@jmruthers/pace-core 0.5.68 → 0.5.70

package/src/providers/services/UnifiedAuthProvider.tsx

@@ -0,0 +1,368 @@
+/**
+ * @file Unified Auth Provider
+ * @package @jmruthers/pace-core
+ * @module Providers/Services
+ * @since 0.1.0
+ *
+ * Unified authentication provider using service architecture.
+ * Combines all services in a single provider for backward compatibility.
+ */
+
+import React, { createContext, useContext, useMemo } from 'react';
+import { type SupabaseClient } from '@supabase/supabase-js';
+import { AuthServiceProvider } from './AuthServiceProvider';
+import { RBACServiceProvider } from './RBACServiceProvider';
+import { OrganisationServiceProvider } from './OrganisationServiceProvider';
+import { EventServiceProvider } from './EventServiceProvider';
+import { InactivityServiceProvider } from './InactivityServiceProvider';
+import { useAuthService } from '../../hooks/services/useAuthService';
+import { useRBACService } from '../../hooks/services/useRBACService';
+import { useOrganisationService } from '../../hooks/services/useOrganisationService';
+import { useEventService } from '../../hooks/services/useEventService';
+import { useInactivityService } from '../../hooks/services/useInactivityService';
+
+// Combined context type - now service-aware and secure
+export interface UnifiedAuthContextType {
+  // Auth state
+  user: any | null;
+  session: any | null;
+  isAuthenticated: boolean;
+  authLoading: boolean;
+  authError: any | null;
+  error: any | null; // Alias for authError for backward compatibility
+  supabase: SupabaseClient | null;
+  
+  // Auth methods
+  signIn: (email: string, password?: string) => Promise<{ error: any | null }>;
+  signUp: (email: string, password: string) => Promise<{ error: any | null }>;
+  signOut: () => Promise<{ error: any | null }>;
+  resetPassword: (email: string) => Promise<{ error: any | null }>;
+  updatePassword: (password: string) => Promise<{ error: any | null }>;
+  refreshSession: () => Promise<{ error: any | null }>;
+
+  // RBAC state
+  permissions: Record<string, boolean>;
+  roles: string[];
+  accessLevel: any;
+  rbacLoading: boolean;
+  rbacError: Error | null;
+  selectedEventId: string | null;
+  appConfig: any | null;
+  userEventAccess: any[];
+  eventAccessLoading: boolean;
+  selectedOrganisationId: string | null;
+  
+  // RBAC methods
+  hasPermission: (permission: string, orgId?: string) => boolean;
+  hasAnyPermission: (permissions: string[], orgId?: string) => boolean;
+  hasAllPermissions: (permissions: string[], orgId?: string) => boolean;
+  hasRole: (role: string) => boolean;
+  hasAccessLevel: (level: any) => boolean;
+  canAccess: (resource: string, action: string, orgId?: string) => boolean;
+  validatePermission: (permission: string, orgId?: string) => Promise<boolean>;
+  validateAccess: (resource: string, action: string, orgId?: string) => Promise<boolean>;
+  refreshPermissions: (eventId?: string, orgId?: string) => Promise<void>;
+  setSelectedEventId: (eventId: string | null) => void;
+  loadUserEventAccess: (orgId?: string) => Promise<void>;
+  getUserEventAccess: (eventId: string) => any | undefined;
+  requireOrganisationContext: () => string;
+
+  // Organisation state
+  selectedOrganisation: any | null;
+  organisations: any[];
+  userMemberships: any[];
+  organisationLoading: boolean;
+  organisationError: Error | null;
+  hasValidOrganisationContext: boolean;
+  isContextReady: boolean;
+  
+  // Organisation methods
+  switchOrganisation: (orgId: string) => Promise<void>;
+  getUserRole: (orgId?: string) => string;
+  validateOrganisationAccess: (orgId: string) => boolean;
+  refreshOrganisations: () => Promise<void>;
+  ensureOrganisationContext: () => any;
+  isOrganisationSecure: () => boolean;
+  getPrimaryOrganisation: () => any | null;
+
+  // Event state
+  events: any[];
+  selectedEvent: any | null;
+  eventLoading: boolean;
+  eventError: Error | null;
+  
+  // Event methods
+  setSelectedEvent: (event: any | null) => void;
+  refreshEvents: () => Promise<void>;
+
+  // Inactivity state
+  showInactivityWarning: boolean;
+  inactivityTimeRemaining: number;
+  isIdle: boolean;
+  timeRemaining: number;
+  showWarning: boolean;
+  isTracking: boolean;
+  
+  // Inactivity methods
