@jmruthers/pace-core 0.5.193 → 0.6.2

package/src/utils/core/cn.ts

@@ -2,6 +2,6 @@
 import { type ClassValue, clsx } from "clsx";
 import { twMerge } from "tailwind-merge";
 
-export function cn(...inputs: ClassValue[]) {
+export function cn(...inputs: ClassValue[]): string {
   return twMerge(clsx(inputs));
 }

package/src/utils/file-reference/index.ts

@@ -15,12 +15,34 @@ import { setOrganisationContext } from '../context/organisationContext';
 import { invalidateFileDisplayCache } from '../../hooks/useFileDisplay';
 import { createLogger } from '../core/logger';
 import { assertAppId } from '../../types/core';
+import { isSuperAdmin } from '../../rbac/api';
 
 const log = createLogger('FileReferenceService');
 
 export class FileReferenceServiceImpl implements FileReferenceService {
   constructor(private supabase: SupabaseClient) {}
 
+  /**
+   * Helper method to get app name from app ID
+   */
+  private async getAppName(appId: string): Promise<string> {
+    try {
+      const { data, error } = await this.supabase
+        .from('rbac_apps')
+        .select('name')
+        .eq('id', appId)
+        .single();
+      
+      if (error || !data) {
+        return 'unknown';
+      }
+      
+      return data.name || 'unknown';
+    } catch {
+      return 'unknown';
+    }
+  }
+
   /**
    * Creates a file reference by uploading a file to storage and linking it in the database.
    * 
@@ -130,9 +152,39 @@ export class FileReferenceServiceImpl implements FileReferenceService {
 
       // Check if RPC returned null (permission denied or other failure)
       if (!data || data === null) {
+        // Before throwing permission error, check if user is super-admin
+        // If super-admin, the RPC should have allowed the upload, so this is likely a different issue
+        let isSuperAdminUser = false;
+        try {
+          const { data: { user: authUser } } = await this.supabase.auth.getUser();
+          if (authUser) {
+            isSuperAdminUser = await isSuperAdmin(authUser.id);
+          }
+        } catch (superAdminCheckError) {
+          // If super-admin check fails, continue with permission error
+          log.warn('Failed to check super-admin status', superAdminCheckError);
+        }
+
         // Clean up the uploaded file since DB insert failed
         await deleteFile(this.supabase, filePath, options.is_public || false);
-        throw new Error(`File upload denied: insufficient permissions. You need 'create:page.${options.pageContext}' or 'update:page.${options.pageContext}' permission for the '${options.pageContext}' page. Make sure the page exists in rbac_app_pages table.`);
+
+        // Provide more helpful error message
+        const appName = await this.getAppName(options.app_id).catch(() => 'unknown');
+        const pageContextDisplay = options.pageContext || 'undefined';
+        
+        if (isSuperAdminUser) {
+          // Super-admin should have been allowed - this suggests a different issue
+          throw new Error(
+            `File upload failed for super-admin user. This may indicate a database issue. ` +
+            `Page context: '${pageContextDisplay}', App: '${appName}'. ` +
+            `Please check that the page '${pageContextDisplay}' exists in rbac_app_pages table for app '${appName}'.`
+          );
+        } else {
+          throw new Error(
+            `File upload denied: insufficient permissions. You need 'create:page.${pageContextDisplay}' or 'update:page.${pageContextDisplay}' permission for the '${pageContextDisplay}' page. ` +
+            `Make sure the page exists in rbac_app_pages table for app '${appName}'.`
+          );
+        }
       }
 
