@jmruthers/pace-core 0.5.191 → 0.6.1

package/docs/rbac/event-based-apps.md

@@ -29,7 +29,9 @@ A simple event management app that demonstrates:
 4. **ALWAYS set up providers correctly** in the exact order shown below
 5. **Use the exact app name** from your environment variable (must match database exactly, case-sensitive)
 6. **Ensure database setup is complete** before starting the app - App must be registered with `requires_event = true`
-7. **User must have organisation role** - Users need roles assigned in `rbac_organisation_roles` table
+7. **User must have organisation role OR event access** - Users need either:
+   - Explicit roles in `rbac_organisation_roles` table, OR
+   - Event access via `rbac_event_app_roles` (organisation access is automatically inferred)
 8. **Event must be selected** - `selectedEventId` must be set in UnifiedAuth context before permission checks
 9. **Event must belong to organisation** - The event's `organisation_id` must match the user's organisation
 
@@ -200,6 +202,8 @@ RETURNING event_id, event_name, event_code, organisation_id;
 
 #### 5.5 Assign User Roles
 
+**Option 1: Explicit Organisation Membership (Traditional)**
+
 ```sql
 -- Grant a user the org_admin role (replace with actual user and organisation IDs)
 INSERT INTO rbac_organisation_roles (user_id, organisation_id, role, status, granted_at)
@@ -216,6 +220,42 @@ ON CONFLICT (user_id, organisation_id) DO UPDATE SET
   updated_at = NOW();
 ```
 
+**Option 2: Event-Based Access (Automatic Organisation Inference)**
+
+For event-based apps, you can grant access via event roles. The system will automatically infer organisation access from event access:
+
+```sql
+-- Grant a user event access (organisation access is automatically inferred)
+-- Replace with actual user, event, app, and organisation IDs
+INSERT INTO rbac_event_app_roles (
+  user_id, 
+  event_id, 
+  app_id, 
+  organisation_id,
+  role, 
+  status, 
+  granted_at
+)
+VALUES (
+  'your-user-id'::uuid,
+  'your-event-id'::text,
+  (SELECT id FROM rbac_apps WHERE name = 'pace-trac'),
+  'your-organisation-id'::uuid,  -- Must match event's organisation_id
+  'planner',  -- or 'event_admin', 'participant', etc.
+  'active',
+  NOW()
+)
+ON CONFLICT (user_id, event_id, app_id, role) DO UPDATE SET
+  status = EXCLUDED.status,
+  updated_at = NOW();
+```
+
+**Important Notes:**
+- When a user has event access via `rbac_event_app_roles`, they automatically get implicit organisation access
+- The system grants an implicit 'member' role for permission checks
+- Explicit organisation memberships take precedence over inferred access
+- This eliminates the need to maintain duplicate organisation memberships for event-only users
+
 ### 6. Create Supabase Client
 
 Create `src/lib/supabase.ts`:
@@ -640,7 +680,9 @@ Your event-based RBAC setup is working correctly if:
 - [ ] App is registered in `rbac_apps` table with `requires_event = true` and `is_active = true`
 - [ ] Pages exist in `rbac_app_pages` for your app
 - [ ] Page permissions exist in `rbac_page_permissions` for your pages, roles, and organisation
-- [ ] User has an active role in `rbac_organisation_roles` for the organisation
+- [ ] User has either:
+  - An active role in `rbac_organisation_roles` for the organisation, OR
+  - Event access via `rbac_event_app_roles` (organisation access is automatically inferred)
 - [ ] At least one event exists in the `event` table for your organisation
 - [ ] `VITE_APP_NAME` environment variable matches database `rbac_apps.name` exactly
 - [ ] `EventProvider` wraps your app content
@@ -762,15 +804,40 @@ WHERE event_id = 'your-event-id'::uuid;
    ```
    - Must have pages for `dashboard`, `participants`, etc.
 
