@jmruthers/pace-core 0.5.54 → 0.5.56

package/src/rbac/audit.test.ts

@@ -0,0 +1,485 @@
+/**
+ * @file RBAC Audit Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Audit
+ * @since 1.0.0
+ * 
+ * Comprehensive tests for the RBAC audit system covering event emission, manager lifecycle, and batch operations.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { 
+  RBACAuditManager, 
+  createAuditManager, 
+  setGlobalAuditManager, 
+  getGlobalAuditManager,
+  emitAuditEvent
+} from './audit';
+import { 
+  PermissionCheckAuditEvent,
+  PermissionDeniedAuditEvent,
+  RoleGrantedAuditEvent,
+  RoleRevokedAuditEvent,
+  RLSDeniedAuditEvent
+} from './audit';
+import { UUID, AuditEventSource } from './types';
+import { Database } from '../types/database';
+
+// Mock Supabase client
+const createMockSupabaseClient = () => {
+  const mockInsert = vi.fn().mockResolvedValue({ data: null, error: null });
+  const mockSelect = vi.fn().mockReturnThis();
+  const mockEq = vi.fn().mockReturnThis();
+  const mockOrder = vi.fn().mockReturnThis();
+  const mockLimit = vi.fn().mockReturnThis();
+  
+  const mockFrom = vi.fn(() => ({
+    insert: mockInsert,
+    select: mockSelect,
+    eq: mockEq,
+    order: mockOrder,
+    limit: mockLimit,
+  }));
+
+  return {
+    from: mockFrom,
+    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+    // Add the mocked methods directly to the client for the (client as any) pattern
+    insert: mockInsert,
+    select: mockSelect,
+    eq: mockEq,
+    order: mockOrder,
+    limit: mockLimit,
+  };
+};
+
+describe('RBACAuditManager', () => {
+  let auditManager: RBACAuditManager;
+  let mockSupabase: any;
+
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+    auditManager = new RBACAuditManager(mockSupabase as any);
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Permission Check Events', () => {
+    it('emits permission check events correctly', async () => {
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        pageId: 'page-202' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        bypass: false,
+        duration_ms: 150,
+        metadata: { ip: '192.168.1.1' }
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'permission_check',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            event_id: 'event-789',
+            app_id: 'app-101',
+            page_id: 'page-202',
+            permission: 'read:users',
+            decision: true,
+            source: 'api',
+            bypass: false,
+            duration_ms: 150,
+            metadata: { ip: '192.168.1.1' }
+          })
+        ])
+      );
+    });
+
+    it('handles permission check events without optional fields', async () => {
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: false,
+        source: 'ui' as AuditEventSource,
+        duration_ms: 50
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'permission_check',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            permission: 'read:users',
+            decision: false,
+            source: 'ui',
+            duration_ms: 50
+          })
+        ])
+      );
+    });
+  });
+
+  describe('Permission Denied Events', () => {
+    it('emits permission denied events correctly', async () => {
+      const event: PermissionDeniedAuditEvent = {
+        type: 'permission_denied',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        pageId: 'page-202' as UUID,
+        permission: 'manage:users',
+        source: 'api' as AuditEventSource,
+        metadata: { reason: 'Insufficient role' }
+      };
+
+      await auditManager.emitPermissionDenied(event);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'permission_denied',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            event_id: 'event-789',
+            app_id: 'app-101',
+            page_id: 'page-202',
+            permission: 'manage:users',
+            source: 'api',
+            metadata: { reason: 'Insufficient role' }
+          })
+        ])
+      );
+    });
+  });
+
+  describe('Role Granted Events', () => {
+    it('emits role granted events correctly', async () => {
+      const event: RoleGrantedAuditEvent = {
+        type: 'role_granted',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        role: 'org_admin',
+        grantedBy: 'admin-456' as UUID,
+        metadata: { reason: 'Promotion' }
+      };
+
