@jmruthers/pace-core 0.5.189 → 0.5.191

package/src/__tests__/fixtures/supabase.ts

@@ -0,0 +1,301 @@
+/**
+ * @file Supabase Test Fixtures
+ * @package @jmruthers/pace-core
+ * @module TestFixtures/Supabase
+ * @since 1.0.0
+ * 
+ * Shared Supabase client fixtures and mock data generators for tests.
+ * Reduces repeated mock setup across test files.
+ */
+
+import { createMockSupabaseClient, createMockQueryBuilder } from '../helpers/supabaseMock';
+import type { User, Session } from '@supabase/supabase-js';
+import { TEST_FIXTURES } from './test-data';
+
+/**
+ * Creates a standard mock Supabase client with common RBAC mocks
+ */
+export function createTestSupabaseClient(overrides: {
+  user?: User;
+  session?: Session;
+  rpcResponses?: Record<string, any>;
+  tableData?: Record<string, any[]>;
+} = {}) {
+  const mockUser = overrides.user || {
+    id: TEST_FIXTURES.users.basic.id,
+    email: TEST_FIXTURES.users.basic.email,
+    user_metadata: {},
+    app_metadata: {},
+    aud: 'authenticated',
+    created_at: '2024-01-01T00:00:00Z',
+  } as User;
+
+  const mockSession = overrides.session || {
+    access_token: 'test-access-token',
+    refresh_token: 'test-refresh-token',
+    expires_at: Date.now() + 3600000,
+    expires_in: 3600,
+    token_type: 'bearer',
+    user: mockUser,
+  } as Session;
+
+  const client = createMockSupabaseClient();
+  if (!overrides.tableData) {
+    throw new Error('createTestSupabaseClient requires tableData overrides for tests');
+  }
+  
+
+  // Setup auth mocks
+  vi.spyOn(client.auth, 'getSession').mockResolvedValue({
+    data: { session: mockSession },
+    error: null
+  });
+
+  vi.spyOn(client.auth, 'getUser').mockResolvedValue({
+    data: { user: mockUser },
+    error: null
+  });
+
+  // Setup default RPC responses
+  const defaultRpcResponses: Record<string, any> = {
+    rbac_page_access_check: { data: true, error: null },
+    rbac_permissions_get: {
+      data: [
+        {
+          permission_type: 'organisation_access',
+          role_name: 'member',
+          context_id: TEST_FIXTURES.organisations.basic.id
+        }
+      ],
+      error: null
+    },
+    rbac_access_validate: {
+      data: [{
+        has_access: true,
+        access_level: 'organisation',
+        context_id: TEST_FIXTURES.organisations.basic.id
+      }],
+      error: null
+    },
+    ...overrides.rpcResponses
+  };
+
+  client.rpc.mockImplementation((functionName: string, params?: any) => {
+    const response = defaultRpcResponses[functionName];
+    if (response) {
+      // If response is a function, call it with params
+      if (typeof response === 'function') {
+        return response(params);
+      }
+      return Promise.resolve(response);
+    }
+    return Promise.resolve({ data: null, error: null });
+  });
+
+  // Setup default table data
+  // CRITICAL: Capture organisations from overrides BEFORE any processing
+  // This ensures we use the exact organisations provided, not defaults
+  const organisationsData = overrides.tableData?.organisations 
+    ? [...overrides.tableData.organisations] // Create a copy to avoid mutations
+    : [TEST_FIXTURES.organisations.basic];
+  
+  // Ensure all organisations have is_active: true (required by OrganisationService)
+  // But preserve all other properties including name
+  const processedOrganisations = organisationsData.map((org: any) => {
+    // If is_active is already set, return org as-is to preserve all properties including name
+    if (org.is_active !== undefined) {
+      return org;
+    }
+    // Only add is_active if missing, preserving all other properties
+    return {
+      ...org, // Preserve ALL existing properties including name
+      is_active: true
+    };
+  });
+  
+  const defaultTableData: Record<string, any> = {
+    organisations: processedOrganisations, // Use processed organisations
+    event: overrides.tableData?.event ?? [TEST_FIXTURES.events.basic],
+    rbac_global_roles: overrides.tableData?.rbac_global_roles ?? [],
+    rbac_apps: overrides.tableData?.rbac_apps ?? [{ id: 'app-123', name: 'TEST_APP', is_active: true }],
+    rbac_app_pages: overrides.tableData?.rbac_app_pages ?? [{ id: 'page-123', page_name: 'dashboard', app_id: 'app-123' }],
+  };
+  
+  // Apply any additional table data that wasn't explicitly handled above
+  if (overrides.tableData) {
+    for (const [key, value] of Object.entries(overrides.tableData)) {
+      if (!(key in defaultTableData)) {
+        defaultTableData[key] = value;
+      }
+    }
+  }
+  
+  // Mock from() to return a builder that resolves with table-specific data
+  // CRITICAL: Capture processedOrganisations in closure to ensure it's always used
+  const organisationsForMock = processedOrganisations;
+  
+  // Override the from() mock completely - don't use the default one from createMockSupabaseClient
+  client.from = vi.fn().mockImplementation((table: string) => {
+    // For organisations table, always use the captured processedOrganisations
+    // This ensures we use the correct organisations even if defaultTableData is modified
+    let tableData: any;
+    if (table === 'organisations') {
+      tableData = organisationsForMock;
+    } else {
+      tableData = defaultTableData[table as keyof typeof defaultTableData];
+    }
+    
+    // Ensure data is always an array
+    const data = Array.isArray(tableData) ? tableData : (tableData ? [tableData] : []);
