@jmruthers/pace-core 0.5.68 → 0.5.70

package/src/rbac/components/__tests__/RoleBasedRouter.test.tsx

@@ -120,11 +120,7 @@ describe('RoleBasedRouter Component', () => {
     });
   });
 
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  describe('Rendering', () => {
+    describe('Rendering', () => {
     it('renders children when user has permission', async () => {
       mockUseCan.mockReturnValue({
         can: true,
@@ -143,7 +139,7 @@ describe('RoleBasedRouter Component', () => {
       await waitFor(() => {
         expect(screen.getByTestId('test-component')).toBeInTheDocument();
         expect(screen.getByText('App Content')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
 
     it('renders unauthorized component when user lacks permission', async () => {
@@ -167,7 +163,7 @@ describe('RoleBasedRouter Component', () => {
       await waitFor(() => {
         expect(screen.getByTestId('test-unauthorized')).toBeInTheDocument();
         expect(screen.getByText('Unauthorized: /dashboard - Insufficient permissions')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
 
     it('shows loading state while checking permissions', () => {
@@ -207,7 +203,7 @@ describe('RoleBasedRouter Component', () => {
       await waitFor(() => {
         expect(screen.getByTestId('test-component')).toBeInTheDocument();
         expect(screen.getByText('App Content')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
   });
 
@@ -229,7 +225,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
 
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
@@ -261,7 +257,7 @@ describe('RoleBasedRouter Component', () => {
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.getByText('You don\'t have permission to access')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
 
     it('handles routes not found in configuration', async () => {
@@ -353,7 +349,7 @@ describe('RoleBasedRouter Component', () => {
         expect(screen.getByTestId('context-consumer')).toBeInTheDocument();
         expect(screen.getByTestId('strict-mode')).toHaveTextContent('true');
         expect(screen.getByTestId('audit-log')).toHaveTextContent('false');
-      });
+      }, { interval: 10 });
     });
 
     it('throws error when useRoleBasedRouter is used outside provider', () => {
@@ -392,7 +388,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
 
       expect(onRouteAccessSpy).toHaveBeenCalledWith(
         '/dashboard',
@@ -465,7 +461,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('history-length')).toHaveTextContent('1');
-      });
+      }, { interval: 10 });
     });
 
     it('provides accessible routes', async () => {
@@ -493,7 +489,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('accessible-routes')).toHaveTextContent('3');
-      });
+      }, { interval: 10 });
     });
 
     it('provides route configuration', async () => {
@@ -521,7 +517,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('route-config')).toHaveTextContent('/dashboard');
-      });
+      }, { interval: 10 });
     });
   });
 
@@ -545,7 +541,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
 
       expect(consoleSpy).not.toHaveBeenCalledWith(
         expect.stringContaining('STRICT MODE VIOLATION')
@@ -577,7 +573,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
 
       expect(onRouteAccessSpy).not.toHaveBeenCalled();
     });
@@ -607,7 +603,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByTestId('history-length')).toHaveTextContent('1');
-      });
+      }, { interval: 10 });
     });
   });
 
@@ -635,7 +631,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
 
       expect(mockUseCan).toHaveBeenCalledWith(
         '',
@@ -672,7 +668,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
 
     it('handles permission check errors', async () => {
@@ -693,7 +689,7 @@ describe('RoleBasedRouter Component', () => {
 
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
+      }, { interval: 10 });
     });
   });
 
@@ -735,7 +731,7 @@ describe('RoleBasedRouter Component', () => {
           'admin:system',
           'admin'
         );
-      });
+      }, { interval: 10 });
     });
   });
 });

package/src/rbac/config.test.ts

@@ -32,11 +32,7 @@ describe('RBAC Configuration', () => {
     vi.clearAllMocks();
   });
 
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  describe('Configuration Creation', () => {
+    describe('Configuration Creation', () => {
     it('creates configuration with required fields', () => {
       const config: RBACConfig = {
         supabase: mockSupabase as any,

package/src/rbac/hooks/useCan.test.ts

@@ -32,15 +32,7 @@ describe('useCan Hook', () => {
   const mockIsPermitted = vi.mocked(isPermitted);
   const mockIsPermittedCached = vi.mocked(isPermittedCached);
 
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  describe('Permission Checking', () => {
+      describe('Permission Checking', () => {
     it('returns true for allowed permissions', async () => {
       mockIsPermitted.mockResolvedValue(true);
 
@@ -353,6 +345,215 @@ describe('useCan Hook', () => {
     });
   });
 
