@jmruthers/pace-core 0.5.189 → 0.5.191

package/src/rbac/utils/__tests__/eventContext.unit.test.ts

@@ -15,7 +15,9 @@ import {
   getOrganisationFromEvent,
   createScopeFromEvent,
   isEventBasedScope,
-  isValidEventBasedScope
+  isValidEventBasedScope,
+  clearAllOrgDerivationCache,
+  clearOrgDerivationCache
 } from '../eventContext';
 
 // Mock Supabase client
@@ -26,8 +28,10 @@ const createMockSupabaseClient = () => {
     single: vi.fn()
   };
 
+  const fromMock = vi.fn().mockReturnValue(mockQuery);
+  
   return {
-    from: vi.fn().mockReturnValue(mockQuery),
+    from: fromMock,
     query: mockQuery
   } as unknown as SupabaseClient<Database>;
 };
@@ -37,12 +41,23 @@ describe('Event Context Utilities', () => {
   let mockQuery: any;
 
   beforeEach(() => {
+    // Clear cache before each test
+    clearAllOrgDerivationCache();
+    
     mockSupabase = createMockSupabaseClient();
-    mockQuery = mockSupabase.from('event');
+    // Reset mockQuery to get a fresh query builder for each test
+    mockQuery = {
+      select: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      single: vi.fn()
+    };
+    (mockSupabase.from as any).mockReturnValue(mockQuery);
   });
 
   afterEach(() => {
     vi.clearAllMocks();
+    // Clear cache after each test
+    clearAllOrgDerivationCache();
   });
 
   describe('getOrganisationFromEvent', () => {
@@ -58,7 +73,7 @@ describe('Event Context Utilities', () => {
       const result = await getOrganisationFromEvent(mockSupabase, eventId);
 
       expect(result).toBe(organisationId);
-      expect(mockSupabase.from).toHaveBeenCalledWith('event');
+      expect(mockSupabase.from).toHaveBeenCalledWith('core_events');
       expect(mockQuery.select).toHaveBeenCalledWith('organisation_id');
       expect(mockQuery.eq).toHaveBeenCalledWith('event_id', eventId);
       expect(mockQuery.single).toHaveBeenCalled();
@@ -80,6 +95,9 @@ describe('Event Context Utilities', () => {
     it('should return null when data is null', async () => {
       const eventId = 'event-123';
       
+      // Clear cache for this specific test
+      clearOrgDerivationCache(eventId);
+      
       mockQuery.single.mockResolvedValue({
         data: null,
         error: null
@@ -94,6 +112,9 @@ describe('Event Context Utilities', () => {
       const eventId = 'event-123';
       const dbError = new Error('Database connection failed');
       
+      // Clear cache for this specific test
+      clearOrgDerivationCache(eventId);
+      
       mockQuery.single.mockRejectedValue(dbError);
 
       await expect(getOrganisationFromEvent(mockSupabase, eventId))
@@ -103,6 +124,9 @@ describe('Event Context Utilities', () => {
     it('should handle empty organisation_id', async () => {
       const eventId = 'event-123';
       
+      // Clear cache for this specific test
+      clearOrgDerivationCache(eventId);
+      
       mockQuery.single.mockResolvedValue({
         data: { organisation_id: null },
         error: null
@@ -168,6 +192,9 @@ describe('Event Context Utilities', () => {
     it('should return null when organisation lookup fails', async () => {
       const eventId = 'event-123';
       
+      // Clear cache for this specific test
+      clearOrgDerivationCache(eventId);
+      
       mockQuery.single.mockResolvedValue({
         data: { organisation_id: null },
         error: null
@@ -182,6 +209,9 @@ describe('Event Context Utilities', () => {
       const eventId = 'event-123';
       const dbError = new Error('Database connection failed');
       
+      // Clear cache for this specific test
+      clearOrgDerivationCache(eventId);
+      
       mockQuery.single.mockRejectedValue(dbError);
 
       await expect(createScopeFromEvent(mockSupabase, eventId))
@@ -349,15 +379,31 @@ describe('Event Context Utilities', () => {
       const organisationId1 = 'org-123';
       const organisationId2 = 'org-456';
       
