@jmruthers/pace-core 0.5.54 → 0.5.56

package/src/rbac/__tests__/rbac-integration.test.ts

@@ -0,0 +1,532 @@
+/**
+ * @file RBAC Integration Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Tests
+ * @since 1.0.0
+ * 
+ * Integration tests for complete RBAC permission flows.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createClient } from '@supabase/supabase-js';
+
+// Mock Supabase client
+const mockSupabase = {
+  rpc: vi.fn(),
+  from: vi.fn(() => ({
+    select: vi.fn(() => ({
+      eq: vi.fn(() => ({
+        single: vi.fn()
+      }))
+    }))
+  }))
+};
+
+// Test data
+const testUser = {
+  id: 'user-123',
+  email: 'test@example.com'
+};
+
+const testOrganisation = {
+  id: 'org-123',
+  name: 'Test Organisation'
+};
+
+const testEvent = {
+  id: 'event-123',
+  name: 'Test Event',
+  organisation_id: 'org-123'
+};
+
+const testApp = {
+  id: 'app-123',
+  name: 'CAKE',
+  is_active: true
+};
+
+describe('RBAC Integration Tests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('Complete Permission Flow', () => {
+    it('should handle user login → permission check → data access flow', async () => {
+      // 1. User logs in and session is tracked
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            session_id: 'session-123',
+            message: 'Session tracked successfully',
+            error_code: null
+          }],
+          error: null
+        })
+        // 2. Check if user has organisation access
+        .mockResolvedValueOnce({
+          data: [{ has_access: true, access_level: 'organisation', context_id: testOrganisation.id }],
+          error: null
+        })
+        // 3. Check page permission
+        .mockResolvedValueOnce({
+          data: true,
+          error: null
+        })
+        // 4. Get user permissions
+        .mockResolvedValueOnce({
+          data: [{
+            permission_type: 'organisation_access',
+            role_name: 'member',
+            has_permission: true,
+            granted_at: expect.any(String),
+            context_id: testOrganisation.id
+          }],
+          error: null
+        });
+
+      // Step 1: Track session
+      const sessionResult = await mockSupabase.rpc('rbac_session_track', {
+        p_user_id: testUser.id,
+        p_session_type: 'web',
+        p_organisation_id: testOrganisation.id
+      });
+
+      expect(sessionResult.data[0].success).toBe(true);
+
+      // Step 2: Validate organisation access
+      const accessResult = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'organisation',
+        p_resource_id: testOrganisation.id,
+        p_user_id: testUser.id
+      });
+
+      expect(accessResult.data[0].has_access).toBe(true);
+
+      // Step 3: Check page permission
+      const permissionResult = await mockSupabase.rpc('rbac_page_access_check', {
+        p_user_id: testUser.id,
+        p_app_id: testApp.id,
+        p_page_id: 'dashboard',
+        p_operation: 'read',
+        p_organisation_id: testOrganisation.id
+      });
+
+      expect(permissionResult.data).toBe(true);
+
+      // Step 4: Get all permissions
+      const permissionsResult = await mockSupabase.rpc('rbac_permissions_get', {
+        p_user_id: testUser.id,
+        p_organisation_id: testOrganisation.id
+      });
+
+      expect(permissionsResult.data[0].role_name).toBe('member');
+    });
+
+    it('should handle role grant → permission check → access granted flow', async () => {
+      // 1. Grant role to user
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            message: 'Role granted successfully',
+            role_id: 'role-123',
+            error_code: null
+          }],
+          error: null
+        })
+        // 2. Log the role grant
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            audit_id: 'audit-123',
+            message: 'Audit event logged successfully',
+            error_code: null
+          }],
+          error: null
+        })
+        // 3. Validate the role is active
+        .mockResolvedValueOnce({
+          data: [{
+            is_valid: true,
+            role_id: 'role-123',
+            granted_at: expect.any(String),
+            expires_at: null,
+            status: 'active'
+          }],
+          error: null
+        })
+        // 4. Check permission with new role
+        .mockResolvedValueOnce({
+          data: [{ has_permission: true, role_name: 'member', permission_source: 'organisation', granted_at: expect.any(String) }],
+          error: null
+        });
+
+      // Step 1: Grant role
+      const grantResult = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: testOrganisation.id,
+        p_granted_by: 'admin-123'
+      });
+
+      expect(grantResult.data[0].success).toBe(true);
+
+      // Step 2: Log audit event
+      const auditResult = await mockSupabase.rpc('rbac_audit_log', {
+        p_event_type: 'role_granted',
+        p_user_id: testUser.id,
+        p_organisation_id: testOrganisation.id,
+        p_permission: 'member',
+        p_metadata: { role_id: 'role-123' }
+      });
+
+      expect(auditResult.data[0].success).toBe(true);
+
