@jmruthers/pace-core 0.5.193 → 0.6.2

package/src/rbac/hooks/useResourcePermissions.test.ts

@@ -143,28 +143,36 @@ describe('useResourcePermissions Hook', () => {
         mockScope,
         'create:contacts',
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'update:contacts',
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'delete:contacts',
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'read:contacts',
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
   });
@@ -296,7 +304,9 @@ describe('useResourcePermissions Hook', () => {
         resolvedScope,
         expect.any(String),
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
 
@@ -320,7 +330,9 @@ describe('useResourcePermissions Hook', () => {
         fallbackScope,
         expect.any(String),
         undefined,
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
 
@@ -348,7 +360,9 @@ describe('useResourcePermissions Hook', () => {
         fallbackScope,
         expect.any(String),
         undefined,
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
 
@@ -376,7 +390,9 @@ describe('useResourcePermissions Hook', () => {
         fallbackScope,
         expect.any(String),
         undefined,
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
   });
@@ -397,28 +413,36 @@ describe('useResourcePermissions Hook', () => {
         mockScope,
         'create:contacts',
         'contacts', // pageId is resource name when appId is available in scope
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         '',
         mockScope,
         'update:contacts',
         'contacts',
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         '',
         mockScope,
         'delete:contacts',
         'contacts',
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         '',
         mockScope,
         'read:contacts',
         'contacts',
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
   });
@@ -614,7 +638,9 @@ describe('useResourcePermissions Hook', () => {
         expect.any(Object),
         'read:contacts',
         'contacts', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
 
@@ -635,21 +661,27 @@ describe('useResourcePermissions Hook', () => {
         expect.any(Object),
         'create:risks',
         'risks', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
         expect.any(Object),
         'update:risks',
         'risks', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
         expect.any(Object),
         'delete:risks',
         'risks', // pageId is resource name when appId is available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
   });
@@ -677,7 +709,9 @@ describe('useResourcePermissions Hook', () => {
         scopeWithAppId,
         'create:planning',
         'planning', // Resource name passed as pageId to enable page permission checks
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
 
@@ -703,7 +737,9 @@ describe('useResourcePermissions Hook', () => {
         scopeWithoutAppId,
         'create:planning',
         undefined, // No pageId when appId is not available
-        true
+        true,
+        null, // precomputedSuperAdmin
+        undefined // appName
       );
     });
   });

package/src/rbac/hooks/useResourcePermissions.ts

@@ -171,12 +171,16 @@ export function useResourcePermissions(
   const pageId = scope.appId ? resource : undefined;
 
   // Permission checks for create, update, delete
+  // Pass null for super admin status (not checked yet - hook will check if needed)
+  // PERFORMANCE: These hooks will each check super admin separately - could be optimized in future
   const { can: canCreateResult, isLoading: createLoading, error: createError } = useCan(
     user?.id || '',
     scope,
     `create:${resource}` as const,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
-    true // useCache
+    true, // useCache
+    null, // precomputedSuperAdmin - not checked yet
+    undefined // appName
   );
 
   const { can: canUpdateResult, isLoading: updateLoading, error: updateError } = useCan(
@@ -184,7 +188,9 @@ export function useResourcePermissions(
     scope,
     `update:${resource}` as const,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
-    true // useCache
+    true, // useCache
+    null, // precomputedSuperAdmin - not checked yet
+    undefined // appName
   );
 
   const { can: canDeleteResult, isLoading: deleteLoading, error: deleteError } = useCan(
@@ -192,7 +198,9 @@ export function useResourcePermissions(
     scope,
     `delete:${resource}` as const,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
-    true // useCache
+    true, // useCache
+    null, // precomputedSuperAdmin - not checked yet
+    undefined // appName
   );
 
   // Optional read permission check
@@ -201,7 +209,9 @@ export function useResourcePermissions(
     scope,
     `read:${resource}` as const,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
-    true // useCache
+    true, // useCache
+    null, // precomputedSuperAdmin - not checked yet
+    undefined // appName
   );
 
