@jmruthers/pace-core 0.5.54 → 0.5.55

package/src/hooks/usePermissionCache.ts

@@ -92,7 +92,7 @@ interface CacheConfig {
 const DEFAULT_CONFIG: CacheConfig = {
   defaultTTL: 5 * 60 * 1000, // 5 minutes
   maxCacheSize: 1000,
-  enableLogging: process.env.NODE_ENV === 'development',
+  enableLogging: import.meta.env.MODE === 'development',
   enableAuditTrail: true
 };
 
@@ -111,7 +111,7 @@ export function usePermissionCache(config: Partial<CacheConfig> = {}) {
     cacheMisses: 0,
     totalChecks: 0,
     totalResponseTime: 0,
-    lastInvalidation: Date.now()
+    lastInvalidation: 0
   });
 
   // Audit trail
@@ -125,7 +125,8 @@ export function usePermissionCache(config: Partial<CacheConfig> = {}) {
   }>>([]);
 
   // Get base RBAC hook
-  const { hasPermission: baseHasPermission, user } = useRBAC();
+  const rbacHook = useRBAC();
+  const { hasPermission: baseHasPermission, user } = rbacHook || {};
 
   // Generate cache key
   const getCacheKey = useCallback((operation: Operation, pageId: string): string => {
@@ -197,6 +198,17 @@ export function usePermissionCache(config: Partial<CacheConfig> = {}) {
     pageId: string, 
     ttl?: number
   ): Promise<boolean> => {
+    // Validate parameters
+    if (!operation || !pageId) {
+      console.warn('[PermissionCache] Invalid parameters: operation and pageId are required');
+      return false;
+    }
+
+    if (!baseHasPermission) {
+      console.warn('[PermissionCache] RBAC not available - permission check failed');
+      return false;
+    }
+
     const startTime = Date.now();
     const cacheKey = getCacheKey(operation, pageId);
     const entry = cache.current.get(cacheKey);
@@ -262,6 +274,24 @@ export function usePermissionCache(config: Partial<CacheConfig> = {}) {
     permissions: Array<[Operation, string]>,
     ttl?: number
   ): Promise<PermissionResult[]> => {
+    // Validate parameters
+    if (!permissions || !Array.isArray(permissions) || permissions.length === 0) {
+      console.warn('[PermissionCache] Invalid permissions array');
+      return [];
+    }
+
+    if (!baseHasPermission) {
+      console.warn('[PermissionCache] RBAC not available - permission checks failed');
+      return permissions.map(([operation, pageId]) => ({
+        operation,
+        pageId,
+        hasPermission: false,
+        cached: false,
+        responseTime: 0,
+        timestamp: Date.now()
+      }));
+    }
+
     const results: PermissionResult[] = [];
     const startTime = Date.now();
     
@@ -433,7 +463,7 @@ export function usePermissionCache(config: Partial<CacheConfig> = {}) {
     };
     
     // Only set up interval in non-test environments to prevent memory leaks during testing
-    const interval = typeof process !== 'undefined' && process.env.NODE_ENV !== 'test' 
+    const interval = import.meta.env.MODE !== 'test' 
       ? setInterval(cleanup, 1000) 
       : null;
     

