@jmruthers/pace-core 0.5.76 → 0.5.78

package/src/rbac/__tests__/rbac-engine-core-logic.test.ts

@@ -39,6 +39,8 @@ describe('RBACEngine - Core Logic Tests', () => {
 
   beforeEach(() => {
     mockSupabase = createMockSupabaseClient();
+    // Set default RPC mock to return true (can be overridden per test)
+    mockSupabase.rpc = vi.fn().mockResolvedValue({ data: true, error: null });
     engine = new RBACEngine(mockSupabase as any);
     // Clear cache before each test
     rbacCache.clear();
@@ -52,25 +54,22 @@ describe('RBACEngine - Core Logic Tests', () => {
 
   describe('Super Admin Bypass', () => {
     it('allows super admin to bypass all permissions', async () => {
-      // Mock the global roles query to return super_admin role
-      mockSupabase.from.mockReturnValueOnce({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockReturnThis(),
-        limit: vi.fn().mockResolvedValue({
-          data: [{ role: 'super_admin' }],
-          error: null
-        })
-      });
+      // Mock the RPC call to return true for super admin (may be called multiple times)
+      mockSupabase.rpc = vi.fn().mockResolvedValue({ data: true, error: null });
 
       const permissionCheck: PermissionCheck = {
-        userId: 'user-123' as UUID,
-        scope: { organisationId: 'org-123' as UUID },
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
+        scope: { organisationId: '00000000-0000-0000-0000-000000000002' as UUID },
         permission: 'manage:everything' as Permission
       };
 
-      const result = await engine.isPermitted(permissionCheck);
+      const securityContext = {
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
+        organisationId: '00000000-0000-0000-0000-000000000002' as UUID,
+        timestamp: new Date()
+      };
+
+      const result = await engine.isPermitted(permissionCheck, securityContext);
       expect(result).toBe(true);
     });
 
@@ -142,108 +141,26 @@ describe('RBACEngine - Core Logic Tests', () => {
 
   describe('Organisation Admin Permissions', () => {
     it('grants organisation admin permissions', async () => {
-      // Mock super admin RPC check to return false
-      mockSupabase.rpc.mockResolvedValue({
-        data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
-        error: null
-      });
-
-      // Mock app config
-      mockSupabase.from.mockReturnValue({
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        single: vi.fn().mockResolvedValue({
-          data: { requires_event: false },
-          error: null
-        })
-      });
-
-      // Mock organisation roles query to return org_admin role
-      const mockOrgRolesQuery = {
-        select: vi.fn().mockReturnThis(),
-        eq: vi.fn().mockReturnThis(),
-        lte: vi.fn().mockReturnThis(),
-        or: vi.fn().mockReturnThis(),
-        data: [{ 
-          role: 'org_admin',
-          status: 'active',
-          valid_from: '2023-01-01',
-          valid_to: null
-        }],
-        error: null
-      };
-      
-      // Mock the specific table queries
-      mockSupabase.from.mockImplementation((tableName: string) => {
-        if (tableName === 'rbac_organisation_roles') {
-          return mockOrgRolesQuery;
-        }
-        if (tableName === 'rbac_apps') {
-          return {
-            select: vi.fn().mockReturnThis(),
-            eq: vi.fn().mockReturnThis(),
-            single: vi.fn().mockResolvedValue({
-              data: { requires_event: false },
-              error: null
-            })
-          };
-        }
-        if (tableName === 'rbac_app_pages') {
-          return {
-            select: vi.fn().mockReturnThis(),
-            eq: vi.fn().mockReturnThis(),
-            single: vi.fn().mockResolvedValue({
-              data: { id: 'test-page', page_name: 'organisation' },
-              error: null
-            })
-          };
-        }
-        // Return empty data for other tables
-        return {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          limit: vi.fn().mockResolvedValue({ data: [], error: null }),
-          data: [],
-          error: null
-        };
-      });
-
-      // Mock the rbac_permissions_get RPC call
-      mockSupabase.rpc.mockImplementation((functionName: string, params: any) => {
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [
-              {
-                permission_type: 'read:page.organisation',
-                role_name: 'org_admin',
-                has_permission: true,
-                granted_at: '2023-01-01T00:00:00Z'
-              }
-            ],
-            error: null
-          });
-        }
-        // Default RPC response
-        return Promise.resolve({
-          data: null,
-          error: null
-        });
-      });
-
+      // Mock the RPC call to return true (may be called multiple times)
+      mockSupabase.rpc = vi.fn().mockResolvedValue({ data: true, error: null });
 
