@jmruthers/pace-core 0.5.193 → 0.6.2

package/src/rbac/__tests__/adapters.comprehensive.test.tsx

@@ -91,7 +91,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
   });
 
   describe('PermissionGuard Component', () => {
-    const defaultProps = {
+    const baseProps = {
       userId: 'user-123' as UUID,
       scope: { organisationId: 'org-123' as UUID },
       permission: 'read:users' as Permission,
@@ -106,7 +106,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} />);
+        render(<PermissionGuard {...baseProps} />);
         
         expect(screen.getByText('Protected Content')).toBeInTheDocument();
       });
@@ -119,7 +119,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const fallback = <div>Access Denied</div>;
-        render(<PermissionGuard {...defaultProps} fallback={fallback} />);
+        render(<PermissionGuard {...baseProps} fallback={fallback} />);
         
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.queryByText('Protected Content')).not.toBeInTheDocument();
@@ -133,7 +133,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const loading = <div>Checking permissions...</div>;
-        render(<PermissionGuard {...defaultProps} loading={loading} />);
+        render(<PermissionGuard {...baseProps} loading={loading} />);
         
         expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
         expect(screen.queryByText('Protected Content')).not.toBeInTheDocument();
@@ -146,7 +146,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} />);
+        render(<PermissionGuard {...baseProps} />);
         
         expect(screen.getByRole('status')).toBeInTheDocument();
         expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
@@ -160,7 +160,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const fallback = <div>Error occurred</div>;
-        render(<PermissionGuard {...defaultProps} fallback={fallback} />);
+        render(<PermissionGuard {...baseProps} fallback={fallback} />);
         
         expect(screen.getByText('Error occurred')).toBeInTheDocument();
         expect(screen.queryByText('Protected Content')).not.toBeInTheDocument();
@@ -180,7 +180,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
 
         render(
           <PermissionGuard
-            {...defaultProps}
+            {...baseProps}
             userId={'' as any}
             fallback={<div>No Access</div>}
           />
@@ -202,13 +202,13 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
 
         render(
           <PermissionGuard
-            {...defaultProps}
+            {...baseProps}
             userId={'' as any}
             fallback={<div>No Access</div>}
           />
         );
 
-        expect(mockUseCan).toHaveBeenCalledWith('', expect.any(Object), expect.any(String), undefined);
+        expect(mockUseCan).toHaveBeenCalledWith('', expect.any(Object), expect.any(String), undefined, true, null, undefined);
       });
     });
 
@@ -221,7 +221,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} onDenied={onDenied} />);
+        render(<PermissionGuard {...baseProps} onDenied={onDenied} />);
         
         expect(onDenied).toHaveBeenCalledTimes(1);
       });
@@ -234,7 +234,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} onDenied={onDenied} />);
+        render(<PermissionGuard {...baseProps} onDenied={onDenied} />);
         
         expect(onDenied).not.toHaveBeenCalled();
       });
@@ -255,7 +255,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} auditLog={true} />);
+        render(<PermissionGuard {...baseProps} auditLog={true} />);
         
         // Note: Audit logging is currently commented out in PermissionGuard
         // The component checks auditLog but doesn't actually log - this is expected behavior
@@ -278,7 +278,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} auditLog={true} />);
+        render(<PermissionGuard {...baseProps} auditLog={true} />);
         
         // Note: Audit logging is currently commented out in PermissionGuard
         // The component checks auditLog but doesn't actually log - this is expected behavior
@@ -301,7 +301,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<PermissionGuard {...defaultProps} strictMode={true} />);
+        render(<PermissionGuard {...baseProps} strictMode={true} />);
         
         expect(mockLoggerInstance.error).toHaveBeenCalledWith(
           expect.stringContaining('STRICT MODE VIOLATION:'),
@@ -316,7 +316,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
   });
 
   describe('AccessLevelGuard Component', () => {
-    const defaultProps = {
+    const baseProps = {
       userId: 'user-123' as UUID,
       scope: { organisationId: 'org-123' as UUID },
       minLevel: 'admin' as const,
@@ -331,7 +331,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<AccessLevelGuard {...defaultProps} />);
+        render(<AccessLevelGuard {...baseProps} />);
         