+    // Create response in the format Supabase returns: { data: [...], error: null }
+    const response = { data, error: null };
+    
+    // Create a fresh builder for each call to ensure data is correct
+    // We'll completely override the builder to use our response
+    // IMPORTANT: All chainable methods must return the builder itself (not 'this')
+    const builder: any = {};
+    
+    // Define chainable methods that return the builder
+    const chainableMethods = ['select', 'insert', 'update', 'delete', 'eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'in', 'not', 'is', 'or', 'and', 'filter', 'match', 'order', 'offset'];
+    chainableMethods.forEach(method => {
+      builder[method] = vi.fn().mockReturnValue(builder);
+    });
+    
+    // Methods that resolve with data
+    builder.limit = vi.fn().mockResolvedValue(response);
+    builder.single = vi.fn().mockResolvedValue({ data: data[0] || null, error: null });
+    builder.maybeSingle = vi.fn().mockResolvedValue({ data: data[0] || null, error: null });
+    
+    // Thenable interface - CRITICAL: must resolve with the correct response
+    builder.then = vi.fn().mockImplementation((resolve, reject) => {
+      Promise.resolve(response).then(resolve, reject);
+    });
+    
+    builder.catch = vi.fn().mockImplementation((onRejected) => {
+      return Promise.resolve(response).catch(onRejected);
+    });
+    
+    builder.finally = vi.fn().mockImplementation((onFinally) => {
+      return Promise.resolve(response).finally(onFinally);
+    });
+    
+    builder.range = vi.fn().mockImplementation((min: number, max: number) => {
+      // Return a thenable builder that resolves with the sliced data
+      const rangedData = data.slice(min, max + 1);
+      const rangedResponse = { data: rangedData, error: null };
+      const rangedBuilder = Object.assign({}, builder);
+      rangedBuilder.then = vi.fn().mockImplementation((resolve, reject) => {
+        Promise.resolve(rangedResponse).then(resolve, reject);
+      });
+      rangedBuilder.catch = vi.fn().mockImplementation((onRejected) => {
+        return Promise.resolve(rangedResponse).catch(onRejected);
+      });
+      rangedBuilder.finally = vi.fn().mockImplementation((onFinally) => {
+        return Promise.resolve(rangedResponse).finally(onFinally);
+      });
+      // Ensure chainable methods still work
+      chainableMethods.forEach(method => {
+        rangedBuilder[method] = vi.fn().mockReturnValue(rangedBuilder);
+      });
+      return rangedBuilder;
+    });
+    
+    return builder;
+  });
+
+  return client;
+}
+
+/**
+ * Creates mock user data
+ */
+export function createMockUser(overrides: Partial<User> = {}): User {
+  return {
+    id: TEST_FIXTURES.users.basic.id,
+    email: TEST_FIXTURES.users.basic.email,
+    user_metadata: {},
+    app_metadata: {},
+    aud: 'authenticated',
+    created_at: '2024-01-01T00:00:00Z',
+    ...overrides
+  } as User;
+}
+
+/**
+ * Creates mock session data
+ */
+export function createMockSession(user?: User, overrides: Partial<Session> = {}): Session {
+  const mockUser = user || createMockUser();
+  return {
+    access_token: 'test-access-token',
+    refresh_token: 'test-refresh-token',
+    expires_at: Date.now() + 3600000,
+    expires_in: 3600,
+    token_type: 'bearer',
+    user: mockUser,
+    ...overrides
+  } as Session;
+}
+
+/**
+ * Creates mock organisation data
+ */
+export function createMockOrganisation(overrides: Partial<typeof TEST_FIXTURES.organisations.basic> & { is_active?: boolean; display_name?: string; name?: string } = {}) {
+  // Extract name from overrides if provided, otherwise use default
+  const orgName = overrides.name ?? TEST_FIXTURES.organisations.basic.name;
+  const displayName = overrides.display_name ?? orgName;
+  
+  // Build the organisation object, ensuring overrides take precedence
+  return {
+    ...TEST_FIXTURES.organisations.basic,
+    // Set required fields with defaults
+    is_active: true, // Required by OrganisationService - only active orgs are used
+    subscription_tier: 'basic',
+    settings: {},
+    parent_id: null,
+    created_at: '2023-01-01T00:00:00Z',
+    updated_at: '2023-01-01T00:00:00Z',
+    // Apply name and display_name (these should come before overrides to ensure they're set)
+    name: orgName, // Explicitly set name (used by UI components)
+    display_name: displayName, // display_name defaults to name
+    // Apply all overrides last to ensure they take precedence (including name if provided)
+    ...overrides
+  };
+}
+
+/**
+ * Creates mock event data
+ */
+export function createMockEvent(overrides: Partial<typeof TEST_FIXTURES.events.basic> = {}) {
+  return {
+    ...TEST_FIXTURES.events.basic,
+    ...overrides
+  };
+}
+
+/**
+ * Creates a Supabase client configured for organisation-scoped data access tests
+ */
+export function createOrganisationScopedSupabaseClient(organisationId: string) {
+  return createTestSupabaseClient({
+    tableData: {
+      organisations: [createMockOrganisation({ id: organisationId })],
+      event: [createMockEvent({ organisation_id: organisationId })]
+    },
+    rpcResponses: {
+      rbac_permissions_get: {
+        data: [{
+          permission_type: 'organisation_access',
+          role_name: 'member',
+          context_id: organisationId
+        }],
+        error: null
+      }
+    }
+  });
+}
+
+// Re-export vi for convenience
+import { vi } from 'vitest';
+export { vi };
+

