@jmruthers/pace-core 0.5.74 → 0.5.76

package/src/rbac/providers/__tests__/RBACProvider.test.tsx

@@ -676,4 +676,511 @@ describe('RBACProvider', () => {
       expect(screen.getByTestId('can-read-users')).toBeInTheDocument();
     });
   });
+
+  describe('[integration] Provider Initialization', () => {
+    it('initializes without errors', () => {
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+      expect(screen.getByTestId('permissions')).toBeInTheDocument();
+    });
+
+    it('handles missing dependencies gracefully', () => {
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: [],
+          isLoading: true,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(false),
+          canAny: vi.fn().mockReturnValue(false),
+          canAll: vi.fn().mockReturnValue(false),
+          isLoading: true,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: [],
+          isLoading: true,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(false),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(false),
+          canAccessEvent: vi.fn().mockReturnValue(false),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: true,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+  });
+
+  describe('[integration] Concurrent Permission Checks', () => {
+    it('handles multiple permission checks simultaneously', () => {
+      const mockCan = vi.fn().mockReturnValue(true);
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: mockCan,
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+
+    it('maintains performance under high permission check load', () => {
+      const mockCan = vi.fn().mockReturnValue(true);
+      let callCount = 0;
+      
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: () => {
+            callCount++;
+            return mockCan();
+          },
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+  });
+
+  describe('[integration] Permission Cache Management', () => {
+    it('provides cache invalidation functionality', () => {
+      const mockClearCache = vi.fn();
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: mockClearCache,
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+      expect(mockClearCache).toBeDefined();
+    });
+
+    it('handles cache validation states', () => {
+      let cacheValid = false;
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn(() => cacheValid),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      const { rerender } = render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+
+      // Toggle cache validity
+      cacheValid = true;
+      rerender(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+  });
+
+  describe('[integration] Security and Access Control', () => {
+    it('validates organization access', () => {
+      const mockCanAccessOrg = vi.fn().mockReturnValue(true);
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: mockCanAccessOrg,
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(mockCanAccessOrg).toBeDefined();
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+
+    it('validates event access', () => {
+      const mockCanAccessEvent = vi.fn().mockReturnValue(true);
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: mockCanAccessEvent,
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(mockCanAccessEvent).toBeDefined();
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+
+    it('checks admin roles correctly', () => {
+      const mockIsOrgAdmin = vi.fn().mockReturnValue(false);
+      const mockIsEventAdmin = vi.fn().mockReturnValue(false);
+      
+      mockUseRBAC.mockReturnValue({
+        permissions: {
+          permissions: ['read:users'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: mockIsOrgAdmin,
+          isEventAdmin: mockIsEventAdmin,
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(mockIsOrgAdmin).toBeDefined();
+      expect(mockIsEventAdmin).toBeDefined();
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+  });
+
+  describe('[integration] Rapid State Changes', () => {
+    it('handles rapid permission updates without errors', () => {
+      let permissionState = { permissions: ['read:users'], isLoading: false, error: null, refetch: vi.fn() };
+      
+      mockUseRBAC.mockReturnValue({
+        permissions: permissionState,
+        can: {
+          can: vi.fn().mockReturnValue(true),
+          canAny: vi.fn().mockReturnValue(true),
+          canAll: vi.fn().mockReturnValue(true),
+          isLoading: false,
+          error: null,
+        },
+        organisationPermissions: {
+          permissions: ['read:organisation'],
+          isLoading: false,
+          error: null,
+          refetch: vi.fn(),
+        },
+        permissionCache: {
+          getCachedPermission: vi.fn(),
+          setCachedPermission: vi.fn(),
+          clearCache: vi.fn(),
+          isCacheValid: vi.fn().mockReturnValue(true),
+        },
+        organisationSecurity: {
+          canAccessOrganisation: vi.fn().mockReturnValue(true),
+          canAccessEvent: vi.fn().mockReturnValue(true),
+          isOrganisationAdmin: vi.fn().mockReturnValue(false),
+          isEventAdmin: vi.fn().mockReturnValue(false),
+          isLoading: false,
+          error: null,
+        },
+      });
+
+      const { rerender } = render(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+
+      // Rapid updates
+      permissionState = { permissions: ['write:users'], isLoading: false, error: null, refetch: vi.fn() };
+      rerender(
+        <RBACProvider>
+          <TestComponent />
+        </RBACProvider>
+      );
+
+      expect(screen.getByTestId('test-component')).toBeInTheDocument();
+    });
+  });
 });

package/src/services/AuthService.ts

@@ -184,7 +184,10 @@ export class AuthService extends BaseService implements IAuthService {
       this.notify();
       return { user: null, session: null, error };
     } catch (error) {
-      const authError = error as AuthError;
+      // Convert regular Error to AuthError if needed
+      const authError = error instanceof AuthError 
+        ? error 
+        : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
       this.authError = authError;
       this.notify();
       return { user: null, session: null, error: authError };
@@ -237,12 +240,24 @@ export class AuthService extends BaseService implements IAuthService {
         this.session = null;
       } else {
         this.authError = null;
-        this.user = data?.user ?? null;
-        this.session = data?.session ?? null;
+        // Only update user and session if both are present (valid session)
+        if (data?.user && data?.session) {
+          this.user = data.user;
+          this.session = data.session;
+        } else {
+          // If no valid session, clear everything
+          this.user = null;
+          this.session = null;
+        }
       }
       
       this.notify();
-      return { user: data?.user ?? null, session: data?.session ?? null, error };
+      // Only return user if we have a valid session
+      return { 
+        user: (data?.user && data?.session) ? data.user : null, 
+        session: data?.session ?? null, 
+        error 
+      };
     } catch (error) {
       // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError