@jmruthers/pace-core 0.5.76 → 0.5.78

package/src/services/__tests__/RBACService.test.ts

@@ -1,492 +0,0 @@
-/**
- * @file RBACService Unit Tests
- * @package @jmruthers/pace-core
- * @module Services/__tests__
- * @since 0.1.0
- *
- * Unit tests for RBACService class.
- * Tests role-based access control operations, permission checking, and state management.
- */
-
-import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
-import { RBACService } from '../RBACService';
-import { AccessLevel } from '../../types/unified';
-
-// Mock Supabase client
-const createMockSupabaseClient = () => ({
-  rpc: vi.fn(),
-  from: vi.fn(() => ({
-    select: vi.fn(() => ({
-      eq: vi.fn(() => ({
-        eq: vi.fn(() => ({
-          single: vi.fn()
-        }))
-      }))
-    }))
-  })),
-});
-
-// Mock user and session
-const mockUser = {
-  id: 'user-1',
-  email: 'test@example.com',
-  user_metadata: { globalRole: 'user' }
-};
-
-const mockSession = {
-  access_token: 'token',
-  user: mockUser
-};
-
-describe('RBACService', () => {
-  let mockSupabase: ReturnType<typeof createMockSupabaseClient>;
-  let rbacService: RBACService;
-
-  beforeEach(() => {
-    mockSupabase = createMockSupabaseClient();
-    rbacService = new RBACService(mockSupabase as any, mockUser, mockSession, 'test-app');
-  });
-
-  afterEach(() => {
-    rbacService.cleanup();
-    vi.clearAllMocks();
-  });
-
-  describe('Initialization', () => {
-    it('should initialize with default state', () => {
-      expect(rbacService.getPermissions()).toEqual({});
-      expect(rbacService.getRoles()).toEqual([]);
-      expect(rbacService.getAccessLevel()).toBe(AccessLevel.VIEWER);
-      expect(rbacService.isLoading()).toBe(false);
-      expect(rbacService.getError()).toBeNull();
-      expect(rbacService.getSelectedEventId()).toBeNull();
-      expect(rbacService.getAppConfig()).toBeNull();
-      expect(rbacService.getUserEventAccess()).toEqual([]);
-      expect(rbacService.isEventAccessLoading()).toBe(false);
-      expect(rbacService.getSelectedOrganisationId()).toBeNull();
-    });
-
-    it('should set super admin role from user metadata', async () => {
-      const superAdminUser = {
-        ...mockUser,
-        user_metadata: { globalRole: 'super_admin' }
-      };
-
-      const service = new RBACService(mockSupabase as any, superAdminUser, mockSession, 'test-app');
-      await service.initialize();
-
-      expect(service.getRoles()).toContain('super_admin');
-      expect(service.getAccessLevel()).toBe(AccessLevel.ADMIN);
-      expect(service.getPermissions()).toHaveProperty('admin:create', true);
-    });
-  });
-
-  describe('Permission Checking', () => {
-    beforeEach(async () => {
-      // Mock app config loading
-      mockSupabase.from.mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-1' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-
-      // Mock get_app_config RPC
-      mockSupabase.rpc.mockImplementation((rpcName, params) => {
-        if (rpcName === 'get_app_config') {
-          return Promise.resolve({
-            data: [{
-              supports_direct_access: false,
-              requires_event: true
-            }],
-            error: null
-          });
-        }
-        // Mock rbac_permissions_get for permission checking
-        return Promise.resolve({
-          data: [
-            {
-              permission_type: 'event_app_access',
-              role_name: 'planner',
-              permission: 'events:read'
-            }
-          ],
-          error: null
-        });
-      });
-
-      // Set event ID before initialization so permissions are loaded
-      rbacService.setSelectedEventId('event-1');
-      await rbacService.initialize();
-    });
-
-    it('should check permissions correctly', async () => {
-      expect(rbacService.hasPermission('events:read')).toBe(true);
-      expect(rbacService.hasPermission('events:write')).toBe(false);
-    });
-
-    it('should check roles correctly', async () => {
-      expect(rbacService.hasRole('planner')).toBe(true);
-      expect(rbacService.hasRole('admin')).toBe(false);
-    });
-
-    it('should check access levels correctly', async () => {
