@jmruthers/pace-core 0.5.189 → 0.5.191

package/src/hooks/useSecureDataAccess.ts

@@ -15,7 +15,7 @@
  *   const loadData = async () => {
  *     try {
  *       // Automatically includes organisation_id filter
- *       const events = await secureQuery('event', '*', { is_visible: true });
+ *       const events = await secureQuery('core_events', '*', { is_visible: true });
  *       console.log('Organisation events:', events);
  *     } catch (error) {
  *       console.error('Failed to load data:', error);
@@ -25,7 +25,7 @@
  *   const createEvent = async (eventData) => {
  *     try {
  *       // Automatically sets organisation_id
- *       const newEvent = await secureInsert('event', eventData);
+ *       const newEvent = await secureInsert('core_events', eventData);
  *       console.log('Created event:', newEvent);
  *     } catch (error) {
  *       console.error('Failed to create event:', error);
@@ -59,6 +59,8 @@ import { setOrganisationContext } from '../utils/context/organisationContext';
 import { logger } from '../utils/core/logger';
 import type { Permission } from '../rbac/types';
 import type { OrganisationSecurityError } from '../types/organisation';
+import { useSuperAdminBypass } from '../rbac/hooks/useSuperAdminBypass';
+import { useResolvedScope } from '../rbac/hooks/useResolvedScope';
 
 export interface SecureDataAccessReturn {
   /** Execute a secure query with organisation filtering */
@@ -149,13 +151,21 @@ export interface DataAccessRecord {
  * - RPC calls include organisation_id parameter
  */
 export function useSecureDataAccess(): SecureDataAccessReturn {
-  const { supabase, user, session } = useUnifiedAuth();
-  const { ensureOrganisationContext } = useOrganisations();
+  const { supabase, user, session, selectedOrganisation, selectedEvent } = useUnifiedAuth();
   
   // Get selected event for event-scoped RPC calls
   // Use useContext directly to safely check if EventServiceProvider is available
   const eventServiceContext = useContext(EventServiceContext);
-  const selectedEvent = eventServiceContext?.eventService?.getSelectedEvent() || null;
+  const eventFromContext = eventServiceContext?.eventService?.getSelectedEvent() || null;
+  const effectiveSelectedEvent = selectedEvent || eventFromContext;
+  const { isSuperAdmin } = useSuperAdminBypass();
+
+  // Use resolved scope to get organisationId (derived from event if needed)
+  const { resolvedScope } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: effectiveSelectedEvent?.event_id || null
+  });
 
   const validateContext = useCallback((): void => {
     if (!supabase) {
@@ -165,23 +175,29 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
       throw new Error('User must be authenticated with valid session') as OrganisationSecurityError;
     }
     
-    try {
-      ensureOrganisationContext();
-    } catch (error) {
+    if (isSuperAdmin) {
+      return;
+    }
+    
+    if (!resolvedScope?.organisationId) {
       throw new Error('Organisation context is required for data access') as OrganisationSecurityError;
     }
-  }, [supabase, user, session, ensureOrganisationContext]);
+  }, [supabase, user, session, resolvedScope, isSuperAdmin]);
 
   const getCurrentOrganisationId = useCallback((): string => {
+    if (isSuperAdmin) {
+      // For super admins, try to get org from resolved scope or selectedOrganisation
+      return resolvedScope?.organisationId || selectedOrganisation?.id || '';
+    }
+
     validateContext();
-    const currentOrg = ensureOrganisationContext();
-    return currentOrg.id;
-  }, [validateContext, ensureOrganisationContext]);
+    return resolvedScope?.organisationId || '';
+  }, [validateContext, resolvedScope, selectedOrganisation, isSuperAdmin]);
 
   // Set organisation context in database session
-  const setOrganisationContextInSession = useCallback(async (organisationId: string): Promise<void> => {
-    if (!supabase) {
-      throw new Error('No Supabase client available') as OrganisationSecurityError;
+  const setOrganisationContextInSession = useCallback(async (organisationId?: string): Promise<void> => {
+    if (!supabase || !organisationId) {
+      return;
     }
 
     await setOrganisationContext(supabase, organisationId);
@@ -199,7 +215,8 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     } = {}
   ): Promise<T[]> => {
     validateContext();
-    const organisationId = getCurrentOrganisationId();
+    const bypassOrganisationFilter = isSuperAdmin;
+    const organisationId = bypassOrganisationFilter ? undefined : getCurrentOrganisationId();
 
