@jmruthers/pace-core 0.5.68 → 0.5.69

package/src/services/RBACService.ts

@@ -0,0 +1,522 @@
+/**
+ * @file RBAC Service
+ * @package @jmruthers/pace-core
+ * @module Services
+ * @since 0.1.0
+ *
+ * RBAC service implementation.
+ * Handles role-based access control, permissions, and event access management.
+ */
+
+import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
+import { BaseService } from './base/BaseService';
+import { IRBACService, UserEventAccess, AppConfig } from './interfaces/IRBACService';
+import { AccessLevel } from '../types/unified';
+import { DebugLogger } from '../utils/debugLogger';
+
+export class RBACService extends BaseService implements IRBACService {
+  private permissions: Record<string, boolean> = {};
+  private roles: string[] = [];
+  private accessLevel: AccessLevel = AccessLevel.VIEWER;
+  private rbacLoading = false;
+  private rbacError: Error | null = null;
+  private selectedEventId: string | null = null;
+  private appConfig: AppConfig | null = null;
+  private userEventAccess: UserEventAccess[] = [];
+  private eventAccessLoading = false;
+  private selectedOrganisationId: string | null = null;
+
+  // Dependencies
+  private supabaseClient: SupabaseClient | null = null;
+  private user: User | null = null;
+  private session: Session | null = null;
+  private appName: string = '';
+
+  constructor(supabaseClient: SupabaseClient, user: User | null, session: Session | null, appName: string) {
+    super();
+    this.supabaseClient = supabaseClient;
+    this.user = user;
+    this.session = session;
+    this.appName = appName;
+  }
+
+  // Update dependencies
+  updateDependencies(user: User | null, session: Session | null, appName: string): void {
+    this.user = user;
+    this.session = session;
+    this.appName = appName;
+    this.notify();
+  }
+
+  // RBAC state getters
+  getPermissions(): Record<string, boolean> {
+    return this.permissions;
+  }
+
+  getRoles(): string[] {
+    return this.roles;
+  }
+
+  getAccessLevel(): AccessLevel {
+    return this.accessLevel;
+  }
+
+  isLoading(): boolean {
+    return this.rbacLoading;
+  }
+
+  getError(): Error | null {
+    return this.rbacError;
+  }
+
+  getSelectedEventId(): string | null {
+    return this.selectedEventId;
+  }
+
+  getAppConfig(): AppConfig | null {
+    return this.appConfig;
+  }
+
+  getUserEventAccess(): UserEventAccess[] {
+    return this.userEventAccess;
+  }
+
+  isEventAccessLoading(): boolean {
+    return this.eventAccessLoading;
+  }
+
+  getSelectedOrganisationId(): string | null {
+    return this.selectedOrganisationId;
+  }
+
+  // RBAC methods
+  hasPermission(permission: string, orgId?: string): boolean {
+    return !!this.permissions[permission];
+  }
+
+  hasAnyPermission(permissions: string[], orgId?: string): boolean {
+    return permissions.some(p => !!this.permissions[p]);
+  }
+
+  hasAllPermissions(permissions: string[], orgId?: string): boolean {
+    return permissions.every(p => !!this.permissions[p]);
+  }
+
+  hasRole(role: string): boolean {
+    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
+    if (role.toLowerCase() === 'super_admin' || role.toLowerCase() === 'super') {
+      return isSuperAdmin;
+    }
+    return this.roles.includes(role);
+  }
+
+  hasAccessLevel(level: AccessLevel): boolean {
+    const levels = Object.values(AccessLevel);
+    return levels.indexOf(this.accessLevel) >= levels.indexOf(level);
+  }
+
+  canAccess(resource: string, action: string, orgId?: string): boolean {
+    const permission = `${resource}:${action}`;
+    return this.hasPermission(permission, orgId);
+  }
+
+  async validatePermission(permission: string, orgId?: string): Promise<boolean> {
+    return this.hasPermission(permission, orgId);
+  }
+
+  async validateAccess(resource: string, action: string, orgId?: string): Promise<boolean> {
+    return this.canAccess(resource, action, orgId);
+  }
+
+  async refreshPermissions(eventId?: string, orgId?: string): Promise<void> {
+    if (!this.supabaseClient || !this.user || !this.appConfig || !this.session) {
+      DebugLogger.log('RBACService', 'refreshPermissions: Missing required dependencies, clearing permissions');
