@jmruthers/pace-core 0.5.190 → 0.5.191

package/src/hooks/__tests__/usePermissionCache.unit.test.ts

@@ -0,0 +1,741 @@
+import { renderHook, waitFor } from '@testing-library/react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { TestWrapper, renderWithProviders } from '../../__tests__/helpers/test-utils';
+import { useRBAC } from '../../rbac/hooks/useRBAC';
+
+// Mock the useRBAC hook
+vi.mock('../../rbac/hooks/useRBAC');
+
+// Mock useUnifiedAuth (required by usePermissionCache for user context)
+const mockUseUnifiedAuthFn = vi.fn(() => ({
+  user: { id: 'test-user-id' },
+  session: null,
+  appName: 'test-app',
+  selectedOrganisation: { id: 'test-org-id' },
+  selectedEvent: null,
+  selectedOrganisationId: undefined,
+  selectedEventId: undefined,
+  supabase: {},
+  isLoading: false,
+  error: null,
+}));
+vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: () => mockUseUnifiedAuthFn(),
+  UnifiedAuthProvider: ({ children }: { children: any }) => children,
+}));
+
+// Mock isPermittedCached from RBAC API (used by usePermissionCache)
+vi.mock('../../rbac/api', async () => {
+  const actual = await vi.importActual('../../rbac/api');
+  return {
+    ...actual,
+    isPermittedCached: vi.fn().mockResolvedValue(true),
+  };
+});
+
+// Mock logger
+vi.mock('../../utils/core/logger', () => {
+  const mockLoggerInstance = {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  };
+  return {
+    createLogger: vi.fn(() => mockLoggerInstance),
+    logger: mockLoggerInstance,
+  };
+});
+
+// Mock useOrganisations hook (required by usePermissionCache)
+const mockOrganisationContext = {
+  selectedOrganisation: {
+    id: 'test-org-id',
+    name: 'Test Organisation',
+    display_name: 'Test Organisation',
+    slug: 'test-org',
+    description: 'Test organisation',
+    subscription_tier: 'basic',
+    settings: {},
+    is_active: true,
+    created_at: '2023-01-01T00:00:00Z',
+    updated_at: '2023-01-01T00:00:00Z',
+  },
+  organisations: [],
+  userMemberships: [],
+  isLoading: false,
+  error: null,
+  hasValidOrganisationContext: true,
+  setSelectedOrganisation: vi.fn(),
+  switchOrganisation: vi.fn().mockResolvedValue(undefined),
+  getUserRole: vi.fn().mockReturnValue('member'),
+  validateOrganisationAccess: vi.fn().mockReturnValue(true),
+  ensureOrganisationContext: vi.fn().mockReturnValue(null),
+  refreshOrganisations: vi.fn().mockResolvedValue(undefined),
+  getPrimaryOrganisation: vi.fn().mockReturnValue(null),
+  isOrganisationSecure: vi.fn().mockReturnValue(true),
+};
+
+vi.mock('../useOrganisations', () => ({
+  useOrganisations: () => mockOrganisationContext,
+}));
+
+// Mock useEvents hook (optional - wrapped in try/catch in usePermissionCache)
+vi.mock('../useEvents', () => ({
+  useEvents: vi.fn(() => ({
+    selectedEvent: { event_id: 'event-123' },
+    events: [],
+    isLoading: false,
+    error: null,
+  })),
+}));
+
+const mockUseRBAC = vi.mocked(useRBAC);
+
+// Import after mocking
+import { usePermissionCache } from '../usePermissionCache';
+import { isPermittedCached } from '../../rbac/api';
+const mockIsPermittedCached = vi.mocked(isPermittedCached);
+
+describe('usePermissionCache', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    // Reset isPermittedCached mock
+    mockIsPermittedCached.mockClear();
+    mockIsPermittedCached.mockResolvedValue(true);
+    
+    // Default mock implementation
+    mockUseRBAC.mockReturnValue({
+      hasPermission: vi.fn().mockResolvedValue(true),
+      user: { id: 'test-user-id' }
+    });
+  });
+
+  afterEach(() => {
+    vi.clearAllTimers();
+  });
+
+  describe('Initial Configuration', () => {
+    it('uses default configuration when no config is provided', () => {
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      expect(result.current).toHaveProperty('checkPermission');
+      expect(result.current).toHaveProperty('checkMultiplePermissions');
+      expect(result.current).toHaveProperty('getCachedPermissions');
+      expect(result.current).toHaveProperty('invalidateCache');
+      expect(result.current).toHaveProperty('getDebugInfo');
+      expect(result.current).toHaveProperty('getAuditTrail');
+    });
+
+    it('merges custom configuration with defaults', () => {
+      const customConfig = {
+        defaultTTL: 10000,
+        maxCacheSize: 500,
+        enableLogging: true,
+        enableAuditTrail: false
+      };
+
+      const { result } = renderHook(() => usePermissionCache(customConfig), {
+        wrapper: TestWrapper
+      });
+
+      expect(result.current).toHaveProperty('checkPermission');