         expect(screen.getByText('Admin Content')).toBeInTheDocument();
       });
@@ -344,7 +344,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const fallback = <div>Insufficient Access</div>;
-        render(<AccessLevelGuard {...defaultProps} fallback={fallback} />);
+        render(<AccessLevelGuard {...baseProps} fallback={fallback} />);
         
         expect(screen.getByText('Insufficient Access')).toBeInTheDocument();
         expect(screen.queryByText('Admin Content')).not.toBeInTheDocument();
@@ -358,7 +358,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const loading = <div>Checking access level...</div>;
-        render(<AccessLevelGuard {...defaultProps} loading={loading} />);
+        render(<AccessLevelGuard {...baseProps} loading={loading} />);
         
         expect(screen.getByText('Checking access level...')).toBeInTheDocument();
         expect(screen.queryByText('Admin Content')).not.toBeInTheDocument();
@@ -372,7 +372,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         });
 
         const fallback = <div>Error occurred</div>;
-        render(<AccessLevelGuard {...defaultProps} fallback={fallback} />);
+        render(<AccessLevelGuard {...baseProps} fallback={fallback} />);
         
         expect(screen.getByText('Error occurred')).toBeInTheDocument();
         expect(screen.queryByText('Admin Content')).not.toBeInTheDocument();
@@ -387,7 +387,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<AccessLevelGuard {...defaultProps} minLevel="admin" />);
+        render(<AccessLevelGuard {...baseProps} minLevel="admin" />);
         
         expect(screen.getByText('Admin Content')).toBeInTheDocument();
       });
@@ -399,7 +399,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<AccessLevelGuard {...defaultProps} minLevel="admin" />);
+        render(<AccessLevelGuard {...baseProps} minLevel="admin" />);
         
         expect(screen.getByText('Admin Content')).toBeInTheDocument();
       });
@@ -411,7 +411,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<AccessLevelGuard {...defaultProps} minLevel="admin" />);
+        render(<AccessLevelGuard {...baseProps} minLevel="admin" />);
         
         expect(screen.queryByText('Admin Content')).not.toBeInTheDocument();
       });
@@ -423,7 +423,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           error: null,
         });
 
-        render(<AccessLevelGuard {...defaultProps} minLevel="planner" />);
+        render(<AccessLevelGuard {...baseProps} minLevel="planner" />);
         
         expect(screen.getByText('Admin Content')).toBeInTheDocument();
       });
@@ -439,7 +439,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
 
         render(
           <AccessLevelGuard
-            {...defaultProps}
+            {...baseProps}
             userId={'' as any}
             minLevel="admin"
             fallback={<div>No Access</div>}
@@ -462,7 +462,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
 
         render(
           <AccessLevelGuard
-            {...defaultProps}
+            {...baseProps}
             userId={'' as any}
             minLevel="admin"
             fallback={<div>No Access</div>}
@@ -499,7 +499,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           scope: { organisationId: 'org-123', eventId: 'event-123', appId: 'app-123' },
           permission: 'read:users',
           pageId: undefined,
-        });
+        }, null, undefined, null);
         expect(handler).toHaveBeenCalledWith(req);
         expect(result).toEqual({ success: true });
       });

package/src/rbac/__tests__/scenarios.user-role.test.tsx

@@ -85,7 +85,7 @@ vi.mock('../hooks/useRBAC', () => ({
 }));
 import { useRBAC } from '../hooks/useRBAC';
 import { useOrganisationSecurity } from '../../hooks/useOrganisationSecurity';
-import { useSecureDataAccess } from '../../hooks/useSecureDataAccess';
+// useSecureDataAccess has been removed - use useSecureSupabase from @jmruthers/pace-core/rbac instead
 import { usePermissions } from '../hooks';
 import { useCan, useAccessLevel, useHasAnyPermission, useHasAllPermissions } from '../hooks';
 import { useCachedPermissions } from '../hooks';
@@ -104,9 +104,7 @@ vi.mock('../hooks', () => ({
   useHasAllPermissions: () => ({ hasAllPermissions: () => true, isLoading: false, error: null }),
   useCachedPermissions: () => ({ cachedPermissions: [], isLoading: false, error: null }),
 }));
-vi.mock('../../hooks/useSecureDataAccess', () => ({
-  useSecureDataAccess: () => ({ secureDataAccess: { secureQuery: vi.fn().mockResolvedValue([]) } })
-}));
+// useSecureDataAccess has been removed - no longer needed
 vi.mock('../../hooks/usePermissionCache', () => ({
   usePermissionCache: () => ({
     permissionCache: new Map([
@@ -197,7 +195,8 @@ const TestComponent = () => {
   const { cachedPermissions } = useCachedPermissions();
   const { permissionCache } = usePermissionCache();
   const { organisationPermissions } = useOrganisationPermissions();
-  const { secureDataAccess: secureData } = useSecureDataAccess();
+  // useSecureDataAccess has been removed - use useSecureSupabase from @jmruthers/pace-core/rbac instead
+  const secureData = { secureQuery: vi.fn().mockResolvedValue([]) };
 