+      this.permissions = {};
+      this.roles = [];
+      this.accessLevel = AccessLevel.VIEWER;
+      this.notify();
+      return;
+    }
+
+    // Check for super admin first - admin override should happen regardless of app configuration
+    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
+    if (isSuperAdmin) {
+      this.permissions = {
+        'admin:create': true,
+        'admin:read': true,
+        'admin:update': true,
+        'admin:delete': true,
+        'users:create': true,
+        'users:read': true,
+        'users:update': true,
+        'users:delete': true,
+        'events:create': true,
+        'events:read': true,
+        'events:update': true,
+        'events:delete': true
+      };
+      this.roles = ['super_admin'];
+      this.accessLevel = AccessLevel.ADMIN;
+      this.notify();
+      return;
+    }
+
+    // Determine if we should load permissions without an event
+    const shouldLoadDirectPermissions = !eventId && !this.appConfig.requires_event;
+    const shouldLoadEventPermissions = eventId;
+    const shouldClearPermissions = !eventId && this.appConfig.requires_event;
+
+    // If no eventId and app requires events, clear permissions
+    if (shouldClearPermissions) {
+      this.permissions = {};
+      this.roles = [];
+      this.accessLevel = AccessLevel.VIEWER;
+      this.notify();
+      return;
+    }
+
+    // Only proceed if we should load permissions
+    if (!shouldLoadDirectPermissions && !shouldLoadEventPermissions) {
+      return;
+    }
+
+    this.rbacLoading = true;
+    this.rbacError = null;
+    this.notify();
+
+    try {
+      // Use the same app name resolution as PagePermissionGuard
+      const { getCurrentAppName } = await import('../utils/appNameResolver');
+      const resolvedAppName = getCurrentAppName() || this.appName;
+      
+      // First resolve app name to app_id
+      const { data: appData, error: appError } = await this.supabaseClient
+        .from('rbac_apps')
+        .select('id')
+        .eq('name', resolvedAppName)
+        .eq('is_active', true)
+        .single();
+
+      if (appError || !appData) {
+        console.warn('App not found or inactive:', resolvedAppName);
+        this.rbacLoading = false;
+        this.notify();
+        return;
+      }
+
+      const { data, error } = await this.supabaseClient.rpc('rbac_permissions_get', {
+        p_user_id: this.user.id,
+        p_app_id: appData.id,
+        p_event_id: eventId || null,
+        p_organisation_id: orgId || this.selectedOrganisationId || null
+      });
+
+      if (error) {
+        throw error;
+      }
+
+      const { permissions, roles, access_level } = this.transformRBACPermissions(data, this.appName);
+
+      this.permissions = permissions;
+      this.roles = roles;
+      this.accessLevel = access_level;
+    } catch (err: any) {
+      this.rbacError = err;
+    } finally {
+      this.rbacLoading = false;
+      this.notify();
+    }
+  }
+
+  setSelectedEventId(eventId: string | null): void {
+    this.selectedEventId = eventId;
+    this.notify();
+  }
+
+  async loadUserEventAccess(orgId?: string): Promise<void> {
+    if (!this.supabaseClient || !this.user || !this.session) {
+      DebugLogger.log('RBACService', 'loadUserEventAccess: Missing required dependencies, clearing event access');
+      this.userEventAccess = [];
+      this.notify();
+      return;
+    }
+
+    this.eventAccessLoading = true;
+    this.notify();
+
+    try {
+      // Use the same app name resolution as PagePermissionGuard
+      const { getCurrentAppName } = await import('../utils/appNameResolver');
+      const resolvedAppName = getCurrentAppName() || this.appName;
+      
+      // First resolve app name to app_id
+      const { data: appData, error: appError } = await this.supabaseClient
+        .from('rbac_apps')
+        .select('id')
+        .eq('name', resolvedAppName)
+        .eq('is_active', true)
+        .single();
+
+      if (appError || !appData) {
+        console.warn('App not found or inactive:', resolvedAppName);
+        this.eventAccessLoading = false;
+        this.notify();
+        return;
+      }
+
+      const { data, error } = await this.supabaseClient