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
@@ -210,27 +227,45 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
       .select(columns);
 
     // Add organisation filter only if table has organisation_id column
+    // Defense in depth strategy:
+    // - RLS policies are the primary security layer (cannot be bypassed)
+    // - Application-level filtering adds an additional layer of protection
     const tablesWithOrganisation = [
-      'event',  'organisation_settings',
+      'core_events',  'organisation_settings',
       'rbac_event_app_roles', 'rbac_organisation_roles',
       // SECURITY: Phase 2 additions - complete organisation table mapping
       'organisation_audit_log', 'organisation_invitations', 'organisation_app_access',
       // SECURITY: Emergency additions for Phase 1 fixes
-      'cake_meal', 'cake_mealtype', 'pace_person', 'pace_member',
+      'cake_meal', 'cake_mealtype', 'core_person',
+      // NOTE: core_member, medi_profile, core_contact, core_consent, core_identification, core_qualification
+      // are now person-scoped (not organisation-scoped) - removed from this list
       // SECURITY: Phase 3A additions - medical and personal data
-      'medi_profile', 'medi_condition', 'medi_diet', 'medi_action_plan', 'medi_profile_versions',
-      'pace_consent', 'pace_contact', 'pace_identification', 'pace_identification_type', 'pace_qualification',
+      // NOTE: medi_condition, medi_diet, medi_action_plan, medi_profile_versions are now person-scoped
+      // (via medi_profile) - removed from this list
+      // core_identification_type remains organisation-scoped (lookup table)
+      'core_identification_type',
       'form_responses', 'form_response_values', 'forms',
       // SECURITY: Phase 3B additions - remaining critical tables
       'invoice', 'line_item', 'credit_balance', 'payment_method',
       'form_contexts', 'form_field_config', 'form_fields',
       'cake_delivery', 'cake_diettype', 'cake_diner', 'cake_dish', 'cake_item', 
       'cake_logistics', 'cake_mealplan', 'cake_package', 'cake_recipe', 'cake_supplier', 
-      'cake_supply', 'cake_unit', 'event_app_access', 'base_application', 'base_questions'
+      'cake_supply', 'cake_unit', 'event_app_access', 'base_application', 'base_questions',
+      // rbac_user_profiles has organisation_id but uses conditional filtering
+      'rbac_user_profiles'
     ];
     
-    if (tablesWithOrganisation.includes(table)) {
-      query = query.eq('organisation_id', organisationId);
+    // Apply organisation filtering based on table and super admin status
+    if (!bypassOrganisationFilter && organisationId && tablesWithOrganisation.includes(table)) {
+      // For rbac_user_profiles: Super admins see all (no filter), non-super-admins get filtered (defense in depth)
+      // For other tables: Always apply filter
+      if (table === 'rbac_user_profiles' && isSuperAdmin) {
+        // Super admin: No org filter - RLS handles access control
+        // This allows super admins to see all users across all organisations
+      } else {
+        // Non-super-admin OR other tables: Apply org filter as defense in depth
+        query = query.eq('organisation_id', organisationId);
+      }
     }
 
     // Apply additional filters
@@ -272,23 +307,26 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     recordDataAccess(table, 'read', true, `SELECT ${columns} FROM ${table}`, filters);
 
     return (data as T[]) || [];
-  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase]);
+  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, isSuperAdmin]);
 
   const secureInsert = useCallback(async <T = any>(
     table: string,
     data: Record<string, any>
   ): Promise<T> => {
     validateContext();
-    const organisationId = getCurrentOrganisationId();
+    const bypassOrganisationFilter = isSuperAdmin;
+    const organisationId = bypassOrganisationFilter ? undefined : getCurrentOrganisationId();
 