+      expect(result.current).toHaveProperty('checkMultiplePermissions');
+    });
+  });
+
+  describe('Single Permission Checking', () => {
+    it('checks permission and caches result', async () => {
+      mockIsPermittedCached.mockResolvedValueOnce(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      const permission = await result.current.checkPermission('read', 'dashboard');
+
+      expect(permission).toBe(true);
+      expect(mockIsPermittedCached).toHaveBeenCalled();
+    });
+
+    it('returns cached result for subsequent calls', async () => {
+      mockIsPermittedCached.mockResolvedValueOnce(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // First call
+      await result.current.checkPermission('read', 'dashboard');
+      
+      // Second call should use cache
+      await result.current.checkPermission('read', 'dashboard');
+
+      // Should only call isPermittedCached once (second call uses cache)
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(1);
+    });
+
+    it('respects custom TTL', async () => {
+      mockIsPermittedCached.mockResolvedValueOnce(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ defaultTTL: 1000 }), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard', 2000);
+
+      expect(mockIsPermittedCached).toHaveBeenCalled();
+    });
+
+    it('handles permission check errors gracefully', async () => {
+      const { logger } = await import('../../utils/core/logger');
+      mockIsPermittedCached.mockRejectedValueOnce(new Error('Database error'));
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      const permission = await result.current.checkPermission('read', 'dashboard');
+
+      expect(permission).toBe(false);
+      // Verify error was logged using logger
+      expect(logger.error).toHaveBeenCalled();
+    });
+  });
+
+  describe('Multiple Permission Checking', () => {
+    it('checks multiple permissions efficiently', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false)
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      const permissions = await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+        ['update', 'dashboard'],
+        ['delete', 'dashboard']
+      ]);
+
+      expect(permissions).toHaveLength(4);
+      expect(permissions[0]).toEqual({
+        operation: 'read',
+        pageId: 'dashboard',
+        hasPermission: true,
+        cached: false,
+        timestamp: expect.any(Number)
+      });
+      expect(permissions[1]).toEqual({
+        operation: 'create',
+        pageId: 'dashboard',
+        hasPermission: false,
+        cached: false,
+        timestamp: expect.any(Number)
+      });
+    });
+
+    it('uses cached results for multiple permission checks', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // First call
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard']
+      ]);
+
+      // Second call should use cache
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard']
+      ]);
+
+      // Should only call isPermittedCached twice (once per permission, second call uses cache)
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(2);
+    });
+
+    it('handles mixed cached and uncached permissions', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false)
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Cache first two permissions
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard']
+      ]);
+
+      // Check all four permissions (first two should be cached)
+      const permissions = await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+        ['update', 'dashboard'],
+        ['delete', 'dashboard']
+      ]);
+
+      expect(permissions).toHaveLength(4);
+      expect(permissions[0].cached).toBe(true);
+      expect(permissions[1].cached).toBe(true);
+      expect(permissions[2].cached).toBe(false);
+      expect(permissions[3].cached).toBe(false);
+    });
+  });
+
+  describe('Cache Management', () => {
+    it('enforces maximum cache size', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ maxCacheSize: 3 }), {
+        wrapper: TestWrapper
+      });
+
+      // Add more entries than max cache size
+      await result.current.checkPermission('read', 'page1');
+      await result.current.checkPermission('read', 'page2');
+      await result.current.checkPermission('read', 'page3');
+      await result.current.checkPermission('read', 'page4');
+      await result.current.checkPermission('read', 'page5');
+
+      // Check that cache size is maintained
+      const debugInfo = result.current.getDebugInfo();
+      expect(debugInfo.cacheSize).toBeLessThanOrEqual(3);
+    });
+
