@jmruthers/pace-core 0.5.53 → 0.5.55

package/src/rbac/__tests__/rbac-functions.test.ts

@@ -0,0 +1,655 @@
+/**
+ * @file RBAC Functions Unit Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Tests
+ * @since 1.0.0
+ * 
+ * Comprehensive unit tests for all standardized RBAC functions.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createClient } from '@supabase/supabase-js';
+
+// Mock Supabase client
+const mockSupabase = {
+  rpc: vi.fn(),
+  from: vi.fn(() => ({
+    select: vi.fn(() => ({
+      eq: vi.fn(() => ({
+        single: vi.fn()
+      }))
+    }))
+  }))
+};
+
+// Mock data
+const mockUser = {
+  id: 'user-123',
+  email: 'test@example.com'
+};
+
+const mockOrganisation = {
+  id: 'org-123',
+  name: 'Test Organisation'
+};
+
+const mockEvent = {
+  id: 'event-123',
+  name: 'Test Event',
+  organisation_id: 'org-123'
+};
+
+const mockApp = {
+  id: 'app-123',
+  name: 'CAKE',
+  is_active: true
+};
+
+describe('RBAC Functions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('rbac_permission_check', () => {
+    it('should return false for null user_id', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_user_id: null
+      });
+
+      expect(result.data[0].has_permission).toBe(false);
+      expect(result.data[0].permission_source).toBe('none');
+    });
+
+    it('should return true for super admin', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_permission: true, role_name: 'super_admin', permission_source: 'global', granted_at: expect.any(String) }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].has_permission).toBe(true);
+      expect(result.data[0].role_name).toBe('super_admin');
+      expect(result.data[0].permission_source).toBe('global');
+    });
+
+    it('should return true for organisation admin', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_permission: true, role_name: 'org_admin', permission_source: 'organisation', granted_at: expect.any(String) }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_user_id: mockUser.id,
+        p_organisation_id: mockOrganisation.id
+      });
+
+      expect(result.data[0].has_permission).toBe(true);
+      expect(result.data[0].role_name).toBe('org_admin');
+      expect(result.data[0].permission_source).toBe('organisation');
+    });
+
+    it('should return false for invalid permission', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'delete',
+        p_page_name: 'admin-panel',
+        p_user_id: mockUser.id,
+        p_organisation_id: mockOrganisation.id
+      });
+
+      expect(result.data[0].has_permission).toBe(false);
+    });
+  });
+
+  describe('rbac_permissions_get', () => {
+    it('should return all permissions for super admin', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          permission_type: 'all_permissions',
+          role_name: 'super_admin',
+          has_permission: true,
+          granted_at: expect.any(String),
+          context_id: 'global'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permissions_get', {
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].permission_type).toBe('all_permissions');
+      expect(result.data[0].role_name).toBe('super_admin');
+    });
+
+    it('should return organisation permissions', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          permission_type: 'organisation_access',
+          role_name: 'member',
+          has_permission: true,
+          granted_at: expect.any(String),
+          context_id: mockOrganisation.id
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permissions_get', {
+        p_user_id: mockUser.id,
+        p_organisation_id: mockOrganisation.id
+      });
+
+      expect(result.data[0].permission_type).toBe('organisation_access');
+      expect(result.data[0].role_name).toBe('member');
+    });
+
+    it('should return empty array for null user_id', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_permissions_get', {
+        p_user_id: null
+      });
+
+      expect(result.data).toEqual([]);
+    });
+  });
+
+  describe('rbac_access_validate', () => {
+    it('should return false for null user_id', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_access: false, access_level: 'none', context_id: null }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'organisation',
+        p_resource_id: mockOrganisation.id,
+        p_user_id: null
+      });
+
+      expect(result.data[0].has_access).toBe(false);
+    });
+
+    it('should return true for super admin', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_access: true, access_level: 'super_admin', context_id: 'global' }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'organisation',
+        p_resource_id: mockOrganisation.id,
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].has_access).toBe(true);
+      expect(result.data[0].access_level).toBe('super_admin');
+    });
+
+    it('should validate organisation access', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_access: true, access_level: 'organisation', context_id: mockOrganisation.id }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'organisation',
+        p_resource_id: mockOrganisation.id,
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].has_access).toBe(true);
+      expect(result.data[0].access_level).toBe('organisation');
+    });
+
+    it('should validate event access', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ has_access: true, access_level: 'event', context_id: mockEvent.id }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'event',
+        p_resource_id: mockEvent.id,
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].has_access).toBe(true);
+      expect(result.data[0].access_level).toBe('event');
+    });
+  });
+
+  describe('rbac_page_access_check', () => {
+    it('should return false for invalid access', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: false,
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_page_access_check', {
+        p_app_id: mockApp.id,
+        p_page_id: 'admin-panel',
+        p_operation: 'delete',
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data).toBe(false);
+    });
+
+    it('should return true for valid access', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: true,
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_page_access_check', {
+        p_app_id: mockApp.id,
+        p_page_id: 'dashboard',
+        p_operation: 'read',
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data).toBe(true);
+    });
+  });
+
+  describe('rbac_role_grant', () => {
+    it('should grant global role successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          message: 'Role granted successfully',
+          role_id: 'role-123',
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: mockUser.id,
+        p_role_type: 'global',
+        p_role_name: 'super_admin',
+        p_granted_by: 'admin-123'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].role_id).toBe('role-123');
+    });
+
+    it('should grant organisation role successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          message: 'Role granted successfully',
+          role_id: 'role-456',
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: mockUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: mockOrganisation.id,
+        p_granted_by: 'admin-123'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].role_id).toBe('role-456');
+    });
+
+    it('should grant event-app role successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          message: 'Role granted successfully',