   // Aggregate loading states - any permission check or scope resolution loading

package/src/rbac/hooks/useSecureSupabase.ts

@@ -121,7 +121,7 @@ import { useOrganisations } from '../../hooks/useOrganisations';
 import { useEvents } from '../../hooks/useEvents';
 import { useResolvedScope } from './useResolvedScope';
 import { useOrganisationSecurity } from '../../hooks/useOrganisationSecurity';
-import { createSecureClient, SecureSupabaseClient } from '../secureClient';
+import { createSecureClient, fromSupabaseClient, SecureSupabaseClient } from '../secureClient';
 import type { Database } from '../../types/database';
 import type { SupabaseClient } from '@supabase/supabase-js';
 import { logger } from '../../utils/core/logger';
@@ -138,12 +138,12 @@ const MAX_CACHE_SIZE = 5;
  * CRITICAL: Must include isSuperAdmin in cache key to ensure correct filtering behavior
  */
 function getCacheKey(
-  organisationId: string,
+  organisationId: string | null | undefined,
   eventId: string | undefined,
   appId: string | undefined,
   isSuperAdmin: boolean
 ): string {
-  return `${organisationId}-${eventId || 'no-event'}-${appId || 'no-app'}-${isSuperAdmin ? 'super' : 'regular'}`;
+  return `${organisationId || 'no-org'}-${eventId || 'no-event'}-${appId || 'no-app'}-${isSuperAdmin ? 'super' : 'regular'}`;
 }
 
 /**
@@ -250,8 +250,11 @@ export function useSecureSupabase(
     const eventId = resolvedScope?.eventId || selectedEvent?.event_id;
     const appId = resolvedScope?.appId;
     
-    // If we have organisation context (from resolved scope), create or reuse a secure client
-    if (organisationId && user?.id) {
+    // Allow super-admins to create a secure client even without organisationId
+    // For non-super-admins, organisationId is required
+    const canCreateSecureClient = user?.id && (isSuperAdmin || organisationId);
+    
+    if (canCreateSecureClient) {
       // Update previous context
       prevContextRef.current = { organisationId, eventId, appId };
 
@@ -274,14 +277,31 @@ export function useSecureSupabase(
       }
 
       try {
-        const secureClient = createSecureClient(
-          config.url,
-          config.key,
-          organisationId as any, // organisationId is string, UUID is string alias
-          eventId,
-          appId as any, // appId is string | undefined, UUID is string alias
-          isSuperAdmin // Pass super admin status for conditional filtering
-        );
+        // For super-admins, organisationId can be null
+        const effectiveOrganisationId = isSuperAdmin ? (organisationId || null) : organisationId;
+        
+        const baseForSecureClient = baseClient || authSupabase || null;
+
+        // IMPORTANT:
+        // Reuse the existing authenticated client when possible to avoid:
+        // - Multiple GoTrueClient instances warning
+        // - Auth/session desync causing RLS SELECT to return empty after refresh
+        const secureClient = baseForSecureClient
+          ? fromSupabaseClient(
+              baseForSecureClient as any,
+              (effectiveOrganisationId as any) ?? null,
+              eventId,
+              appId as any,
+              isSuperAdmin
+            )
+          : createSecureClient(
+              config.url,
+              config.key,
+              effectiveOrganisationId as any, // organisationId is string | null, UUID is string alias
+              eventId,
+              appId as any, // appId is string | undefined, UUID is string alias
+              isSuperAdmin // Pass super admin status for conditional filtering
+            );
 
         // Cache the client for reuse
         secureClientCache.set(cacheKey, secureClient);

package/src/rbac/permissions.ts

@@ -167,36 +167,6 @@ export function isValidPermission(permission: string): permission is Permission
   return pattern.test(permission);
 }
 
-/**
- * Get all permissions for a role - REMOVED
- * 
- * @deprecated This function has been removed to ensure RBAC compliance.
- * Permissions must be queried from the rbac_page_permissions database table,
- * not hardcoded in application code. This allows organizations to customize
- * their own page-level permissions as required by the RBAC specification.
- * 
- * To get permissions for a role, query the database:
- * ```typescript
- * const { data } = await supabase
- *   .from('rbac_page_permissions')
- *   .select('operation, allowed')
- *   .eq('role_name', roleName)
- *   .eq('organisation_id', organisationId)
- *   .eq('allowed', true);
- * ```
- * 
- * @param role - Role name
- * @returns Empty array (function deprecated)
- */
-export function getPermissionsForRole(role: string): Permission[] {
-  log.warn(
-    'getPermissionsForRole() is deprecated. ' +
-    'Permissions must be queried from rbac_page_permissions table. ' +
-    `Called with role: ${role}`
-  );
-  return [];
-}
-
 // ============================================================================
 // EXPORTS
 // ============================================================================