       const permissionCheck: PermissionCheck = {
-        userId: 'user-123' as UUID,
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
         scope: { 
-          organisationId: 'org-123' as UUID,
-          appId: 'test-app-id' as UUID
+          organisationId: '00000000-0000-0000-0000-000000000002' as UUID,
+          appId: '00000000-0000-0000-0000-000000000003' as UUID
         },
-        permission: 'read:page.organisation' as Permission,
-        pageId: 'organisation'
+        permission: 'read:organisation' as Permission,
+        pageId: '00000000-0000-0000-0000-000000000004' as UUID
       };
 
-      const result = await engine.isPermitted(permissionCheck);
+      const securityContext = {
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
+        organisationId: '00000000-0000-0000-0000-000000000002' as UUID,
+        timestamp: new Date()
+      };
+
+      const result = await engine.isPermitted(permissionCheck, securityContext);
       expect(result).toBe(true);
     });
   });
@@ -287,6 +204,7 @@ describe('RBACEngine - Core Logic Tests', () => {
           return {
             select: vi.fn().mockReturnThis(),
             eq: vi.fn().mockReturnThis(),
+            is: vi.fn().mockReturnThis(),
             single: vi.fn().mockResolvedValue({
               data: { role: 'org_admin' },
               error: null

package/src/rbac/__tests__/rbac-engine-simplified.test.ts

@@ -40,6 +40,8 @@ describe('RBACEngine - Simplified Tests', () => {
 
   beforeEach(() => {
     mockSupabase = createMockSupabaseClient();
+    // Set default RPC mock to return true (can be overridden per test)
+    mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
     engine = new RBACEngine(mockSupabase as any);
     // Clear cache before each test
     rbacCache.clear();
@@ -92,101 +94,45 @@ describe('RBACEngine - Simplified Tests', () => {
 
   describe('Engine Behavior', () => {
     it('handles permission checks with proper database calls', async () => {
-      // Mock successful permission check - the engine uses rbac_permissions_get, not rbac_permission_check
-      mockSupabase.rpc.mockImplementation((funcName: string) => {
-        if (funcName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ 
-              permission_type: 'read:page.users', 
-              resource_name: 'users',
-              role_name: 'org_admin', 
-              has_permission: true,
-              granted_at: '2023-01-01T00:00:00Z'
-            }],
-            error: null
-          });
-        }
-        // For other RPC calls like rbac_permission_check (used in checkSuperAdmin)
-        return Promise.resolve({
-          data: false, // Return false for super admin check
-          error: null
-        });
-      });
-
-      // Mock the from() chain for various database queries
-      mockSupabase.from.mockImplementation((table: string) => {
-        const mockChain = {
-          select: vi.fn().mockReturnThis(),
-          eq: vi.fn().mockReturnThis(),
-          lte: vi.fn().mockReturnThis(),
-          or: vi.fn().mockReturnThis(),
-          limit: vi.fn().mockResolvedValue({ data: [], error: null }),
-          single: vi.fn(),
-        };
-
-        if (table === 'rbac_organisation_roles') {
-          // Return organisation role for the user - make the chain thenable
-          Object.assign(mockChain, {
-            then: (resolve: any) => resolve({
-              data: [{ role: 'org_admin', status: 'active', valid_from: '2023-01-01', valid_to: null }],
-              error: null
-            })
-          });
-        } else if (table === 'rbac_global_roles') {
-          // Return global roles for the user - make the chain thenable
-          mockChain.limit = vi.fn().mockResolvedValue({
-            data: [],
-            error: null
-          });
-        } else if (table === 'rbac_event_app_roles') {
-          // Return empty event-app roles - make the chain thenable
-          Object.assign(mockChain, {
-            then: (resolve: any) => resolve({
-              data: [],
-              error: null
-            })
-          });
-        } else if (table === 'rbac_app_pages') {
-          // Return page name for page ID resolution
-          // The engine will call .select().eq().single()
-          mockChain.single.mockImplementation(() => Promise.resolve({
-            data: { id: 'page-123', page_name: 'users' },
-            error: null
-          }));
-        } else if (table === 'rbac_apps') {
-          // Return app config
-          mockChain.single.mockResolvedValue({
-            data: { requires_event: false },
-            error: null
-          });
-        } else {
-          mockChain.single.mockResolvedValue({
-            data: { requires_event: false },
-            error: null
-          });
-        }
-
-        return mockChain;
-      });
-
+      // Verify that the RPC call is made with correct parameters
+      // Use valid UUID format for validation
       const permissionCheck: PermissionCheck = {
-        userId: 'user-123' as UUID,
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
         scope: { 
-          organisationId: 'org-123' as UUID,
-          appId: 'app-123' as UUID
+          organisationId: '00000000-0000-0000-0000-000000000002' as UUID,
+          appId: '00000000-0000-0000-0000-000000000003' as UUID
         },
-        permission: 'read:page.users' as Permission,
-        pageId: 'users' // Use page name directly
+        permission: 'read:users' as Permission,
+        pageId: '00000000-0000-0000-0000-000000000004' as UUID
       };
 