+      await auditManager.emitRoleGranted(event);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'role_granted',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            event_id: 'event-789',
+            app_id: 'app-101',
+            source: 'api',
+            metadata: { reason: 'Promotion' }
+          })
+        ])
+      );
+    });
+  });
+
+  describe('Role Revoked Events', () => {
+    it('emits role revoked events correctly', async () => {
+      const event: RoleRevokedAuditEvent = {
+        type: 'role_denied',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        role: 'org_admin',
+        revokedBy: 'admin-456' as UUID,
+        metadata: { reason: 'Policy violation' }
+      };
+
+      await auditManager.emitRoleRevoked(event);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'role_denied',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            event_id: 'event-789',
+            app_id: 'app-101',
+            source: 'api',
+            metadata: { reason: 'Policy violation' }
+          })
+        ])
+      );
+    });
+  });
+
+  describe('RLS Denied Events', () => {
+    it('emits RLS denied events correctly', async () => {
+      const event: RLSDeniedAuditEvent = {
+        type: 'rls_denied',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        eventId: 'event-789',
+        appId: 'app-101' as UUID,
+        tableName: 'users',
+        operation: 'SELECT',
+        source: 'rls' as AuditEventSource,
+        metadata: { query: 'SELECT * FROM users' }
+      };
+
+      await auditManager.emitRLSDenied(event);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(mockSupabase.insert).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({
+            event_type: 'rls_denied',
+            user_id: 'user-123',
+            organisation_id: 'org-456',
+            event_id: 'event-789',
+            app_id: 'app-101',
+            source: 'rls',
+            metadata: { query: 'SELECT * FROM users' }
+          })
+        ])
+      );
+    });
+  });
+
+  describe('Batch Operations', () => {
+    it('emits multiple events in batch', async () => {
+      const events = [
+        {
+          type: 'permission_check' as const,
+          userId: 'user-123' as UUID,
+          organisationId: 'org-456' as UUID,
+          permission: 'read:users',
+          decision: true,
+          source: 'api' as AuditEventSource,
+          duration_ms: 100
+        },
+        {
+          type: 'permission_check' as const,
+          userId: 'user-123' as UUID,
+          organisationId: 'org-456' as UUID,
+          permission: 'write:users',
+          decision: false,
+          source: 'api' as AuditEventSource,
+          duration_ms: 150
+        }
+      ];
+
+      // Emit events individually since emitBatch doesn't exist
+      for (const event of events) {
+        await auditManager.emitPermissionCheck(event);
+      }
+
+      expect(mockSupabase.insert).toHaveBeenCalledTimes(2);
+      expect(mockSupabase.insert).toHaveBeenCalledTimes(2);
+    });
+
+    it('handles empty batch gracefully', async () => {
+      // Test with no events - should not call insert
+      expect(mockSupabase.insert).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('handles database errors gracefully', async () => {
+      mockSupabase.from().insert.mockResolvedValue({
+        data: null,
+        error: { message: 'Database error' }
+      });
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      // Should not throw, but log error
+      await expect(auditManager.emitPermissionCheck(event)).resolves.not.toThrow();
+    });
+
+    it('handles network errors gracefully', async () => {
+      mockSupabase.from().insert.mockRejectedValue(new Error('Network error'));
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100
+      };
+
+      // Should not throw, but log error
+      await expect(auditManager.emitPermissionCheck(event)).resolves.not.toThrow();
+    });
+  });
+
+  describe('Event Retrieval', () => {
+    it('retrieves audit events for user', async () => {
+      const mockEvents = [
+        {
+          id: 'event-1',
+          event_type: 'permission_check',
+          user_id: 'user-123',
+          created_at: '2023-01-01T00:00:00Z'
+        }
+      ];
+
+      // Mock the chained calls
+      const mockLimit = vi.fn().mockResolvedValue({
+        data: mockEvents,
+        error: null
+      });