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
 
     // Ensure organisation_id is set
-    const secureData = {
-      ...data,
-      organisation_id: organisationId
-    };
+    const secureData = bypassOrganisationFilter
+      ? { ...data }
+      : {
+          ...data,
+          organisation_id: organisationId
+        };
 
     const { data: insertData, error } = await supabase!
       .from(table)
@@ -302,7 +340,7 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     }
 
     return insertData as T;
-  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase]);
+  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, isSuperAdmin]);
 
   const secureUpdate = useCallback(async <T = any>(
     table: string,
@@ -310,7 +348,8 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     filters: Record<string, any>
   ): Promise<T[]> => {
     validateContext();
-    const organisationId = getCurrentOrganisationId();
+    const bypassOrganisationFilter = isSuperAdmin;
+    const organisationId = bypassOrganisationFilter ? undefined : getCurrentOrganisationId();
 
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
@@ -325,15 +364,15 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
 
     // Add organisation filter only if table has organisation_id column
     const tablesWithOrganisation = [
-      'event',  'organisation_settings',
+      'core_events',  'organisation_settings',
       'rbac_event_app_roles', 'rbac_organisation_roles',
       // SECURITY: Phase 2 additions - complete organisation table mapping
       'organisation_audit_log', 'organisation_invitations', 'organisation_app_access',
       // SECURITY: Emergency additions for Phase 1 fixes
-      'cake_meal', 'cake_mealtype', 'pace_person', 'pace_member'
+      'cake_meal', 'cake_mealtype', 'core_person', 'core_member'
     ];
     
-    if (tablesWithOrganisation.includes(table)) {
+    if (!bypassOrganisationFilter && organisationId && tablesWithOrganisation.includes(table)) {
       query = query.eq('organisation_id', organisationId);
     }
 
@@ -352,14 +391,15 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     }
 
     return (updateData as T[]) || [];
-  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase]);
+  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, isSuperAdmin]);
 
   const secureDelete = useCallback(async (
     table: string,
     filters: Record<string, any>
   ): Promise<void> => {
     validateContext();
-    const organisationId = getCurrentOrganisationId();
+    const bypassOrganisationFilter = isSuperAdmin;
+    const organisationId = bypassOrganisationFilter ? undefined : getCurrentOrganisationId();
 
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
@@ -371,15 +411,15 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
 
     // Add organisation filter only if table has organisation_id column
     const tablesWithOrganisation = [
-      'event',  'organisation_settings',
+      'core_events',  'organisation_settings',
       'rbac_event_app_roles', 'rbac_organisation_roles',
       // SECURITY: Phase 2 additions - complete organisation table mapping
       'organisation_audit_log', 'organisation_invitations', 'organisation_app_access',
       // SECURITY: Emergency additions for Phase 1 fixes
-      'cake_meal', 'cake_mealtype', 'pace_person', 'pace_member',
+      'cake_meal', 'cake_mealtype', 'core_person', 'core_member',
       // SECURITY: Phase 3A additions - medical and personal data
       'medi_profile', 'medi_condition', 'medi_diet', 'medi_action_plan', 'medi_profile_versions',
-      'pace_consent', 'pace_contact', 'pace_identification', 'pace_identification_type', 'pace_qualification',
+      'core_consent', 'core_contact', 'core_identification', 'core_identification_type', 'core_qualification',
       'form_responses', 'form_response_values', 'forms',
       // SECURITY: Phase 3B additions - remaining critical tables
       'invoice', 'line_item', 'credit_balance', 'payment_method',
@@ -389,7 +429,7 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
       'cake_supply', 'cake_unit', 'event_app_access', 'base_application', 'base_questions'
     ];
     
-    if (tablesWithOrganisation.includes(table)) {
+    if (!bypassOrganisationFilter && organisationId && tablesWithOrganisation.includes(table)) {
       query = query.eq('organisation_id', organisationId);
     }
 
@@ -406,14 +446,15 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
       logger.error('useSecureDataAccess', 'Delete failed', { table, filters, error });
       throw error;
     }
-  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase]);
+  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, isSuperAdmin]);
 
   const secureRpc = useCallback(async <T = any>(
     functionName: string,
     params: Record<string, any> = {}
   ): Promise<T> => {
     validateContext();
-    const organisationId = getCurrentOrganisationId();
+    const bypassOrganisationFilter = isSuperAdmin;
+    const organisationId = bypassOrganisationFilter ? undefined : getCurrentOrganisationId();
 