-      expect(rbacService.hasAccessLevel(AccessLevel.VIEWER)).toBe(true);
-      expect(rbacService.hasAccessLevel(AccessLevel.PLANNER)).toBe(true);
-      expect(rbacService.hasAccessLevel(AccessLevel.ADMIN)).toBe(false);
-    });
-
-    it('should check resource access correctly', async () => {
-      expect(rbacService.canAccess('events', 'read')).toBe(true);
-      expect(rbacService.canAccess('events', 'write')).toBe(false);
-    });
-
-    it('should validate permissions asynchronously', async () => {
-      const result = await rbacService.validatePermission('events:read');
-      expect(result).toBe(true);
-    });
-
-    it('should validate access asynchronously', async () => {
-      const result = await rbacService.validateAccess('events', 'read');
-      expect(result).toBe(true);
-    });
-  });
-
-  describe('Event Management', () => {
-    it('should set selected event ID', () => {
-      rbacService.setSelectedEventId('event-123');
-      
-      expect(rbacService.getSelectedEventId()).toBe('event-123');
-    });
-
-    it('should get user event access for specific event', async () => {
-      const mockEventAccess = [
-        {
-          event_id: 'event-1',
-          event_name: 'Test Event',
-          event_description: 'Test Description',
-          start_date: '2024-01-01',
-          end_date: '2024-01-02',
-          event_status: 'active',
-          app_id: 'app-1',
-          access_level: 'planner',
-          granted_at: '2024-01-01T00:00:00Z',
-          organisation_id: 'org-1'
-        }
-      ];
-
-      // Mock the rbac_apps and rbac_event_app_roles queries
-      mockSupabase.from.mockImplementation((table: string) => {
-        if (table === 'rbac_apps') {
-          return {
-            select: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  single: vi.fn().mockResolvedValue({
-                    data: { id: 'app-1' },
-                    error: null
-                  })
-                })
-              })
-            })
-          };
-        }
-        if (table === 'rbac_event_app_roles') {
-          return {
-            select: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockResolvedValue({
-                  data: mockEventAccess,
-                  error: null
-                })
-              })
-            })
-          };
-        }
-        return mockSupabase.from();
-      });
-
-      await rbacService.loadUserEventAccess();
-
-      const eventAccess = rbacService.getUserEventAccessById('event-1');
-      expect(eventAccess).toEqual(mockEventAccess[0]);
-    });
-  });
-
-  describe('Organisation Context', () => {
-    it('should require organisation context', () => {
-      expect(() => rbacService.requireOrganisationContext()).toThrow('Organisation context is required but not available');
-    });
-
-    it('should return organisation context when set', () => {
-      rbacService.setSelectedEventId('event-1'); // This sets the organisation context internally
-      
-      // Mock the organisation context
-      const orgId = 'org-1';
-      // Note: In a real implementation, this would be set by the OrganisationService
-      // For testing, we'll simulate it
-      (rbacService as any).selectedOrganisationId = orgId;
-      
-      expect(rbacService.requireOrganisationContext()).toBe(orgId);
-    });
-  });
-
-  describe('Data Operations', () => {
-    it('should refresh permissions for event', async () => {
-      // Mock the rbac_apps query
-      mockSupabase.from.mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-1' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-
-      mockSupabase.rpc.mockImplementation((rpcName, params) => {
-        if (rpcName === 'get_app_config') {
-          return Promise.resolve({
-            data: [{
-              supports_direct_access: false,
-              requires_event: true
-            }],
-            error: null
-          });
-        }
-        return Promise.resolve({
-          data: [
-            {
-              permission_type: 'event_app_access',
-              role_name: 'planner',
-              permission: 'events:read'
-            }
-          ],
-          error: null
