+      appId: effectiveScope?.appId || contextAppId || void 0,
+      eventId: effectiveScope?.eventId || selectedEvent?.event_id || void 0
+    };
     if (scopeEqual(prevScopeRef.current, newScope)) {
       return prevScopeRef.current;
     }
     prevScopeRef.current = newScope;
     return newScope;
-  }, [resolvedScope]);
+  }, [effectiveScope, appName, contextAppId, selectedEvent?.event_id]);
   const { can, isLoading: canIsLoading, error: canError } = useCan(
     user?.id || "",
     stableScope,
     permission,
     effectivePageId,
-    true
+    true,
     // Use cache
+    appName
+    // Pass appName for PORTAL/ADMIN special case
   );
-  const isLoading = !resolvedScope || canIsLoading;
+  const isLoading = scopeLoading || canIsLoading;
   const error = checkError || canError;
   useEffect2(() => {
     if (!isLoading && !error) {
       setHasChecked(true);
-      setCheckError(null);
       if (!can && onDenied) {
         onDenied(pageName, operation);
       }
     } else if (error) {
-      setCheckError(error);
       setHasChecked(true);
     }
   }, [can, isLoading, error, pageName, operation, onDenied]);
@@ -373,12 +261,12 @@ var PagePermissionGuardComponent = ({
         pageName,
         operation,
         userId: user?.id,
-        scope: resolvedScope,
+        scope: effectiveScope,
         allowed: can,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [auditLog, hasChecked, isLoading, pageName, operation, user?.id, resolvedScope, can]);
+  }, [auditLog, hasChecked, isLoading, pageName, operation, user?.id, effectiveScope, can]);
   useEffect2(() => {
     if (strictMode && hasChecked && !isLoading && !can) {
       const logger2 = getRBACLogger();
@@ -388,22 +276,23 @@ var PagePermissionGuardComponent = ({
         permission: `${operation}:page.${pageName}`,
         pageId: effectivePageId,
         userId: user?.id,
-        scope: resolvedScope,
-        scopeValid: resolvedScope && resolvedScope.organisationId ? true : false,
+        scope: effectiveScope,
+        scopeValid: allowsOptionalContexts ? true : effectiveScope !== null,
+        // PORTAL/ADMIN allow scope without org/event
         checkError,
         canError,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [strictMode, hasChecked, isLoading, can, pageName, operation, effectivePageId, user?.id, resolvedScope, checkError, canError]);
-  const hasValidScope = resolvedScope && resolvedScope.organisationId;
+  }, [strictMode, hasChecked, isLoading, can, pageName, operation, effectivePageId, user?.id, effectiveScope, allowsOptionalContexts, checkError, canError]);
+  const hasValidScopeForPagePermissions = allowsOptionalContexts ? true : effectiveScope !== null;
   const hasValidUser = user && user.id;
   const isPermissionCheckComplete = hasChecked && !isLoading;
-  const shouldShowAccessDenied = isPermissionCheckComplete && hasValidScope && hasValidUser && !checkError && !can;
-  const shouldShowContent = isPermissionCheckComplete && hasValidScope && hasValidUser && !checkError && can;
-  const scopeKey = resolvedScope ? `${resolvedScope.organisationId}-${resolvedScope.eventId}-${resolvedScope.appId}` : "no-scope";
+  const shouldShowAccessDenied = isPermissionCheckComplete && hasValidScopeForPagePermissions && hasValidUser && !checkError && !can;
+  const shouldShowContent = isPermissionCheckComplete && hasValidScopeForPagePermissions && hasValidUser && !checkError && can;
+  const scopeKey = effectiveScope ? `${effectiveScope.organisationId}-${effectiveScope.eventId}-${effectiveScope.appId}` : "no-scope";
   const permissionKey = `${scopeKey}-${can}-${isLoading}-${!!checkError}-${hasChecked}`;
-  if (isLoading || !hasValidScope || !hasValidUser || !hasChecked) {
+  if (isLoading || !hasValidUser || !hasChecked) {
     return loading || /* @__PURE__ */ jsx2("div", { children: "Checking permissions..." });
   }
   if (checkError && !can) {
@@ -434,7 +323,7 @@ function DefaultAccessDenied() {
 }
 function DefaultLoading() {
   return /* @__PURE__ */ jsx2("div", { className: "flex items-center justify-center min-h-[200px] p-8", children: /* @__PURE__ */ jsxs("div", { className: "flex items-center space-x-2", children: [