+    it('invalidates cache entries', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Cache some permissions
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+
+      // Invalidate all cache
+      result.current.invalidateCache();
+
+      // Check permissions again (should not use cache)
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+
+      // Should be called 4 times (2 initial + 2 after invalidation)
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(4);
+    });
+
+    it('invalidates cache entries by pattern', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Cache permissions for different pages
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('read', 'admin');
+      await result.current.checkPermission('read', 'users');
+
+      // Invalidate only dashboard permissions
+      result.current.invalidateCache('dashboard');
+
+      // Check permissions again
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('read', 'admin');
+
+      // dashboard should be called again, admin should use cache
+      // 3 initial calls + 1 for dashboard after invalidation = 4 total
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(4);
+    });
+
+    it('cleans up expired cache entries', async () => {
+      vi.useFakeTimers();
+      
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ defaultTTL: 1000 }), {
+        wrapper: TestWrapper
+      });
+
+      // Cache a permission
+      await result.current.checkPermission('read', 'dashboard');
+
+      // Advance time past TTL
+      vi.advanceTimersByTime(2000);
+
+      // Trigger cleanup by checking another permission
+      await result.current.checkPermission('read', 'admin');
+
+      const debugInfo = result.current.getDebugInfo();
+      expect(debugInfo.cacheSize).toBe(1); // Only the new permission should remain
+    });
+  });
+
+  describe('Debug Information', () => {
+    it('provides accurate debug information', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Make some permission checks
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+      await result.current.checkPermission('read', 'dashboard'); // This should be cached
+
+      const debugInfo = result.current.getDebugInfo();
+
+      expect(debugInfo.cacheSize).toBe(2);
+      expect(debugInfo.cacheHits).toBe(1);
+      expect(debugInfo.cacheMisses).toBe(2);
+      expect(debugInfo.totalChecks).toBe(3);
+      expect(debugInfo.averageResponseTime).toBeGreaterThan(0);
+      expect(debugInfo.lastInvalidation).toBe(0); // No invalidation has been performed yet
+    });
+
+    it('tracks response times accurately', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard');
+
+      const debugInfo = result.current.getDebugInfo();
+      // Just verify that response time is tracked (greater than 0)
+      expect(debugInfo.averageResponseTime).toBeGreaterThan(0);
+      expect(debugInfo.totalChecks).toBe(1);
+    });
+  });
+
+  describe('Audit Trail', () => {
+    it('records audit trail when enabled', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      // The hook uses useUnifiedAuth for user, not useRBAC
+      mockUseUnifiedAuthFn.mockReturnValue({
+        user: { id: 'test-user-id' },
+        session: null,
+        appName: 'test-app',
+        selectedOrganisationId: undefined,
+        selectedEventId: undefined
+      } as any);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: true }), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'admin');
+
+      const auditTrail = result.current.getAuditTrail();
+
+      expect(auditTrail).toHaveLength(2);
+      // Check all properties including timestamp
+      expect(auditTrail[0]).toHaveProperty('timestamp');
+      expect(auditTrail[0]).toHaveProperty('operation', 'read');
+      expect(auditTrail[0]).toHaveProperty('pageId', 'dashboard');
+      expect(auditTrail[0]).toHaveProperty('result', true);
+      expect(auditTrail[0]).toHaveProperty('cached', false);
+      expect(auditTrail[0]).toHaveProperty('userId', 'test-user-id');
+      expect(typeof auditTrail[0].timestamp).toBe('number');
+      
+      expect(auditTrail[1]).toHaveProperty('timestamp');
+      expect(auditTrail[1]).toHaveProperty('operation', 'create');
+      expect(auditTrail[1]).toHaveProperty('pageId', 'admin');
+      expect(auditTrail[1]).toHaveProperty('result', true);
+      expect(auditTrail[1]).toHaveProperty('cached', false);
+      expect(auditTrail[1]).toHaveProperty('userId', 'test-user-id');
+      expect(typeof auditTrail[1].timestamp).toBe('number');
+    });
+
+    it('does not record audit trail when disabled', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: false }), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard');