-5. **Verify user has organisation role**:
+5. **Verify user has organisation role OR event access**:
    ```sql
-   SELECT ror.*, u.email
+   -- Check explicit organisation roles
+   SELECT ror.*, u.email, 'explicit' as access_type
    FROM rbac_organisation_roles ror
    JOIN auth.users u ON ror.user_id = u.id
    WHERE ror.user_id = 'your-user-id'::uuid 
-     AND ror.status = 'active';
+     AND ror.status = 'active'
+   
+   UNION ALL
+   
+   -- Check event-based access (which infers organisation access)
+   SELECT 
+     rear.id,
+     rear.user_id,
+     e.organisation_id as organisation_id,
+     'member' as role,  -- Implicit role granted from event access
+     rear.status,
+     rear.granted_at,
+     rear.granted_by,
+     rear.revoked_at,
+     rear.revoked_by,
+     u.email,
+     'inferred' as access_type
+   FROM rbac_event_app_roles rear
+   JOIN event e ON e.event_id = rear.event_id
+   JOIN auth.users u ON rear.user_id = u.id
+   WHERE rear.user_id = 'your-user-id'::uuid 
+     AND rear.status = 'active'
+     AND e.organisation_id = 'your-organisation-id'::uuid;
    ```
-   - User must have at least one active role
+   - User must have either:
+     - At least one active explicit organisation role, OR
+     - Event access via `rbac_event_app_roles` (organisation access is automatically inferred)
    - Must be for the organisation that owns the event
 
 6. **Verify event belongs to user's organisation**:
@@ -847,8 +914,59 @@ WHERE event_id = 'your-event-id'::uuid;
 | **Context Required** | `organisationId` | `eventId` (org auto-resolved) |
 | **PagePermissionGuard** | Needs `organisationId` | Needs `eventId` (org auto-resolved) |
 | **Scope Resolution** | Direct from context | Organisation resolved from event |
+| **User Access** | Requires explicit `rbac_organisation_roles` | Can use `rbac_event_app_roles` (org access inferred) |
 | **Use Case** | User management, org settings | Event registration, event management |
 
+## 🎯 Organisation Access Inference from Events
+
+**New Feature:** The RBAC system can now automatically infer organisation access from event access, eliminating the need for explicit organisation memberships when users have event access.
+
+### How It Works
+
+1. **User has event access** via `rbac_event_app_roles` table
+2. **System derives organisation** from the event's `organisation_id`
+3. **System grants implicit 'member' role** for permission checks
+4. **Permission checks proceed** as if user had explicit organisation membership
+
+### Benefits
+
+- **Eliminates data duplication** - No need to maintain both event and organisation memberships
+- **Simplifies onboarding** - Grant event access, organisation access is automatic
+- **Maintains security** - Still validates that user has valid event access
+- **Backward compatible** - Explicit organisation memberships still work and take precedence
+
+### Example
+
+```sql
+-- User has event access but no explicit organisation membership
+INSERT INTO rbac_event_app_roles (
+  user_id, 
+  event_id, 
+  app_id, 
+  organisation_id,
+  role, 
+  status
+)
+VALUES (
+  'user-123'::uuid,
+  'event-456'::text,
+  (SELECT id FROM rbac_apps WHERE name = 'pace-trac'),
+  'org-789'::uuid,
+  'planner',
+  'active'
+);
+
+-- System automatically allows organisation access for permission checks
+-- User can now access pages that require organisation context
+-- Implicit role: 'member' (for permission matching)
+```
+
+### When Explicit Membership is Still Required
+
+- Users who need organisation-level access without event context
+- Users who need specific organisation roles (org_admin, leader) that aren't granted via events
+- Organisation management features that don't require event context
+
 ## 🚀 Next Steps
 