+  resetActivity: () => void;
+  startTracking: () => void;
+  stopTracking: () => void;
+  handleIdleLogout: () => Promise<void>;
+  handleStaySignedIn: () => void;
+  handleSignOutNow: () => Promise<void>;
+
+  // Additional unified properties
+  appName: string;
+  isLoading: boolean;
+  hasErrors: boolean;
+}
+
+const UnifiedAuthContext = createContext<UnifiedAuthContextType | undefined>(undefined);
+
+export const useUnifiedAuth = () => {
+  const context = useContext(UnifiedAuthContext);
+  if (!context) {
+    throw new Error('useUnifiedAuth must be used within a UnifiedAuthProvider');
+  }
+  return context;
+};
+
+export interface UnifiedAuthProviderProps {
+  children: React.ReactNode;
+  supabaseClient: SupabaseClient;
+  appName: string;
+  persistState?: boolean;
+  enablePersistence?: boolean;
+  requireOrganisationContext?: boolean;
+  enableRBAC?: boolean;
+  
+  // Inactivity auto-logout configuration - MANDATORY for security
+  idleTimeoutMs: number; // REQUIRED: Inactivity timeout in milliseconds
+  warnBeforeMs: number; // REQUIRED: Warning time before logout in milliseconds
+  onIdleLogout: (reason: 'inactivity') => void; // REQUIRED: App handles redirect/navigation
+  renderInactivityWarning?: (args: {
+    timeRemaining: number;
+    onStaySignedIn: () => void;
+    onSignOutNow: () => void;
+  }) => React.ReactNode; // Optional custom warning UI
+  dangerouslyDisableInactivity?: boolean; // Dev-only; must not disable in production
+}
+
+// Internal component that combines all contexts
+function UnifiedAuthContextProvider({ 
+  children, 
+  appName,
+  ...props 
+}: UnifiedAuthProviderProps) {
+  const authService = useAuthService();
+  const rbacService = useRBACService();
+  const organisationService = useOrganisationService();
+  const eventService = useEventService();
+  const inactivityService = useInactivityService();
+
+  // Memoized combined context value
+  const contextValue = useMemo<UnifiedAuthContextType>(() => ({
+    // Auth state
+    user: authService.getUser(),
+    session: authService.getSession(),
+    isAuthenticated: authService.isAuthenticated(),
+    authLoading: authService.isLoading(),
+    authError: authService.getError(),
+    error: authService.getError(), // Alias for backward compatibility
+    supabase: authService.getSupabaseClient(),
+    
+    // Auth methods
+    signIn: authService.signIn.bind(authService),
+    signUp: authService.signUp.bind(authService),
+    signOut: authService.signOut.bind(authService),
+    resetPassword: authService.resetPassword.bind(authService),
+    updatePassword: authService.updatePassword.bind(authService),
+    refreshSession: authService.refreshSession.bind(authService),
+
+    // RBAC state
+    permissions: rbacService.getPermissions(),
+    roles: rbacService.getRoles(),
+    accessLevel: rbacService.getAccessLevel(),
+    rbacLoading: rbacService.isLoading(),
+    rbacError: rbacService.getError(),
+    selectedEventId: rbacService.getSelectedEventId(),
+    appConfig: rbacService.getAppConfig(),
+    userEventAccess: rbacService.getUserEventAccess(),
+    eventAccessLoading: rbacService.isEventAccessLoading(),
+    selectedOrganisationId: rbacService.getSelectedOrganisationId(),
+    
+    // RBAC methods
+    hasPermission: rbacService.hasPermission.bind(rbacService),
+    hasAnyPermission: rbacService.hasAnyPermission.bind(rbacService),
+    hasAllPermissions: rbacService.hasAllPermissions.bind(rbacService),
+    hasRole: rbacService.hasRole.bind(rbacService),
+    hasAccessLevel: rbacService.hasAccessLevel.bind(rbacService),
+    canAccess: rbacService.canAccess.bind(rbacService),
+    validatePermission: rbacService.validatePermission.bind(rbacService),
+    validateAccess: rbacService.validateAccess.bind(rbacService),
+    refreshPermissions: rbacService.refreshPermissions.bind(rbacService),
+    setSelectedEventId: rbacService.setSelectedEventId.bind(rbacService),
+    loadUserEventAccess: rbacService.loadUserEventAccess.bind(rbacService),
+    getUserEventAccess: rbacService.getUserEventAccess.bind(rbacService),
+    requireOrganisationContext: rbacService.requireOrganisationContext.bind(rbacService),
+
+    // Organisation state
+    selectedOrganisation: organisationService.getSelectedOrganisation(),