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
@@ -477,8 +518,13 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
       secureParams.p_user_id = user.id;
     }
     
-    // Add organisation_id parameter
-    secureParams[paramName] = organisationId;
+    // Add organisation_id parameter when needed
+    if (!bypassOrganisationFilter && organisationId) {
+      secureParams[paramName] = organisationId;
+    } else if (organisationId && !(paramName in params)) {
+      // Default to the current organisation if caller didn't specify one
+      secureParams[paramName] = organisationId;
+    }
     
     // Add p_event_id if function needs it and event is selected
     // CRITICAL: This must be added AFTER organisation_id but BEFORE caller params
@@ -505,7 +551,7 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     }
 
     return data as T;
-  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, selectedEvent?.event_id, user?.id]);
+  }, [validateContext, getCurrentOrganisationId, setOrganisationContextInSession, supabase, selectedEvent?.event_id, user?.id, isSuperAdmin]);
 
   // NEW: Phase 1 - Enhanced Security Features
   const [dataAccessHistory, setDataAccessHistory] = useState<DataAccessRecord[]>([]);
@@ -570,12 +616,13 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     filters?: Record<string, any>
   ) => {
     if (!isAuditLogEnabled || !user?.id) return;
-    
+    const auditOrganisationId = getCurrentOrganisationId() || 'super-admin-bypass';
+
     const record: DataAccessRecord = {
       table,
       operation,
       userId: user.id,
-      organisationId: getCurrentOrganisationId(),
+      organisationId: auditOrganisationId,
       allowed,
       timestamp: new Date().toISOString(),
       query,
@@ -592,7 +639,7 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
         table,
         operation,
         userId: user.id,
-        organisationId: getCurrentOrganisationId(),
+        organisationId: auditOrganisationId,
         timestamp: new Date().toISOString()
       });
     }

package/src/providers/__tests__/OrganisationProvider.test.tsx

@@ -40,24 +40,7 @@ const createMockSupabaseClient = () => {
   const orgId = '123e4567-e89b-12d3-a456-426614174000'; // Valid UUID format
   const userId = '123e4567-e89b-12d3-a456-426614174001'; // Valid UUID format
   
-  return {
-    rpc: vi.fn().mockResolvedValue({
-      data: [
-        {
-          user_id: userId,
-          organisation_id: orgId,
-          role: 'org_admin',
-          status: 'active',
-        },
-      ],
-      error: null,
-    }),
-    from: vi.fn((table: string) => {
-      if (table === 'organisations') {
-        return {
-          select: vi.fn().mockResolvedValue({
-            data: [
-              {
+  const mockOrganisation = {
                 id: orgId,
                 name: 'Test Organisation 1',
                 display_name: 'Test Organisation 1',
@@ -67,11 +50,34 @@ const createMockSupabaseClient = () => {
                 parent_id: null,
                 created_at: '2023-01-01T00:00:00Z',
                 updated_at: '2023-01-01T00:00:00Z',
-              },
-            ],
+  };
+  
+  const mockQueryBuilder = {
+    select: vi.fn().mockReturnThis(),
+    eq: vi.fn().mockReturnThis(),
+    is: vi.fn().mockResolvedValue({
+      data: [{
+        id: 'membership-1',
+        user_id: userId,
+        organisation_id: orgId,
+        role: 'org_admin',
+        status: 'active',
+        granted_at: '2023-01-01T00:00:00Z',
+        revoked_at: null,
+        core_organisations: mockOrganisation
+      }],
+      error: null
+    })
+  };
+  
+  return {
+    rpc: vi.fn().mockResolvedValue({
+      data: [],
             error: null,
           }),
-        };
+    from: vi.fn((table: string) => {
+      if (table === 'rbac_organisation_roles') {
+        return mockQueryBuilder;
       }
       return {
         select: vi.fn().mockResolvedValue({ data: [], error: null }),

package/src/providers/services/EventServiceProvider.tsx

@@ -31,17 +31,18 @@ export interface EventServiceProviderProps {
   setSelectedEventId: (eventId: string | null) => void;
 }
 