 - **[RBAC Overview](./README.md)** - Complete RBAC system documentation

package/docs/standards/README.md

@@ -33,3 +33,42 @@ This document is the single source of truth for all engineering standards for pa
 - Apply Cursor Checklists
 - Prefer pace-core for reusable logic
 - Update docs on API changes
+
+## Cursor Rules
+
+pace-core provides comprehensive Cursor rules that automatically enforce these standards in consuming apps.
+
+### Installation
+
+Install cursor rules in your consuming app:
+
+```bash
+node node_modules/@jmruthers/pace-core/scripts/install-cursor-rules.cjs
+```
+
+### Rule Files
+
+The cursor rules cover:
+- **00-pace-core-compliance** - Enforce pace-core usage patterns
+- **01-standards-compliance** - Enforce all standards (this document)
+- **02-project-structure** - Define standard folder structure
+- **03-solid-principles** - Enforce SOLID architecture
+- **04-testing-standards** - Enforce testing consistency
+- **05-bug-reports-and-features** - Templates for issue reporting
+- **06-code-quality** - Enforce code quality standards
+- **07-tech-stack-compliance** - Enforce tech stack versions
+
+### Audit Tool
+
+Run comprehensive audits to check compliance:
+
+```bash
+node node_modules/@jmruthers/pace-core/scripts/audit-consuming-app.cjs
+```
+
+This generates timestamped markdown reports in `audit/` directory.
+
+### Documentation
+
+- [Cursor Rules Quick Start](../getting-started/cursor-rules.md)
+- [Cursor Rules README](../../cursor-rules/README.md)

package/docs/troubleshooting/migration.md

@@ -506,8 +506,8 @@ export default defineConfig({
     
     // New dependencies
     "@jmruthers/pace-core": "^2.0.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "@supabase/supabase-js": "^2.38.0",
     "zod": "^3.22.0"
   },
@@ -517,8 +517,8 @@ export default defineConfig({
     "@types/react-dom": "^17.0.0",
     
     // New dev dependencies
-    "@types/react": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^4.0.0",
     "vite": "^4.4.0",
     "typescript": "^5.0.0"

package/examples/PublicPages/PublicEventPage.tsx

@@ -23,7 +23,7 @@
  * ```
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - React Router - Routing
  * - Public pages components - Layout and data access
  * - Tailwind CSS - Styling

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jmruthers/pace-core",
-  "version": "0.5.191",
+  "version": "0.6.1",
   "description": "Clean, modern React component library with Tailwind v4 styling and native utilities",
   "private": false,
   "publishConfig": {
@@ -71,6 +71,9 @@
     "./docs": "./docs/README.md",
     "./package.json": "./package.json",
     "./core-usage-manifest.json": "./core-usage-manifest.json",
+    "./cursor-rules": "./cursor-rules",
+    "./scripts/install-cursor-rules": "./scripts/install-cursor-rules.cjs",
+    "./scripts/audit-consuming-app": "./scripts/audit-consuming-app.cjs",
     "./source": {
       "import": "./src/index.ts",
       "default": "./src/index.ts"
@@ -138,7 +141,8 @@
     "docs",
     "core-usage-manifest.json",
     "eslint-config-pace-core.cjs",
-    "scripts"
+    "scripts",
+    "cursor-rules"
   ],
   "scripts": {
     "_comment_build": "Build package and documentation",
@@ -207,9 +211,9 @@
     "@tanstack/react-table": "^8.0.0",
     "clsx": "^2.0.0",
     "lucide-react": "^0.400.0",
-    "react": "^18.0.0",
-    "react-dom": "^18.0.0",
+    "react": "^19.0.0",
     "react-day-picker": "^9.0.0",
+    "react-dom": "^19.0.0",
     "react-hook-form": "^7.0.0",
     "react-router-dom": "^6.0.0",
     "tailwind-merge": "^2.0.0",
@@ -222,8 +226,8 @@
     "@testing-library/react": "^16.1.0",
     "@testing-library/user-event": "^14.5.2",
     "@types/papaparse": "^5.3.16",
-    "@types/react": "^18.3.17",
-    "@types/react-dom": "^18.3.5",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
     "@types/react-window": "^1.8.8",
     "@vitejs/plugin-react": "^4.5.1",
     "@vitest/coverage-v8": "^3.2.3",
@@ -236,6 +240,7 @@
     "typedoc": "^0.25.13",
     "typedoc-plugin-markdown": "^3.17.1",
     "typedoc-plugin-merge-modules": "^5.1.0",
+    "tsup": "^8.5.0",
     "typescript": "^5.4.0",
     "typescript-eslint": "^8.39.0",
     "vite": "^6.0.3"