@jmruthers/pace-core 0.5.189 → 0.5.191

package/src/services/EventService.ts

@@ -16,6 +16,9 @@ import { Organisation } from '../types/organisation';
 import { assertOrganisationId } from '../types/core';
 import { logger } from '../utils/core/logger';
 import { secureStorage } from '../utils/security/secureStorage';
+import { isSuperAdmin, getAppConfigByName } from '../rbac/api';
+import type { UUID } from '../rbac/types';
+import type { AppConfig } from '../rbac/utils/contextValidator';
 
 export class EventService extends BaseService implements IEventService {
   private events: Event[] = [];
@@ -30,6 +33,8 @@ export class EventService extends BaseService implements IEventService {
   private appName: string = '';
   private selectedOrganisation: Organisation | null = null;
   private setSelectedEventId: ((eventId: string | null) => void) | null = null;
+  private isSuperAdmin: boolean = false; // Track super admin status for conditional validation
+  private appConfig: AppConfig | null = null; // Cache app config to avoid repeated lookups
 
   // Internal state management
   private isInitializedRef = false;
@@ -76,6 +81,7 @@ export class EventService extends BaseService implements IEventService {
     const newOrgId = selectedOrganisation?.id;
     const previousUserId = this.user?.id || null;
     const newUserId = user?.id || null;
+    const previousAppName = this.appName;
     
     // If user changed, clear previous user's event selection from storage
     if (previousUserId !== newUserId) {
@@ -87,6 +93,10 @@ export class EventService extends BaseService implements IEventService {
         this.selectedEvent = null;
         this.setSelectedEventId?.(null);
       }
+      // Reset initialization when user changes
+      this.resetInitialization();
+      this.isInitializedRef = false;
+      this.isFetchingRef = false;
     }
     
     this.supabaseClient = supabaseClient;
@@ -96,8 +106,31 @@ export class EventService extends BaseService implements IEventService {
     this.selectedOrganisation = selectedOrganisation;
     this.setSelectedEventId = setSelectedEventId;
     
-    // If organisation changed (from null to value, or different org), reset initialization
-    // This ensures events are re-fetched when organisation context becomes available
+    // Clear app config cache when app name changes
+    if (previousAppName !== appName) {
+      this.appConfig = null;
+    }
+    
+    // Update super admin status when user changes
+    // This allows super admins to select events from any organisation
+    if (user?.id) {
+      try {
+        this.isSuperAdmin = await isSuperAdmin(user.id as UUID);
+        logger.debug('EventService', 'Updated super admin status', {
+          userId: user.id,
+          isSuperAdmin: this.isSuperAdmin
+        });
+      } catch (error) {
+        logger.warn('EventService', 'Failed to check super admin status', { error });
+        this.isSuperAdmin = false; // Default to false on error
+      }
+    } else {
+      this.isSuperAdmin = false;
+    }
+    
+    // If organisation changed (from null to value, or different org, or value to null), reset initialization
+    // This ensures events are re-fetched when organisation context changes
+    // For event-required apps, selectedOrganisation will be null, so we need to reset when it changes from undefined/null to null
     if (previousOrgId !== newOrgId) {
       this.resetInitialization(); // Reset BaseService's isInitialized flag
       this.isInitializedRef = false;
@@ -138,20 +171,9 @@ export class EventService extends BaseService implements IEventService {
   // Event methods
   setSelectedEvent(event: Event | null): void {
     if (event) {
-      // SECURITY: Validate event belongs to current organisation
-      try {
-        if (this.selectedOrganisation && event.organisation_id !== this.selectedOrganisation.id) {
-          logger.error('EventService', 'Event organisation_id does not match selected organisation', {
-            eventOrganisationId: event.organisation_id,
-            selectedOrganisationId: this.selectedOrganisation.id,
-            eventName: event.event_name
-          });
-          return;
-        }
-      } catch (error) {
-        logger.error('EventService', 'Error during event validation:', error);
-      }
-
+      // No validation needed: For event-required apps, org is derived from event
+      // For org-required apps, event is optional and doesn't need validation
+      // RLS policies handle security at the database level
       this.selectedEvent = event;
       this.setSelectedEventId?.(event.event_id);
       // Persist asynchronously (don't await to avoid blocking)
@@ -286,6 +308,12 @@ export class EventService extends BaseService implements IEventService {
   async initialize(): Promise<void> {
     // Only call super.initialize() which will call doInitialize() and fetchEvents()
     // Don't call fetchEvents() again here to avoid double-fetching
+    logger.debug('EventService', 'initialize() called', {
+      isInitializedRef: this.isInitializedRef,
+      hasUser: !!this.user,
+      hasSession: !!this.session,
+      appName: this.appName
+    });
     await super.initialize();
   }
 