-export function EventServiceProvider({ 
-  children, 
-  supabaseClient, 
-  user, 
-  session, 
+export function EventServiceProvider({
+  children,
+  supabaseClient,
+  user,
+  session,
   appName,
   selectedOrganisation,
   setSelectedEventId
 }: EventServiceProviderProps) {
   // Create service instance once with useRef to avoid recreation on dependency changes
   const eventServiceRef = useRef<EventService | null>(null);
+  const initializingRef = useRef(false);
   
   if (!eventServiceRef.current) {
     eventServiceRef.current = new EventService(supabaseClient, user, session, appName, selectedOrganisation, setSelectedEventId);
@@ -53,25 +54,44 @@ export function EventServiceProvider({
   // Note: eventService is a ref and never changes, so we don't include it in dependencies
   useEffect(() => {
     let isMounted = true;
-    
+
+    if (initializingRef.current) {
+      return;
+    }
+
     const updateAndInitialize = async () => {
-      // Update dependencies (now async to handle user change cleanup)
-      await eventService.updateDependencies(supabaseClient, user, session, appName, selectedOrganisation, setSelectedEventId);
-      
-      if (!isMounted) return;
-      
-      // Re-initialize service when dependencies change
-      await eventService.initialize().catch(error => {
-        if (isMounted) {
-          logger.error('EventServiceProvider', 'Failed to initialize event service:', error);
-        }
-      });
+      initializingRef.current = true;
+
+      try {
+        logger.debug('EventServiceProvider', 'Updating dependencies and initializing', {
+          hasUser: !!user,
+          hasSession: !!session,
+          appName,
+          hasSelectedOrganisation: !!selectedOrganisation,
+          organisationId: selectedOrganisation?.id
+        });
+
+        // Update dependencies (now async to handle user change cleanup)
+        await eventService.updateDependencies(supabaseClient, user, session, appName, selectedOrganisation, setSelectedEventId);
+
+        if (!isMounted) return;
+
+        // Re-initialize service when dependencies change
+        await eventService.initialize().catch(error => {
+          if (isMounted) {
+            logger.error('EventServiceProvider', 'Failed to initialize event service:', error);
+          }
+        });
+      } finally {
+        initializingRef.current = false;
+      }
     };
 
     updateAndInitialize();
 
     return () => {
       isMounted = false;
+      initializingRef.current = false;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
     // eventService is a ref and never changes, so we exclude it from dependencies

package/src/providers/services/InactivityServiceProvider.tsx

@@ -25,8 +25,8 @@ export interface InactivityServiceProviderProps {
   supabaseClient: SupabaseClient;
   user: User | null;
   session: Session | null;
-  idleTimeoutMs?: number;
-  warnBeforeMs?: number;
+  idleTimeoutMs: number; // REQUIRED: No default - must be explicitly provided
+  warnBeforeMs: number; // REQUIRED: No default - must be explicitly provided
   onIdleLogout: (reason: 'inactivity') => void;
 }
 
@@ -35,8 +35,8 @@ export function InactivityServiceProvider({
   supabaseClient, 
   user, 
   session, 
-  idleTimeoutMs = 30 * 60 * 1000,
-  warnBeforeMs = 60 * 1000,
+  idleTimeoutMs, // REQUIRED: No default - must be explicitly provided
+  warnBeforeMs, // REQUIRED: No default - must be explicitly provided
   onIdleLogout
 }: InactivityServiceProviderProps) {
   // Create service instance once with useRef to avoid recreation on dependency changes

package/src/providers/services/OrganisationServiceProvider.tsx

@@ -52,7 +52,14 @@ export function OrganisationServiceProvider({
     organisationService.initialize()
       .catch(error => {
         if (isMounted) {
-          logger.error('OrganisationServiceProvider', 'Failed to initialize organisation service:', error);
+          // "User has no access to active organisations" is a valid state for users without orgs (e.g., profile pages)
+          // Log it as a warning instead of an error to reduce noise
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          if (errorMessage === 'User has no access to active organisations') {
+            logger.warn('OrganisationServiceProvider', 'User has no active organisations (this is expected for users without organisation access):', error);
+          } else {
+            logger.error('OrganisationServiceProvider', 'Failed to initialize organisation service:', error);
+          }
         }
       });