@jmruthers/pace-core 0.5.193 → 0.6.2

package/src/rbac/hooks/useCan.test.ts

@@ -11,13 +11,18 @@ import { renderHook, waitFor } from '@testing-library/react';
 import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { useCan } from './usePermissions';
 
-// Mock the RBAC API
-vi.mock('../api', () => ({
-  isPermitted: vi.fn(),
-  isPermittedCached: vi.fn()
-}));
+// Mock the RBAC API - use async factory to support dynamic imports
+vi.mock('../api', async () => {
+  const actual = await vi.importActual('../api');
+  return {
+    ...actual,
+    isPermitted: vi.fn(),
+    isPermittedCached: vi.fn(),
+    isSuperAdmin: vi.fn()
+  };
+});
 
-import { isPermitted, isPermittedCached } from '../api';
+import { isPermitted, isPermittedCached, isSuperAdmin } from '../api';
 
 // Mock data
 const mockUserId = 'user-123';
@@ -32,12 +37,15 @@ const mockPageId = 'dashboard';
 describe('useCan Hook', () => {
   const mockIsPermitted = vi.mocked(isPermitted);
   const mockIsPermittedCached = vi.mocked(isPermittedCached);
+  const mockIsSuperAdmin = vi.mocked(isSuperAdmin);
 
   beforeEach(() => {
     vi.clearAllMocks();
     // Reset mocks to return resolved promises by default
     mockIsPermitted.mockResolvedValue(true);
     mockIsPermittedCached.mockResolvedValue(true);
+    // Default to not super admin for most tests
+    mockIsSuperAdmin.mockResolvedValue(false);
   });
 
       describe('Permission Checking', () => {
@@ -45,7 +53,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       expect(result.current.isLoading).toBe(true);
@@ -62,7 +70,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -76,7 +84,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockImplementation(() => new Promise(() => {})); // Never resolves
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       expect(result.current.isLoading).toBe(true);
@@ -89,7 +97,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockRejectedValue(error);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -105,7 +113,7 @@ describe('useCan Hook', () => {
       mockIsPermittedCached.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, mockPageId, true)
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, true, false)
       );
 
       await waitFor(() => {
@@ -129,7 +137,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, mockPageId, false)
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, false, false)
       );
 
       await waitFor(() => {
@@ -143,7 +151,8 @@ describe('useCan Hook', () => {
             pageId: mockPageId
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
         expect(mockIsPermittedCached).not.toHaveBeenCalled();
       });
@@ -153,7 +162,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, mockPageId, false)
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, false, false)
       );
 
       await waitFor(() => {
@@ -169,7 +178,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, 'custom-page', false)
+        useCan(mockUserId, mockScope, mockPermission, 'custom-page', false, false)
       );
 
       await waitFor(() => {
@@ -182,7 +191,8 @@ describe('useCan Hook', () => {
             pageId: 'custom-page'
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
@@ -191,7 +201,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -204,7 +214,8 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
@@ -215,7 +226,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result, rerender } = renderHook(
-        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false),
+        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false, false),
         {
           initialProps: { 
             userId: mockUserId, 
@@ -246,7 +257,8 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
@@ -255,7 +267,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result, rerender } = renderHook(
-        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false),
+        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false, false),
         {
           initialProps: { 
             userId: mockUserId, 
@@ -287,7 +299,8 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
@@ -296,7 +309,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result, rerender } = renderHook(
-        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false),
+        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false, false),
         {
           initialProps: { 
             userId: mockUserId, 
@@ -327,7 +340,8 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
@@ -338,7 +352,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockRejectedValue('String error');
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -353,7 +367,7 @@ describe('useCan Hook', () => {
         .mockResolvedValueOnce(true);
 
       const { result, rerender } = renderHook(
-        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false),
+        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false, false),
         {
           initialProps: { 
             userId: mockUserId, 
@@ -383,10 +397,10 @@ describe('useCan Hook', () => {
 
   describe('Role-Based Permission Scenarios', () => {
     it('allows super admin permissions', async () => {
-      mockIsPermitted.mockResolvedValue(true);
-
+      // When precomputedSuperAdmin is true, the hook bypasses permission checks
+      // Super admins get immediate access without calling isPermitted
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'update:organisations', undefined, false)
+        useCan(mockUserId, mockScope, 'update:organisations', undefined, false, true)
       );
 
       await waitFor(() => {
@@ -395,23 +409,15 @@ describe('useCan Hook', () => {
         expect(result.current.error).toBeNull();
       });
 