+    organisations: organisationService.getOrganisations(),
+    userMemberships: organisationService.getUserMemberships(),
+    organisationLoading: organisationService.isLoading(),
+    organisationError: organisationService.getError(),
+    hasValidOrganisationContext: organisationService.hasValidOrganisationContext(),
+    isContextReady: organisationService.isContextReady(),
+    
+    // Organisation methods
+    switchOrganisation: organisationService.switchOrganisation.bind(organisationService),
+    getUserRole: organisationService.getUserRole.bind(organisationService),
+    validateOrganisationAccess: organisationService.validateOrganisationAccess.bind(organisationService),
+    refreshOrganisations: organisationService.refreshOrganisations.bind(organisationService),
+    ensureOrganisationContext: organisationService.ensureOrganisationContext.bind(organisationService),
+    isOrganisationSecure: organisationService.isOrganisationSecure.bind(organisationService),
+    getPrimaryOrganisation: organisationService.getPrimaryOrganisation.bind(organisationService),
+
+    // Event state
+    events: eventService.getEvents(),
+    selectedEvent: eventService.getSelectedEvent(),
+    eventLoading: eventService.isLoading(),
+    eventError: eventService.getError(),
+    
+    // Event methods
+    setSelectedEvent: eventService.setSelectedEvent.bind(eventService),
+    refreshEvents: eventService.refreshEvents.bind(eventService),
+
+    // Inactivity state
+    showInactivityWarning: inactivityService.getShowInactivityWarning(),
+    inactivityTimeRemaining: inactivityService.getInactivityTimeRemaining(),
+    isIdle: inactivityService.isIdle(),
+    timeRemaining: inactivityService.getTimeRemaining(),
+    showWarning: inactivityService.isWarningShown(),
+    isTracking: inactivityService.isTracking(),
+    
+    // Inactivity methods
+    resetActivity: inactivityService.resetActivity.bind(inactivityService),
+    startTracking: inactivityService.startTracking.bind(inactivityService),
+    stopTracking: inactivityService.stopTracking.bind(inactivityService),
+    handleIdleLogout: inactivityService.handleIdleLogout.bind(inactivityService),
+    handleStaySignedIn: inactivityService.handleStaySignedIn.bind(inactivityService),
+    handleSignOutNow: inactivityService.handleSignOutNow.bind(inactivityService),
+
+    // Additional unified properties
+    appName,
+    isLoading: authService.isLoading() || rbacService.isLoading() || organisationService.isLoading() || eventService.isLoading(),
+    hasErrors: !!(authService.getError() || rbacService.getError() || organisationService.getError() || eventService.getError()),
+  }), [authService, rbacService, organisationService, eventService, inactivityService, appName]);
+
+  return (
+    <UnifiedAuthContext.Provider value={contextValue}>
+      {children}
+    </UnifiedAuthContext.Provider>
+  );
+}
+
+// Internal component that provides user/session to child providers
+function ServiceAwareProviders({ 
+  children, 
+  supabaseClient,
+  appName,
+  persistState,
+  enablePersistence,
+  requireOrganisationContext,
+  enableRBAC,
+  idleTimeoutMs,
+  warnBeforeMs,
+  onIdleLogout,
+  renderInactivityWarning,
+  dangerouslyDisableInactivity
+}: UnifiedAuthProviderProps) {
+  const authService = useAuthService();
+
+  return (
+    <RBACServiceProvider
+      supabaseClient={supabaseClient}
+      user={authService.getUser()}
+      session={authService.getSession()}
+      appName={appName}
+    >
+      <OrganisationServiceProvider
+        supabaseClient={supabaseClient}
+        user={authService.getUser()}
+        session={authService.getSession()}
+      >
+        <EventServiceProvider
+          supabaseClient={supabaseClient}
+          user={authService.getUser()}
+          session={authService.getSession()}
+          appName={appName}
+          selectedOrganisation={null} // Will be updated by OrganisationService
+          setSelectedEventId={(eventId: string | null) => {
+            // This will be handled by the RBACService
+          }}
+        >
+          <InactivityServiceProvider
+            supabaseClient={supabaseClient}
+            user={authService.getUser()}
+            session={authService.getSession()}
+            idleTimeoutMs={idleTimeoutMs}