-    /* @__PURE__ */ jsx2("div", { className: "animate-spin rounded-full h-8 w-8 border-b-2 border-main-600" }),
+    /* @__PURE__ */ jsx2("div", { className: "animate-spin rounded-full size-8 border-b-2 border-main-600" }),
     /* @__PURE__ */ jsx2("span", { className: "text-sec-600", children: "Checking permissions..." })
   ] }) });
 }
@@ -453,18 +342,16 @@ function SecureDataProvider({
   maxHistorySize = 1e3,
   enforceRLS = true
 }) {
-  const { user, selectedOrganisation, selectedEvent } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const { validateContext } = useSecureDataAccess();
   const [dataAccessHistory, setDataAccessHistory] = useState3([]);
   const [isEnabled, setIsEnabled] = useState3(true);
-  const currentScope = useMemo3(() => {
-    if (!selectedOrganisation) return null;
-    return {
-      organisationId: selectedOrganisation.id,
-      eventId: selectedEvent?.event_id || void 0,
-      appId: void 0
-    };
-  }, [selectedOrganisation, selectedEvent]);
+  const { resolvedScope } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const currentScope = resolvedScope;
   const isDataAccessAllowed = useCallback3((table, operation, scope) => {
     if (!isEnabled) return true;
     if (!user?.id) return false;
@@ -579,54 +466,22 @@ function PermissionEnforcer({
 }) {
   const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const [hasChecked, setHasChecked] = useState4(false);
-  const [checkError, setCheckError] = useState4(null);
-  const [resolvedScope, setResolvedScope] = useState4(null);
-  useEffect4(() => {
-    const resolveScope = async () => {
-      if (scope) {
-        setResolvedScope(scope);
-        return;
-      }
-      if (selectedOrganisation && selectedEvent) {
-        setResolvedScope({
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent.event_id,
-          appId: void 0
-        });
-        return;
-      }
-      if (selectedOrganisation) {
-        setResolvedScope({
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent?.event_id || void 0,
-          appId: void 0
-        });
-        return;
-      }
-      if (selectedEvent && supabase) {
-        try {
-          const eventScope = await createScopeFromEvent(supabase, selectedEvent.event_id);
-          if (!eventScope) {
-            setCheckError(new Error("Could not resolve organization from event context"));
-            return;
-          }
-          setResolvedScope(eventScope);
-        } catch (error2) {
-          setCheckError(error2);
-        }
-        return;
-      }
-      setCheckError(new Error("Either organisation context or event context is required for permission checking"));
-    };
-    resolveScope();
-  }, [scope, selectedOrganisation, selectedEvent, supabase]);
-  const { results: permissionResults, isLoading, error } = useMultiplePermissions(
+  const { resolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const effectiveScope = scope || resolvedScope;
+  const checkError = scopeError;
+  const { results: permissionResults, isLoading: permissionsLoading, error: permissionsError } = useMultiplePermissions(
     user?.id || "",
-    resolvedScope || { eventId: selectedEvent?.event_id || void 0 },
+    effectiveScope || { eventId: selectedEvent?.event_id || void 0 },
     permissions,
     true
     // Use cache
   );
+  const isLoading = scopeLoading || permissionsLoading;
+  const error = checkError || permissionsError;
   const hasRequiredPermissions = useMemo4(() => {
     if (permissions.length === 0) return true;
     if (!permissionResults || Object.keys(permissionResults).length === 0) {
@@ -641,12 +496,10 @@ function PermissionEnforcer({
   useEffect4(() => {
     if (!isLoading && !error) {
       setHasChecked(true);
-      setCheckError(null);
       if (!hasRequiredPermissions && onDenied) {
         onDenied(permissions, operation);
       }
     } else if (error) {
-      setCheckError(error);
       setHasChecked(true);
     }
   }, [hasRequiredPermissions, isLoading, error, permissions, operation, onDenied]);
@@ -656,13 +509,13 @@ function PermissionEnforcer({
         permissions,
         operation,
         userId: user?.id,
-        scope: resolvedScope,
+        scope: effectiveScope,
         allowed: hasRequiredPermissions,