package/src/hooks/useSecureDataAccess.test.ts

@@ -0,0 +1,486 @@
+/**
+ * @file Secure Data Access Hook Tests
+ * @package @jmruthers/pace-core
+ * @module Hooks/useSecureDataAccess
+ * @since 0.4.0
+ * 
+ * Comprehensive tests for the useSecureDataAccess hook covering all critical functionality.
+ */
+
+import { renderHook, waitFor } from '@testing-library/react';
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { useSecureDataAccess } from './useSecureDataAccess';
+import { useUnifiedAuth } from '../providers/UnifiedAuthProvider';
+import { useOrganisations } from '../providers/OrganisationProvider';
+import { setOrganisationContext } from '../utils/organisationContext';
+import { createMockSupabaseClient, createMockQueryBuilderWithData } from '../__tests__/helpers/supabaseMock';
+
+// Mock the providers
+vi.mock('../providers/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: vi.fn()
+}));
+
+vi.mock('../providers/OrganisationProvider', () => ({
+  useOrganisations: vi.fn()
+}));
+
+// Mock the organisation context utility
+vi.mock('../utils/organisationContext', () => ({
+  setOrganisationContext: vi.fn()
+}));
+
+
+describe('useSecureDataAccess', () => {
+  const mockUseUnifiedAuth = vi.mocked(useUnifiedAuth);
+  const mockUseOrganisations = vi.mocked(useOrganisations);
+  const mockSetOrganisationContext = vi.mocked(setOrganisationContext);
+
+  const mockUser = {
+    id: 'user-123',
+    email: 'test@example.com'
+  };
+
+  const mockSession = {
+    access_token: 'token-123',
+    refresh_token: 'refresh-123'
+  };
+
+  // Create proper thenable mock query builder
+  const mockQueryBuilder = createMockQueryBuilderWithData([{ id: 'record-123' }]);
+  const mockSupabase = createMockSupabaseClient([{ id: 'record-123' }]);
+  
+
+  const mockSelectedOrganisation = {
+    id: 'org-123',
+    name: 'Test Organisation'
+  };
+
+  let freshMockQueryBuilder: any;
+  let freshMockSupabase: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    // Recreate the mock to ensure it's fresh
+    freshMockQueryBuilder = createMockQueryBuilderWithData([{ id: 'record-123' }]);
+    freshMockSupabase = createMockSupabaseClient([{ id: 'record-123' }]);
+    freshMockSupabase.from.mockReturnValue(freshMockQueryBuilder);
+    
+    mockUseUnifiedAuth.mockReturnValue({
+      user: mockUser,
+      session: mockSession,
+      supabase: freshMockSupabase,
+      isAuthenticated: true,
+      signOut: vi.fn(),
+      // Add other required properties
+    } as any);
+
+    mockUseOrganisations.mockReturnValue({
+      selectedOrganisation: mockSelectedOrganisation,
+      getUserRole: vi.fn().mockReturnValue('member'),
+      validateOrganisationAccess: vi.fn().mockResolvedValue(true),
+      ensureOrganisationContext: vi.fn().mockReturnValue(mockSelectedOrganisation),
+      // Add other required properties
+    } as any);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('Hook Initialization', () => {
+    it('initializes with required dependencies', () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      expect(result.current).toBeDefined();
+      expect(result.current.secureQuery).toBeInstanceOf(Function);
+      expect(result.current.secureInsert).toBeInstanceOf(Function);
+      expect(result.current.secureUpdate).toBeInstanceOf(Function);
+      expect(result.current.secureDelete).toBeInstanceOf(Function);
+      expect(result.current.secureRpc).toBeInstanceOf(Function);
+      expect(result.current.getCurrentOrganisationId()).toBe('org-123');
+    });
+
+    it('depends on useUnifiedAuth hook', () => {
+      renderHook(() => useSecureDataAccess());
+      expect(mockUseUnifiedAuth).toHaveBeenCalled();
+    });
+
+    it('depends on useOrganisations hook', () => {
+      renderHook(() => useSecureDataAccess());
+      expect(mockUseOrganisations).toHaveBeenCalled();
+    });
+  });
+
+  describe('Secure Query Operations', () => {
+    it('executes secure query with organisation filtering', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureQuery('event', '*', { active: true });
+      
+      expect(freshMockSupabase.from).toHaveBeenCalledWith('event');
+      expect(freshMockQueryBuilder.select).toHaveBeenCalledWith('*');
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('organisation_id', 'org-123');
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('active', true);
+    });
+
+    it('executes secure query with custom filters', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureQuery('users', '*', { active: true });
+      
+      expect(freshMockSupabase.from).toHaveBeenCalledWith('users');
+      expect(freshMockQueryBuilder.select).toHaveBeenCalledWith('*');
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('active', true);
+    });
+
+    it('executes secure query with ordering', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureQuery('users', '*', {}, {
+        orderBy: 'created_at',
+        ascending: false
+      });
+      
+      expect(freshMockQueryBuilder.select).toHaveBeenCalledWith('*');
+    });
+
+    it('executes secure query with pagination', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureQuery('users', '*', {}, {
+        limit: 10,
+        offset: 20
+      });
+      
+      expect(freshMockQueryBuilder.select).toHaveBeenCalledWith('*');
+    });
+
+    it('handles query errors gracefully', async () => {
+      // Mock error response - the query builder should reject with an error
+      freshMockQueryBuilder.then.mockImplementation((resolve, reject) => {
+        reject(new Error('Query failed'));
+      });
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureQuery('users', '*')).rejects.toThrow('Query failed');