-        });
-      });
-
-      // Ensure app config is loaded
-      await rbacService.initialize();
-      
-      // Clear the RPC mock call count from initialization
-      vi.clearAllMocks();
-      
-      // Re-setup mocks for the refresh call
-      mockSupabase.from.mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-1' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-
-      mockSupabase.rpc.mockResolvedValue({
-        data: [
-          {
-            permission_type: 'event_app_access',
-            role_name: 'planner',
-            permission: 'events:read'
-          }
-        ],
-        error: null
-      });
-
-      await rbacService.refreshPermissions('event-1');
-
-      expect(mockSupabase.rpc).toHaveBeenCalledWith('rbac_permissions_get', {
-        p_user_id: mockUser.id,
-        p_app_id: 'app-1',
-        p_event_id: 'event-1',
-        p_organisation_id: null
-      });
-    });
-
-    it('should load user event access', async () => {
-      const mockEventAccess = [
-        {
-          event_id: 'event-1',
-          role: 'planner',
-          granted_at: '2024-01-01T00:00:00Z'
-        }
-      ];
-
-      // Mock the rbac_apps and rbac_event_app_roles queries
-      mockSupabase.from.mockImplementation((table: string) => {
-        if (table === 'rbac_apps') {
-          return {
-            select: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  single: vi.fn().mockResolvedValue({
-                    data: { id: 'app-1' },
-                    error: null
-                  })
-                })
-              })
-            })
-          };
-        }
-        if (table === 'rbac_event_app_roles') {
-          return {
-            select: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockResolvedValue({
-                  data: mockEventAccess,
-                  error: null
-                })
-              })
-            })
-          };
-        }
-        return mockSupabase.from();
-      });
-
-      await rbacService.loadUserEventAccess();
-
-      expect(rbacService.getUserEventAccess()).toHaveLength(1);
-      expect(rbacService.getUserEventAccess()[0].event_id).toBe('event-1');
-    });
-
-    it('should handle RPC errors gracefully', async () => {
-      // Mock the rbac_apps query
-      mockSupabase.from.mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-1' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-
-      // Mock the RPC call to return app config first, then error
-      mockSupabase.rpc.mockImplementation((rpcName, params) => {
-        if (rpcName === 'get_app_config') {
-          return Promise.resolve({
-            data: [{
-              supports_direct_access: false,
-              requires_event: true
-            }],
-            error: null
-          });
-        }
-        if (rpcName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: null,
-            error: { message: 'RPC error' }
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      // Ensure app config is loaded
-      await rbacService.initialize();
-
-      await rbacService.refreshPermissions('event-1');
-
-      expect(rbacService.getError()).toBeDefined();
-      expect(rbacService.getError()?.message).toBe('RPC error');
-    });
-  });
-
-  describe('State Management', () => {
-    it('should notify subscribers when state changes', () => {
-      const subscriber = vi.fn();
-      const unsubscribe = rbacService.subscribe(subscriber);
-
-      rbacService.setSelectedEventId('event-1');
-
-      expect(subscriber).toHaveBeenCalled();
-
-      unsubscribe();
-    });
-
-    it('should cleanup subscriptions on cleanup', () => {
-      const subscriber = vi.fn();
-      rbacService.subscribe(subscriber);
-
-      rbacService.cleanup();
-
-      // After cleanup, new state changes shouldn't notify subscribers
-      rbacService.setSelectedEventId('event-1');
-
-      expect(subscriber).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Super Admin Override', () => {
-    it('should grant all permissions to super admin', async () => {
-      const superAdminUser = {
-        ...mockUser,
-        user_metadata: { globalRole: 'super_admin' }
-      };
-