         requireAll,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [auditLog, hasChecked, isLoading, permissions, operation, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);
+  }, [auditLog, hasChecked, isLoading, permissions, operation, user?.id, effectiveScope, hasRequiredPermissions, requireAll]);
   useEffect4(() => {
     if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {
       const logger2 = getRBACLogger();
@@ -670,12 +523,12 @@ function PermissionEnforcer({
         permissions,
         operation,
         userId: user?.id,
-        scope: resolvedScope,
+        scope: effectiveScope,
         requireAll,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, permissions, operation, user?.id, resolvedScope, requireAll]);
+  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, permissions, operation, user?.id, effectiveScope, requireAll]);
   if (isLoading || !hasChecked) {
     return /* @__PURE__ */ jsx4(Fragment2, { children: loading });
   }
@@ -706,7 +559,7 @@ function DefaultAccessDenied2() {
 }
 function DefaultLoading2() {
   return /* @__PURE__ */ jsx4("div", { className: "flex items-center justify-center min-h-[200px] p-8", children: /* @__PURE__ */ jsxs2("div", { className: "flex items-center space-x-2", children: [
-    /* @__PURE__ */ jsx4("div", { className: "animate-spin rounded-full h-8 w-8 border-b-2 border-main-600" }),
+    /* @__PURE__ */ jsx4("div", { className: "animate-spin rounded-full size-8 border-b-2 border-main-600" }),
     /* @__PURE__ */ jsx4("span", { className: "text-sec-600", children: "Checking permissions..." })
   ] }) });
 }
@@ -727,19 +580,17 @@ function RoleBasedRouter({
   maxHistorySize = 1e3,
   unauthorizedComponent: UnauthorizedComponent = DefaultUnauthorizedComponent
 }) {
-  const { user, selectedOrganisation, selectedEvent } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const location = useLocation();
   const navigate = useNavigate();
   const [routeAccessHistory, setRouteAccessHistory] = useState5([]);
   const [currentRoute, setCurrentRoute] = useState5("");
-  const currentScope = useMemo5(() => {
-    if (!selectedOrganisation) return null;
-    return {
-      organisationId: selectedOrganisation.id,
-      eventId: selectedEvent?.event_id || void 0,
-      appId: void 0
-    };
-  }, [selectedOrganisation, selectedEvent]);
+  const { resolvedScope } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const currentScope = resolvedScope;
   const currentRouteConfig = useMemo5(() => {
     const currentPath = location.pathname;
     return routes.find((route) => route.path === currentPath) || null;
@@ -846,7 +697,7 @@ function RoleBasedRouter({
   ]);
   if (finalLoading && !isPublicRoute) {
     return /* @__PURE__ */ jsx5("div", { className: "flex items-center justify-center min-h-screen", children: /* @__PURE__ */ jsxs3("div", { className: "text-center", children: [
-      /* @__PURE__ */ jsx5("div", { className: "animate-spin rounded-full h-8 w-8 border-b-2 border-main-600 mx-auto mb-4" }),
+      /* @__PURE__ */ jsx5("div", { className: "animate-spin rounded-full size-8 border-b-2 border-main-600 mx-auto mb-4" }),
       /* @__PURE__ */ jsx5("p", { className: "text-sec-600", children: "Checking permissions..." })
     ] }) });
   }
@@ -906,17 +757,15 @@ function NavigationProvider({
   onStrictModeViolation,
   maxHistorySize = 1e3
 }) {
-  const { user, selectedOrganisation, selectedEvent } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const [navigationAccessHistory, setNavigationAccessHistory] = useState6([]);
   const [isEnabled, setIsEnabled] = useState6(true);
-  const currentScope = useMemo6(() => {
-    if (!selectedOrganisation) return null;
-    return {
-      organisationId: selectedOrganisation.id,
-      eventId: selectedEvent?.event_id || void 0,
-      appId: void 0
-    };
-  }, [selectedOrganisation, selectedEvent]);
+  const { resolvedScope } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const currentScope = resolvedScope;
   const hasNavigationPermission = useCallback6((item) => {
     if (!isEnabled) return true;
     if (!user?.id) return false;
@@ -1029,54 +878,22 @@ function NavigationGuard({
 }) {
