@jmruthers/pace-core 0.5.190 → 0.5.193

package/src/services/OrganisationService.ts

@@ -20,6 +20,8 @@ import type {
 import { setOrganisationContext } from '../utils/context/organisationContext';
 import { logger } from '../utils/core/logger';
 import { assertUserId, assertOrganisationId } from '../types/core';
+import { isSuperAdmin } from '../rbac/api';
+import type { UUID } from '../rbac/types';
 
 // Type for RPC response from data_user_organisation_roles_get
 interface OrganisationRoleRpcResponse {
@@ -27,6 +29,15 @@ interface OrganisationRoleRpcResponse {
   organisation_id: string;
   role: 'org_admin' | 'leader' | 'member' | 'supporter';
   status: 'active' | 'inactive' | 'suspended';
+  // Organisation fields from RPC
+  name?: string;
+  display_name?: string;
+  subscription_tier?: string;
+  settings?: unknown;
+  is_active?: boolean;
+  parent_id?: string;
+  organisation_created_at?: string;
+  organisation_updated_at?: string;
   [key: string]: unknown;
 }
 
@@ -37,6 +48,7 @@ export class OrganisationService extends BaseService implements IOrganisationSer
   private _roleMapState: Map<string, string> = new Map();
   private _isLoading = false;
   private _error: Error | null = null;
+  private _isSuperAdmin: boolean = false; // Cache super admin status
   private _isContextReady = false;
   private retryCount = 0;
 
@@ -72,17 +84,21 @@ export class OrganisationService extends BaseService implements IOrganisationSer
   // Additional methods for testing
   setSelectedOrganisation(organisation: Organisation | null): void {
     // SECURITY: Validate organisation is in user's accessible organisations (only if orgs are loaded)
+    // Exception: Super admins can set any organisation (they have global access)
     if (organisation && this._organisations.length > 0) {
-      const isValidOrg = this._organisations.some(org => org.id === organisation.id);
-      if (!isValidOrg) {
-        logger.warn('OrganisationService', 'Attempted to set invalid organisation - not in user\'s accessible organisations', {
-          organisationId: organisation.id,
-          organisationName: organisation.name,
-          accessibleOrgIds: this._organisations.map(o => o.id)
-        });
-        // Don't set invalid organisation - this prevents security issues
-        // If organisations haven't loaded yet, validation will happen in loadUserOrganisations()
-        return;
+      // Only validate if user is not a super admin (use cached status)
+      if (!this._isSuperAdmin) {
+        const isValidOrg = this._organisations.some(org => org.id === organisation.id);
+        if (!isValidOrg) {
+          logger.warn('OrganisationService', 'Attempted to set invalid organisation - not in user\'s accessible organisations', {
+            organisationId: organisation.id,
+            organisationName: organisation.name,
+            accessibleOrgIds: this._organisations.map(o => o.id)
+          });
+          // Don't set invalid organisation - this prevents security issues
+          // If organisations haven't loaded yet, validation will happen in loadUserOrganisations()
+          return;
+        }
       }
     }
     
@@ -131,6 +147,11 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     const wasAuthenticated = !!(this.user && this.session);
     const isAuthenticated = !!(user && session);
     
+    // Reset super admin cache when user changes
+    if (this.user?.id !== user?.id) {
+      this._isSuperAdmin = false;
+    }
+    
     this.user = user;
     this.session = session;
     
@@ -358,159 +379,142 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     this.notify();
       