-      const result = await engine.isPermitted(permissionCheck);
+      const securityContext = {
+        userId: '00000000-0000-0000-0000-000000000001' as UUID,
+        organisationId: '00000000-0000-0000-0000-000000000002' as UUID,
+        timestamp: new Date()
+      };
+
+      const result = await engine.isPermitted(permissionCheck, securityContext);
+      
+      // Verify RPC was called
+      expect(mockSupabase.rpc).toHaveBeenCalledWith(
+        'rbac_check_permission_simplified',
+        expect.objectContaining({
+          p_user_id: '00000000-0000-0000-0000-000000000001',
+          p_permission: 'read:users',
+          p_organisation_id: '00000000-0000-0000-0000-000000000002',
+          p_app_id: '00000000-0000-0000-0000-000000000003',
+          p_page_id: '00000000-0000-0000-0000-000000000004'
+        })
+      );
+      
       expect(result).toBe(true);
     });
 
     it('returns false for denied permissions', async () => {
-      // Mock denied permission check
+      // Mock denied permission check - use the simplified RPC
       mockSupabase.rpc.mockResolvedValue({
-        data: [{ has_permission: false, role_name: null, permission_source: 'none', granted_at: null }],
+        data: false,
         error: null
       });
 
@@ -228,6 +174,7 @@ describe('RBACEngine - Simplified Tests', () => {
           return {
             select: vi.fn().mockReturnThis(),
             eq: vi.fn().mockReturnThis(),
+            is: vi.fn().mockReturnThis(),
             single: vi.fn().mockResolvedValue({
               data: { role: 'org_admin' },
               error: null
@@ -237,6 +184,7 @@ describe('RBACEngine - Simplified Tests', () => {
         return {
           select: vi.fn().mockReturnThis(),
           eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
           lte: vi.fn().mockReturnThis(),
           or: vi.fn().mockReturnThis(),
           limit: vi.fn().mockResolvedValue({ data: [], error: null })

package/src/rbac/__tests__/scenarios.user-role.test.tsx

@@ -5,7 +5,7 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { createMemoryRouter, RouterProvider } from 'react-router-dom';
 import { UnifiedAuthProvider } from '../../providers/UnifiedAuthProvider';
 import { OrganisationProvider } from '../../providers/OrganisationProvider';
-import { RBACProvider } from '../providers/RBACProvider';
+// Note: RBACProvider was removed as part of Phase 1 - use useRBAC() hook instead
 vi.mock('../hooks/useRBAC', () => ({
   useRBAC: () => ({
     user: { email: 'test@example.com' },
@@ -144,7 +144,7 @@ const Wrapper = ({ children }: { children: React.ReactNode }) => {
     <QueryClientProvider client={queryClient}>
       <UnifiedAuthProvider supabase={mockSupabaseClient}>
         <OrganisationProvider>
-          <RBACProvider>{children}</RBACProvider>
+          {children}
         </OrganisationProvider>
       </UnifiedAuthProvider>
     </QueryClientProvider>

package/src/rbac/adapters.tsx

@@ -7,11 +7,12 @@
  * This module provides adapters for different frameworks and server runtimes.
  */
 
-import React, { ReactNode, useContext } from 'react';
+import React, { ReactNode } from 'react';
 import { UUID, Permission } from './types';
 import { useCan } from './hooks';
 import { rbacCache, RBACCache } from './cache';
 import { getRBACLogger } from './config';
+import { useUnifiedAuth } from '../providers/UnifiedAuthProvider';
 
