@jmruthers/pace-core 0.5.54 → 0.5.55

package/src/components/PaceAppLayout/__tests__/PaceAppLayout.rbac.test.tsx

@@ -0,0 +1,558 @@
+/**
+ * @file PaceAppLayout RBAC Tests
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout
+ * @since 1.0.0
+ *
+ * Comprehensive tests for PaceAppLayout RBAC functionality and permission enforcement.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor, act } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { createMemoryRouter, RouterProvider, MemoryRouter } from 'react-router-dom';
+import { PaceAppLayout } from '../PaceAppLayout';
+import { UnifiedAuthProvider } from '../../../providers/UnifiedAuthProvider';
+import { RBACProvider } from '../../../rbac/providers/RBACProvider';
+import { OrganisationProvider } from '../../../providers/OrganisationProvider';
+import { useUnifiedAuth } from '../../../providers/UnifiedAuthProvider';
+import { useRBAC } from '../../../rbac/hooks/useRBAC';
+import { isPermitted } from '../../../rbac/api';
+import { isSuperAdmin } from '../../../rbac/api';
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { User } from '@supabase/supabase-js';
+import type { Organisation } from '../../../types/organisation';
+import type { Permission } from '../../../rbac/types/permission';
+import type { AccessLevel } from '../../../rbac/types/access';
+
+// Mock Supabase client
+const mockSupabaseClient = {
+  auth: {
+    getUser: vi.fn(),
+    signIn: vi.fn(),
+    signOut: vi.fn(),
+    onAuthStateChange: vi.fn(),
+  },
+  from: vi.fn(),
+  rpc: vi.fn(),
+} as unknown as SupabaseClient;
+
+// Mock RBAC API functions
+vi.mock('../../../rbac/api', () => ({
+  isPermitted: vi.fn(),
+  isSuperAdmin: vi.fn(),
+}));
+
+// Mock useUnifiedAuth hook
+const mockUseUnifiedAuth = vi.fn();
+vi.mock('../../../providers/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: () => mockUseUnifiedAuth(),
+  UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+// Mock useRBAC hook
+const mockUseRBAC = vi.fn();
+vi.mock('../../../rbac/hooks/useRBAC', () => ({
+  useRBAC: () => mockUseRBAC(),
+}));
+
+// Mock OrganisationProvider
+vi.mock('../../../providers/OrganisationProvider', () => ({
+  OrganisationProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+// Mock RBACProvider
+vi.mock('../../../rbac/providers/RBACProvider', () => ({
+  RBACProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+// Test data
+const mockUser: User = {
+  id: 'user-123',
+  email: 'test@example.com',
+  created_at: '2023-01-01T00:00:00Z',
+  updated_at: '2023-01-01T00:00:00Z',
+  aud: 'authenticated',
+  role: 'authenticated',
+  app_metadata: {
+    organisationId: 'org-123',
+    eventId: 'event-123',
+    appId: 'app-123',
+  },
+  user_metadata: {
+    organisationId: 'org-123',
+    eventId: 'event-123',
+    appId: 'app-123',
+  },
+  identities: [],
+  factors: [],
+} as User;
+
+const mockOrganisation: Organisation = {
+  id: 'org-123',
+  name: 'Test Organisation',
+  slug: 'test-org',
+  createdAt: '2023-01-01T00:00:00Z',
+  updatedAt: '2023-01-01T00:00:00Z',
+};
+
+// Test components
+const TestPage = () => <div>Test Page Content</div>;
+const AccessDeniedPage = () => <div>Access Denied</div>;
+const LoadingPage = () => <div>Loading...</div>;
+
+// Test wrapper
+const TestWrapper = ({ children }: { children: React.ReactNode }) => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <UnifiedAuthProvider supabaseClient={mockSupabaseClient} appName="Test App">
+        <RBACProvider>
+          <OrganisationProvider>
+            {children}
+          </OrganisationProvider>
+        </RBACProvider>
+      </UnifiedAuthProvider>
+    </QueryClientProvider>
+  );
+};
+
+describe('PaceAppLayout RBAC Tests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    // Setup default mocks
+    mockUseUnifiedAuth.mockReturnValue({
+      user: mockUser,
+      session: { user: mockUser },
+      isLoading: false,
+      error: null,
+    });
+
+    mockUseRBAC.mockReturnValue({
+      hasPermission: vi.fn().mockResolvedValue(true),
+      isSuperAdmin: vi.fn().mockResolvedValue(false),
+      isLoading: false,
+      error: null,
+    });
+
+    // Mock isPermitted to always return true
+    (isPermitted as any).mockImplementation(async (input) => {
+      console.log('isPermitted called with:', input);
+      return true;
+    });
+    (isSuperAdmin as any).mockResolvedValue(false);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('Basic Rendering', () => {
+    it('should render with basic configuration', async () => {
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+    });
+
+    it('should render without permission enforcement', async () => {
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={false}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Permission Enforcement', () => {
+    it('should show access denied when permission is denied', async () => {
+      (isPermitted as any).mockResolvedValue(false);
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText("You don't have permission to access this page.")).toBeInTheDocument();
+      });
+
+      expect(screen.queryByText('Test Page Content')).not.toBeInTheDocument();
+    });
+
+    it('should show custom fallback when permission is denied', async () => {
+      (isPermitted as any).mockResolvedValue(false);
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+              permissionFallback={<AccessDeniedPage />}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Access Denied')).toBeInTheDocument();
+      });
+
+      expect(screen.queryByText('Test Page Content')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Route-Specific Permissions', () => {
+    it('should check route-specific permissions', async () => {
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+              routePermissions={{
+                '/dashboard': 'write',
+                '/settings': 'delete',
+              }}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+
+      expect(isPermitted).toHaveBeenCalledWith({
+        userId: 'user-123',
+        scope: {
+          organisationId: 'org-123',
+          eventId: 'event-123',
+          appId: 'app-123',
+        },
+        permission: 'read',
+        pageId: 'home',
+      });
+    });
+
+    it('should use custom page ID mapping', async () => {
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+              pageIdMapping={{
+                '/': 'homepage',
+                '/dashboard': 'dashboard-page',
+              }}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+
+      expect(isPermitted).toHaveBeenCalledWith({
+        userId: 'user-123',
+        scope: {
+          organisationId: 'org-123',
+          eventId: 'event-123',
+          appId: 'app-123',
+        },
+        permission: 'read',
+        pageId: 'homepage',
+      });
+    });
+  });
+
+  describe('Loading States', () => {
+    it('should show loading state while checking permissions', async () => {
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockResolvedValue(true),
+        isSuperAdmin: vi.fn().mockResolvedValue(false),
+        isLoading: true,
+        error: null,
+      });
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Audit Logging', () => {
+    it('should log page access when audit logging is enabled', async () => {
+      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      (isPermitted as any).mockResolvedValue(true);
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+              auditLog={true}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        '[PaceAppLayout] Page access attempt:',
+        expect.objectContaining({
+          pageName: 'home',
+          operation: 'read',
+          userId: 'user-123',
+          allowed: true,
+          strictMode: true,
+        })
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it('should not log when audit logging is disabled', async () => {
+      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      (isPermitted as any).mockResolvedValue(true);
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+              auditLog={false}
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+
+      expect(consoleSpy).not.toHaveBeenCalledWith(
+        expect.stringContaining('[PaceAppLayout] Page access attempt:')
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should handle RBAC errors gracefully', async () => {
+      mockUseRBAC.mockReturnValue({
+        hasPermission: vi.fn().mockRejectedValue(new Error('RBAC Error')),
+        isSuperAdmin: vi.fn().mockResolvedValue(false),
+        isLoading: false,
+        error: new Error('RBAC Error'),
+      });
+
+      const router = createMemoryRouter([
+        {
+          path: '/',
+          element: (
+            <PaceAppLayout
+              appName="Test App"
+              enforcePermissions={true}
+              defaultPermission="read"
+            />
+          ),
+          children: [
+            {
+              index: true,
+              element: <TestPage />,
+            },
+          ],
+        },
+      ]);
+
+      render(
+        <TestWrapper>
+          <RouterProvider router={router} />
+        </TestWrapper>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByText('Test Page Content')).toBeInTheDocument();
+      });
+    });
+  });
+});