     try {
-      // Get user's organisation memberships using secure RPC function
-      // Include all roles (org_admin, leader, member, supporter) - supporters can access PORTAL
-      let memberships, membershipError;
+      // Get user's organisation roles directly from rbac_organisation_roles table
+      // This queries the source table directly instead of using the RPC which filters to match core_organisation_memberships view
+      // We still filter to active, non-revoked roles for the org selector
+      // The join includes organisation data, so we don't need a separate query that might be filtered by RLS
+      let memberships, membershipError, organisations: Organisation[] = [];
       try {
-        // Add timeout and abort signal to prevent hanging RPC calls
-        const timeoutPromise = new Promise((_, reject) => {
-          const timeoutId = setTimeout(() => reject(new Error('RPC call timeout after 10 seconds')), 10000);
-          abortSignal.addEventListener('abort', () => {
-            clearTimeout(timeoutId);
-            reject(new Error('Request aborted'));
-          });
-        });
-        
-        const rpcPromise = this.supabaseClient.rpc('data_user_organisation_roles_get', {
-          p_user_id: this.user.id,
-          p_organisation_id: null
-        });
-        
-        // Check if request was aborted before making the call
+        // Check if request was aborted before making query
         if (abortSignal.aborted) {
           throw new Error('Request aborted');
         }
+
+        const { data: rolesData, error: rolesError } = await this.supabaseClient
+          .from('rbac_organisation_roles')
+          .select(`
+            id,
+            user_id,
+            organisation_id,
+            role,
+            status,
+            granted_at,
+            granted_by,
+            revoked_at,
+            revoked_by,
+            notes,
+            created_at,
+            updated_at,
+            core_organisations!inner(
+              id,
+              name,
+              display_name,
+              subscription_tier,
+              settings,
+              is_active,
+              parent_id,
+              created_at,
+              updated_at
+            )
+          `)
+          .eq('user_id', this.user.id)
+          .eq('status', 'active')
+          .is('revoked_at', null);
         
-        const result = await Promise.race([rpcPromise, timeoutPromise]) as { data: OrganisationRoleRpcResponse[] | null; error: Error | null };
+        if (rolesError) {
+          logger.error("OrganisationService", "Error loading organisation roles:", rolesError);
+          throw rolesError;
+        }
         
-        // Filter to organisation members (org_admin, leader, member, supporter)
-        // Supporters are included to allow PORTAL access
-        // Map to branded types when filtering
-        memberships = result.data?.filter((role) => 
-          ['org_admin', 'leader', 'member', 'supporter'].includes(role.role)
-        ).map((m) => ({
+        // Map to branded types and extract organisation data from the join
+        // The join already includes organisation data, so we don't need a separate query
+        memberships = rolesData?.map((m) => ({
           ...m,
           user_id: assertUserId(m.user_id),
           organisation_id: assertOrganisationId(m.organisation_id),
         })) || [];
-        membershipError = result.error;
-      } catch (queryError) {
-        membershipError = queryError instanceof Error ? queryError : new Error(String(queryError));
-      }
-
-      if (membershipError) {
-        logger.error("OrganisationService", "Error loading memberships:", membershipError);
         
-        // If RPC fails with timeout, try direct database query as fallback
-        if (membershipError.message?.includes('timeout')) {
-          try {
-            // Check if request was aborted before making fallback query
-            if (abortSignal.aborted) {
-              throw new Error('Request aborted');
-            }
-
-            const { data: fallbackData, error: fallbackError } = await this.supabaseClient
-              .from('rbac_organisation_roles')
-              .select(`
-                id,
-                user_id,
-                organisation_id,
-                role,
-                status,
-                granted_at,
-                granted_by,
-                revoked_at,
-                revoked_by,
-                notes,
-                created_at,
-                updated_at,
-                organisations!inner(
-                  id,
-                  name,
-                  display_name,
-                  subscription_tier,
-                  settings,
-                  is_active,
-                  parent_id,
-                  created_at,
-                  updated_at
-                )
-              `)
-              .eq('user_id', this.user.id)
-              .eq('status', 'active')
-              .is('revoked_at', null)
-              .in('role', ['org_admin', 'leader', 'member', 'supporter']);
-            
-            if (fallbackError) {
-              logger.error("OrganisationService", "Fallback query also failed:", fallbackError);
-              throw membershipError; // Throw original error
-            }
-            
-            // Map to branded types
-            memberships = fallbackData?.map((m) => ({
-              ...m,
-              user_id: assertUserId(m.user_id),
-              organisation_id: assertOrganisationId(m.organisation_id),
-            })) || [];
-            membershipError = null;
-          } catch (fallbackErr) {
-            logger.error("OrganisationService", "Fallback query failed:", fallbackErr);
-            throw membershipError; // Throw original error
+        // Extract unique organisations from the join results
+        // Use a Map to deduplicate by organisation ID
+        // Supabase returns joined data nested under the relation name
+        const organisationsMap = new Map<string, Organisation>();
+        rolesData?.forEach((role: any) => {
+          // The join returns organisation data nested under 'core_organisations' key
+          const orgData = role.core_organisations;
+          if (orgData && role.organisation_id && !organisationsMap.has(role.organisation_id)) {
+            organisationsMap.set(role.organisation_id, {
+              id: orgData.id,
+              name: orgData.name,
+              display_name: orgData.display_name,
+              subscription_tier: orgData.subscription_tier,
+              settings: orgData.settings,
+              is_active: orgData.is_active,
+              parent_id: orgData.parent_id,
+              created_at: orgData.created_at,
+              updated_at: orgData.updated_at,
+            } as Organisation);
           }
+        });
+        
+        organisations = Array.from(organisationsMap.values());
+        
+        // Extract organisations from join results
+      } catch (queryError) {
+        // Extract error message properly from Supabase error objects
+        if (queryError instanceof Error) {
+          membershipError = queryError;
+        } else if (queryError && typeof queryError === 'object' && 'message' in queryError) {
+          membershipError = new Error(String((queryError as any).message));
         } else {
-          throw membershipError;
+          membershipError = new Error(String(queryError));
         }
+        logger.error("OrganisationService", "Error loading organisation roles:", membershipError);
+        throw membershipError;
       }
       