+      // Step 3: Validate role is active
+      const validateResult = await mockSupabase.rpc('rbac_role_validate', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: testOrganisation.id
+      });
+
+      expect(validateResult.data[0].is_valid).toBe(true);
+
+      // Step 4: Check permission
+      const permissionResult = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_user_id: testUser.id,
+        p_organisation_id: testOrganisation.id
+      });
+
+      expect(permissionResult.data[0].has_permission).toBe(true);
+    });
+
+    it('should handle role revoke → permission check → access denied flow', async () => {
+      // 1. Revoke role from user
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            message: 'Role revoked successfully',
+            revoked_count: 1,
+            error_code: null
+          }],
+          error: null
+        })
+        // 2. Log the role revoke
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            audit_id: 'audit-456',
+            message: 'Audit event logged successfully',
+            error_code: null
+          }],
+          error: null
+        })
+        // 3. Validate the role is no longer active
+        .mockResolvedValueOnce({
+          data: [{
+            is_valid: false,
+            role_id: null,
+            granted_at: null,
+            expires_at: null,
+            status: 'inactive'
+          }],
+          error: null
+        })
+        // 4. Check permission (should be denied)
+        .mockResolvedValueOnce({
+          data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
+          error: null
+        });
+
+      // Step 1: Revoke role
+      const revokeResult = await mockSupabase.rpc('rbac_role_revoke', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: testOrganisation.id,
+        p_revoked_by: 'admin-123'
+      });
+
+      expect(revokeResult.data[0].success).toBe(true);
+
+      // Step 2: Log audit event
+      const auditResult = await mockSupabase.rpc('rbac_audit_log', {
+        p_event_type: 'role_revoked',
+        p_user_id: testUser.id,
+        p_organisation_id: testOrganisation.id,
+        p_permission: 'member',
+        p_metadata: { role_id: 'role-123' }
+      });
+
+      expect(auditResult.data[0].success).toBe(true);
+
+      // Step 3: Validate role is inactive
+      const validateResult = await mockSupabase.rpc('rbac_role_validate', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: testOrganisation.id
+      });
+
+      expect(validateResult.data[0].is_valid).toBe(false);
+
+      // Step 4: Check permission (should be denied)
+      const permissionResult = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_user_id: testUser.id,
+        p_organisation_id: testOrganisation.id
+      });
+
+      expect(permissionResult.data[0].has_permission).toBe(false);
+    });
+  });
+
+  describe('Cross-Organisation Access Prevention', () => {
+    it('should prevent access to other organisation\'s data', async () => {
+      const otherOrganisation = {
+        id: 'org-456',
+        name: 'Other Organisation'
+      };
+
+      // User tries to access other organisation's data
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{ has_access: false, access_level: 'none', context_id: null }],
+          error: null
+        })
+        .mockResolvedValueOnce({
+          data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
+          error: null
+        });
+
+      // Check access to other organisation
+      const accessResult = await mockSupabase.rpc('rbac_access_validate', {
+        p_user_id: testUser.id,
+        p_resource_type: 'organisation',
+        p_resource_id: otherOrganisation.id
+      });
+
+      expect(accessResult.data[0].has_access).toBe(false);
+
+      // Check permission in other organisation context
+      const permissionResult = await mockSupabase.rpc('rbac_permission_check', {
+        p_user_id: testUser.id,
+        p_operation: 'read',
+        p_page_name: 'dashboard',
+        p_organisation_id: otherOrganisation.id
+      });
+
+      expect(permissionResult.data[0].has_permission).toBe(false);
+    });
+
+    it('should prevent role grants to other organisations', async () => {
+      const otherOrganisation = {
+        id: 'org-456',
+        name: 'Other Organisation'
+      };
+
+      // Try to grant role in other organisation
+      mockSupabase.rpc.mockResolvedValueOnce({
+        data: [{
+          success: false,
+          message: 'Organisation not found',
+          role_id: null,
+          error_code: 'ORGANISATION_NOT_FOUND'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: otherOrganisation.id,
+        p_granted_by: 'admin-123'
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('ORGANISATION_NOT_FOUND');
+    });
+  });
+
+  describe('Super Admin Bypass', () => {
+    it('should allow super admin to access all resources', async () => {
+      // Super admin checks
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{ has_permission: true, role_name: 'super_admin', permission_source: 'global', granted_at: expect.any(String) }],
+          error: null
+        })