package/src/components/PublicLayout/PublicErrorBoundary.tsx

@@ -97,7 +97,7 @@ export class PublicErrorBoundary extends Component<PublicErrorBoundaryProps, Pub
 
   componentDidCatch(error: Error, errorInfo: ErrorInfo) {
     // Log the error to console in development
-    if (process.env.NODE_ENV === 'development') {
+    if (import.meta.env.MODE === 'development') {
       console.error('PublicErrorBoundary caught an error:', error, errorInfo);
     }
 

package/src/components/PublicLayout/PublicPageDebugger.tsx

@@ -70,8 +70,8 @@ export function PublicPageDebugger({ enabled = true, label = 'PublicPage' }: Pub
     }
 
     // Check environment variables
-    const supabaseUrl = (import.meta as any).env?.VITE_SUPABASE_URL || process.env.VITE_SUPABASE_URL;
-    const supabaseKey = (import.meta as any).env?.VITE_SUPABASE_ANON_KEY || process.env.VITE_SUPABASE_ANON_KEY;
+    const supabaseUrl = (import.meta as any).env?.VITE_SUPABASE_URL;
+    const supabaseKey = (import.meta as any).env?.VITE_SUPABASE_ANON_KEY;
     
     console.log(`[${label}] Environment variables:`, {
       supabaseUrl: supabaseUrl ? 'Present' : 'Missing',

package/src/components/PublicLayout/PublicPageDiagnostic.tsx

@@ -87,8 +87,8 @@ export function PublicPageDiagnostic({ enabled = true, label = 'PublicPage' }: P
       }
 
       // Check environment variables
-      const supabaseUrl = (import.meta as any).env?.VITE_SUPABASE_URL || process.env.VITE_SUPABASE_URL;
-      const supabaseKey = (import.meta as any).env?.VITE_SUPABASE_ANON_KEY || process.env.VITE_SUPABASE_ANON_KEY;
+      const supabaseUrl = (import.meta as any).env?.VITE_SUPABASE_URL;
+      const supabaseKey = (import.meta as any).env?.VITE_SUPABASE_ANON_KEY;
       newDiagnostics.hasEnvironmentVars = !!(supabaseUrl && supabaseKey);
 
       // Check route parameters

package/src/components/PublicLayout/PublicPageProvider.tsx

@@ -70,8 +70,8 @@ export function PublicPageProvider({ children }: PublicPageProviderProps) {
       return (import.meta as any).env[key];
     }
     // Check Node.js environment (server-side)
-    if (typeof process !== 'undefined' && process.env) {
-      return process.env[key];
+    if (typeof import.meta !== 'undefined' && import.meta.env) {
+      return import.meta.env[key];
     }
     return undefined;
   };