@jmruthers/pace-core 0.5.76 → 0.5.78

package/src/rbac/providers/index.ts

@@ -1,11 +0,0 @@
-/**
- * RBAC Providers Public API
- * @package @jmruthers/pace-core
- * @module RBAC/Providers
- * @since 2.0.0
- * 
- * This module provides the public API for RBAC providers.
- */
-
-export { RBACProvider, useRBAC as useRBACProvider } from './RBACProvider';
-export type { RBACProviderProps, RBACContextType, UserEventAccess } from './RBACProvider';

package/src/services/RBACService.ts

@@ -1,522 +0,0 @@
-/**
- * @file RBAC Service
- * @package @jmruthers/pace-core
- * @module Services
- * @since 0.1.0
- *
- * RBAC service implementation.
- * Handles role-based access control, permissions, and event access management.
- */
-
-import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
-import { BaseService } from './base/BaseService';
-import { IRBACService, UserEventAccess, AppConfig } from './interfaces/IRBACService';
-import { AccessLevel } from '../types/unified';
-import { DebugLogger } from '../utils/debugLogger';
-
-export class RBACService extends BaseService implements IRBACService {
-  private permissions: Record<string, boolean> = {};
-  private roles: string[] = [];
-  private accessLevel: AccessLevel = AccessLevel.VIEWER;
-  private rbacLoading = false;
-  private rbacError: Error | null = null;
-  private selectedEventId: string | null = null;
-  private appConfig: AppConfig | null = null;
-  private userEventAccess: UserEventAccess[] = [];
-  private eventAccessLoading = false;
-  private selectedOrganisationId: string | null = null;
-
-  // Dependencies
-  private supabaseClient: SupabaseClient | null = null;
-  private user: User | null = null;
-  private session: Session | null = null;
-  private appName: string = '';
-
-  constructor(supabaseClient: SupabaseClient, user: User | null, session: Session | null, appName: string) {
-    super();
-    this.supabaseClient = supabaseClient;
-    this.user = user;
-    this.session = session;
-    this.appName = appName;
-  }
-
-  // Update dependencies
-  updateDependencies(user: User | null, session: Session | null, appName: string): void {
-    this.user = user;
-    this.session = session;
-    this.appName = appName;
-    this.notify();
-  }
-
-  // RBAC state getters
-  getPermissions(): Record<string, boolean> {
-    return this.permissions;
-  }
-
-  getRoles(): string[] {
-    return this.roles;
-  }
-
-  getAccessLevel(): AccessLevel {
-    return this.accessLevel;
-  }
-
-  isLoading(): boolean {
-    return this.rbacLoading;
-  }
-
-  getError(): Error | null {
-    return this.rbacError;
-  }
-
-  getSelectedEventId(): string | null {
-    return this.selectedEventId;
-  }
-
-  getAppConfig(): AppConfig | null {
-    return this.appConfig;
-  }
-
-  getUserEventAccess(): UserEventAccess[] {
-    return this.userEventAccess;
-  }
-
-  isEventAccessLoading(): boolean {
-    return this.eventAccessLoading;
-  }
-
-  getSelectedOrganisationId(): string | null {
-    return this.selectedOrganisationId;
-  }
-
-  // RBAC methods
-  hasPermission(permission: string, orgId?: string): boolean {
-    return !!this.permissions[permission];
-  }
-
-  hasAnyPermission(permissions: string[], orgId?: string): boolean {
-    return permissions.some(p => !!this.permissions[p]);
-  }
-
-  hasAllPermissions(permissions: string[], orgId?: string): boolean {
-    return permissions.every(p => !!this.permissions[p]);
-  }
-
-  hasRole(role: string): boolean {
-    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
-    if (role.toLowerCase() === 'super_admin' || role.toLowerCase() === 'super') {
-      return isSuperAdmin;
-    }
-    return this.roles.includes(role);
-  }
-
-  hasAccessLevel(level: AccessLevel): boolean {
-    const levels = Object.values(AccessLevel);
-    return levels.indexOf(this.accessLevel) >= levels.indexOf(level);
-  }
-
-  canAccess(resource: string, action: string, orgId?: string): boolean {
-    const permission = `${resource}:${action}`;
-    return this.hasPermission(permission, orgId);
-  }
-
-  async validatePermission(permission: string, orgId?: string): Promise<boolean> {
-    return this.hasPermission(permission, orgId);
-  }
-
-  async validateAccess(resource: string, action: string, orgId?: string): Promise<boolean> {
-    return this.canAccess(resource, action, orgId);
-  }
-
-  async refreshPermissions(eventId?: string, orgId?: string): Promise<void> {
-    if (!this.supabaseClient || !this.user || !this.appConfig || !this.session) {
-      DebugLogger.log('RBACService', 'refreshPermissions: Missing required dependencies, clearing permissions');
-      this.permissions = {};
-      this.roles = [];
-      this.accessLevel = AccessLevel.VIEWER;
-      this.notify();
-      return;
-    }
-
-    // Check for super admin first - admin override should happen regardless of app configuration
-    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
-    if (isSuperAdmin) {
-      this.permissions = {
-        'admin:create': true,
-        'admin:read': true,
-        'admin:update': true,
-        'admin:delete': true,
-        'users:create': true,
-        'users:read': true,
-        'users:update': true,
-        'users:delete': true,
-        'events:create': true,
-        'events:read': true,
-        'events:update': true,
-        'events:delete': true
-      };
-      this.roles = ['super_admin'];
-      this.accessLevel = AccessLevel.ADMIN;
-      this.notify();
-      return;
-    }
-
-    // Determine if we should load permissions without an event
-    const shouldLoadDirectPermissions = !eventId && !this.appConfig.requires_event;
-    const shouldLoadEventPermissions = eventId;
-    const shouldClearPermissions = !eventId && this.appConfig.requires_event;
-
-    // If no eventId and app requires events, clear permissions
-    if (shouldClearPermissions) {
-      this.permissions = {};
-      this.roles = [];
-      this.accessLevel = AccessLevel.VIEWER;
-      this.notify();
-      return;
-    }
-
-    // Only proceed if we should load permissions
-    if (!shouldLoadDirectPermissions && !shouldLoadEventPermissions) {
-      return;
-    }
-
-    this.rbacLoading = true;
-    this.rbacError = null;
-    this.notify();
-
-    try {
-      // Use the same app name resolution as PagePermissionGuard
-      const { getCurrentAppName } = await import('../utils/appNameResolver');
-      const resolvedAppName = getCurrentAppName() || this.appName;
-      
-      // First resolve app name to app_id
-      const { data: appData, error: appError } = await this.supabaseClient
-        .from('rbac_apps')
-        .select('id')
-        .eq('name', resolvedAppName)
-        .eq('is_active', true)
-        .single();
-
-      if (appError || !appData) {
-        console.warn('App not found or inactive:', resolvedAppName);
-        this.rbacLoading = false;
-        this.notify();
-        return;
-      }
-
-      const { data, error } = await this.supabaseClient.rpc('rbac_permissions_get', {
-        p_user_id: this.user.id,
-        p_app_id: appData.id,
-        p_event_id: eventId || null,
-        p_organisation_id: orgId || this.selectedOrganisationId || null
-      });
-
-      if (error) {
-        throw error;
-      }
-
-      const { permissions, roles, access_level } = this.transformRBACPermissions(data, this.appName);
-
-      this.permissions = permissions;
-      this.roles = roles;
-      this.accessLevel = access_level;
-    } catch (err: any) {
-      this.rbacError = err;
-    } finally {
-      this.rbacLoading = false;
-      this.notify();
-    }
-  }
-
-  setSelectedEventId(eventId: string | null): void {
-    this.selectedEventId = eventId;
-    this.notify();
-  }
-
-  async loadUserEventAccess(orgId?: string): Promise<void> {
-    if (!this.supabaseClient || !this.user || !this.session) {
-      DebugLogger.log('RBACService', 'loadUserEventAccess: Missing required dependencies, clearing event access');
-      this.userEventAccess = [];
-      this.notify();
-      return;
-    }
-
-    this.eventAccessLoading = true;
-    this.notify();
-
-    try {
-      // Use the same app name resolution as PagePermissionGuard
-      const { getCurrentAppName } = await import('../utils/appNameResolver');
-      const resolvedAppName = getCurrentAppName() || this.appName;
-      
-      // First resolve app name to app_id
-      const { data: appData, error: appError } = await this.supabaseClient
-        .from('rbac_apps')
-        .select('id')
-        .eq('name', resolvedAppName)
-        .eq('is_active', true)
-        .single();
-
-      if (appError || !appData) {