@@ -294,13 +322,23 @@ export class EventService extends BaseService implements IEventService {
   }
 
   protected async doInitialize(): Promise<void> {
+    logger.debug('EventService', 'doInitialize() called', {
+      isInitializedRef: this.isInitializedRef,
+      isFetchingRef: this.isFetchingRef,
+      hasUser: !!this.user,
+      hasSession: !!this.session,
+      appName: this.appName
+    });
+    
     // Skip if already initialized
     if (this.isInitializedRef) {
+      logger.debug('EventService', 'Skipping initialization - already initialized');
       return;
     }
     
     // Skip if already fetching
     if (this.isFetchingRef) {
+      logger.debug('EventService', 'Skipping initialization - already fetching');
       return;
     }
     
@@ -313,13 +351,25 @@ export class EventService extends BaseService implements IEventService {
       logger.warn('EventService', 'Failed to clean up old storage keys:', error);
     }
     
-    // Skip if no user or organisation
-    if (!this.user || !this.selectedOrganisation) {
+    // Skip if no user
+    // For event-required apps, selectedOrganisation may be null (org derived from event)
+    // For org-required apps, selectedOrganisation is required
+    if (!this.user) {
+      logger.debug('EventService', 'Skipping initialization - missing user');
       return;
     }
     
+    logger.debug('EventService', 'Initializing - fetching events', {
+      userId: this.user.id,
+      organisationId: this.selectedOrganisation?.id || 'derived-from-event',
+      appName: this.appName
+    });
+    
     // Initial setup - fetch events on initialization
     await this.fetchEvents(false);
+    
+    // Mark as initialized after successful fetch
+    this.isInitializedRef = true;
   }
 
   protected doCleanup(): void {
@@ -327,7 +377,15 @@ export class EventService extends BaseService implements IEventService {
   }
 
   private async fetchEvents(skipLoadPersisted: boolean = false): Promise<void> {
-    if (!this.user || !this.session || !this.supabaseClient || !this.appName || !this.selectedOrganisation) {
+    // For event-required apps, selectedOrganisation may be null (org derived from event)
+    // For org-required apps, selectedOrganisation is required
+    if (!this.user || !this.session || !this.supabaseClient || !this.appName) {
+      logger.debug('EventService', 'Skipping fetchEvents - missing dependencies', {
+        hasUser: !!this.user,
+        hasSession: !!this.session,
+        hasSupabaseClient: !!this.supabaseClient,
+        appName: this.appName
+      });
       // Already false from initialization, just notify
       this.notify();
       return;
@@ -339,6 +397,7 @@ export class EventService extends BaseService implements IEventService {
 
     // Prevent multiple simultaneous fetches
     if (this.isFetchingRef) {
+      logger.debug('EventService', 'Skipping fetchEvents - already fetching');
       return;
     }
 
@@ -346,12 +405,97 @@ export class EventService extends BaseService implements IEventService {
     let isMounted = true;
 