-      mockQuery.single
-        .mockResolvedValueOnce({
+      // Clear cache for these specific events
+      clearOrgDerivationCache(eventId1);
+      clearOrgDerivationCache(eventId2);
+      
+      // Create separate query builders for concurrent calls
+      const mockQuery1 = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
           data: { organisation_id: organisationId1 },
           error: null
         })
-        .mockResolvedValueOnce({
+      };
+      const mockQuery2 = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
           data: { organisation_id: organisationId2 },
           error: null
-        });
+        })
+      };
+      
+      (mockSupabase.from as any)
+        .mockReturnValueOnce(mockQuery1)
+        .mockReturnValueOnce(mockQuery2);
 
       const [result1, result2] = await Promise.all([
         getOrganisationFromEvent(mockSupabase, eventId1),
@@ -376,15 +422,31 @@ describe('Event Context Utilities', () => {
       const appId1 = 'app-123';
       const appId2 = 'app-456';
       
-      mockQuery.single
-        .mockResolvedValueOnce({
+      // Clear cache for these specific events
+      clearOrgDerivationCache(eventId1);
+      clearOrgDerivationCache(eventId2);
+      
+      // Create separate query builders for concurrent calls
+      const mockQuery1 = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
           data: { organisation_id: organisationId1 },
           error: null
         })
-        .mockResolvedValueOnce({
+      };
+      const mockQuery2 = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
           data: { organisation_id: organisationId2 },
           error: null
-        });
+        })
+      };
+      
+      (mockSupabase.from as any)
+        .mockReturnValueOnce(mockQuery1)
+        .mockReturnValueOnce(mockQuery2);
 
       const [result1, result2] = await Promise.all([
         createScopeFromEvent(mockSupabase, eventId1, appId1),