 // ============================================================================
 // REACT COMPONENTS
@@ -74,49 +75,27 @@ export function PermissionGuard({
   enforceAudit?: boolean;
 }): React.ReactNode {
   const logger = getRBACLogger();
-  
-  // Always call hooks at the top level
-  const authContext = useContext(React.createContext<any>(null));
-  
-  // Try to get userId from context if not provided
-  let effectiveUserId = userId;
-  if (!effectiveUserId) {
-    try {
-      // Try to get from common auth contexts
-      if (authContext?.user?.id) {
-        effectiveUserId = authContext.user.id;
-      } else {
-        // Try to get from window or global context
-        const globalUser = (window as any).__PACE_USER__;
-        if (globalUser?.id) {
-          effectiveUserId = globalUser.id;
-        }
-      }
-    } catch (error) {
-      logger.debug('Could not infer userId from context:', error);
+
+  let authContext: ReturnType<typeof useUnifiedAuth> | null = null;
+  try {
+    authContext = useUnifiedAuth();
+  } catch (error) {
+    if (error instanceof Error && error.message.includes('must be used within')) {
+      authContext = null;
+    } else {
+      throw error;
     }
   }
 
+  const effectiveUserId = userId ?? authContext?.user?.id ?? null;
+
   // Always call useCan hook, but handle the case where userId might be undefined
   const { can, isLoading, error } = useCan(effectiveUserId || '', scope, permission, pageId);
 
   // If still no userId, show helpful error
   if (!effectiveUserId) {
     logger.error('PermissionGuard: No userId provided and could not infer from context');
-    return (
-      <div className="rbac-error" role="alert">
-        <p>Permission check failed: User context not available</p>
-        <details>
-          <summary>Debug info</summary>
-          <p>Make sure to either:</p>
-          <ul>
-            <li>Pass userId prop explicitly</li>
-            <li>Wrap your app with an auth provider</li>
-            <li>Set window.__PACE_USER__ with user data</li>
-          </ul>
-        </details>
-      </div>
-    );
+    return fallback ?? null;
   }
 
   // Handle loading state
@@ -234,49 +213,27 @@ export function AccessLevelGuard({
   loading?: ReactNode;
 }): React.ReactNode {
   const logger = getRBACLogger();
-  
-  // Always call hooks at the top level
-  const authContext = useContext(React.createContext<any>(null));
-  
-  // Try to get userId from context if not provided
-  let effectiveUserId = userId;
-  if (!effectiveUserId) {
-    try {
-      // Try to get from common auth contexts
-      if (authContext?.user?.id) {
-        effectiveUserId = authContext.user.id;
-      } else {
-        // Try to get from window or global context
-        const globalUser = (window as any).__PACE_USER__;
-        if (globalUser?.id) {
-          effectiveUserId = globalUser.id;
-        }
-      }
-    } catch (error) {
-      logger.debug('Could not infer userId from context:', error);
+
+  let authContext: ReturnType<typeof useUnifiedAuth> | null = null;
+  try {
+    authContext = useUnifiedAuth();
+  } catch (error) {
+    if (error instanceof Error && error.message.includes('must be used within')) {
+      authContext = null;
+    } else {
+      throw error;
     }
   }
 
+  const effectiveUserId = userId ?? authContext?.user?.id ?? null;
+
   // Always call useAccessLevel hook, but handle the case where userId might be undefined
   const { accessLevel, isLoading, error } = useAccessLevel(effectiveUserId || '', scope);
 
   // If still no userId, show helpful error
   if (!effectiveUserId) {
     logger.error('AccessLevelGuard: No userId provided and could not infer from context');
-    return (
-      <div className="rbac-error" role="alert">
-        <p>Access level check failed: User context not available</p>
-        <details>
-          <summary>Debug info</summary>
-          <p>Make sure to either:</p>
-          <ul>
-            <li>Pass userId prop explicitly</li>
-            <li>Wrap your app with an auth provider</li>
-            <li>Set window.__PACE_USER__ with user data</li>
-          </ul>
-        </details>
-      </div>
-    );
+    return fallback ?? null;
   }
 
   // Handle loading state

package/src/rbac/api.test.ts

@@ -451,6 +451,8 @@ describe('RBAC API', () => {
         getAccessLevel: vi.fn(),
         getPermissionMap: vi.fn(),
         isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
         checkSuperAdmin: vi.fn(),
         getAppConfig: vi.fn()
       };
@@ -534,6 +536,52 @@ describe('RBAC API', () => {
       });
     });
 