     try {
+      // Load app config if not already cached (only once per app)
+      if (!this.appConfig && this.appName) {
+        try {
+          this.appConfig = await getAppConfigByName(this.appName);
+        } catch (configError) {
+          logger.warn('EventService', 'Failed to load app config, defaulting to event-required', {
+            error: configError
+          });
+          // Default to event-required for safety
+          this.appConfig = { requires_event: true };
+        }
+      }
+
+      // Determine organisationId for RPC call
+      // For event-required apps: org is derived from selectedEvent (if available), or null to get all accessible events
+      // For org-required apps: org comes from selectedOrganisation
+      // Super admins: pass null to see all events
+      let organisationIdForRpc: string | null = null;
+      
+      // Check if user is super admin first
+      let userIsSuperAdmin = false;
+      try {
+        userIsSuperAdmin = await isSuperAdmin(this.user.id as UUID);
+        if (userIsSuperAdmin) {
+          // Super admin: Pass null to see all events across all organisations
+          organisationIdForRpc = null;
+          logger.debug('EventService', 'Super admin detected - fetching all events', {
+            userId: this.user.id
+          });
+        } else {
+          // Not super admin: determine org from context based on app type
+          if (this.selectedEvent) {
+            // If event is already selected, use its organisation
+            organisationIdForRpc = this.selectedEvent.organisation_id;
+          } else if (this.appConfig?.requires_event === true) {
+            // Event-required app with no selected event yet: pass null to get all accessible events
+            // The RPC will filter by event app roles, returning all events the user has access to
+            organisationIdForRpc = null;
+            logger.debug('EventService', 'Event-required app: fetching all accessible events (no event selected yet)', {
+              userId: this.user.id,
+              appName: this.appName
+            });
+          } else if (this.selectedOrganisation) {
+            // Org-required app: use selected organisation
+            organisationIdForRpc = this.selectedOrganisation.id;
+          } else {
+            // No context available - this shouldn't happen for authenticated users
+            logger.warn('EventService', 'No organisation context available for event fetch', {
+              hasSelectedEvent: !!this.selectedEvent,
+              hasSelectedOrganisation: !!this.selectedOrganisation,
+              appRequiresEvent: this.appConfig?.requires_event
+            });
+            organisationIdForRpc = null; // Will return empty list
+          }
+        }
+      } catch (superAdminCheckError) {
+        // If super admin check fails, fall back to organisation-scoped query
+        logger.warn('EventService', 'Failed to check super admin status, using organisation-scoped query', {
+          error: superAdminCheckError
+        });
+        // Fallback: use available context
+        if (this.selectedEvent) {
+          organisationIdForRpc = this.selectedEvent.organisation_id;
+        } else if (this.appConfig?.requires_event === true) {
+          // Event-required app: pass null to get all accessible events
+          organisationIdForRpc = null;
+        } else if (this.selectedOrganisation) {
+          organisationIdForRpc = this.selectedOrganisation.id;
+        }
+      }
+      
+      logger.debug('EventService', 'Fetching events via RPC', {
+        userId: this.user.id,
+        organisationId: organisationIdForRpc,
+        appName: this.appName
+      });
+      
       // Call the RPC function following the established pattern
-      const { data, error: rpcError } = await this.supabaseClient.rpc('data_user_events_get', {
+      // For super admins, pass null for p_organisation_id to see all events
+      let { data, error: rpcError } = await this.supabaseClient.rpc('data_user_events_get', {
         p_user_id: this.user.id,
-        p_organisation_id: this.selectedOrganisation.id,
+        p_organisation_id: organisationIdForRpc,
         p_app_name: this.appName
       });
+      
+      logger.debug('EventService', 'RPC response received', {
+        hasData: !!data,
+        dataLength: Array.isArray(data) ? data.length : 'not array',
+        hasError: !!rpcError,
+        error: rpcError
+      });
 
       if (rpcError) {
         logger.error('EventService', 'RPC error fetching events:', rpcError);

package/src/services/OrganisationService.ts

@@ -27,6 +27,15 @@ interface OrganisationRoleRpcResponse {
   organisation_id: string;
   role: 'org_admin' | 'leader' | 'member' | 'supporter';
   status: 'active' | 'inactive' | 'suspended';
+  // Organisation fields from RPC
+  name?: string;
+  display_name?: string;
+  subscription_tier?: string;
+  settings?: unknown;
+  is_active?: boolean;
+  parent_id?: string;
+  organisation_created_at?: string;
+  organisation_updated_at?: string;
   [key: string]: unknown;
 }
 
@@ -71,6 +80,21 @@ export class OrganisationService extends BaseService implements IOrganisationSer
 