-    expect(mockIsPermitted).toHaveBeenCalledWith(
-      {
-        userId: mockUserId,
-        scope: mockScope,
-        permission: 'update:organisations',
-        pageId: undefined
-      },
-      undefined,
-      undefined
-    );
+      // Super admins bypass permission checks - isPermitted should not be called
+      expect(mockIsPermitted).not.toHaveBeenCalled();
     });
 
     it('denies super admin permissions for regular users', async () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'super_admin', undefined, false)
+        useCan(mockUserId, mockScope, 'super_admin', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -425,7 +431,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'org_admin', undefined, false)
+        useCan(mockUserId, mockScope, 'org_admin', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -439,7 +445,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'org_admin', undefined, false)
+        useCan(mockUserId, mockScope, 'org_admin', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -453,7 +459,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'event_admin', undefined, false)
+        useCan(mockUserId, mockScope, 'event_admin', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -467,7 +473,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'event_admin', undefined, false)
+        useCan(mockUserId, mockScope, 'event_admin', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -481,7 +487,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'read:users', undefined, false)
+        useCan(mockUserId, mockScope, 'read:users', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -495,7 +501,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'read:users', undefined, false)
+        useCan(mockUserId, mockScope, 'read:users', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -509,7 +515,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, 'participant', undefined, false)
+        useCan(mockUserId, mockScope, 'participant', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -526,7 +532,7 @@ describe('useCan Hook', () => {
       mockIsPermittedCached.mockResolvedValue(true);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, mockPageId, true)
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, true, false)
       );
 
       await waitFor(() => {
@@ -552,7 +558,7 @@ describe('useCan Hook', () => {
       mockIsPermittedCached.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, mockPageId, true)
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, true, false)
       );
 
       await waitFor(() => {
@@ -569,7 +575,7 @@ describe('useCan Hook', () => {
       );
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       // Should show loading initially
@@ -587,7 +593,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockRejectedValue(networkError);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -603,7 +609,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan('', mockScope, mockPermission, undefined, false)
+        useCan('', mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -617,7 +623,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(false);
 
       const { result } = renderHook(() => 
-        useCan(mockUserId, mockScope, '', undefined, false)
+        useCan(mockUserId, mockScope, '', undefined, false, false)
       );
 
       await waitFor(() => {
@@ -631,14 +637,15 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined
+          undefined,
+          false
         );
       });
     });
 
     it('handles empty scope', async () => {
       const { result } = renderHook(() => 
-        useCan(mockUserId, {} as any, mockPermission, undefined, false)
+        useCan(mockUserId, {} as any, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -654,7 +661,7 @@ describe('useCan Hook', () => {
       
       const emptyScope = {} as any;
       const { result } = renderHook(() => 
-        useCan(mockUserId, emptyScope, mockPermission, undefined, false)
+        useCan(mockUserId, emptyScope, mockPermission, undefined, false, false)
       );
 
       // Initially loading
@@ -678,7 +685,7 @@ describe('useCan Hook', () => {
 
     it('handles null userId', async () => {
       const { result } = renderHook(() => 
-        useCan(null as any, mockScope, mockPermission, undefined, false)
+        useCan(null as any, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -690,7 +697,7 @@ describe('useCan Hook', () => {
 
     it('handles undefined userId', async () => {
       const { result } = renderHook(() => 
-        useCan(undefined as any, mockScope, mockPermission, undefined, false)
+        useCan(undefined as any, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -704,7 +711,7 @@ describe('useCan Hook', () => {
       const invalidScope = { organisationId: '', eventId: 'event-123' };
       
       const { result } = renderHook(() => 
-        useCan(mockUserId, invalidScope, mockPermission, undefined, false)
+        useCan(mockUserId, invalidScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -718,7 +725,7 @@ describe('useCan Hook', () => {
       const invalidScope = { organisationId: '   ', eventId: 'event-123' };
       
       const { result } = renderHook(() => 
-        useCan(mockUserId, invalidScope, mockPermission, undefined, false)
+        useCan(mockUserId, invalidScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -730,7 +737,7 @@ describe('useCan Hook', () => {
 
     it('handles undefined scope gracefully', async () => {
       const { result } = renderHook(() => 
-        useCan(mockUserId, undefined as any, mockPermission, undefined, false)
+        useCan(mockUserId, undefined as any, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -742,7 +749,7 @@ describe('useCan Hook', () => {
 
     it('handles null scope gracefully', async () => {
       const { result } = renderHook(() => 
-        useCan(mockUserId, null as any, mockPermission, undefined, false)
+        useCan(mockUserId, null as any, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -758,7 +765,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result, rerender } = renderHook(() => 
-        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+        useCan(mockUserId, mockScope, mockPermission, undefined, false, false)
       );
 
       await waitFor(() => {
@@ -778,7 +785,7 @@ describe('useCan Hook', () => {
       mockIsPermitted.mockResolvedValue(true);
 
       const { result, rerender } = renderHook(
-        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false),
+        ({ userId, scope, permission }) => useCan(userId, scope, permission, undefined, false, false),
         {
           initialProps: { 
             userId: mockUserId,