   if (isLoading) return <div>Loading...</div>;
   if (!isAuthenticated) return <div>Not authenticated</div>;

package/src/rbac/adapters.tsx

@@ -90,7 +90,16 @@ export function PermissionGuard({
   const effectiveUserId = userId ?? authContext?.user?.id ?? null;
 
   // Always call useCan hook, but handle the case where userId might be undefined
-  const { can, isLoading, error } = useCan(effectiveUserId || '', scope, permission, pageId);
+  // Pass null for super admin status (not checked yet - hook will check if needed)
+  const { can, isLoading, error } = useCan(
+    effectiveUserId || '', 
+    scope, 
+    permission, 
+    pageId,
+    true, // useCache
+    null, // precomputedSuperAdmin - not checked yet
+    undefined // appName
+  );
 
   // If still no userId, show helpful error
   if (!effectiveUserId) {
@@ -294,7 +303,7 @@ export function withPermissionGuard<T extends any[]>(
       scope: { organisationId, eventId, appId },
       permission: config.permission,
       pageId: config.pageId,
-    });
+    }, null, undefined, null);
 
     if (!hasPermission) {
       throw new Error(`Permission denied: ${config.permission}`);
@@ -516,7 +525,7 @@ export function createRBACMiddleware(config: {
     pageId?: UUID;
   }>;
   fallbackUrl?: string;
-}) {
+}): (req: { nextUrl: { pathname: string }; user?: { id: string }; organisationId?: string }, res: { redirect: (url: string) => void }, next: () => void) => Promise<void> {
   return async (req: { nextUrl: { pathname: string }; user?: { id: string }; organisationId?: string }, res: { redirect: (url: string) => void }, next: () => void) => {
     const { pathname } = req.nextUrl;
     const userId = req.user?.id;
@@ -539,7 +548,7 @@ export function createRBACMiddleware(config: {
           scope: { organisationId },
           permission: protectedRoute.permission,
           pageId: protectedRoute.pageId,
-        });
+        }, null, undefined, null);
 
         if (!hasPermission) {
           return res.redirect(config.fallbackUrl || '/access-denied');
@@ -579,7 +588,7 @@ export function createRBACMiddleware(config: {
 export function createRBACExpressMiddleware(config: {
   permission: Permission;
   pageId?: UUID;
-}) {
+}): (req: { user?: { id: string }; organisationId?: string; eventId?: string; appId?: string }, res: { status: (code: number) => { json: (data: object) => void } }, next: () => void) => Promise<void> {
   return async (req: { user?: { id: string }; organisationId?: string; eventId?: string; appId?: string }, res: { status: (code: number) => { json: (data: object) => void } }, next: () => void) => {
     const userId = req.user?.id;
     const organisationId = req.organisationId;