   // Additional methods for testing
   setSelectedOrganisation(organisation: Organisation | null): void {
+    // SECURITY: Validate organisation is in user's accessible organisations (only if orgs are loaded)
+    if (organisation && this._organisations.length > 0) {
+      const isValidOrg = this._organisations.some(org => org.id === organisation.id);
+      if (!isValidOrg) {
+        logger.warn('OrganisationService', 'Attempted to set invalid organisation - not in user\'s accessible organisations', {
+          organisationId: organisation.id,
+          organisationName: organisation.name,
+          accessibleOrgIds: this._organisations.map(o => o.id)
+        });
+        // Don't set invalid organisation - this prevents security issues
+        // If organisations haven't loaded yet, validation will happen in loadUserOrganisations()
+        return;
+      }
+    }
+    
     this._selectedOrganisation = organisation;
     if (organisation) {
       localStorage.setItem('pace-core-selected-organisation', JSON.stringify(organisation));
@@ -343,159 +367,106 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     this.notify();
       
     try {
-      // Get user's organisation memberships using secure RPC function
-      // Include all roles (org_admin, leader, member, supporter) - supporters can access PORTAL
-      let memberships, membershipError;
+      // Get user's organisation roles directly from rbac_organisation_roles table
+      // This queries the source table directly instead of using the RPC which filters to match core_organisation_memberships view
+      // We still filter to active, non-revoked roles for the org selector
+      // The join includes organisation data, so we don't need a separate query that might be filtered by RLS
+      let memberships, membershipError, organisations: Organisation[] = [];
       try {
-        // Add timeout and abort signal to prevent hanging RPC calls
-        const timeoutPromise = new Promise((_, reject) => {
-          const timeoutId = setTimeout(() => reject(new Error('RPC call timeout after 10 seconds')), 10000);
-          abortSignal.addEventListener('abort', () => {
-            clearTimeout(timeoutId);
-            reject(new Error('Request aborted'));
-          });
-        });
-        
-        const rpcPromise = this.supabaseClient.rpc('data_user_organisation_roles_get', {
-          p_user_id: this.user.id,
-          p_organisation_id: null
-        });
-        
-        // Check if request was aborted before making the call
+        // Check if request was aborted before making query
         if (abortSignal.aborted) {
           throw new Error('Request aborted');
         }
+
+        const { data: rolesData, error: rolesError } = await this.supabaseClient
+          .from('rbac_organisation_roles')
+          .select(`
+            id,
+            user_id,
+            organisation_id,
+            role,
+            status,
+            granted_at,
+            granted_by,
+            revoked_at,
+            revoked_by,
+            notes,
+            created_at,
+            updated_at,
+            core_organisations!inner(
+              id,
+              name,
+              display_name,
+              subscription_tier,
+              settings,
+              is_active,
+              parent_id,
+              created_at,
+              updated_at
+            )
+          `)
+          .eq('user_id', this.user.id)
+          .eq('status', 'active')
+          .is('revoked_at', null);
         
-        const result = await Promise.race([rpcPromise, timeoutPromise]) as { data: OrganisationRoleRpcResponse[] | null; error: Error | null };
+        if (rolesError) {
+          logger.error("OrganisationService", "Error loading organisation roles:", rolesError);
+          throw rolesError;
+        }
         
-        // Filter to organisation members (org_admin, leader, member, supporter)
-        // Supporters are included to allow PORTAL access
-        // Map to branded types when filtering
-        memberships = result.data?.filter((role) => 
-          ['org_admin', 'leader', 'member', 'supporter'].includes(role.role)
-        ).map((m) => ({
+        // Map to branded types and extract organisation data from the join
+        // The join already includes organisation data, so we don't need a separate query
+        memberships = rolesData?.map((m) => ({
           ...m,
           user_id: assertUserId(m.user_id),
           organisation_id: assertOrganisationId(m.organisation_id),
         })) || [];
-        membershipError = result.error;
-      } catch (queryError) {
-        membershipError = queryError instanceof Error ? queryError : new Error(String(queryError));
-      }
-
-      if (membershipError) {
-        logger.error("OrganisationService", "Error loading memberships:", membershipError);
         