-        console.warn('App not found or inactive:', resolvedAppName);
-        this.eventAccessLoading = false;
-        this.notify();
-        return;
-      }
-
-      const { data, error } = await this.supabaseClient
-        .from('rbac_event_app_roles')
-        .select(`
-          event_id,
-          role,
-          granted_at
-        `)
-        .eq('user_id', this.user.id)
-        .eq('app_id', appData.id);
-
-      if (error) {
-        console.error('Failed to load user event access:', error);
-        this.userEventAccess = [];
-        this.notify();
-        return;
-      }
-
-      const eventAccess = data?.map(item => ({
-        event_id: item.event_id,
-        event_name: (item as any).event_name || 'Unknown Event', // Event details not available in this query
-        event_description: (item as any).event_description || null, // Not available in this schema
-        start_date: (item as any).start_date || '', // Event date not available in this query
-        end_date: (item as any).end_date || '', // Event date not available in this query
-        event_status: (item as any).event_status || 'unknown', // Not available in this schema
-        app_id: (item as any).app_id || appData.id,
-        access_level: (item as any).access_level || item.role, // Map role to access_level
-        granted_at: item.granted_at,
-        organisation_id: (item as any).organisation_id || '' // Will be populated from event's organisation_id if needed
-      })) || [];
-
-      this.userEventAccess = eventAccess;
-    } catch (error) {
-      console.error('Error loading user event access:', error);
-      this.userEventAccess = [];
-    } finally {
-      this.eventAccessLoading = false;
-      this.notify();
-    }
-  }
-
-  getUserEventAccessById(eventId: string): UserEventAccess | undefined {
-    return this.userEventAccess.find(access => access.event_id === eventId);
-  }
-
-  requireOrganisationContext(): string {
-    if (!this.selectedOrganisationId) {
-      throw new Error('Organisation context is required but not available');
-    }
-    return this.selectedOrganisationId;
-  }
-
-  // Lifecycle methods
-  async initialize(): Promise<void> {
-    await super.initialize();
-    await this.loadAppConfig();
-    
-    // Load permissions for regular users after app config is loaded
-    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
-    if (!isSuperAdmin && this.appConfig) {
-      await this.refreshPermissions(this.selectedEventId || undefined);
-    }
-    
-    await this.loadPersistedState();
-  }
-
-  cleanup(): void {
-    super.cleanup();
-  }
-
-  protected async doInitialize(): Promise<void> {
-    // Set super admin roles and permissions based on user metadata
-    const isSuperAdmin = this.user?.user_metadata?.globalRole === 'super_admin';
-    if (isSuperAdmin) {
-      this.roles = ['super_admin'];
-      this.accessLevel = AccessLevel.ADMIN;
-      // Set super admin permissions immediately
-      this.permissions = {
-        'admin:create': true,
-        'admin:read': true,
-        'admin:update': true,
-        'admin:delete': true,
-        'users:create': true,
-        'users:read': true,
-        'users:update': true,
-        'users:delete': true,
-        'events:create': true,
-        'events:read': true,
-        'events:update': true,
-        'events:delete': true
-      };
-    } else {
-      this.roles = [];
-      this.accessLevel = AccessLevel.VIEWER;
-      this.permissions = {};
-    }
-  }
-
-  protected doCleanup(): void {
-    // No specific cleanup needed
-  }
-
-  private async loadAppConfig(): Promise<void> {
-    if (!this.supabaseClient) return;
-
-    try {
-      // Use the same app name resolution as PagePermissionGuard
-      const { getCurrentAppName } = await import('../utils/appNameResolver');
-      const resolvedAppName = getCurrentAppName() || this.appName;
-      
-      // First resolve app name to app_id
-      const { data: appData, error: appError } = await this.supabaseClient
-        .from('rbac_apps')
-        .select('id')
-        .eq('name', resolvedAppName)
-        .eq('is_active', true)
-        .single();
-
-      if (appError || !appData) {
-        console.warn('App not found or inactive:', resolvedAppName);
-        this.appConfig = {
-          supports_direct_access: false,