   const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const [hasChecked, setHasChecked] = useState7(false);
-  const [checkError, setCheckError] = useState7(null);
-  const [resolvedScope, setResolvedScope] = useState7(null);
-  useEffect7(() => {
-    const resolveScope = async () => {
-      if (scope) {
-        setResolvedScope(scope);
-        return;
-      }
-      if (selectedOrganisation && selectedEvent) {
-        setResolvedScope({
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent.event_id,
-          appId: void 0
-        });
-        return;
-      }
-      if (selectedOrganisation) {
-        setResolvedScope({
-          organisationId: selectedOrganisation.id,
-          eventId: selectedEvent?.event_id || void 0,
-          appId: void 0
-        });
-        return;
-      }
-      if (selectedEvent && supabase) {
-        try {
-          const eventScope = await createScopeFromEvent(supabase, selectedEvent.event_id);
-          if (!eventScope) {
-            setCheckError(new Error("Could not resolve organization from event context"));
-            return;
-          }
-          setResolvedScope(eventScope);
-        } catch (error2) {
-          setCheckError(error2);
-        }
-        return;
-      }
-      setCheckError(new Error("Either organisation context or event context is required for navigation permission checking"));
-    };
-    resolveScope();
-  }, [scope, selectedOrganisation, selectedEvent, supabase]);
-  const { results: permissionResults, isLoading, error } = useMultiplePermissions(
+  const { resolvedScope: hookResolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null
+  });
+  const effectiveScope = scope || hookResolvedScope;
+  const checkError = scopeError;
+  const { results: permissionResults, isLoading: permissionsLoading, error: permissionsError } = useMultiplePermissions(
     user?.id || "",
-    resolvedScope || { eventId: selectedEvent?.event_id || void 0 },
+    effectiveScope || { eventId: selectedEvent?.event_id || void 0 },
     navigationItem.permissions || [],
     true
     // Use cache
   );
+  const isLoading = scopeLoading || permissionsLoading;
+  const error = checkError || permissionsError;
   const hasRequiredPermissions = useMemo7(() => {
     if (!navigationItem.permissions || navigationItem.permissions.length === 0) return true;
     if (requireAll) {
@@ -1088,12 +905,10 @@ function NavigationGuard({
   useEffect7(() => {
     if (!isLoading && !error) {
       setHasChecked(true);
-      setCheckError(null);
       if (!hasRequiredPermissions && onDenied) {
         onDenied(navigationItem);
       }
     } else if (error) {
-      setCheckError(error);
       setHasChecked(true);
     }
   }, [hasRequiredPermissions, isLoading, error, navigationItem, onDenied]);
@@ -1104,13 +919,13 @@ function NavigationGuard({
         navigationItem: navigationItem.id,
         permissions: navigationItem.permissions,
         userId: user?.id,
-        scope: resolvedScope,
+        scope: effectiveScope,
         allowed: hasRequiredPermissions,
         requireAll,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [auditLog, hasChecked, isLoading, navigationItem, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);
+  }, [auditLog, hasChecked, isLoading, navigationItem, user?.id, effectiveScope, hasRequiredPermissions, requireAll]);
   useEffect7(() => {
     if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {
       const logger2 = getRBACLogger();
@@ -1118,13 +933,13 @@ function NavigationGuard({
         navigationItem: navigationItem.id,
         permissions: navigationItem.permissions,
         userId: user?.id,
-        scope: resolvedScope,
+        scope: effectiveScope,
         requireAll,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
-  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, navigationItem, user?.id, resolvedScope, requireAll]);
-  if (isLoading || !resolvedScope || !hasChecked) {
+  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, navigationItem, user?.id, effectiveScope, requireAll]);
+  if (isLoading || !effectiveScope || !hasChecked) {
     return /* @__PURE__ */ jsx7(Fragment3, { children: loading });
   }
   if (checkError) {