-        // If RPC fails with timeout, try direct database query as fallback
-        if (membershipError.message?.includes('timeout')) {
-          try {
-            // Check if request was aborted before making fallback query
-            if (abortSignal.aborted) {
-              throw new Error('Request aborted');
-            }
-
-            const { data: fallbackData, error: fallbackError } = await this.supabaseClient
-              .from('rbac_organisation_roles')
-              .select(`
-                id,
-                user_id,
-                organisation_id,
-                role,
-                status,
-                granted_at,
-                granted_by,
-                revoked_at,
-                revoked_by,
-                notes,
-                created_at,
-                updated_at,
-                organisations!inner(
-                  id,
-                  name,
-                  display_name,
-                  subscription_tier,
-                  settings,
-                  is_active,
-                  parent_id,
-                  created_at,
-                  updated_at
-                )
-              `)
-              .eq('user_id', this.user.id)
-              .eq('status', 'active')
-              .is('revoked_at', null)
-              .in('role', ['org_admin', 'leader', 'member', 'supporter']);
-            
-            if (fallbackError) {
-              logger.error("OrganisationService", "Fallback query also failed:", fallbackError);
-              throw membershipError; // Throw original error
-            }
-            
-            // Map to branded types
-            memberships = fallbackData?.map((m) => ({
-              ...m,
-              user_id: assertUserId(m.user_id),
-              organisation_id: assertOrganisationId(m.organisation_id),
-            })) || [];
-            membershipError = null;
-          } catch (fallbackErr) {
-            logger.error("OrganisationService", "Fallback query failed:", fallbackErr);
-            throw membershipError; // Throw original error
+        // Extract unique organisations from the join results
+        // Use a Map to deduplicate by organisation ID
+        // Supabase returns joined data nested under the relation name
+        const organisationsMap = new Map<string, Organisation>();
+        rolesData?.forEach((role: any) => {
+          // The join returns organisation data nested under 'core_organisations' key
+          const orgData = role.core_organisations;
+          if (orgData && role.organisation_id && !organisationsMap.has(role.organisation_id)) {
+            organisationsMap.set(role.organisation_id, {
+              id: orgData.id,
+              name: orgData.name,
+              display_name: orgData.display_name,
+              subscription_tier: orgData.subscription_tier,
+              settings: orgData.settings,
+              is_active: orgData.is_active,
+              parent_id: orgData.parent_id,
+              created_at: orgData.created_at,
+              updated_at: orgData.updated_at,
+            } as Organisation);
           }
+        });
+        
+        organisations = Array.from(organisationsMap.values());
+        
+        // Extract organisations from join results
+      } catch (queryError) {
+        // Extract error message properly from Supabase error objects
+        if (queryError instanceof Error) {
+          membershipError = queryError;
+        } else if (queryError && typeof queryError === 'object' && 'message' in queryError) {
+          membershipError = new Error(String((queryError as any).message));
         } else {
-          throw membershipError;
+          membershipError = new Error(String(queryError));
         }
+        logger.error("OrganisationService", "Error loading organisation roles:", membershipError);
+        throw membershipError;
       }
       
       if (!memberships || memberships.length === 0) {
         throw new Error('User has no active organisation memberships') as OrganisationSecurityError;
       }
 