+      // Check if user is super admin - super admins don't need organisation memberships
+      let userIsSuperAdmin = false;
+      if (this.user?.id) {
+        try {
+          userIsSuperAdmin = await isSuperAdmin(this.user.id as UUID);
+          this._isSuperAdmin = userIsSuperAdmin; // Cache the result
+        } catch (error) {
+          logger.warn('OrganisationService', 'Failed to check super admin status', { error });
+          // Continue with normal flow if check fails
+          this._isSuperAdmin = false;
+        }
+      } else {
+        this._isSuperAdmin = false;
+      }
+
+      // Super admins can proceed without organisation memberships
       if (!memberships || memberships.length === 0) {
+        if (userIsSuperAdmin) {
+          // Super admin without org memberships - allow empty state
+          this._organisations = [];
+          this._userMemberships = [];
+          this._isLoading = false;
+          this._error = null;
+          this._isContextReady = true;
+          this.notify();
+          return;
+        }
         throw new Error('User has no active organisation memberships') as OrganisationSecurityError;
       }
 
-      // Get organisation details for the memberships
-      const organisationIds = memberships
-        .map((m) => m.organisation_id)
-        .filter((id: string) => {
-          // Better validation to prevent empty string UUID errors
-          if (!id || typeof id !== 'string') {
-            logger.warn("OrganisationService", "Invalid organisation ID (not string):", id);
-            return false;
-          }
-          const trimmedId = id.trim();
-          if (trimmedId === '') {
-            logger.warn("OrganisationService", "Empty organisation ID found");
-            return false;
-          }
-          // Validate UUID format
-          const isValidUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(trimmedId);
-          if (!isValidUuid) {
-            logger.warn("OrganisationService", "Invalid UUID format:", trimmedId);
-          }
-          return isValidUuid;
-        });
-      
-      if (organisationIds.length === 0) {
-        logger.warn("OrganisationService", "No valid organisation IDs found in memberships:", memberships);
-        throw new Error('No valid organisation IDs found in memberships') as OrganisationSecurityError;
-      }
-      
-      // Check if request was aborted before making organisations query
-      if (abortSignal.aborted) {
-        throw new Error('Request aborted');
-      }
-      
-      const { data: allOrganisations, error: orgError } = await this.supabaseClient
-        .from('organisations')
-        .select('id, name, display_name, subscription_tier, settings, is_active, parent_id, created_at, updated_at');
-      
-      if (orgError) {
-        logger.error("OrganisationService", "Error loading organisations:", orgError);
-        throw orgError;
+      if (!organisations || organisations.length === 0) {
+        if (userIsSuperAdmin) {
+          // Super admin without orgs - allow empty state
+          this._organisations = [];
+          this._userMemberships = [];
+          this._isLoading = false;
+          this._error = null;
+          this._isContextReady = true;
+          this.notify();
+          return;
+        }
+        throw new Error('No organisations found in role data') as OrganisationSecurityError;
       }
-      
-      // Filter manually on the client side
-      const organisations = allOrganisations?.filter(org => 
-        organisationIds.includes(org.id)
-      ) || [];
 