+            warnBeforeMs={warnBeforeMs}
+            onIdleLogout={onIdleLogout}
+          >
+            <UnifiedAuthContextProvider
+              appName={appName}
+              supabaseClient={supabaseClient}
+              persistState={persistState}
+              enablePersistence={enablePersistence}
+              requireOrganisationContext={requireOrganisationContext}
+              enableRBAC={enableRBAC}
+              idleTimeoutMs={idleTimeoutMs}
+              warnBeforeMs={warnBeforeMs}
+              onIdleLogout={onIdleLogout}
+              renderInactivityWarning={renderInactivityWarning}
+              dangerouslyDisableInactivity={dangerouslyDisableInactivity}
+            >
+              {children}
+            </UnifiedAuthContextProvider>
+          </InactivityServiceProvider>
+        </EventServiceProvider>
+      </OrganisationServiceProvider>
+    </RBACServiceProvider>
+  );
+}
+
+export function UnifiedAuthProvider({
+  children,
+  supabaseClient,
+  appName,
+  persistState = true,
+  enablePersistence,
+  requireOrganisationContext = true,
+  enableRBAC = false,
+  idleTimeoutMs = 30 * 60 * 1000, // 30 minutes
+  warnBeforeMs = 60 * 1000, // 60 seconds
+  onIdleLogout,
+  renderInactivityWarning,
+  dangerouslyDisableInactivity = false
+}: UnifiedAuthProviderProps) {
+  return (
+    <AuthServiceProvider supabaseClient={supabaseClient}>
+      <ServiceAwareProviders
+        supabaseClient={supabaseClient}
+        appName={appName}
+        persistState={persistState}
+        enablePersistence={enablePersistence}
+        requireOrganisationContext={requireOrganisationContext}
+        enableRBAC={enableRBAC}
+        idleTimeoutMs={idleTimeoutMs}
+        warnBeforeMs={warnBeforeMs}
+        onIdleLogout={onIdleLogout}
+        renderInactivityWarning={renderInactivityWarning}
+        dangerouslyDisableInactivity={dangerouslyDisableInactivity}
+      >
+        {children}
+      </ServiceAwareProviders>
+    </AuthServiceProvider>
+  );
+}

package/src/providers/services/__tests__/AuthServiceProvider.integration.test.tsx

@@ -0,0 +1,210 @@
+/**
+ * @file Auth Service Provider Integration Tests
+ * @package @jmruthers/pace-core
+ * @module Providers/Services/__tests__
+ * @since 0.1.0
+ *
+ * Integration tests for AuthServiceProvider.
+ * Tests provider + hook integration and React component usage.
+ */
+
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import React from 'react';
+import { AuthServiceProvider, useAuthService } from '../AuthServiceProvider';
+import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
+
+// Mock Supabase client
+const createMockSupabaseClient = (): SupabaseClient => ({
+  auth: {
+    signInWithPassword: vi.fn(),
+    signUp: vi.fn(),
+    signOut: vi.fn(),
+    resetPasswordForEmail: vi.fn(),
+    updateUser: vi.fn(),
+    refreshSession: vi.fn(),
+    getSession: vi.fn(),
+    getUser: vi.fn(),
+    onAuthStateChange: vi.fn(),
+  },
+} as any);
+
+// Mock user and session
+const mockUser: User = {
+  id: 'test-user-id',
+  email: 'test@example.com',
+  created_at: '2023-01-01T00:00:00Z',
+  updated_at: '2023-01-01T00:00:00Z',
+  aud: 'authenticated',
+  role: 'authenticated',
+  user_metadata: {},
+  app_metadata: {},
+  identities: [],
+} as User;
+
+const mockSession: Session = {
+  access_token: 'test-access-token',
+  refresh_token: 'test-refresh-token',
+  expires_in: 3600,
+  expires_at: Date.now() + 3600000,
+  token_type: 'bearer',
+  user: mockUser,
+} as Session;
+
+// Test component that uses the auth service
+function TestComponent() {
+  const authService = useAuthService();
+  const [, forceUpdate] = React.useReducer(x => x + 1, 0);
+  
+  // Subscribe to auth service state changes
+  React.useEffect(() => {
+    const unsubscribe = authService.subscribe(() => {
+      forceUpdate();
+    });
+    return unsubscribe;
+  }, [authService]);
+  
+  return (
+    <div>
+      <div data-testid="user-id">{authService.getUser()?.id || 'no-user'}</div>
+      <div data-testid="is-authenticated">{authService.isAuthenticated().toString()}</div>
+      <div data-testid="is-loading">{authService.isLoading().toString()}</div>
+      <div data-testid="error">{authService.getError()?.message || 'no-error'}</div>
+    </div>
+  );
+}
+