-          requires_event: true
-        };
-        return;
-      }
-
-      const response = await this.supabaseClient.rpc('get_app_config', {
-        app_id: appData.id
-      });
-      
-      const { data } = response || {};
-
-      if (data && data.length > 0) {
-        this.appConfig = {
-          supports_direct_access: false,
-          requires_event: data[0].requires_event
-        };
-      } else {
-        // Default configuration if app not found
-        this.appConfig = {
-          supports_direct_access: false,
-          requires_event: true
-        };
-      }
-    } catch (error) {
-      console.warn('Failed to load app configuration:', error);
-      // Default configuration on error
-      this.appConfig = {
-        supports_direct_access: false,
-        requires_event: true
-      };
-    }
-  }
-
-  private async loadPersistedState(): Promise<void> {
-    try {
-      const persistedEvent = localStorage.getItem('pace-core-selected-event');
-      if (persistedEvent) {
-        this.selectedEventId = JSON.parse(persistedEvent);
-      }
-    } catch (error) {
-      console.warn("Clearing corrupted localStorage data");
-      localStorage.removeItem('pace-core-selected-event');
-    }
-  }
-
-  private transformRBACPermissions(rbacData: any[], appName: string) {
-    const permissions: Record<string, boolean> = {};
-    let roles: string[] = [];
-    let access_level: AccessLevel = AccessLevel.VIEWER;
-
-    if (!rbacData || !Array.isArray(rbacData)) {
-      return { permissions: {}, roles: ['viewer'], access_level: AccessLevel.VIEWER };
-    }
-
-    // Check for super admin first
-    const superAdminPerm = rbacData.find((p: any) => p.permission_type === 'all_permissions');
-    if (superAdminPerm) {
-      return { 
-        permissions: { 'all:all': true } as Record<string, boolean>, 
-        roles: ['super'], 
-        access_level: AccessLevel.SUPER 
-      };
-    }
-
-    // Process event-app permissions
-    const eventAppPerms = rbacData.filter((p: any) => p.permission_type === 'event_app_access');
-    if (eventAppPerms.length > 0) {
-      const role = eventAppPerms[0].role_name;
-      
-      // Map RBAC roles to AccessLevel
-      switch (role) {
-        case 'event_admin':
-          access_level = AccessLevel.ADMIN;
-          roles = ['admin'];
-          break;
-        case 'planner':
-          access_level = AccessLevel.PLANNER;
-          roles = ['planner'];
-          break;
-        case 'participant':
-          access_level = AccessLevel.PARTICIPANT;
-          roles = ['participant'];
-          break;
-        case 'editor':
-          access_level = AccessLevel.EDITOR;
-          roles = ['editor'];
-          break;
-        case 'viewer':
-        default:
-          access_level = AccessLevel.VIEWER;
-          roles = ['viewer'];
-          break;
-      }
-
-      // Set permissions from the RPC response
-      eventAppPerms.forEach((perm: any) => {
-        if (perm.permission) {
-          permissions[perm.permission] = true;
-        }
-      });
-
-      // For now, we'll set basic permissions based on role
-      // In a full implementation, you'd want to fetch page-specific permissions
-      const basePermissions = ['read'];
-      if (['event_admin', 'planner'].includes(role)) {
-        basePermissions.push('create', 'update');
-      }
-      if (role === 'event_admin') {
-        basePermissions.push('delete');
-      }
-
-      // Set permissions for all pages (simplified approach)
-      // In a real implementation, you'd want to get actual page permissions
-      basePermissions.forEach(operation => {
-        permissions[`default:${operation}`] = true;
-      });
-    }
-
-    // Process organisation permissions
-    const orgPerms = rbacData.filter((p: any) => p.permission_type === 'organisation_access');
-    if (orgPerms.length > 0) {
-      const role = orgPerms[0].role_name;
-      if (role === 'org_admin') {
-        access_level = AccessLevel.ADMIN;
-        roles = ['admin'];
-        // Org admins get all permissions
-        ['create', 'read', 'update', 'delete'].forEach(operation => {
-          permissions[`default:${operation}`] = true;
-        });
-      }
-    }
-
-    return { permissions, roles, access_level };
-  }
-}