-      const service = new RBACService(mockSupabase as any, superAdminUser, mockSession, 'test-app');
-      await service.initialize();
-
-      expect(service.hasPermission('admin:create')).toBe(true);
-      expect(service.hasPermission('admin:read')).toBe(true);
-      expect(service.hasPermission('admin:update')).toBe(true);
-      expect(service.hasPermission('admin:delete')).toBe(true);
-      expect(service.hasPermission('users:create')).toBe(true);
-      expect(service.hasPermission('users:read')).toBe(true);
-      expect(service.hasPermission('users:update')).toBe(true);
-      expect(service.hasPermission('users:delete')).toBe(true);
-      expect(service.hasPermission('events:create')).toBe(true);
-      expect(service.hasPermission('events:read')).toBe(true);
-      expect(service.hasPermission('events:update')).toBe(true);
-      expect(service.hasPermission('events:delete')).toBe(true);
-    });
-
-    it('should recognize super admin role', async () => {
-      const superAdminUser = {
-        ...mockUser,
-        user_metadata: { globalRole: 'super_admin' }
-      };
-
-      const service = new RBACService(mockSupabase as any, superAdminUser, mockSession, 'test-app');
-      await service.initialize();
-
-      expect(service.hasRole('super_admin')).toBe(true);
-      expect(service.hasRole('super')).toBe(true);
-    });
-  });
-
-  describe('Error Handling', () => {
-    it('should handle missing dependencies gracefully', async () => {
-      const serviceWithoutUser = new RBACService(mockSupabase as any, null, null, 'test-app', true);
-      
-      await serviceWithoutUser.refreshPermissions();
-
-      expect(serviceWithoutUser.getPermissions()).toEqual({});
-      expect(serviceWithoutUser.getRoles()).toEqual([]);
-      expect(serviceWithoutUser.getAccessLevel()).toBe(AccessLevel.VIEWER);
-    });
-
-    it('should handle network errors', async () => {
-      mockSupabase.from().select().eq().eq().single.mockRejectedValue(new Error('Network error'));
-
-      await rbacService.initialize();
-
-      expect(rbacService.getError()).toBeDefined();
-    });
-  });
-});

package/src/services/interfaces/IRBACService.ts

@@ -1,62 +0,0 @@
-/**
- * @file RBAC Service Interface
- * @package @jmruthers/pace-core
- * @module Services/Interfaces
- * @since 0.1.0
- *
- * Interface for RBAC service operations.
- * Defines the contract for role-based access control functionality.
- */
-
-import { AccessLevel } from '../../types/unified';
-
-export interface UserEventAccess {
-  event_id: string;
-  event_name: string;
-  event_description?: string | null;
-  start_date: string;
-  end_date: string;
-  event_status: string;
-  app_id: string;
-  access_level: string;
-  granted_at: string;
-  organisation_id: string;
-}
-
-export interface AppConfig {
-  supports_direct_access: boolean;
-  requires_event: boolean;
-}
-
-export interface IRBACService {
-  // RBAC state
-  getPermissions(): Record<string, boolean>;
-  getRoles(): string[];
-  getAccessLevel(): AccessLevel;
-  isLoading(): boolean;
-  getError(): Error | null;
-  getSelectedEventId(): string | null;
-  getAppConfig(): AppConfig | null;
-  getUserEventAccess(): UserEventAccess[];
-  isEventAccessLoading(): boolean;
-  getSelectedOrganisationId(): string | null;
-
-  // RBAC methods
-  hasPermission(permission: string, orgId?: string): boolean;
-  hasAnyPermission(permissions: string[], orgId?: string): boolean;
-  hasAllPermissions(permissions: string[], orgId?: string): boolean;
-  hasRole(role: string): boolean;
-  hasAccessLevel(level: AccessLevel): boolean;
-  canAccess(resource: string, action: string, orgId?: string): boolean;
-  validatePermission(permission: string, orgId?: string): Promise<boolean>;
-  validateAccess(resource: string, action: string, orgId?: string): Promise<boolean>;
-  refreshPermissions(eventId?: string, orgId?: string): Promise<void>;
-  setSelectedEventId(eventId: string | null): void;
-  loadUserEventAccess(orgId?: string): Promise<void>;
-  getUserEventAccessById(eventId: string): UserEventAccess | undefined;
-  requireOrganisationContext(): string;
-
-  // Lifecycle
-  initialize(): Promise<void>;
-  cleanup(): void;
-}