-      // Get organisation details for the memberships
-      const organisationIds = memberships
-        .map((m) => m.organisation_id)
-        .filter((id: string) => {
-          // Better validation to prevent empty string UUID errors
-          if (!id || typeof id !== 'string') {
-            logger.warn("OrganisationService", "Invalid organisation ID (not string):", id);
-            return false;
-          }
-          const trimmedId = id.trim();
-          if (trimmedId === '') {
-            logger.warn("OrganisationService", "Empty organisation ID found");
-            return false;
-          }
-          // Validate UUID format
-          const isValidUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(trimmedId);
-          if (!isValidUuid) {
-            logger.warn("OrganisationService", "Invalid UUID format:", trimmedId);
-          }
-          return isValidUuid;
-        });
-      
-      if (organisationIds.length === 0) {
-        logger.warn("OrganisationService", "No valid organisation IDs found in memberships:", memberships);
-        throw new Error('No valid organisation IDs found in memberships') as OrganisationSecurityError;
-      }
-      
-      // Check if request was aborted before making organisations query
-      if (abortSignal.aborted) {
-        throw new Error('Request aborted');
-      }
-      
-      const { data: allOrganisations, error: orgError } = await this.supabaseClient
-        .from('organisations')
-        .select('id, name, display_name, subscription_tier, settings, is_active, parent_id, created_at, updated_at');
-      
-      if (orgError) {
-        logger.error("OrganisationService", "Error loading organisations:", orgError);
-        throw orgError;
+      if (!organisations || organisations.length === 0) {
+        throw new Error('No organisations found in role data') as OrganisationSecurityError;
       }
-      
-      // Filter manually on the client side
-      const organisations = allOrganisations?.filter(org => 
-        organisationIds.includes(org.id)
-      ) || [];
 
       // Create a map of organisation_id to role from the memberships data
       const roleMap = new Map<string, string>();
@@ -507,6 +478,8 @@ export class OrganisationService extends BaseService implements IOrganisationSer
       const orgs = organisations as Organisation[];
       const activeOrgs = orgs.filter(org => org.is_active);
       
+      // Filter to active organisations only
+      
       if (activeOrgs.length === 0) {
         throw new Error('User has no access to active organisations') as OrganisationSecurityError;
       }
@@ -534,16 +507,13 @@ export class OrganisationService extends BaseService implements IOrganisationSer
               initialOrg = validPersistedOrg;
               selectionMethod = 'persisted';
             } else {
-              logger.warn("OrganisationService", "Persisted organisation not found in active orgs, clearing cache");
               localStorage.removeItem('pace-core-selected-organisation');
             }
           } else {
-            logger.warn("OrganisationService", "Invalid persisted organisation ID, clearing cache");
             localStorage.removeItem('pace-core-selected-organisation');
           }
         }
       } catch (storageError) {
-        logger.warn("OrganisationService", "Failed to restore persisted organisation:", storageError);
         // Clear potentially corrupted cache
         localStorage.removeItem('pace-core-selected-organisation');
       }
@@ -570,6 +540,16 @@ export class OrganisationService extends BaseService implements IOrganisationSer
         throw new Error('No valid organisation found for user') as OrganisationSecurityError;
       }
 
+      // SECURITY: Validate current selected organisation is still valid (in case it was set before orgs loaded)
+      const currentSelectedOrg = this._selectedOrganisation;
+      if (currentSelectedOrg && !activeOrgs.some(org => org.id === currentSelectedOrg.id)) {
+        logger.warn('OrganisationService', 'Current selected organisation is no longer valid, resetting', {
+          invalidOrgId: currentSelectedOrg.id,
+          validOrgIds: activeOrgs.map(o => o.id)
+        });
+        this._selectedOrganisation = null;
+      }
+
       this._selectedOrganisation = initialOrg;
       
       // Persist selection
@@ -583,14 +563,22 @@ export class OrganisationService extends BaseService implements IOrganisationSer
       this.hasFailedRef = false;
       
     } catch (err) {
-      logger.error("OrganisationService", "Failed to load organisations:", err);
-      this._error = err as Error;
+      const error = err as Error;
+      // "User has no access to active organisations" is a valid state for users without orgs (e.g., profile pages)
+      // Only log actual errors, not expected states
+      if (error.message !== 'User has no access to active organisations') {
+        logger.error("OrganisationService", "Failed to load organisations:", err);
+      }
+      this._error = error;
       // Increment retry count on error
       this.retryCount = this.retryCount + 1;
       // Set failed flag to prevent further attempts
       this.hasFailedRef = true;
       // Clear all cached data on error to prevent corruption
       this.clearAllCachedData();
+      // Mark context as ready even on error - this allows the app to proceed
+      // The app can check hasValidOrganisationContext() to determine if org context is available
+      this._isContextReady = true;
     } finally {
       // Always cleanup refs and abort controller
       this.isLoadingRef = false;