package/src/__tests__/public-recipe-view.test.ts

@@ -19,10 +19,10 @@ const TEST_TIMEOUT = 5000;
 const PERFORMANCE_THRESHOLD = 500; // 500ms for public view queries
 
 // Check if we're using real test-db (via environment variables)
-const USE_REAL_DB = !!(process.env.SUPABASE_URL && process.env.VITE_SUPABASE_ANON_KEY);
+const USE_REAL_DB = !!(process.env.SUPABASE_URL && process.env.VITE_SUPABASE_PUBLISHABLE_KEY);
 const TEST_SUPABASE_URL = process.env.SUPABASE_URL || process.env.VITE_SUPABASE_URL;
-const TEST_SUPABASE_ANON_KEY = process.env.TEST_SUPABASE_ANON_KEY || process.env.VITE_SUPABASE_ANON_KEY;
-const TEST_SUPABASE_SERVICE_ROLE_KEY = process.env.TEST_SUPABASE_SERVICE_ROLE_KEY;
+const TEST_SUPABASE_PUBLISHABLE_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
+const TEST_SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
 
 let anonClient: SupabaseClient<Database>;
 let authenticatedClient: SupabaseClient<Database>;
@@ -43,14 +43,14 @@ const privateEvent = {
   organisation_id: 'org-1' as any
 };
 
-describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('Public Recipe View - Anonymous Access', () => {
+describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_PUBLISHABLE_KEY)('Public Recipe View - Anonymous Access', () => {
   beforeEach(() => {
-    if (USE_REAL_DB && TEST_SUPABASE_URL && TEST_SUPABASE_ANON_KEY) {
-      anonClient = createClient<Database>(TEST_SUPABASE_URL, TEST_SUPABASE_ANON_KEY);
-      authenticatedClient = createClient<Database>(TEST_SUPABASE_URL, TEST_SUPABASE_SERVICE_ROLE_KEY || TEST_SUPABASE_ANON_KEY);
+    if (USE_REAL_DB && TEST_SUPABASE_URL && TEST_SUPABASE_PUBLISHABLE_KEY) {
+      anonClient = createClient<Database>(TEST_SUPABASE_URL, TEST_SUPABASE_PUBLISHABLE_KEY);
+      authenticatedClient = createClient<Database>(TEST_SUPABASE_URL, TEST_SUPABASE_SERVICE_ROLE_KEY || TEST_SUPABASE_PUBLISHABLE_KEY);
     } else {
       // This should not happen due to skipIf, but provide fallback
-      throw new Error('Test database credentials not available. Set SUPABASE_URL and VITE_SUPABASE_ANON_KEY environment variables.');
+      throw new Error('Test database credentials not available. Set SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY environment variables.');
     }
   });
 
@@ -58,7 +58,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
     it('should allow anonymous access when event.public_readable = true', async () => {
       const start = Date.now();
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id);
       const duration = Date.now() - start;
@@ -70,7 +70,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
 
     it('should block anonymous access when event.public_readable = false', async () => {
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', privateEvent.event_id);
 
@@ -80,7 +80,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
 
     it('should block anonymous access when event.is_visible = false', async () => {
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', 'hidden-event-1');
 
@@ -92,7 +92,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
   describe('View Column Exposure', () => {
     it('should expose only expected columns', async () => {
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id)
         .limit(1)
@@ -119,7 +119,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
     it('should filter by meal type', async () => {
       const start = Date.now();
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id)
         .eq('mealtype_name', 'Breakfast');
@@ -134,7 +134,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
       // This test would verify that diet filters work correctly
       // Adjust based on actual view structure
       const { data, error } = await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id)
         .eq('dish_dietnote', 'Vegetarian');
@@ -148,7 +148,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
     it('should complete view queries in < 500ms', async () => {
       const start = Date.now();
       await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id)
         .limit(100);
@@ -160,7 +160,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
     it('should handle filtered queries efficiently', async () => {
       const start = Date.now();
       await anonClient
-        .from('public_recipe_details')
+        .from('cake_public_recipe_details')
         .select('*')
         .eq('event_id', publicEvent.event_id)
         .eq('mealtype_name', 'Breakfast')
@@ -172,10 +172,10 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
   });
 });
 
-describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('Public Recipe View - Authenticated Access', () => {
+describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_PUBLISHABLE_KEY)('Public Recipe View - Authenticated Access', () => {
   it('should allow authenticated users to view public recipes', async () => {
     const { data, error } = await authenticatedClient
-      .from('public_recipe_details')
+      .from('cake_public_recipe_details')
       .select('*')
       .eq('event_id', publicEvent.event_id);
 
@@ -188,7 +188,7 @@ describe.skipIf(!USE_REAL_DB || !TEST_SUPABASE_URL || !TEST_SUPABASE_ANON_KEY)('
     // recipes from events in their organisation, even if not public_readable
     // (This depends on the view definition and RLS policies)
     const { data, error } = await authenticatedClient
-      .from('public_recipe_details')
+      .from('cake_public_recipe_details')
       .select('*')
       .eq('event_id', privateEvent.event_id);