+    });
+  });
+
+  describe('Secure Insert Operations', () => {
+    it('executes secure insert with organisation context', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureInsert('users', { name: 'Test User' });
+      
+      expect(freshMockSupabase.from).toHaveBeenCalledWith('users');
+      expect(freshMockQueryBuilder.insert).toHaveBeenCalledWith({
+        name: 'Test User',
+        organisation_id: 'org-123'
+      });
+    });
+
+    it('handles insert errors gracefully', async () => {
+      // Mock error response - the entire chain should reject
+      freshMockQueryBuilder.single.mockRejectedValue(new Error('Insert failed'));
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureInsert('users', { name: 'Test User' })).rejects.toThrow('Insert failed');
+    });
+
+    it('prevents organisation_id override', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureInsert('users', { 
+        name: 'Test User',
+        organisation_id: 'malicious-org-id'
+      });
+      
+      expect(freshMockQueryBuilder.insert).toHaveBeenCalledWith({
+        name: 'Test User',
+        organisation_id: 'org-123' // Should override malicious value
+      });
+    });
+  });
+
+  describe('Secure Update Operations', () => {
+    it('executes secure update with organisation filtering', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureUpdate('event', { event_name: 'Updated Event' }, { id: 'event-123' });
+      
+      expect(freshMockSupabase.from).toHaveBeenCalledWith('event');
+      expect(freshMockQueryBuilder.update).toHaveBeenCalledWith({ event_name: 'Updated Event' });
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('id', 'event-123');
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('organisation_id', 'org-123');
+    });
+
+    it('handles update errors gracefully', async () => {
+      // Mock error response - mock the entire chain to throw an error
+      const errorQueryBuilder = {
+        ...freshMockQueryBuilder,
+        then: vi.fn().mockImplementation(() => {
+          throw new Error('Update failed');
+        })
+      };
+      freshMockSupabase.from.mockReturnValue(errorQueryBuilder);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureUpdate('users', { name: 'Updated User' }, { id: 'user-123' })).rejects.toThrow('Update failed');
+    });
+
+    it('prevents organisation_id updates', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureUpdate('users', { 
+        name: 'Updated User',
+        organisation_id: 'malicious-org-id'
+      }, { id: 'user-123' });
+      
+      expect(freshMockQueryBuilder.update).toHaveBeenCalledWith({
+        name: 'Updated User'
+        // organisation_id should be filtered out
+      });
+    });
+  });
+
+  describe('Secure Delete Operations', () => {
+    it('executes secure delete with organisation filtering', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureDelete('event', { id: 'event-123' });
+      
+      expect(freshMockSupabase.from).toHaveBeenCalledWith('event');
+      expect(freshMockQueryBuilder.delete).toHaveBeenCalled();
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('id', 'event-123');
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('organisation_id', 'org-123');
+    });
+
+    it('handles delete errors gracefully', async () => {
+      // Mock error response - mock the entire chain to throw an error
+      const errorQueryBuilder = {
+        ...freshMockQueryBuilder,
+        then: vi.fn().mockImplementation(() => {
+          throw new Error('Delete failed');
+        })
+      };
+      freshMockSupabase.from.mockReturnValue(errorQueryBuilder);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureDelete('users', { id: 'user-123' })).rejects.toThrow('Delete failed');
+    });
+  });
+
+  describe('Secure RPC Operations', () => {
+    it('executes secure RPC with organisation context', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      const data = await result.current.secureRpc('get_user_data', { user_id: 'user-123' });
+      
+      expect(freshMockSupabase.rpc).toHaveBeenCalledWith('get_user_data', {
+        user_id: 'user-123',
+        organisation_id: 'org-123'
+      });
+    });
+
+    it('handles RPC errors gracefully', async () => {
+      // Mock error response - the RPC should reject with an error
+      freshMockSupabase.rpc.mockRejectedValue(new Error('RPC failed'));
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureRpc('get_user_data')).rejects.toThrow('RPC failed');
+    });
+  });
+
+  describe('Organisation Context Management', () => {
+    it('sets organisation context before operations', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureQuery('users', '*');
+      
+      expect(mockSetOrganisationContext).toHaveBeenCalledWith(freshMockSupabase, 'org-123');
+    });
+
+    it('handles missing organisation context', () => {
+      mockUseOrganisations.mockReturnValue({
+        selectedOrganisation: null,
+        getUserRole: vi.fn().mockReturnValue('no_access'),
+        validateOrganisationAccess: vi.fn().mockResolvedValue(false),
+        ensureOrganisationContext: vi.fn().mockImplementation(() => {
+          throw new Error('Organisation context is required but not available');
+        }),
+        // Add other required properties
+      } as any);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      expect(() => result.current.getCurrentOrganisationId()).toThrow('Organisation context is required for data access');
+    });
+
+    it('validates organisation access before operations', async () => {
+      const mockValidateAccess = vi.fn().mockResolvedValue(true);