+    describe('resolveAppContext', () => {
+      it('resolves app context via engine', async () => {
+        const { resolveAppContext } = await import('./api');
+        const context = { appId: 'app-123', hasAccess: true };
+        mockEngine.resolveAppContext.mockResolvedValue(context);
+
+        const result = await resolveAppContext({ userId: 'user-1', appName: 'test-app' });
+
+        expect(result).toEqual(context);
+        expect(mockEngine.resolveAppContext).toHaveBeenCalledWith({ userId: 'user-1', appName: 'test-app' });
+      });
+
+      it('returns null when engine fails', async () => {
+        const { resolveAppContext } = await import('./api');
+        mockEngine.resolveAppContext.mockResolvedValue(null);
+
+        const result = await resolveAppContext({ userId: 'user-1', appName: 'test-app' });
+
+        expect(result).toBeNull();
+      });
+    });
+
+    describe('getRoleContext', () => {
+      it('returns role context from engine', async () => {
+        const { getRoleContext } = await import('./api');
+        const roleContext = {
+          globalRole: 'super_admin',
+          organisationRole: 'org_admin',
+          eventAppRole: 'event_admin',
+        };
+
+        mockEngine.getRoleContext.mockResolvedValue(roleContext);
+
+        const result = await getRoleContext({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+        });
+
+        expect(result).toEqual(roleContext);
+        expect(mockEngine.getRoleContext).toHaveBeenCalledWith({
+          userId: 'user-123',
+          scope: { organisationId: 'org-456' },
+        });
+      });
+    });
+
     describe('isPermitted', () => {
       it('returns permission result', async () => {
         const { isPermitted } = await import('./api');
@@ -548,12 +596,18 @@ describe('RBAC API', () => {
         });
 
         expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-          permission: 'read:users',
-          pageId: 'page-789'
-        });
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
+          {
+            userId: 'user-123',
+            scope: { organisationId: 'org-456' },
+            permission: 'read:users',
+            pageId: 'page-789'
+          },
+          expect.objectContaining({
+            userId: 'user-123',
+            organisationId: 'org-456'
+          })
+        );
       });
 
       it('handles engine errors', async () => {
@@ -603,12 +657,18 @@ describe('RBAC API', () => {
         });
 
         expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-          permission: 'read:users',
-          pageId: 'page-789'
-        });
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
+          {
+            userId: 'user-123',
+            scope: { organisationId: 'org-456' },
+            permission: 'read:users',
+            pageId: 'page-789'
+          },
+          expect.objectContaining({
+            userId: 'user-123',
+            organisationId: 'org-456'
+          })
+        );
         expect(rbacCache.set).toHaveBeenCalledWith(
           expect.any(String),
           true
@@ -629,11 +689,17 @@ describe('RBAC API', () => {
         });
 
         expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-          permission: 'read:users'
-        });
+        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
+          {
+            userId: 'user-123',
+            scope: { organisationId: 'org-456' },
+            permission: 'read:users'
+          },
+          expect.objectContaining({
+            userId: 'user-123',
+            organisationId: 'org-456'
+          })
+        );
       });
     });
 
@@ -731,22 +797,19 @@ describe('RBAC API', () => {
       it('returns app configuration', async () => {
         const { getAppConfig } = await import('./api');
         
-        const mockConfig = { requires_event: true };
-        mockEngine.getAppConfig.mockResolvedValue(mockConfig);
-
+        // getAppConfig now returns null (needs Supabase client)
         const result = await getAppConfig('app-123');
 
-        expect(result).toEqual(mockConfig);
-        expect(mockEngine.getAppConfig).toHaveBeenCalledWith('app-123');
+        expect(result).toBeNull();
       });
 
-      it('handles engine errors', async () => {
+      it('handles missing Supabase client gracefully', async () => {
         const { getAppConfig } = await import('./api');
         
-        const error = new Error('Engine error');
-        mockEngine.getAppConfig.mockRejectedValue(error);
-
-        await expect(getAppConfig('app-123')).rejects.toThrow('Engine error');
+        const result = await getAppConfig('app-123');
+        
+        // Should return null when no client is available
+        expect(result).toBeNull();
       });
     });