package/src/rbac/api.ts

@@ -129,39 +129,44 @@ export async function getAccessLevel(
   appConfig?: AppConfig | null,
   appName?: string
 ): Promise<AccessLevel> {
-  const engine = getEngine();
-  
-  // Check super admin status first - super admins bypass context requirements
-  const isSuperAdminUser = await engine['checkSuperAdmin'](input.userId);
-  if (isSuperAdminUser) {
-    return 'super';
-  }
-  
-  // Fetch app config if not provided
-  let resolvedAppConfig: AppConfig | null = appConfig ?? null;
-  let resolvedAppName = appName;
-  
-  if (!resolvedAppConfig && input.scope.appId) {
-    resolvedAppConfig = await getAppConfig(input.scope.appId);
-  }
-  
-  // Validate context using ContextValidator
-  const validation = await ContextValidator.resolveRequiredContext(
-    input.scope,
-    resolvedAppConfig,
-    resolvedAppName,
-    engine['supabase']
-  );
-  
-  if (!validation.isValid || !validation.resolvedScope) {
-    throw validation.error || new OrganisationContextRequiredError();
+  try {
+    const engine = getEngine();
+    
+    // Check super admin status first - super admins bypass context requirements
+    const isSuperAdminUser = await engine['checkSuperAdmin'](input.userId);
+    if (isSuperAdminUser) {
+      return 'super';
+    }
+    
+    // Fetch app config if not provided
+    let resolvedAppConfig: AppConfig | null = appConfig ?? null;
+    let resolvedAppName = appName;
+    
+    if (!resolvedAppConfig && input.scope.appId) {
+      resolvedAppConfig = await getAppConfig(input.scope.appId);
+    }
+    
+    // Validate context using ContextValidator
+    const validation = await ContextValidator.resolveRequiredContext(
+      input.scope,
+      resolvedAppConfig,
+      resolvedAppName,
+      engine['supabase']
+    );
+    
+    if (!validation.isValid || !validation.resolvedScope) {
+      throw validation.error || new OrganisationContextRequiredError();
+    }
+    
+    // Use resolved scope
+    return engine.getAccessLevel({
+      ...input,
+      scope: validation.resolvedScope
+    });
+  } catch (error) {
+    // Re-throw the error - this is an API function that should propagate errors
+    throw error;
   }
-  
-  // Use resolved scope
-  return engine.getAccessLevel({
-    ...input,
-    scope: validation.resolvedScope
-  });
 }
 
 /**
@@ -192,41 +197,51 @@ export async function getPermissionMap(
   appConfig?: AppConfig | null,
   appName?: string
 ): Promise<PermissionMap> {
-  const engine = getEngine();
-  
-  // Fetch app config if not provided
-  let resolvedAppConfig: AppConfig | null = appConfig ?? null;
-  let resolvedAppName = appName;
-  
-  if (!resolvedAppConfig && input.scope.appId) {
-    resolvedAppConfig = await getAppConfig(input.scope.appId);
-  }
-  
-  // Validate context using ContextValidator
-  const validation = await ContextValidator.resolveRequiredContext(
-    input.scope,
-    resolvedAppConfig,
-    resolvedAppName,
-    engine['supabase']
-  );
-  
-  if (!validation.isValid || !validation.resolvedScope) {
-    throw validation.error || new OrganisationContextRequiredError();
+  try {
+    const engine = getEngine();
+    
+    // Fetch app config if not provided
+    let resolvedAppConfig: AppConfig | null = appConfig ?? null;
+    let resolvedAppName = appName;
+    
+    if (!resolvedAppConfig && input.scope.appId) {
+      resolvedAppConfig = await getAppConfig(input.scope.appId);
+    }
+    
+    // Validate context using ContextValidator
+    const validation = await ContextValidator.resolveRequiredContext(
+      input.scope,
+      resolvedAppConfig,
+      resolvedAppName,
+      engine['supabase']
+    );
+    
+    if (!validation.isValid || !validation.resolvedScope) {
+      throw validation.error || new OrganisationContextRequiredError();
+    }
+    
+    // Use resolved scope
+    return engine.getPermissionMap({
+      ...input,
+      scope: validation.resolvedScope
+    });
+  } catch (error) {
+    // Re-throw the error - this is an API function that should propagate errors
+    throw error;
   }
-  
-  // Use resolved scope
-  return engine.getPermissionMap({
-    ...input,
-    scope: validation.resolvedScope
-  });
 }
 
 export async function resolveAppContext(input: {
   userId: UUID;
   appName: string;
 }): Promise<RBACAppContext | null> {
-  const engine = getEngine();
-  return engine.resolveAppContext(input);
+  try {
+    const engine = getEngine();
+    return await engine.resolveAppContext(input);
+  } catch (error) {
+    // Re-throw the error - this is an API function that should propagate errors
+    throw error;
+  }
 }
 
 export async function getRoleContext(
@@ -287,17 +302,33 @@ export async function getRoleContext(
 export async function isPermitted(
   input: PermissionCheck,
   appConfig?: AppConfig | null,
-  appName?: string
+  appName?: string,
+  /**
+   * Pre-computed super admin status to avoid duplicate checks.
+   * Pass null if not checked yet (will check), true if already checked and is super admin,
+   * or false if already checked and is not super admin.
+   * @default null
+   */
+  precomputedSuperAdmin: boolean | null = null
 ): Promise<boolean> {
   const engine = getEngine();
   