+        .mockResolvedValueOnce({
+          data: [{ has_access: true, access_level: 'super_admin', context_id: 'global' }],
+          error: null
+        })
+        .mockResolvedValueOnce({
+          data: [{
+            permission_type: 'all_permissions',
+            role_name: 'super_admin',
+            has_permission: true,
+            granted_at: expect.any(String),
+            context_id: 'global'
+          }],
+          error: null
+        });
+
+      // Check permission
+      const permissionResult = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'delete',
+        p_page_name: 'admin-panel',
+        p_user_id: testUser.id
+      });
+
+      expect(permissionResult.data[0].has_permission).toBe(true);
+      expect(permissionResult.data[0].role_name).toBe('super_admin');
+
+      // Check access to any resource
+      const accessResult = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'organisation',
+        p_resource_id: 'any-org-id',
+        p_user_id: testUser.id
+      });
+
+      expect(accessResult.data[0].has_access).toBe(true);
+      expect(accessResult.data[0].access_level).toBe('super_admin');
+
+      // Get all permissions
+      const permissionsResult = await mockSupabase.rpc('rbac_permissions_get', {
+        p_user_id: testUser.id
+      });
+
+      expect(permissionsResult.data[0].permission_type).toBe('all_permissions');
+    });
+  });
+
+  describe('Event-App Role Flow', () => {
+    it('should handle event-app role grant and permission check', async () => {
+      // 1. Grant event-app role
+      mockSupabase.rpc
+        .mockResolvedValueOnce({
+          data: [{
+            success: true,
+            message: 'Role granted successfully',
+            role_id: 'event-role-123',
+            error_code: null
+          }],
+          error: null
+        })
+        // 2. Check event access
+        .mockResolvedValueOnce({
+          data: [{ has_access: true, access_level: 'event', context_id: testEvent.id }],
+          error: null
+        })
+        // 3. Check page permission in event context
+        .mockResolvedValueOnce({
+          data: [{ has_permission: true, role_name: 'participant', permission_source: 'event_app', granted_at: expect.any(String) }],
+          error: null
+        });
+
+      // Step 1: Grant event-app role
+      const grantResult = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: testUser.id,
+        p_role_type: 'event_app',
+        p_role_name: 'participant',
+        p_context_id: `${testEvent.id}:${testApp.id}`,
+        p_granted_by: 'admin-123'
+      });
+
+      expect(grantResult.data[0].success).toBe(true);
+
+      // Step 2: Check event access
+      const accessResult = await mockSupabase.rpc('rbac_access_validate', {
+        p_resource_type: 'event',
+        p_resource_id: testEvent.id,
+        p_user_id: testUser.id
+      });
+
+      expect(accessResult.data[0].has_access).toBe(true);
+
+      // Step 3: Check page permission in event context
+      const permissionResult = await mockSupabase.rpc('rbac_permission_check', {
+        p_operation: 'read',
+        p_page_name: 'event-dashboard',
+        p_user_id: testUser.id,
+        p_event_id: testEvent.id,
+        p_app_id: testApp.id
+      });
+
+      expect(permissionResult.data[0].has_permission).toBe(true);
+      expect(permissionResult.data[0].role_name).toBe('participant');
+    });
+  });
+
+  describe('Error Handling and Edge Cases', () => {
+    it('should handle database errors gracefully', async () => {
+      mockSupabase.rpc.mockRejectedValueOnce(new Error('Database connection failed'));
+
+      try {
+        await mockSupabase.rpc('rbac_permission_check', {
+          p_operation: 'read',
+          p_page_name: 'dashboard',
+          p_user_id: testUser.id
+        });
+      } catch (error) {
+        expect(error).toBeInstanceOf(Error);
+        expect(error.message).toBe('Database connection failed');
+      }
+    });
+
+    it('should handle invalid parameters', async () => {
+      mockSupabase.rpc.mockResolvedValueOnce({
+        data: [{
+          success: false,
+          message: 'Invalid role type',
+          role_id: null,
+          error_code: 'INVALID_ROLE_TYPE'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: testUser.id,
+        p_role_type: 'invalid_type',
+        p_role_name: 'member'
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('INVALID_ROLE_TYPE');
+    });
+
+    it('should handle missing required parameters', async () => {
+      mockSupabase.rpc.mockResolvedValueOnce({
+        data: [{
+          success: false,
+          message: 'Organisation ID required',
+          role_id: null,
+          error_code: 'MISSING_ORGANISATION_ID'
+        }],
+        error: null
+      });
+
+      const result = await mockSupabase.rpc('rbac_role_grant', {
+        p_user_id: testUser.id,
+        p_role_type: 'organisation',
+        p_role_name: 'member',
+        p_context_id: null
+      });
+
+      expect(result.data[0].success).toBe(false);
+      expect(result.data[0].error_code).toBe('MISSING_ORGANISATION_ID');
+    });
+  });
+});