       // Get the created file reference

package/src/utils/formatting/formatting.ts

@@ -82,16 +82,9 @@ export function formatNumber(
 /**
  * Format a number as a percentage.
  * 
- * The third parameter can be either:
- * - A number for fixed decimal places (backward compatible): `formatPercent(0.81, 'en-US', 2)`
- * - An options object with:
- *   - `decimals`: Fixed number of decimal places (default: 1)
- *   - `preserveDecimals`: Auto-detect and preserve decimal places from the input value
- *   - `maxDecimals`: Maximum decimal places when preserving (default: 10)
- * 
  * @param value - The percentage value as a decimal (e.g., 0.81 for 0.81%)
  * @param locale - The locale string (default: 'en-US')
- * @param decimalsOrOptions - Either a number for fixed decimals, or an options object with:
+ * @param options - Options object with:
  *   - `decimals` - Fixed number of decimal places (default: 1)
  *   - `preserveDecimals` - Auto-detect and preserve decimal places from the input value
  *   - `maxDecimals` - Maximum decimal places when preserving (default: 10)
@@ -101,7 +94,7 @@ export function formatNumber(
  * ```ts
  * // Fixed decimals (default behavior)
  * formatPercent(0.5) // '0.5%'
- * formatPercent(0.81, 'en-US', 1) // '0.8%' (loses precision)
+ * formatPercent(0.81, 'en-US', { decimals: 1 }) // '0.8%' (loses precision)
  * 
  * // Preserve decimal places dynamically
  * formatPercent(0.81, 'en-US', { preserveDecimals: true }) // '0.81%'
@@ -111,7 +104,7 @@ export function formatNumber(
 export function formatPercent(
   value: number,
   locale: string = 'en-US',
-  decimalsOrOptions?: number | {
+  options?: {
     decimals?: number;
     preserveDecimals?: boolean;
     maxDecimals?: number;
@@ -119,24 +112,21 @@ export function formatPercent(
 ): string {
   let decimals: number;
 
-  // Backward compatibility: if decimalsOrOptions is a number, use it directly
-  if (typeof decimalsOrOptions === 'number') {
-    decimals = decimalsOrOptions;
-  } else if (decimalsOrOptions && typeof decimalsOrOptions === 'object') {
-    // New options object: check if we should preserve decimals
-    if (decimalsOrOptions.preserveDecimals) {
+  if (options && typeof options === 'object') {
+    // Check if we should preserve decimals
+    if (options.preserveDecimals) {
       const valueStr = value.toString();
       const decimalIndex = valueStr.indexOf('.');
       
       if (decimalIndex !== -1) {
         const detectedDecimals = valueStr.length - decimalIndex - 1;
-        const maxDecimals = decimalsOrOptions.maxDecimals ?? 10;
+        const maxDecimals = options.maxDecimals ?? 10;
         decimals = Math.min(detectedDecimals, maxDecimals);
       } else {
         decimals = 0;
       }
     } else {
-      decimals = decimalsOrOptions.decimals ?? 1;
+      decimals = options.decimals ?? 1;
     }
   } else {
     decimals = 1;

package/src/utils/index.ts

@@ -98,7 +98,6 @@ export {
 // Audit utilities
 export { 
   auditLogger, 
-  auditLog,
   logAuthEvent,
   logPermissionEvent,
   logSecurityEvent,

package/src/utils/security/secureDataAccess.test.ts

@@ -21,15 +21,25 @@ const mockSupabaseClient = {
 let mockQueryBuilder: any;
 
 const createMockQueryBuilder = (customData?: any, customError?: any) => {
+  // Create spy functions that return this for chaining
+  const selectSpy = vi.fn(function(this: any) { return this; });
+  const eqSpy = vi.fn(function(this: any) { return this; });
+  const orderSpy = vi.fn(function(this: any) { return this; });
+  const limitSpy = vi.fn(function(this: any) { return this; });
+  const rangeSpy = vi.fn(function(this: any) { return this; });
+  const insertSpy = vi.fn(function(this: any) { return this; });
+  const updateSpy = vi.fn(function(this: any) { return this; });
+  const deleteSpy = vi.fn(function(this: any) { return this; });
+  
   const builder: any = {
-    select: vi.fn(function(this: any) { return this; }),
-    eq: vi.fn(function(this: any) { return this; }),
-    order: vi.fn(function(this: any) { return this; }),
-    limit: vi.fn(function(this: any) { return this; }),
-    range: vi.fn(function(this: any) { return this; }),
-    insert: vi.fn(function(this: any) { return this; }),
-    update: vi.fn(function(this: any) { return this; }),
-    delete: vi.fn(function(this: any) { return this; }),
+    select: selectSpy,
+    eq: eqSpy,
+    order: orderSpy,