+      const mockOrder = vi.fn().mockReturnValue({ limit: mockLimit });
+      const mockEq = vi.fn().mockReturnValue({ order: mockOrder });
+      const mockSelect = vi.fn().mockReturnValue({ eq: mockEq });
+      
+      mockSupabase.from.mockReturnValue({ select: mockSelect });
+
+      const events = await auditManager.getUserAuditEvents('user-123' as UUID, 10);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(events).toEqual(mockEvents);
+    });
+
+    it('retrieves audit events for organisation', async () => {
+      const mockEvents = [
+        {
+          id: 'event-1',
+          event_type: 'permission_check',
+          organisation_id: 'org-456',
+          created_at: '2023-01-01T00:00:00Z'
+        }
+      ];
+
+      // Mock the chained calls
+      const mockLimit = vi.fn().mockResolvedValue({
+        data: mockEvents,
+        error: null
+      });
+      const mockOrder = vi.fn().mockReturnValue({ limit: mockLimit });
+      const mockEq = vi.fn().mockReturnValue({ order: mockOrder });
+      const mockSelect = vi.fn().mockReturnValue({ eq: mockEq });
+      
+      mockSupabase.from.mockReturnValue({ select: mockSelect });
+
+      const events = await auditManager.getOrganisationAuditEvents('org-456' as UUID, 10);
+
+      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
+      expect(events).toEqual(mockEvents);
+    });
+  });
+});
+
+describe('Global Audit Manager', () => {
+  let mockSupabase: any;
+
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    // Reset global state
+    setGlobalAuditManager(null as any);
+  });
+
+  it('creates and sets global audit manager', () => {
+    const manager = createAuditManager(mockSupabase as any);
+    setGlobalAuditManager(manager);
+
+    const globalManager = getGlobalAuditManager();
+    expect(globalManager).toBe(manager);
+  });
+
+  it('emits events through global manager', async () => {
+    const manager = createAuditManager(mockSupabase as any);
+    setGlobalAuditManager(manager);
+
+    const event: PermissionCheckAuditEvent = {
+      type: 'permission_check',
+      userId: 'user-123' as UUID,
+      organisationId: 'org-456' as UUID,
+      permission: 'read:users',
+      decision: true,
+      source: 'api' as AuditEventSource,
+      duration_ms: 100
+    };
+
+    await emitAuditEvent(event);
+
+    expect(mockSupabase.insert).toHaveBeenCalled();
+  });
+
+  it('handles missing global manager gracefully', async () => {
+    setGlobalAuditManager(null as any);
+
+    const event: PermissionCheckAuditEvent = {
+      type: 'permission_check',
+      userId: 'user-123' as UUID,
+      organisationId: 'org-456' as UUID,
+      permission: 'read:users',
+      decision: true,
+      source: 'api' as AuditEventSource,
+      duration_ms: 100
+    };
+
+    // Should not throw
+    await expect(emitAuditEvent(event)).resolves.not.toThrow();
+  });
+});
+
+describe('Audit Event Types', () => {
+  it('defines correct event type values', () => {
+    const eventTypes = [
+      'permission_check',
+      'permission_denied',
+      'role_granted',
+      'role_denied',
+      'rls_denied'
+    ];
+
+    eventTypes.forEach(type => {
+      expect(typeof type).toBe('string');
+      expect(type.length).toBeGreaterThan(0);
+    });
+  });
+
+  it('defines correct source values', () => {
+    const sources: AuditEventSource[] = ['api', 'ui', 'middleware', 'rls'];
+
+    sources.forEach(source => {
+      expect(['api', 'ui', 'middleware', 'rls']).toContain(source);
+    });
+  });
+});

package/src/rbac/audit.ts

@@ -30,6 +30,8 @@ export interface PermissionCheckAuditEvent {
   source: AuditEventSource;
   bypass?: boolean;
   duration_ms: number;
+  cache_hit?: boolean;
+  cache_source?: 'memory' | 'database' | 'rpc';
   metadata?: Record<string, any>;
 }
 
@@ -163,7 +165,11 @@ export class RBACAuditManager {
         source: 'source' in event ? event.source : 'api', // Default to 'api' if not provided
         bypass: 'bypass' in event ? event.bypass : undefined,
         duration_ms: 'duration_ms' in event ? event.duration_ms : undefined,
-        metadata: event.metadata || {},
+        metadata: {
+          ...event.metadata,
+          cache_hit: 'cache_hit' in event ? event.cache_hit : undefined,
+          cache_source: 'cache_source' in event ? event.cache_source : undefined,
+        },
       };
 
       const { error } = await (this.supabase as any)