@jmruthers/pace-core 0.5.190 → 0.5.193

package/src/rbac/hooks/useSuperAdminBypass.ts

@@ -1,126 +0,0 @@
-/**
- * @file useSuperAdminBypass
- * @package @jmruthers/pace-core
- *
- * Detects whether the current user is a super admin, keeps the
- * server session override flag in sync, and exposes a boolean
- * that downstream hooks can use to bypass organisation scoping.
- */
-
-import { useEffect, useMemo, useRef, useState } from 'react';
-import { useUnifiedAuth, type UnifiedAuthContextType } from '../../providers/services/UnifiedAuthProvider';
-import { isSuperAdmin as fetchIsSuperAdmin } from '../api';
-import { setSuperAdminOverrideFlag } from '../../utils/context/superAdminOverride';
-import { createLogger } from '../../utils/core/logger';
-
-const log = createLogger('useSuperAdminBypass');
-
-export interface SuperAdminBypassState {
-  /** True when the user has been verified as a super admin */
-  isSuperAdmin: boolean;
-  /** True while the hook is checking the server */
-  isLoading: boolean;
-  /** Error returned by the verification request, if any */
-  error: Error | null;
-}
-
-function useSafeUnifiedAuth(): UnifiedAuthContextType | null {
-  try {
-    return useUnifiedAuth();
-  } catch (error) {
-    log.debug('useSuperAdminBypass', 'UnifiedAuthProvider not available, falling back to defaults', {
-      error: error instanceof Error ? error.message : error
-    });
-    return null;
-  }
-}
-
-export function useSuperAdminBypass(): SuperAdminBypassState {
-  const authContext = useSafeUnifiedAuth();
-  const user = authContext?.user ?? null;
-  const supabase = authContext?.supabase ?? null;
-  const metadataHint =
-    Boolean(user?.app_metadata?.is_super_admin) ||
-    Boolean(user?.user_metadata?.is_super_admin);
-
-  const [isSuperAdminState, setIsSuperAdminState] = useState<boolean>(metadataHint);
-  const [hasVerified, setHasVerified] = useState<boolean>(!user?.id);
-  const [isLoading, setIsLoading] = useState<boolean>(!!user?.id);
-  const [error, setError] = useState<Error | null>(null);
-  const lastOverrideValueRef = useRef<boolean | null>(null);
-
-  // Verify against the RBAC engine whenever the user changes
-  useEffect(() => {
-    if (!user?.id) {
-      setIsSuperAdminState(false);
-      setHasVerified(true);
-      setIsLoading(false);
-      setError(null);
-      return;
-    }
-
-    let cancelled = false;
-    setIsLoading(true);
-    setError(null);
-
-    fetchIsSuperAdmin(user.id)
-      .then((result) => {
-        if (cancelled) {
-          return;
-        }
-        setIsSuperAdminState(result);
-        setHasVerified(true);
-      })
-      .catch((err) => {
-        if (cancelled) {
-          return;
-        }
-        const normalisedError =
-          err instanceof Error ? err : new Error('Failed to resolve super admin status');
-        setError(normalisedError);
-        setIsSuperAdminState(false);
-        setHasVerified(false);
-        log.error('Unable to verify super admin status', normalisedError);
-      })
-      .finally(() => {
-        if (!cancelled) {
-          setIsLoading(false);
-        }
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, [user?.id]);
-
-  const shouldBypass = hasVerified && isSuperAdminState;
-
-  // Keep the database session flag in sync for auditing/RLS helpers
-  useEffect(() => {
-    if (!supabase) {
-      return;
-    }
-    if (lastOverrideValueRef.current === shouldBypass) {
-      return;
-    }
-    lastOverrideValueRef.current = shouldBypass;
-
-    setSuperAdminOverrideFlag({
-      supabase,
-      enabled: shouldBypass,
-      reason: 'pace-core-super-admin-bypass'
-    }).catch(() => {
-      // Errors are logged inside the helper
-    });
-  }, [supabase, shouldBypass]);
-
-  return useMemo(
-    () => ({
-      isSuperAdmin: shouldBypass,
-      isLoading,
-      error
-    }),
-    [shouldBypass, isLoading, error]
-  );
-}
-

package/src/utils/context/superAdminOverride.ts

@@ -1,58 +0,0 @@
-/**
- * @file Super Admin Override Utility
- * @package @jmruthers/pace-core
- * @module Utils/SuperAdminOverride
- *
- * Provides helpers for toggling the database session flag that
- * signals a super admin override. This ensures SECURITY DEFINER
- * functions and RLS policies can audit elevated operations.
- */
-
-import type { SupabaseClient } from '@supabase/supabase-js';
-import { createLogger } from '../core/logger';
-
-const log = createLogger('superAdminOverride');
-
-interface SuperAdminOverrideParams {
-  supabase: SupabaseClient | null | undefined;
-  enabled: boolean;
-  reason?: string;
-}
-
-/**
- * Toggle the super admin override flag in the current Supabase session.
- * Also records the action server-side for audit purposes.
- */
-export async function setSuperAdminOverrideFlag({
-  supabase,
-  enabled,
-  reason = 'client_request'
-}: SuperAdminOverrideParams): Promise<void> {
-  if (!supabase) {
-    return;
-  }
-
-  try {
-    const { error } = await supabase.rpc('set_super_admin_override', {
-      p_enabled: enabled,
-      p_reason: reason
-    });
-
-    if (error) {
-      log.error('Failed to toggle super admin override', {
-        enabled,
-        reason,
-        error: error.message
-      });
-    } else {
-      log.debug('Super admin override flag updated', { enabled, reason });
-    }
-  } catch (rpcError) {
-    log.error('Unexpected error toggling super admin override', {
-      enabled,
-      reason,
-      error: rpcError instanceof Error ? rpcError.message : rpcError
-    });
-  }
-}
-