+  describe('Role-Based Permission Scenarios', () => {
+    it('allows super admin permissions', async () => {
+      mockIsPermitted.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'manage:organisations', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+
+      expect(mockIsPermitted).toHaveBeenCalledWith({
+        userId: mockUserId,
+        scope: mockScope,
+        permission: 'manage:organisations',
+        pageId: undefined
+      });
+    });
+
+    it('denies super admin permissions for regular users', async () => {
+      mockIsPermitted.mockResolvedValue(false);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'super_admin', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('allows organisation admin permissions', async () => {
+      mockIsPermitted.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'org_admin', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('denies organisation admin permissions for members', async () => {
+      mockIsPermitted.mockResolvedValue(false);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'org_admin', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('allows event admin permissions', async () => {
+      mockIsPermitted.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'event_admin', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('denies event admin permissions for participants', async () => {
+      mockIsPermitted.mockResolvedValue(false);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'event_admin', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('allows member permissions', async () => {
+      mockIsPermitted.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'read:users', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('denies member permissions for participants', async () => {
+      mockIsPermitted.mockResolvedValue(false);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'read:users', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('handles participant-only permissions', async () => {
+      mockIsPermitted.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, 'participant', undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+    });
+  });
+
+  describe('Fallback Scenarios', () => {
+    it('falls back to cached permissions when API fails', async () => {
+      mockIsPermitted.mockRejectedValue(new Error('API Error'));
+      mockIsPermittedCached.mockResolvedValue(true);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, true)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(true);
+        expect(result.current.error).toBeNull();
+      });
+
+      expect(mockIsPermittedCached).toHaveBeenCalledWith({
+        userId: mockUserId,
+        scope: mockScope,
+        permission: mockPermission,
+        pageId: mockPageId
+      });
+    });
+
+    it('handles permission denied with fallback to false', async () => {
+      mockIsPermitted.mockResolvedValue(false);
+      mockIsPermittedCached.mockResolvedValue(false);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, mockPermission, mockPageId, true)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toBeNull();
+      });
+    });
+
+    it('handles permission check timeout gracefully', async () => {
+      // Mock a slow API response
+      mockIsPermitted.mockImplementation(() => 
+        new Promise((resolve) => setTimeout(() => resolve(false), 1000))
+      );
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+      );
+
+      // Should show loading initially
+      expect(result.current.isLoading).toBe(true);
+      expect(result.current.can).toBe(false);
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+      }, { timeout: 2000 });
+    });
+
+    it('handles network error with graceful degradation', async () => {
+      const networkError = new Error('Network error');
+      mockIsPermitted.mockRejectedValue(networkError);
+
+      const { result } = renderHook(() => 
+        useCan(mockUserId, mockScope, mockPermission, undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(result.current.error).toEqual(networkError);
+      });
+    });
+  });
+
   describe('Edge Cases', () => {
     it('handles empty userId', async () => {
       mockIsPermitted.mockResolvedValue(false);
@@ -399,6 +600,58 @@ describe('useCan Hook', () => {
         expect(mockIsPermitted).not.toHaveBeenCalled();
       }, { timeout: 20000 });
     });
+
+    it('handles null userId', async () => {
+      const { result } = renderHook(() => 
+        useCan(null as any, mockScope, mockPermission, undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(mockIsPermitted).not.toHaveBeenCalled();
+      });
+    });
+
+    it('handles undefined userId', async () => {
+      const { result } = renderHook(() => 
+        useCan(undefined as any, mockScope, mockPermission, undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+        expect(result.current.can).toBe(false);
+        expect(mockIsPermitted).not.toHaveBeenCalled();
+      });
+    });
+
+    it('handles scope with empty organisationId', async () => {
+      const invalidScope = { organisationId: '', eventId: 'event-123' };
+      
+      const { result } = renderHook(() => 
+        useCan(mockUserId, invalidScope, mockPermission, undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(true);
+        expect(result.current.can).toBe(false);
+        expect(mockIsPermitted).not.toHaveBeenCalled();
+      });
+    });
+
+    it('handles scope with whitespace-only organisationId', async () => {
+      const invalidScope = { organisationId: '   ', eventId: 'event-123' };
+      
+      const { result } = renderHook(() => 
+        useCan(mockUserId, invalidScope, mockPermission, undefined, false)
+      );
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(true);
+        expect(result.current.can).toBe(false);
+        expect(mockIsPermitted).not.toHaveBeenCalled();
+      });
+    });
   });
 
   describe('Performance', () => {