+        .from('rbac_event_app_roles')
+        .select(`
+          event_id,
+          role,
+          granted_at
+        `)
+        .eq('user_id', this.user.id)
+        .eq('app_id', appData.id);
+
+      if (error) {
+        console.error('Failed to load user event access:', error);
+        this.userEventAccess = [];
+        this.notify();
+        return;
+      }
+
+      const eventAccess = data?.map(item => ({
+        event_id: item.event_id,
+        event_name: (item as any).event_name || 'Unknown Event', // Event details not available in this query
+        event_description: (item as any).event_description || null, // Not available in this schema
+        start_date: (item as any).start_date || '', // Event date not available in this query
+        end_date: (item as any).end_date || '', // Event date not available in this query
+        event_status: (item as any).event_status || 'unknown', // Not available in this schema
+        app_id: (item as any).app_id || appData.id,
+        access_level: (item as any).access_level || item.role, // Map role to access_level
+        granted_at: item.granted_at,
+        organisation_id: (item as any).organisation_id || '' // Will be populated from event's organisation_id if needed
+      })) || [];
+
+      this.userEventAccess = eventAccess;
+    } catch (error) {
+      console.error('Error loading user event access:', error);
+      this.userEventAccess = [];
+    } finally {
+      this.eventAccessLoading = false;
+      this.notify();
+    }
+  }
+
+  getUserEventAccessById(eventId: string): UserEventAccess | undefined {
+    return this.userEventAccess.find(access => access.event_id === eventId);
+  }
+
+  requireOrganisationContext(): string {
+    if (!this.selectedOrganisationId) {
+      throw new Error('Organisation context is required but not available');
+    }
+    return this.selectedOrganisationId;
+  }
+
+  // Lifecycle methods
+  async initialize(): Promise<void> {
+    await super.initialize();
+    await this.loadAppConfig();
+    
+    // Load permissions for regular users after app config is loaded
+    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
+    if (!isSuperAdmin && this.appConfig) {
+      await this.refreshPermissions(this.selectedEventId || undefined);
+    }
+    
+    await this.loadPersistedState();
+  }
+
+  cleanup(): void {
+    super.cleanup();
+  }
+
+  protected async doInitialize(): Promise<void> {
+    // Set super admin roles and permissions based on user metadata
+    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
+    if (isSuperAdmin) {
+      this.roles = ['super_admin'];
+      this.accessLevel = AccessLevel.ADMIN;
+      // Set super admin permissions immediately
+      this.permissions = {
+        'admin:create': true,
+        'admin:read': true,
+        'admin:update': true,
+        'admin:delete': true,
+        'users:create': true,
+        'users:read': true,
+        'users:update': true,
+        'users:delete': true,
+        'events:create': true,
+        'events:read': true,
+        'events:update': true,
+        'events:delete': true
+      };
+    } else {
+      this.roles = [];
+      this.accessLevel = AccessLevel.VIEWER;
+      this.permissions = {};
+    }
+  }
+
+  protected doCleanup(): void {
+    // No specific cleanup needed
+  }
+
+  private async loadAppConfig(): Promise<void> {
+    if (!this.supabaseClient) return;
+
+    try {
+      // Use the same app name resolution as PagePermissionGuard
+      const { getCurrentAppName } = await import('../utils/appNameResolver');
+      const resolvedAppName = getCurrentAppName() || this.appName;
+      
+      // First resolve app name to app_id
+      const { data: appData, error: appError } = await this.supabaseClient
+        .from('rbac_apps')
+        .select('id')
+        .eq('name', resolvedAppName)
+        .eq('is_active', true)
+        .single();
+
+      if (appError || !appData) {
+        console.warn('App not found or inactive:', resolvedAppName);
+        this.appConfig = {
+          supports_direct_access: false,
+          requires_event: true
+        };
+        return;
+      }
+