package/src/rbac/utils/contextValidator.ts

@@ -0,0 +1,288 @@
+/**
+ * Context Validator for RBAC
+ * @package @jmruthers/pace-core
+ * @module RBAC/ContextValidator
+ * @since 1.0.0
+ * 
+ * Centralized validation for RBAC context requirements based on app configuration.
+ * Enforces app-specific context rules with single primary context:
+ * - requires_event = TRUE: Event is PRIMARY context, org derived from event (org not required in input)
+ * - requires_event = FALSE: Organisation is PRIMARY context, event optional
+ * - PORTAL/ADMIN apps: Both contexts optional (allows users to view/edit own profiles, super admin access)
+ * 
+ * Key principle: Only one primary context is required based on app config. The other is derived or optional.
+ */
+
+import { SupabaseClient } from '@supabase/supabase-js';
+import { Database } from '../../types/database';
+import { UUID, Scope } from '../types';
+import { EventContextRequiredError, OrganisationContextRequiredError } from '../types';
+import { getOrganisationFromEvent } from './eventContext';
+import { createLogger } from '../../utils/core/logger';
+
+const log = createLogger('ContextValidator');
+
+export interface AppConfig {
+  requires_event: boolean;
+}
+
+/**
+ * Check if an app allows optional contexts (both organisation and event optional)
+ * @param appName - App name to check
+ * @returns True if app allows optional contexts
+ */
+function allowsOptionalContexts(appName?: string): boolean {
+  return appName === 'PORTAL' || appName === 'ADMIN';
+}
+
+export interface ContextValidationResult {
+  isValid: boolean;
+  resolvedScope: Scope | null;
+  error: Error | null;
+}
+
+/**
+ * Context Validator class
+ * 
+ * Validates and resolves RBAC scope based on app configuration requirements.
+ */
+export class ContextValidator {
+  /**
+   * Validate scope against app requirements
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration (requires_event flag)
+   * @param appName - App name (for PORTAL/ADMIN special case)
+   * @returns Validation result with resolved scope
+   */
+  static async validateScope(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string
+  ): Promise<ContextValidationResult> {
+    // PORTAL/ADMIN special case: both contexts optional
+    if (allowsOptionalContexts(appName)) {
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId: scope.organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      if (!scope.organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Event-required apps: must have eventId, derive org from event
+    if (appConfig.requires_event) {
+      if (!scope.eventId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new EventContextRequiredError()
+        };
+      }
+
+      // If org is not provided, we'll need to derive it from event
+      // But for validation, we just check that eventId exists
+      // The actual derivation happens in resolveRequiredContext
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Org-required apps: must have organisationId, eventId optional
+    if (!scope.organisationId) {
+      return {
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      };
+    }
+
+    return {
+      isValid: true,
+      resolvedScope: scope,
+      error: null
+    };
+  }
+
+  /**
+   * Resolve required context and derive missing values
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration
+   * @param appName - App name (for PORTAL/ADMIN special case)
+   * @param supabase - Supabase client (for deriving org from event)
+   * @returns Resolved scope with all required context
+   */
+  static async resolveRequiredContext(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string,
+    supabase?: SupabaseClient<Database> | null
+  ): Promise<ContextValidationResult> {
+    // PORTAL/ADMIN special case: both contexts optional
+    if (allowsOptionalContexts(appName)) {
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId: scope.organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      if (!scope.organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    }
+
+    // Event-required apps: must have eventId, derive org from event
+    if (appConfig.requires_event) {
+      if (!scope.eventId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new EventContextRequiredError()
+        };
+      }
+
+      // Derive organisationId from event if not provided
+      let organisationId: UUID | undefined = scope.organisationId;
+      if (!organisationId && supabase && scope.eventId) {
+        try {
+          const derivedOrgId = await this.deriveOrgFromEvent(supabase, scope.eventId);
+          organisationId = derivedOrgId || undefined;
+          if (!organisationId) {
+            return {
+              isValid: false,
+              resolvedScope: null,
+              error: new Error('Could not resolve organisation from event context')
+            };
+          }
+        } catch (error) {
+          log.error('Failed to derive org from event:', error);
+          return {
+            isValid: false,
+            resolvedScope: null,
+            error: error instanceof Error ? error : new Error('Failed to derive organisation from event')
+          };
+        }
+      } else if (!organisationId) {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new Error('Event context requires organisationId but it could not be derived (supabase client not available)')
+        };
+      }
+
+      return {
+        isValid: true,
+        resolvedScope: {
+          organisationId,
+          eventId: scope.eventId,
+          appId: scope.appId
+        },
+        error: null
+      };
+    }
+
+    // Org-required apps: must have organisationId, eventId optional
+    if (!scope.organisationId) {
+      return {
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      };
+    }
+
+    return {
+      isValid: true,
+      resolvedScope: scope,
+      error: null
+    };
+  }
+
+  /**
+   * Derive organisation ID from event ID
+   * 
+   * @param supabase - Supabase client
+   * @param eventId - Event ID
+   * @returns Organisation ID or null
+   */
+  static async deriveOrgFromEvent(
+    supabase: SupabaseClient<Database>,
+    eventId: string
+  ): Promise<UUID | null> {
+    return getOrganisationFromEvent(supabase, eventId);
+  }
+
+  /**
+   * Check if context is ready for permission checks
+   * 
+   * @param scope - Current scope
+   * @param appConfig - App configuration
+   * @param appName - App name
+   * @param hasSelectedEvent - Whether event is selected
+   * @param hasSelectedOrganisation - Whether organisation is selected
+   * @returns True if context is ready
+   */
+  static isContextReady(
+    scope: Scope,
+    appConfig: AppConfig | null,
+    appName?: string,
+    hasSelectedEvent?: boolean,
+    hasSelectedOrganisation?: boolean
+  ): boolean {
+    // PORTAL/ADMIN special case: context is always ready
+    if (allowsOptionalContexts(appName)) {
+      return true;
+    }
+
+    // If no app config, default to requiring org context
+    if (!appConfig) {
+      return !!hasSelectedOrganisation || !!scope.organisationId;
+    }
+
+    // Event-required apps: need event context
+    if (appConfig.requires_event) {
+      return !!hasSelectedEvent || !!scope.eventId;
+    }
+
+    // Org-required apps: need org context
+    return !!hasSelectedOrganisation || !!scope.organisationId;
+  }
+}
+

package/src/rbac/utils/eventContext.ts

@@ -12,9 +12,35 @@ import { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../../types/database';
 import { UUID, Scope } from '../types';
 
+/**
+ * Cache for organisation derivation from event
+ * Key: eventId, Value: organisationId | null
+ * Maximum cache size to prevent memory leaks
+ */
+const orgDerivationCache = new Map<string, UUID | null>();
+const MAX_CACHE_SIZE = 100; // Limit cache to 100 entries
+
+/**
+ * Clear cache entry for a specific event (useful if event's org changes)
+ * @param eventId - Event ID to clear from cache
+ */
+export function clearOrgDerivationCache(eventId: string): void {
+  orgDerivationCache.delete(eventId);
+}
+
+/**
+ * Clear all cached organisation derivations
+ */
+export function clearAllOrgDerivationCache(): void {
+  orgDerivationCache.clear();
+}
+
 /**
  * Get organization ID from event ID
  * 
+ * Uses caching to avoid repeated database queries for the same event.
+ * Cache is limited to prevent memory leaks.
+ * 
  * @param supabase - Supabase client
  * @param eventId - Event ID
  * @returns Promise resolving to organization ID or null
@@ -23,17 +49,40 @@ export async function getOrganisationFromEvent(
   supabase: SupabaseClient<Database>,
   eventId: string
 ): Promise<UUID | null> {
+  // Check cache first
+  if (orgDerivationCache.has(eventId)) {
+    return orgDerivationCache.get(eventId) ?? null;
+  }
+
+  // Query database
   const { data, error } = await supabase
-    .from('event')
+    .from('core_events')
     .select('organisation_id')
     .eq('event_id', eventId)
     .single() as { data: { organisation_id: string } | null; error: any };
 
