@jmruthers/pace-core 0.5.193 → 0.6.1

package/src/rbac/components/PagePermissionGuard.tsx

@@ -61,7 +61,7 @@
  * - Efficient error handling
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - useCan hook - Permission checking
  * - useUnifiedAuth - Authentication context
  * - RBAC types - Type definitions

package/src/rbac/components/PagePermissionProvider.tsx

@@ -49,7 +49,7 @@
  * - Cached permission checks
  *
  * @dependencies
- * - React 18+ - Context and hooks
+ * - React 19+ - Context and hooks
  * - useUnifiedAuth - Authentication context
  * - RBAC types - Type definitions
  */

package/src/rbac/components/PermissionEnforcer.tsx

@@ -60,7 +60,7 @@
  * - Efficient error handling
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - useCan hook - Permission checking
  * - useUnifiedAuth - Authentication context
  * - RBAC types - Type definitions

package/src/rbac/components/RoleBasedRouter.tsx

@@ -56,7 +56,7 @@
  * - Efficient route matching
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - React Router - Routing functionality
  * - useCan hook - Permission checking
  * - useUnifiedAuth - Authentication context

package/src/rbac/components/SecureDataProvider.tsx

@@ -50,7 +50,7 @@
  * - Cached permission checks
  *
  * @dependencies
- * - React 18+ - Context and hooks
+ * - React 19+ - Context and hooks
  * - useUnifiedAuth - Authentication context
  * - useSecureDataAccess - Secure data access hook
  * - RBAC types - Type definitions

package/src/rbac/secureClient.ts

@@ -223,6 +223,18 @@ export class SecureSupabaseClient {
       'rbac_apps', // App configuration table - no organisation scope
       'rbac_app_pages', // Page configuration table - scoped by app_id, not organisation_id
       'rbac_global_roles', // Global roles - no organisation scope
+      // Person-scoped tables (organisation_id was removed in person-scoped profiles migration)
+      'core_person', // Person records - person-scoped, no organisation_id
+      'core_member', // Member profiles - person-scoped, no organisation_id
+      'core_contact', // Contact profiles - person-scoped, no organisation_id
+      'core_consent', // Consent records - person-scoped, no organisation_id
+      'core_identification', // Identification records - person-scoped, no organisation_id
+      'core_qualification', // Qualification records - person-scoped, no organisation_id
+      'medi_profile', // Medical profiles - person-scoped, no organisation_id
+      'medi_condition', // Medical conditions - person-scoped via medi_profile, no organisation_id
+      'medi_diet', // Medical diets - person-scoped via medi_profile, no organisation_id
+      'medi_action_plan', // Medical action plans - person-scoped via medi_profile, no organisation_id
+      'medi_profile_versions', // Medical profile versions - person-scoped via medi_profile, no organisation_id
     ];
     
     // Skip organisation filter for tables that don't have organisation_id column

package/src/utils/security/secureDataAccess.test.ts

@@ -21,15 +21,25 @@ const mockSupabaseClient = {
 let mockQueryBuilder: any;
 
 const createMockQueryBuilder = (customData?: any, customError?: any) => {
+  // Create spy functions that return this for chaining
+  const selectSpy = vi.fn(function(this: any) { return this; });
+  const eqSpy = vi.fn(function(this: any) { return this; });
+  const orderSpy = vi.fn(function(this: any) { return this; });
+  const limitSpy = vi.fn(function(this: any) { return this; });
+  const rangeSpy = vi.fn(function(this: any) { return this; });
+  const insertSpy = vi.fn(function(this: any) { return this; });
+  const updateSpy = vi.fn(function(this: any) { return this; });
+  const deleteSpy = vi.fn(function(this: any) { return this; });
+  
   const builder: any = {
-    select: vi.fn(function(this: any) { return this; }),
-    eq: vi.fn(function(this: any) { return this; }),
-    order: vi.fn(function(this: any) { return this; }),
-    limit: vi.fn(function(this: any) { return this; }),
-    range: vi.fn(function(this: any) { return this; }),
-    insert: vi.fn(function(this: any) { return this; }),
-    update: vi.fn(function(this: any) { return this; }),
-    delete: vi.fn(function(this: any) { return this; }),
+    select: selectSpy,
+    eq: eqSpy,
+    order: orderSpy,
+    limit: limitSpy,
+    range: rangeSpy,
+    insert: insertSpy,
+    update: updateSpy,
+    delete: deleteSpy,
     single: vi.fn().mockImplementation(() => {
       const data = customData !== undefined ? customData : { id: 'test-123' };
       const error = customError !== undefined ? customError : null;
@@ -56,7 +66,7 @@ const createMockQueryBuilder = (customData?: any, customError?: any) => {
 describe('secureDataAccess', () => {
   let secureDataAccess: ReturnType<typeof createSecureDataAccess>;
   const mockOrganisationId = 'org-123';
-  const mockTable = 'pace_person'; // Use a table that has organisation_id column
+  const mockTable = 'core_events'; // Use a table that has organisation_id column (pace_person doesn't have it)
   const mockSelect = 'id, name, organisation_id';
 