+      const response = await this.supabaseClient.rpc('get_app_config', {
+        app_id: appData.id
+      });
+      
+      const { data } = response || {};
+
+      if (data && data.length > 0) {
+        this.appConfig = {
+          supports_direct_access: false,
+          requires_event: data[0].requires_event
+        };
+      } else {
+        // Default configuration if app not found
+        this.appConfig = {
+          supports_direct_access: false,
+          requires_event: true
+        };
+      }
+    } catch (error) {
+      console.warn('Failed to load app configuration:', error);
+      // Default configuration on error
+      this.appConfig = {
+        supports_direct_access: false,
+        requires_event: true
+      };
+    }
+  }
+
+  private async loadPersistedState(): Promise<void> {
+    try {
+      const persistedEvent = localStorage.getItem('pace-core-selected-event');
+      if (persistedEvent) {
+        this.selectedEventId = JSON.parse(persistedEvent);
+      }
+    } catch (error) {
+      console.warn("Clearing corrupted localStorage data");
+      localStorage.removeItem('pace-core-selected-event');
+    }
+  }
+
+  private transformRBACPermissions(rbacData: any[], appName: string) {
+    const permissions: Record<string, boolean> = {};
+    let roles: string[] = [];
+    let access_level: AccessLevel = AccessLevel.VIEWER;
+
+    if (!rbacData || !Array.isArray(rbacData)) {
+      return { permissions: {}, roles: ['viewer'], access_level: AccessLevel.VIEWER };
+    }
+
+    // Check for super admin first
+    const superAdminPerm = rbacData.find((p: any) => p.permission_type === 'all_permissions');
+    if (superAdminPerm) {
+      return { 
+        permissions: { 'all:all': true } as Record<string, boolean>, 
+        roles: ['super'], 
+        access_level: AccessLevel.SUPER 
+      };
+    }
+
+    // Process event-app permissions
+    const eventAppPerms = rbacData.filter((p: any) => p.permission_type === 'event_app_access');
+    if (eventAppPerms.length > 0) {
+      const role = eventAppPerms[0].role_name;
+      
+      // Map RBAC roles to AccessLevel
+      switch (role) {
+        case 'event_admin':
+          access_level = AccessLevel.ADMIN;
+          roles = ['admin'];
+          break;
+        case 'planner':
+          access_level = AccessLevel.PLANNER;
+          roles = ['planner'];
+          break;
+        case 'participant':
+          access_level = AccessLevel.PARTICIPANT;
+          roles = ['participant'];
+          break;
+        case 'editor':
+          access_level = AccessLevel.EDITOR;
+          roles = ['editor'];
+          break;
+        case 'viewer':
+        default:
+          access_level = AccessLevel.VIEWER;
+          roles = ['viewer'];
+          break;
+      }
+
+      // Set permissions from the RPC response
+      eventAppPerms.forEach((perm: any) => {
+        if (perm.permission) {
+          permissions[perm.permission] = true;
+        }
+      });
+
+      // For now, we'll set basic permissions based on role
+      // In a full implementation, you'd want to fetch page-specific permissions
+      const basePermissions = ['read'];
+      if (['event_admin', 'planner'].includes(role)) {
+        basePermissions.push('create', 'update');
+      }
+      if (role === 'event_admin') {
+        basePermissions.push('delete');
+      }
+
+      // Set permissions for all pages (simplified approach)
+      // In a real implementation, you'd want to get actual page permissions
+      basePermissions.forEach(operation => {
+        permissions[`default:${operation}`] = true;
+      });
+    }
+
+    // Process organisation permissions
+    const orgPerms = rbacData.filter((p: any) => p.permission_type === 'organisation_access');
+    if (orgPerms.length > 0) {
+      const role = orgPerms[0].role_name;
+      if (role === 'org_admin') {
+        access_level = AccessLevel.ADMIN;
+        roles = ['admin'];
+        // Org admins get all permissions
+        ['create', 'read', 'update', 'delete'].forEach(operation => {
+          permissions[`default:${operation}`] = true;
+        });
+      }
+    }
+
+    return { permissions, roles, access_level };
+  }
+}