+  let organisationId: UUID | null = null;
+
   if (error || !data) {
-    return null;
+    organisationId = null;
+  } else if (data.organisation_id) {
+    organisationId = data.organisation_id;
+  } else {
+    // organisation_id is null or undefined
+    organisationId = null;
+  }
+
+  // Cache the result (with size limit to prevent memory leaks)
+  if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
+    // Remove oldest entry (first key in Map)
+    const firstKey = orgDerivationCache.keys().next().value;
+    if (firstKey) {
+      orgDerivationCache.delete(firstKey);
+    }
   }
+  orgDerivationCache.set(eventId, organisationId);
 
-  return data.organisation_id;
+  return organisationId;
 }
 
 /**

package/src/services/AuthService.ts

@@ -299,7 +299,15 @@ export class AuthService extends BaseService implements IAuthService {
   // Lifecycle methods
   async initialize(): Promise<void> {
     await super.initialize();
+    // Set loading to true before starting session restoration
+    // This ensures ProtectedRoute shows loading state while session is being restored
+    this.authLoading = true;
+    this.notify();
+    
+    // Setup auth state listener first - this will receive INITIAL_SESSION event
     await this.setupAuthStateListener();
+    
+    // Then restore session - this will trigger INITIAL_SESSION event if session exists
     await this.restoreSession();
   }
 
@@ -431,17 +439,25 @@ export class AuthService extends BaseService implements IAuthService {
                     this.sessionRestorationState.restorationError ||
                     (hasTimeoutError && session)) {
                   this.finishSessionRestoration();
-                  return;
+                }
+              } else {
+                // No session in INITIAL_SESSION event - user is not authenticated
+                // Finish restoration to clear loading state
+                if (this.sessionRestorationState.isRestoring) {
+                  this.finishSessionRestoration();
                 }
               }
 
-              if (this.sessionRestorationState.isRestoring) {
-                this.finishSessionRestoration();
-                return;
-              }
+              // CRITICAL: Set loading to false AFTER handling INITIAL_SESSION
+              // This ensures ProtectedRoute waits for session restoration to complete
+              // before checking authentication state
+              this.authLoading = false;
+              this.notify();
+              return; // Return early to avoid setting loading to false again below
             }
 
-            // Always set loading to false after any auth state change
+            // For other events (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED), set loading to false
+            // INITIAL_SESSION is handled above and returns early
             this.authLoading = false;
             this.notify();
           } catch (error) {
@@ -519,8 +535,21 @@ export class AuthService extends BaseService implements IAuthService {
         this.authError = null;
       }
 
-      // Finish successfully even if earlier calls reported an error, to avoid noisy warnings in benign cases
-      this.finishSessionRestoration();
+      // CRITICAL FIX: Don't finish restoration here - wait for INITIAL_SESSION event
+      // The INITIAL_SESSION event should fire when the auth state listener is set up
+      // However, if it doesn't fire within a short delay (e.g., edge case), we'll finish it
+      // This ensures ProtectedRoute waits for the event before checking auth state
+      
+      // Set a short fallback timeout to finish restoration if INITIAL_SESSION doesn't fire
+      // This handles edge cases where the event might be delayed or not fire
+      setTimeout(() => {
+        // Only finish if restoration is still in progress and INITIAL_SESSION hasn't fired
+        // The INITIAL_SESSION handler will have set restorationComplete to true if it fired
+        if (this.sessionRestorationState.isRestoring && !this.sessionRestorationState.restorationComplete) {
+          logger.debug('AuthService', 'INITIAL_SESSION event did not fire, finishing restoration');
+          this.finishSessionRestoration();
+        }
+      }, 100); // 100ms fallback - INITIAL_SESSION should fire immediately when listener is set up
     } catch (error) {
       const restorationError = error instanceof Error
         ? error