+      mockUseOrganisations.mockReturnValue({
+        selectedOrganisation: mockSelectedOrganisation,
+        getUserRole: vi.fn().mockReturnValue('member'),
+        validateOrganisationAccess: mockValidateAccess,
+        ensureOrganisationContext: vi.fn().mockReturnValue(mockSelectedOrganisation),
+        // Add other required properties
+      } as any);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureQuery('users', '*');
+      
+      // The hook doesn't call validateOrganisationAccess, it calls ensureOrganisationContext
+      expect(mockUseOrganisations().ensureOrganisationContext).toHaveBeenCalled();
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('handles missing user context', () => {
+      mockUseUnifiedAuth.mockReturnValue({
+        user: null,
+        session: null,
+        supabase: null,
+        isAuthenticated: false,
+        signOut: vi.fn(),
+        // Add other required properties
+      } as any);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      expect(() => result.current.getCurrentOrganisationId()).toThrow('No Supabase client available');
+    });
+
+    it('handles missing supabase client', () => {
+      mockUseUnifiedAuth.mockReturnValue({
+        user: mockUser,
+        session: mockSession,
+        supabase: null,
+        isAuthenticated: true,
+        signOut: vi.fn(),
+        // Add other required properties
+      } as any);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      expect(() => result.current.getCurrentOrganisationId()).toThrow('No Supabase client available');
+    });
+
+    it('handles organisation access validation failures', async () => {
+      mockUseOrganisations.mockReturnValue({
+        selectedOrganisation: mockSelectedOrganisation,
+        getUserRole: vi.fn().mockReturnValue('no_access'),
+        validateOrganisationAccess: vi.fn().mockResolvedValue(false),
+        // Add other required properties
+      } as any);
+
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await expect(result.current.secureQuery('users', '*')).rejects.toThrow();
+    });
+  });
+
+  describe('Security Features', () => {
+    it('prevents data leaks between organisations', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureQuery('event', '*');
+      
+      // Verify organisation_id filter is always applied
+      expect(freshMockQueryBuilder.eq).toHaveBeenCalledWith('organisation_id', 'org-123');
+    });
+
+    it('prevents organisation_id manipulation in inserts', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureInsert('users', { 
+        name: 'Test User',
+        organisation_id: 'malicious-org-id'
+      });
+      
+      expect(freshMockQueryBuilder.insert).toHaveBeenCalledWith({
+        name: 'Test User',
+        organisation_id: 'org-123' // Should override malicious value
+      });
+    });
+
+    it('prevents organisation_id manipulation in updates', async () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      await result.current.secureUpdate('users', { 
+        name: 'Updated User',
+        organisation_id: 'malicious-org-id'
+      }, { id: 'user-123' });
+      
+      expect(freshMockQueryBuilder.update).toHaveBeenCalledWith({
+        name: 'Updated User'
+        // organisation_id should be filtered out
+      });
+    });
+  });
+
+  describe('Performance', () => {
+    it('memoizes results to prevent unnecessary re-renders', () => {
+      const { result, rerender } = renderHook(() => useSecureDataAccess());
+      const initialSecureQuery = result.current.secureQuery;
+      const initialGetCurrentOrganisationId = result.current.getCurrentOrganisationId;
+      
+      // Re-render with same props
+      rerender();
+      
+      // Should not cause additional renders due to memoization
+      expect(result.current.secureQuery).toBe(initialSecureQuery);
+      expect(result.current.getCurrentOrganisationId).toBe(initialGetCurrentOrganisationId);
+    });
+
+    it('handles organisation changes efficiently', () => {
+      const { result, rerender } = renderHook(() => useSecureDataAccess());
+
+      expect(result.current.getCurrentOrganisationId()).toBe('org-123');
+
+      // Change organisation
+      const newOrganisation = { id: 'org-456', name: 'New Organisation' };
+      mockUseOrganisations.mockReturnValue({
+        selectedOrganisation: newOrganisation,
+        getUserRole: vi.fn().mockReturnValue('member'),
+        validateOrganisationAccess: vi.fn().mockResolvedValue(true),
+        ensureOrganisationContext: vi.fn().mockReturnValue(newOrganisation),
+        // Add other required properties
+      } as any);
+
+      rerender();
+
+      expect(result.current.getCurrentOrganisationId()).toBe('org-456');
+    });
+  });
+
+  describe('Integration with Providers', () => {
+    it('integrates with useUnifiedAuth hook correctly', () => {
+      renderHook(() => useSecureDataAccess());
+      expect(mockUseUnifiedAuth).toHaveBeenCalled();
+    });
+
+    it('integrates with useOrganisations hook correctly', () => {
+      renderHook(() => useSecureDataAccess());
+      expect(mockUseOrganisations).toHaveBeenCalled();
+    });
+
+    it('uses organisation context from provider', () => {
+      const { result } = renderHook(() => useSecureDataAccess());
+
+      expect(result.current.getCurrentOrganisationId()).toBe('org-123');
+    });
+
+    it('validates organisation access through provider', () => {
+      // This test is removed as validateOrganisationAccess is not used in useSecureDataAccess
+      // The hook only calls ensureOrganisationContext during operations
+      expect(true).toBe(true);
+    });
+  });
+});