   beforeEach(() => {
@@ -332,10 +342,10 @@ describe('secureDataAccess', () => {
           const mockFilters = { id: '1' };
           const mockResult = { id: '1', name: 'Updated Item', organisation_id: mockOrganisationId };
           
-          mockQueryBuilder.update = vi.fn().mockReturnThis();
-          mockQueryBuilder.eq = vi.fn().mockReturnThis();
-          mockQueryBuilder.select = vi.fn().mockReturnThis();
+          // Create a fresh mock query builder with proper chaining
+          mockQueryBuilder = createMockQueryBuilder(mockResult);
           mockQueryBuilder.single = vi.fn().mockResolvedValue({ data: mockResult, error: null });
+          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
           const result = await secureDataAccess.secureUpdate(mockTable, mockData, mockFilters, mockOrganisationId);
 
@@ -366,9 +376,13 @@ describe('secureDataAccess', () => {
         it('should delete data with organisation filter', async () => {
           const mockFilters = { id: '1' };
           
-          mockQueryBuilder.delete = vi.fn().mockReturnThis();
-          mockQueryBuilder.eq = vi.fn().mockReturnThis();
-          mockQueryBuilder.single = vi.fn().mockResolvedValue({ data: null, error: null });
+          // Create a fresh mock query builder with proper chaining
+          mockQueryBuilder = createMockQueryBuilder();
+          // Make the query builder thenable and resolve successfully
+          mockQueryBuilder.then = function(resolve: any) {
+            return Promise.resolve({ data: null, error: null }).then(resolve);
+          };
+          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
           const result = await secureDataAccess.secureDelete(mockTable, mockFilters, mockOrganisationId);
 
@@ -687,12 +701,9 @@ describe('secureDataAccess', () => {
       };
 
       const mockData = [{ id: '1', name: 'Test', organisation_id: mockOrganisationId }];
-          // Create a new mock with the expected data
-          mockQueryBuilder = createMockQueryBuilder(mockData);
-          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
       // Create a new mock with the expected data
-          mockQueryBuilder = createMockQueryBuilder(mockData);
-          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
+      mockQueryBuilder = createMockQueryBuilder(mockData);
+      mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
       const options: SecureQueryOptions = {
         table: mockTable,

package/src/utils/security/secureDataAccess.ts

@@ -99,9 +99,10 @@ export const createSecureDataAccess = (
       // SECURITY: Phase 2 additions - complete organisation table mapping
       'organisation_audit_log', 'organisation_invitations', 'organisation_app_access',
       // SECURITY: Emergency additions for Phase 1 fixes
-      'cake_meal', 'cake_mealtype', 'core_person', 'pace_person',
-      // NOTE: core_member, medi_profile, core_contact, core_consent, core_identification, core_qualification
-      // are now person-scoped (not organisation-scoped) - removed from this list
+      'cake_meal', 'cake_mealtype',
+      // NOTE: core_person, pace_person, core_member, medi_profile, core_contact, core_consent, 
+      // core_identification, core_qualification are now person-scoped (not organisation-scoped) 
+      // and do NOT have organisation_id columns - removed from this list
       // SECURITY: Phase 3A additions - medical and personal data
       // NOTE: medi_condition, medi_diet, medi_action_plan, medi_profile_versions are now person-scoped
       // (via medi_profile) - removed from this list