+
+      const auditTrail = result.current.getAuditTrail();
+      expect(auditTrail).toHaveLength(0);
+    });
+
+    it('limits audit trail size', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: true }), {
+        wrapper: TestWrapper
+      });
+
+      // Make more than 1000 permission checks
+      for (let i = 0; i < 1100; i++) {
+        await result.current.checkPermission('read', `page${i}`);
+      }
+
+      const auditTrail = result.current.getAuditTrail();
+      expect(auditTrail.length).toBeLessThanOrEqual(500);
+    });
+  });
+
+  describe('Logging', () => {
+    it('logs permission checks when enabled', async () => {
+      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ enableLogging: true }), {
+        wrapper: TestWrapper
+      });
+
+      // Verify the actual behavior: permission check works correctly
+      const hasPermission = await result.current.checkPermission('read', 'dashboard');
+      
+      // Test the actual functionality: permission is checked and result is returned
+      expect(hasPermission).toBe(true);
+      // Verify caching is working: second call should use cache
+      const hasPermissionCached = await result.current.checkPermission('read', 'dashboard');
+      expect(hasPermissionCached).toBe(true);
+      // Verify debug info shows cache hits
+      const debugInfo = result.current.getDebugInfo();
+      expect(debugInfo.cacheHits).toBeGreaterThan(0);
+
+      consoleSpy.mockRestore();
+    });
+
+    it('does not log when disabled', async () => {
+      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache({ enableLogging: false }), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard');
+
+      expect(consoleSpy).not.toHaveBeenCalledWith(
+        expect.stringContaining('[PermissionCache]')
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('Cached Permissions', () => {
+    it('returns cached permissions for a page', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false)
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+      
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+      
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Cache all permissions for dashboard
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+      await result.current.checkPermission('update', 'dashboard');
+      await result.current.checkPermission('delete', 'dashboard');
+
+      const cachedPermissions = result.current.getCachedPermissions('dashboard');
+
+      expect(cachedPermissions).toHaveLength(4);
+      expect(cachedPermissions).toEqual([
+        { operation: 'read', hasPermission: true },
+        { operation: 'create', hasPermission: false },
+        { operation: 'update', hasPermission: true },
+        { operation: 'delete', hasPermission: false }
+      ]);
+    });
+
+    it('returns empty array for uncached page', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      const cachedPermissions = result.current.getCachedPermissions('uncached-page');
+
+      expect(cachedPermissions).toHaveLength(0);
+    });
+  });
+
+  describe('Edge Cases', () => {
+    it('handles concurrent permission checks', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      // Make concurrent permission checks
+      const promises = [
+        result.current.checkPermission('read', 'dashboard'),
+        result.current.checkPermission('read', 'dashboard'),
+        result.current.checkPermission('read', 'dashboard')
+      ];
+
+      const results = await Promise.all(promises);
+
+      expect(results).toEqual([true, true, true]);
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(1); // Should only call once due to caching
+    });
+
+    it('handles rapid cache invalidation', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      await result.current.checkPermission('read', 'dashboard');
+      result.current.invalidateCache();
+      await result.current.checkPermission('read', 'dashboard');
+
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(2);
+    });
+
+    it('handles empty permission arrays', async () => {
+      mockIsPermittedCached.mockResolvedValue(true);
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        user: { id: 'test-user-id' }
+      });
+
+      const { result } = renderHook(() => usePermissionCache(), {
+        wrapper: TestWrapper
+      });
+
+      const permissions = await result.current.checkMultiplePermissions([]);
+
+      expect(permissions).toHaveLength(0);
+      expect(mockIsPermittedCached).not.toHaveBeenCalled();
+    });
+  });
+});