package/src/hooks/useSecureDataAccess.ts

@@ -335,10 +335,13 @@ export function useSecureDataAccess(): SecureDataAccessReturn {
     // Set organisation context in database session
     await setOrganisationContextInSession(organisationId);
 
+    // Filter out organisation_id from data to prevent manipulation
+    const { organisation_id, ...secureData } = data;
+    
     // Build update query with organisation filter
     let query = supabase!
       .from(table)
-      .update(data);
+      .update(secureData);
 
     // Add organisation filter only if table has organisation_id column
     const tablesWithOrganisation = [

package/src/providers/InactivityProvider.tsx

@@ -75,7 +75,7 @@ export function InactivityProvider({
   // Production safety check for inactivity feature
   useEffect(() => {
     if (typeof window !== 'undefined') {
-      const isProduction = process.env.NODE_ENV === 'production';
+      const isProduction = import.meta.env.MODE === 'production';
       
       if (isProduction && dangerouslyDisableInactivity) {
         console.error('[InactivityProvider] CRITICAL: dangerouslyDisableInactivity is not allowed in production! Auto-enabling inactivity feature.');
@@ -89,7 +89,7 @@ export function InactivityProvider({
 
   // Inactivity tracking
   const isInactivityEnabled = typeof window !== 'undefined' && 
-    (process.env.NODE_ENV !== 'production' ? !dangerouslyDisableInactivity : true);
+    (import.meta.env.MODE !== 'production' ? !dangerouslyDisableInactivity : true);
 
   const {
     isIdle,