@@ -1145,7 +960,7 @@ function DefaultAccessDenied3() {
 }
 function DefaultLoading3() {
   return /* @__PURE__ */ jsx7("div", { className: "flex items-center justify-center p-2", children: /* @__PURE__ */ jsxs4("div", { className: "flex items-center space-x-2", children: [
-    /* @__PURE__ */ jsx7("div", { className: "animate-spin rounded-full h-4 w-4 border-b-2 border-main-600" }),
+    /* @__PURE__ */ jsx7("div", { className: "animate-spin rounded-full size-4 border-b-2 border-main-600" }),
     /* @__PURE__ */ jsx7("span", { className: "text-sm text-sec-600", children: "Checking..." })
   ] }) });
 }
@@ -1432,7 +1247,7 @@ function withPermissionGuard(config, handler) {
     if (!userId || !organisationId) {
       throw new Error("User context required for permission check");
     }
-    const { isPermitted: isPermitted2 } = await import("./api-YP7XD5L6.js");
+    const { isPermitted: isPermitted2 } = await import("./api-I6UCQ5S6.js");
     const hasPermission2 = await isPermitted2({
       userId,
       scope: { organisationId, eventId, appId },
@@ -1455,7 +1270,7 @@ function withAccessLevelGuard(minLevel, handler) {
     if (!userId || !organisationId) {
       throw new Error("User context required for access level check");
     }
-    const { getAccessLevel: getAccessLevel2 } = await import("./api-YP7XD5L6.js");
+    const { getAccessLevel: getAccessLevel2 } = await import("./api-I6UCQ5S6.js");
     const accessLevel = await getAccessLevel2({
       userId,
       scope: { organisationId, eventId, appId }
@@ -1480,7 +1295,7 @@ function withRoleGuard(config, handler) {
       throw new Error("User context required for role check");
     }
     if (config.globalRoles && config.globalRoles.length > 0) {
-      const { isSuperAdmin } = await import("./api-YP7XD5L6.js");
+      const { isSuperAdmin } = await import("./api-I6UCQ5S6.js");
       const isSuper = await isSuperAdmin(userId);
       if (isSuper) {
         if (organisationId) {
@@ -1506,14 +1321,14 @@ function withRoleGuard(config, handler) {
       }
     }
     if (config.organisationRoles && config.organisationRoles.length > 0) {
-      const { isOrganisationAdmin } = await import("./api-YP7XD5L6.js");
+      const { isOrganisationAdmin } = await import("./api-I6UCQ5S6.js");
       const isOrgAdmin = await isOrganisationAdmin(userId, organisationId);
       if (!isOrgAdmin && config.requireAll !== false) {
         throw new Error(`Organisation admin role required`);
       }
     }
     if (config.eventAppRoles && config.eventAppRoles.length > 0 && eventId && appId) {
-      const { isEventAdmin } = await import("./api-YP7XD5L6.js");
+      const { isEventAdmin } = await import("./api-I6UCQ5S6.js");
       const isEventAdminUser = await isEventAdmin(userId, { organisationId, eventId, appId });
       if (!isEventAdminUser && config.requireAll !== false) {
         throw new Error(`Event admin role required`);
@@ -1553,7 +1368,7 @@ function createRBACMiddleware(config) {
     );
     if (protectedRoute) {
       try {
-        const { isPermitted: isPermitted2 } = await import("./api-YP7XD5L6.js");
+        const { isPermitted: isPermitted2 } = await import("./api-I6UCQ5S6.js");
         const hasPermission2 = await isPermitted2({
           userId,
           scope: { organisationId },
@@ -1580,7 +1395,7 @@ function createRBACExpressMiddleware(config) {
       return res.status(401).json({ error: "User context required" });
     }
     try {
-      const { isPermitted: isPermitted2 } = await import("./api-YP7XD5L6.js");
+      const { isPermitted: isPermitted2 } = await import("./api-I6UCQ5S6.js");
       const hasPermission2 = await isPermitted2({
         userId,
         scope: { organisationId, eventId, appId },
@@ -1984,7 +1799,7 @@ export const supabase = createClient(url, key);
 // src/lib/supabase.ts
 export const supabase = createClient(
   import.meta.env.VITE_SUPABASE_URL,
-  import.meta.env.VITE_SUPABASE_ANON_KEY
+  import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY
 );
 
 // src/utils/api.ts
@@ -2109,4 +1924,4 @@ export {
   getDirectSupabaseAuthFixes,
   getQuickFixes
 };
-//# sourceMappingURL=chunk-IM4QE42D.js.map
+//# sourceMappingURL=chunk-73HSNNOQ.js.map