+          role_id: 'role-789',
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: mockUser.id,
+        p_role_type: 'event_app',
+        p_role_name: 'participant',
+        p_context_id: `${mockEvent.id}:${mockApp.id}`,
+        p_granted_by: 'admin-123'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].role_id).toBe('role-789');
+    });
+
+    it('should return error for invalid role type', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          message: 'Invalid role type',
+          role_id: null,
+          error_code: 'INVALID_ROLE_TYPE'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: mockUser.id,
+        p_role_type: 'invalid',
+        p_role_name: 'member'
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('INVALID_ROLE_TYPE');
+    });
+
+    it('should return error for missing organisation ID', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          message: 'Organisation ID required',
+          role_id: null,
+          error_code: 'MISSING_ORGANISATION_ID'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: mockUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: null
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('MISSING_ORGANISATION_ID');
+    });
+  });
+
+  describe('rbac_role_revoke', () => {
+    it('should revoke role successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          message: 'Role revoked successfully',
+          revoked_count: 1,
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_revoke', {
+        p_user_id: mockUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: mockOrganisation.id,
+        p_revoked_by: 'admin-123'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].revoked_count).toBe(1);
+    });
+
+    it('should return error for role not found', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          message: 'No matching role found',
+          revoked_count: 0,
+          error_code: 'ROLE_NOT_FOUND'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_revoke', {
+        p_user_id: mockUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'nonexistent',
+        p_context_id: mockOrganisation.id
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('ROLE_NOT_FOUND');
+    });
+  });
+
+  describe('rbac_roles_list', () => {
+    it('should list all user roles', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          {
+            role_type: 'global',
+            role_name: 'super_admin',
+            context_id: 'system',
+            granted_at: expect.any(String),
+            status: 'active',
+            granted_by: 'admin-123'
+          },
+          {
+            role_type: 'organisation',
+            role_name: 'member',
+            context_id: mockOrganisation.id,
+            granted_at: expect.any(String),
+            status: 'active',
+            granted_by: 'admin-123'
+          }
+        ],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_roles_list', {
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data).toHaveLength(2);
+      expect(result.data[0].role_type).toBe('global');
+      expect(result.data[1].role_type).toBe('organisation');
+    });
+
+    it('should filter by organisation', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          role_type: 'organisation',
+          role_name: 'member',
+          context_id: mockOrganisation.id,
+          granted_at: expect.any(String),
+          status: 'active',
+          granted_by: 'admin-123'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_roles_list', {
+        p_user_id: mockUser.id,
+        p_organisation_id: mockOrganisation.id
+      });
+
+      expect(result.data).toHaveLength(1);
+      expect(result.data[0].role_type).toBe('organisation');
+    });
+  });
+
+  describe('rbac_role_validate', () => {
+    it('should validate active role', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          is_valid: true,
+          role_id: 'role-123',
+          granted_at: expect.any(String),
+          expires_at: null,
+          status: 'active'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_validate', {
+        p_user_id: mockUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: mockOrganisation.id
+      });
+
+      expect(result.data[0].is_valid).toBe(true);
+      expect(result.data[0].status).toBe('active');
+    });
+
+    it('should return false for invalid role', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          is_valid: false,
+          role_id: null,
+          granted_at: null,
+          expires_at: null,
+          status: 'invalid_type'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_validate', {
+        p_user_id: mockUser.id,
+        p_role_type: 'invalid',
+        p_role_name: 'member'
+      });
+
+      expect(result.data[0].is_valid).toBe(false);
+    });
+  });
+
+  describe('rbac_session_track', () => {
+    it('should track session successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          session_id: 'session-123',
+          message: 'Session tracked successfully',
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_session_track', {
+        p_user_id: mockUser.id,
+        p_session_type: 'web',
+        p_event_id: mockEvent.id,
+        p_app_id: mockApp.id,
+        p_ip_address: '192.168.1.1',
+        p_user_agent: 'Mozilla/5.0...'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].session_id).toBe('session-123');
+    });
+
+    it('should return error for unauthenticated user', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          session_id: null,
+          message: 'User not authenticated',
+          error_code: 'USER_NOT_AUTHENTICATED'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_session_track', {
+        p_user_id: null,
+        p_session_type: 'web'
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('USER_NOT_AUTHENTICATED');
+    });
+
+    it('should return error for invalid session type', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          session_id: null,
+          message: 'Invalid session type',
+          error_code: 'INVALID_SESSION_TYPE'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_session_track', {
+        p_user_id: mockUser.id,
+        p_session_type: 'invalid'
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('INVALID_SESSION_TYPE');
+    });
+  });
+
+  describe('rbac_audit_log', () => {
+    it('should log audit event successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: true,
+          audit_id: 'audit-123',
+          message: 'Audit event logged successfully',
+          error_code: null
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_audit_log', {
+        p_event_type: 'role_granted',
+        p_user_id: mockUser.id,
+        p_organisation_id: mockOrganisation.id,
+        p_permission: 'member',
+        p_metadata: { entity_type: 'organisation_role' },
+        p_ip_address: '192.168.1.1',
+        p_user_agent: 'Mozilla/5.0...'
+      });
+
+      expect(result.data[0].success).toBe(true);
+      expect(result.data[0].audit_id).toBe('audit-123');
+    });
+
+    it('should return error for invalid event type', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{
+          success: false,
+          audit_id: null,
+          message: 'Invalid event type',
+          error_code: 'INVALID_EVENT_TYPE'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_audit_log', {
+        p_event_type: 'invalid_event',
+        p_user_id: mockUser.id
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('INVALID_EVENT_TYPE');
+    });
+  });
+});