+    limit: limitSpy,
+    range: rangeSpy,
+    insert: insertSpy,
+    update: updateSpy,
+    delete: deleteSpy,
     single: vi.fn().mockImplementation(() => {
       const data = customData !== undefined ? customData : { id: 'test-123' };
       const error = customError !== undefined ? customError : null;
@@ -56,7 +66,7 @@ const createMockQueryBuilder = (customData?: any, customError?: any) => {
 describe('secureDataAccess', () => {
   let secureDataAccess: ReturnType<typeof createSecureDataAccess>;
   const mockOrganisationId = 'org-123';
-  const mockTable = 'pace_person'; // Use a table that has organisation_id column
+  const mockTable = 'core_events'; // Use a table that has organisation_id column (pace_person doesn't have it)
   const mockSelect = 'id, name, organisation_id';
 
   beforeEach(() => {
@@ -332,10 +342,10 @@ describe('secureDataAccess', () => {
           const mockFilters = { id: '1' };
           const mockResult = { id: '1', name: 'Updated Item', organisation_id: mockOrganisationId };
           
-          mockQueryBuilder.update = vi.fn().mockReturnThis();
-          mockQueryBuilder.eq = vi.fn().mockReturnThis();
-          mockQueryBuilder.select = vi.fn().mockReturnThis();
+          // Create a fresh mock query builder with proper chaining
+          mockQueryBuilder = createMockQueryBuilder(mockResult);
           mockQueryBuilder.single = vi.fn().mockResolvedValue({ data: mockResult, error: null });
+          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
           const result = await secureDataAccess.secureUpdate(mockTable, mockData, mockFilters, mockOrganisationId);
 
@@ -366,9 +376,13 @@ describe('secureDataAccess', () => {
         it('should delete data with organisation filter', async () => {
           const mockFilters = { id: '1' };
           
-          mockQueryBuilder.delete = vi.fn().mockReturnThis();
-          mockQueryBuilder.eq = vi.fn().mockReturnThis();
-          mockQueryBuilder.single = vi.fn().mockResolvedValue({ data: null, error: null });
+          // Create a fresh mock query builder with proper chaining
+          mockQueryBuilder = createMockQueryBuilder();
+          // Make the query builder thenable and resolve successfully
+          mockQueryBuilder.then = function(resolve: any) {
+            return Promise.resolve({ data: null, error: null }).then(resolve);
+          };
+          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
           const result = await secureDataAccess.secureDelete(mockTable, mockFilters, mockOrganisationId);
 
@@ -687,12 +701,9 @@ describe('secureDataAccess', () => {
       };
 
       const mockData = [{ id: '1', name: 'Test', organisation_id: mockOrganisationId }];
-          // Create a new mock with the expected data
-          mockQueryBuilder = createMockQueryBuilder(mockData);
-          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
       // Create a new mock with the expected data
-          mockQueryBuilder = createMockQueryBuilder(mockData);
-          mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
+      mockQueryBuilder = createMockQueryBuilder(mockData);
+      mockSupabaseClient.from = vi.fn().mockReturnValue(mockQueryBuilder);
 
       const options: SecureQueryOptions = {
         table: mockTable,

package/src/utils/security/secureDataAccess.ts

@@ -99,9 +99,10 @@ export const createSecureDataAccess = (
       // SECURITY: Phase 2 additions - complete organisation table mapping
       'organisation_audit_log', 'organisation_invitations', 'organisation_app_access',
       // SECURITY: Emergency additions for Phase 1 fixes
-      'cake_meal', 'cake_mealtype', 'core_person', 'pace_person',
-      // NOTE: core_member, medi_profile, core_contact, core_consent, core_identification, core_qualification
-      // are now person-scoped (not organisation-scoped) - removed from this list
+      'cake_meal', 'cake_mealtype',
+      // NOTE: core_person, pace_person, core_member, medi_profile, core_contact, core_consent, 
+      // core_identification, core_qualification are now person-scoped (not organisation-scoped) 
+      // and do NOT have organisation_id columns - removed from this list
       // SECURITY: Phase 3A additions - medical and personal data
       // NOTE: medi_condition, medi_diet, medi_action_plan, medi_profile_versions are now person-scoped
       // (via medi_profile) - removed from this list