       // Create a map of organisation_id to role from the memberships data
       const roleMap = new Map<string, string>();
@@ -522,7 +526,19 @@ export class OrganisationService extends BaseService implements IOrganisationSer
       const orgs = organisations as Organisation[];
       const activeOrgs = orgs.filter(org => org.is_active);
       
+      // Filter to active organisations only
+      
       if (activeOrgs.length === 0) {
+        if (userIsSuperAdmin) {
+          // Super admin without active orgs - allow empty state
+          this._organisations = [];
+          this._userMemberships = [];
+          this._isLoading = false;
+          this._error = null;
+          this._isContextReady = true;
+          this.notify();
+          return;
+        }
         throw new Error('User has no access to active organisations') as OrganisationSecurityError;
       }
 
@@ -549,16 +565,13 @@ export class OrganisationService extends BaseService implements IOrganisationSer
               initialOrg = validPersistedOrg;
               selectionMethod = 'persisted';
             } else {
-              logger.warn("OrganisationService", "Persisted organisation not found in active orgs, clearing cache");
               localStorage.removeItem('pace-core-selected-organisation');
             }
           } else {
-            logger.warn("OrganisationService", "Invalid persisted organisation ID, clearing cache");
             localStorage.removeItem('pace-core-selected-organisation');
           }
         }
       } catch (storageError) {
-        logger.warn("OrganisationService", "Failed to restore persisted organisation:", storageError);
         // Clear potentially corrupted cache
         localStorage.removeItem('pace-core-selected-organisation');
       }
@@ -610,10 +623,8 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     } catch (err) {
       const error = err as Error;
       // "User has no access to active organisations" is a valid state for users without orgs (e.g., profile pages)
-      // Log it as a warning instead of an error to reduce noise
-      if (error.message === 'User has no access to active organisations') {
-        logger.warn("OrganisationService", "User has no active organisations (this is expected for users without organisation access):", error);
-      } else {
+      // Only log actual errors, not expected states
+      if (error.message !== 'User has no access to active organisations') {
         logger.error("OrganisationService", "Failed to load organisations:", err);
       }
       this._error = error;

package/src/services/__tests__/OrganisationService.pagination.test.ts

@@ -88,16 +88,29 @@ describe('OrganisationService Pagination & Validation', () => {
     });
 
     mockSupabase.from.mockImplementation((table: string) => {
-      if (table === 'organisations') {
+      if (table === 'rbac_organisation_roles') {
         return {
           select: vi.fn().mockResolvedValue({
-            data: [mockOrganisation, mockOrganisation2],
+            data: [
+              {
+                ...mockMembership,
+                core_organisations: mockOrganisation
+              },
+              {
+                ...mockMembership2,
+                core_organisations: mockOrganisation2
+              }
+            ],
             error: null
-          })
+          }),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis()
         };
       }
       return {
-        select: vi.fn().mockResolvedValue({ data: [], error: null })
+        select: vi.fn().mockResolvedValue({ data: [], error: null }),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis()
       };
     });
 
@@ -175,16 +188,29 @@ describe('OrganisationService Pagination & Validation', () => {
       });
 
       mockSupabase.from.mockImplementation((table: string) => {
-        if (table === 'organisations') {
+        if (table === 'rbac_organisation_roles') {
           return {
             select: vi.fn().mockResolvedValue({
-              data: [mockOrganisation, inactiveOrganisation],
+              data: [
+                {
+                  ...mockMembership,
+                  core_organisations: mockOrganisation
+                },
+                {
+                  ...inactiveMembership,
+                  core_organisations: inactiveOrganisation
+                }
+              ],
               error: null
-            })
+            }),
+            eq: vi.fn().mockReturnThis(),
+            is: vi.fn().mockReturnThis()
           };
         }
         return {
-          select: vi.fn().mockResolvedValue({ data: [], error: null })
+          select: vi.fn().mockResolvedValue({ data: [], error: null }),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis()
         };
       });