+describe('AuthServiceProvider Integration', () => {
+  let mockSupabase: SupabaseClient;
+
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Provider Setup', () => {
+    it('should provide auth service to children', () => {
+      render(
+        <AuthServiceProvider supabaseClient={mockSupabase}>
+          <TestComponent />
+        </AuthServiceProvider>
+      );
+
+      expect(screen.getByTestId('user-id')).toHaveTextContent('no-user');
+      expect(screen.getByTestId('is-authenticated')).toHaveTextContent('false');
+      expect(screen.getByTestId('is-loading')).toHaveTextContent('true');
+      expect(screen.getByTestId('error')).toHaveTextContent('no-error');
+    });
+
+    it('should throw error when used outside provider', () => {
+      // Suppress console.error for this test
+      const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+      
+      expect(() => {
+        render(<TestComponent />);
+      }).toThrow('useAuthService must be used within AuthServiceProvider');
+      
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('Service Integration', () => {
+    it('should initialize service on mount', async () => {
+      const mockSubscription = { unsubscribe: vi.fn() };
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue(mockSubscription);
+
+      render(
+        <AuthServiceProvider supabaseClient={mockSupabase}>
+          <TestComponent />
+        </AuthServiceProvider>
+      );
+
+      // Service initialization happens in useEffect, need to wait briefly
+      await waitFor(() => {
+        expect(mockSupabase.auth.onAuthStateChange).toHaveBeenCalled();
+      }, { interval: 10 }); // Faster polling
+    });
+
+    it('should cleanup service on unmount', async () => {
+      const mockSubscription = { unsubscribe: vi.fn() };
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockReturnValue(mockSubscription);
+
+      const { unmount } = render(
+        <AuthServiceProvider supabaseClient={mockSupabase}>
+          <TestComponent />
+        </AuthServiceProvider>
+      );
+
+      // Wait for initialization
+      await waitFor(() => {
+        expect(mockSupabase.auth.onAuthStateChange).toHaveBeenCalled();
+      }, { interval: 10 });
+
+      unmount();
+
+      expect(mockSubscription.unsubscribe).toHaveBeenCalled();
+    });
+  });
+
+  describe('State Updates', () => {
+    it('should update component when service state changes', async () => {
+      const mockSubscription = { unsubscribe: vi.fn() };
+      let capturedCallback: any = null;
+      
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockImplementation((callback) => {
+        capturedCallback = callback;
+        return mockSubscription;
+      });
+
+      render(
+        <AuthServiceProvider supabaseClient={mockSupabase}>
+          <TestComponent />
+        </AuthServiceProvider>
+      );
+
+      // Wait for service initialization
+      await waitFor(() => {
+        expect(mockSupabase.auth.onAuthStateChange).toHaveBeenCalled();
+      }, { interval: 10 });
+
+      // Simulate auth state change using the captured callback
+      if (capturedCallback) {
+        capturedCallback('SIGNED_IN', mockSession);
+      }
+
+      // Wait for UI updates after state change
+      await waitFor(() => {
+        expect(screen.getByTestId('user-id')).toHaveTextContent('test-user-id');
+        expect(screen.getByTestId('is-authenticated')).toHaveTextContent('true');
+        expect(screen.getByTestId('is-loading')).toHaveTextContent('false');
+      }, { interval: 10 });
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should handle service initialization errors', async () => {
+      vi.mocked(mockSupabase.auth.onAuthStateChange).mockImplementation(() => {
+        throw new Error('Auth state change setup failed');
+      });
+
+      // Suppress console.error for this test
+      const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+      render(
+        <AuthServiceProvider supabaseClient={mockSupabase}>
+          <TestComponent />
+        </AuthServiceProvider>
+      );
+
+      // Error is logged during initialization
+      await waitFor(() => {
+        expect(consoleSpy).toHaveBeenCalled();
+      }, { interval: 10 });
+
+      consoleSpy.mockRestore();
+    });
+  });
+});