   // Check super admin status first - super admins bypass context requirements
   // Super admins have access to all permissions regardless of organisation context
-  const isSuperAdminUser = await engine['checkSuperAdmin'](input.userId);
-  if (isSuperAdminUser) {
+  // PERFORMANCE: Use precomputed value if provided to avoid duplicate checks
+  if (precomputedSuperAdmin === true) {
     return true;
   }
   
+  // If null, check super admin status
+  if (precomputedSuperAdmin === null) {
+    const isSuperAdminUser = await engine['checkSuperAdmin'](input.userId);
+    if (isSuperAdminUser) {
+      return true;
+    }
+  }
+  // If precomputedSuperAdmin === false, skip check and proceed with permission check
+  
   // Fetch app config if not provided and we have appId
   let resolvedAppConfig: AppConfig | null = appConfig ?? null;
   let resolvedAppName = appName;
@@ -391,7 +422,9 @@ export async function isPermittedCached(
   // Use request deduplication - if same request is in-flight, share the promise
   return getOrCreateRequest(input, async (checkInput) => {
     // Check permission with context validation
-    const result = await isPermitted(checkInput, appConfig, appName);
+    // Note: We can't pass precomputedSuperAdmin here because getOrCreateRequest doesn't support it
+    // The super admin check in isPermitted will be cached, so it's not a huge performance hit
+    const result = await isPermitted(checkInput, appConfig, appName, null);
     
     // Determine if this is a page-level check (has pageId or permission contains 'page.')
     const isPageLevelCheck = !!pageId || permission.includes('page.');
@@ -410,7 +443,7 @@ export async function isPermittedCached(
  * @returns Promise<boolean> - True if user has permission
  */
 export async function hasPermission(input: PermissionCheck): Promise<boolean> {
-  return isPermitted(input);
+  return isPermitted(input, null, undefined, null);
 }
 
 /**
@@ -431,7 +464,7 @@ export async function hasAnyPermission(input: {
     const hasPermission = await isPermitted({
       ...baseInput,
       permission,
-    });
+    }, null, undefined, null);
     
     if (hasPermission) {
       return true;
@@ -459,7 +492,7 @@ export async function hasAllPermissions(input: {
     const hasPermission = await isPermitted({
       ...baseInput,
       permission,
-    });
+    }, null, undefined, null);
     
     if (!hasPermission) {
       return false;

package/src/rbac/components/EnhancedNavigationMenu.tsx

@@ -49,7 +49,7 @@
  * - Efficient filtering
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - NavigationProvider - Navigation permission context
  * - NavigationGuard - Individual navigation item protection
  * - RBAC types - Type definitions

package/src/rbac/components/NavigationGuard.tsx

@@ -58,7 +58,7 @@
  * - Efficient error handling
  *
  * @dependencies
- * - React 18+ - Component framework
+ * - React 19+ - Component framework
  * - useCan hook - Permission checking
  * - useUnifiedAuth - Authentication context
  * - RBAC types - Type definitions

package/src/rbac/components/NavigationProvider.tsx

@@ -49,7 +49,7 @@
  * - Cached permission checks
  *
  * @dependencies
- * - React 18+ - Context and hooks
+ * - React 19+ - Context and hooks
  * - useUnifiedAuth - Authentication context
  * - RBAC types - Type definitions
  */
@@ -211,12 +211,15 @@ export function NavigationProvider({
     const permission = item.permissions[0];
     
     // Call useCan hook for actual permission checking
+    // Pass null for super admin status (not checked yet - hook will check if needed)
     const { can, error } = useCan(
       user.id,
       currentScope,
       permission,
       item.pageId,
-      true // useCache
+      true, // useCache
+      null, // precomputedSuperAdmin - not checked yet
+      undefined // appName
     );
     
     // Handle errors gracefully - allow access when there are permission check errors (graceful degradation)