@jmruthers/pace-core 0.5.76 → 0.5.78

package/src/rbac/api.ts

@@ -9,19 +9,22 @@
 
 import { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../types/database';
-import { 
-  UUID, 
-  Scope, 
-  Permission, 
-  AccessLevel, 
-  PermissionMap, 
+import {
+  UUID,
+  Scope,
+  Permission,
+  AccessLevel,
+  PermissionMap,
   PermissionCheck,
-  RBACNotInitializedError
+  RBACNotInitializedError,
+  RBACAppContext,
+  RBACRoleContext,
 } from './types';
 import { createRBACEngine, RBACEngine } from './engine';
 import { createAuditManager, setGlobalAuditManager } from './audit';
 import { rbacCache, RBACCache, CACHE_PATTERNS } from './cache';
 import { createRBACConfig, RBACConfig, getRBACLogger } from './config';
+import { SecurityContext } from './security';
 
 // Global engine instance
 let globalEngine: RBACEngine | null = null;
@@ -116,6 +119,22 @@ export async function getPermissionMap(input: {
   return engine.getPermissionMap(input);
 }
 
+export async function resolveAppContext(input: {
+  userId: UUID;
+  appName: string;
+}): Promise<RBACAppContext | null> {
+  const engine = getEngine();
+  return engine.resolveAppContext(input);
+}
+
+export async function getRoleContext(input: {
+  userId: UUID;
+  scope: Scope;
+}): Promise<RBACRoleContext> {
+  const engine = getEngine();
+  return engine.getRoleContext(input);
+}
+
 /**
  * Check if user has a specific permission
  * 
@@ -134,7 +153,17 @@ export async function getPermissionMap(input: {
  */
 export async function isPermitted(input: PermissionCheck): Promise<boolean> {
   const engine = getEngine();
-  return engine.isPermitted(input);
+  
+  // Create security context from input
+  // SecurityContext requires organisationId as UUID, so we use a valid fallback
+  const securityContext: SecurityContext = {
+    userId: input.userId,
+    organisationId: input.scope.organisationId || input.userId, // Fallback to userId as UUID
+    timestamp: new Date(),
+    // Optional fields can be omitted
+  };
+  
+  return engine.isPermitted(input, securityContext);
 }
 
 /**
@@ -254,8 +283,30 @@ export async function isSuperAdmin(userId: UUID): Promise<boolean> {
  * @returns Promise resolving to app configuration
  */
 export async function getAppConfig(appId: UUID): Promise<{ requires_event: boolean } | null> {
-  const engine = getEngine();
-  return engine['getAppConfig'](appId);
+  // This function requires a Supabase client to be provided
+  // Callers should pass the client as a parameter
+  console.warn('[RBAC] getAppConfig called without Supabase client - returning null');
+  return null;
+}
+
+export async function getAppConfigWithClient(client: SupabaseClient, appId: UUID): Promise<{ requires_event: boolean } | null> {
+  try {
+    const { data, error } = await client
+      .from('rbac_apps')
+      .select('requires_event')
+      .eq('id', appId)
+      .eq('is_active', true)
+      .single() as { data: { requires_event: boolean } | null; error: any };
+
+    if (error || !data) {
+      return null;
+    }
+
+    return { requires_event: data.requires_event };
+  } catch (err) {
+    console.error('[RBAC] Error fetching app config:', err);
+    return null;
+  }
 }
 
 /**

package/src/rbac/audit.test.ts

@@ -86,24 +86,23 @@ describe('RBACAuditManager', () => {
       await auditManager.emitPermissionCheck(event);
 
       expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
-      expect(mockSupabase.insert).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
-            event_type: 'permission_check',
-            user_id: 'user-123',
-            organisation_id: 'org-456',
-            event_id: 'event-789',
-            app_id: 'app-101',
-            page_id: 'page-202',
-            permission: 'read:users',
-            decision: true,
-            source: 'api',
-            bypass: false,
-            duration_ms: 150,
-            metadata: { ip: '192.168.1.1' }
-          })
-        ])
-      );
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
+          event_type: 'permission_check',
+          user_id: 'user-123',
+          organisation_id: 'org-456',
+          event_id: 'event-789',
+          app_id: 'app-101',
+          page_id: 'page-202',
+          permission: 'read:users',
+          decision: true,
+          source: 'api',
+          bypass: false,
+          duration_ms: 150,
+          metadata: expect.objectContaining({ ip: '192.168.1.1' })
+        })
+      ]
+    );
     });
 
     it('handles permission check events without optional fields', async () => {
@@ -152,9 +151,8 @@ describe('RBACAuditManager', () => {
       await auditManager.emitPermissionDenied(event);
 
       expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
-      expect(mockSupabase.insert).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
             event_type: 'permission_denied',
             user_id: 'user-123',
             organisation_id: 'org-456',
@@ -163,9 +161,9 @@ describe('RBACAuditManager', () => {
             page_id: 'page-202',
             permission: 'manage:users',
             source: 'api',
-            metadata: { reason: 'Insufficient role' }
+            metadata: expect.objectContaining({ reason: 'Insufficient role' })
           })
-        ])
+        ]
       );
     });
   });
@@ -186,18 +184,17 @@ describe('RBACAuditManager', () => {
       await auditManager.emitRoleGranted(event);
 
       expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
-      expect(mockSupabase.insert).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
             event_type: 'role_granted',
             user_id: 'user-123',
             organisation_id: 'org-456',
             event_id: 'event-789',
             app_id: 'app-101',
             source: 'api',
-            metadata: { reason: 'Promotion' }
+            metadata: expect.objectContaining({ reason: 'Promotion' })
           })
-        ])
+        ]
       );
     });
   });
@@ -218,18 +215,17 @@ describe('RBACAuditManager', () => {
       await auditManager.emitRoleRevoked(event);
 
       expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
-      expect(mockSupabase.insert).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
             event_type: 'role_denied',
             user_id: 'user-123',
             organisation_id: 'org-456',
             event_id: 'event-789',
             app_id: 'app-101',
             source: 'api',
-            metadata: { reason: 'Policy violation' }
+            metadata: expect.objectContaining({ reason: 'Policy violation' })
           })
-        ])
+        ]
       );
     });
   });
@@ -251,18 +247,17 @@ describe('RBACAuditManager', () => {
       await auditManager.emitRLSDenied(event);
 
       expect(mockSupabase.from).toHaveBeenCalledWith('rbac_audit_events');
-      expect(mockSupabase.insert).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
             event_type: 'rls_denied',
             user_id: 'user-123',
             organisation_id: 'org-456',
             event_id: 'event-789',
             app_id: 'app-101',
             source: 'rls',
-            metadata: { query: 'SELECT * FROM users' }
+            metadata: expect.objectContaining({ query: 'SELECT * FROM users' })
           })
-        ])
+        ]
       );
     });
   });

package/src/rbac/audit.ts

@@ -143,20 +143,33 @@ export class RBACAuditManager {
     }
 
     // Validate required fields before attempting to insert
-    if (!event.userId || !event.organisationId) {
-      console.warn('[RBAC Audit] Skipping audit event - missing required fields:', {
-        userId: event.userId,
-        organisationId: event.organisationId,
-        eventType: event.type
+    // MANDATORY: All audit events must have userId
+    if (!event.userId) {
+      console.error('[RBAC Audit] CRITICAL: Cannot log audit event without userId:', {
+        eventType: event.type,
+        organisationId: event.organisationId
       });
       return;
     }
 
+    // WARNING: Some audit events may not have organisationId (e.g., global admin operations)
+    // Log these for security monitoring even if organisationId is missing
+    if (!event.organisationId) {
+      console.warn('[RBAC Audit] Audit event without organisation context:', {
+        userId: event.userId,
+        eventType: event.type,
+        note: 'This should be investigated for security compliance'
+      });
+    }
+
     try {
+      // For events without organisationId, store in a special way
       const auditEvent: Omit<RBACAuditEvent, 'id' | 'created_at'> = {
         event_type: event.type,
         user_id: event.userId,
-        organisation_id: event.organisationId,
+        // CRITICAL: Store organisationId even if null for auditing
+        // Use a fallback UUID if organisation context is missing (for database constraint)
+        organisation_id: event.organisationId || '00000000-0000-0000-0000-000000000000' as UUID,
         event_id: 'eventId' in event ? event.eventId : undefined,
         app_id: 'appId' in event ? event.appId : undefined,
         page_id: 'pageId' in event ? event.pageId : undefined,
@@ -169,6 +182,8 @@ export class RBACAuditManager {
           ...event.metadata,
           cache_hit: 'cache_hit' in event ? event.cache_hit : undefined,
           cache_source: 'cache_source' in event ? event.cache_source : undefined,
+          // Store a flag indicating this event had no organisation context
+          no_organisation_context: !event.organisationId,
         },
       };
 

package/src/rbac/cache.ts

@@ -123,7 +123,39 @@ export class RBACCache {
   }
 
   /**
-   * Generate cache key for permission check
+   * Generate cache key for permission check (simplified signature)
+   * 
+   * @param userId - User ID
+   * @param permission - Permission string
+   * @param organisationId - Organisation ID (optional)
+   * @param eventId - Event ID (optional)
+   * @param appId - App ID (optional)
+   * @param pageId - Page ID (optional)
+   * @returns String cache key
+   */
+  static generateKey(
+    userId: UUID,
+    permission: string,
+    organisationId?: UUID,
+    eventId?: string,
+    appId?: UUID,
+    pageId?: UUID | string
+  ): string {
+    const parts = [
+      'perm',
+      userId,
+      organisationId || 'null',
+      eventId || 'null',
+      appId || 'null',
+      permission || 'null',
+      pageId || 'null',
+    ];
+    
+    return parts.join(':');
+  }
+
+  /**
+   * Generate cache key for permission check (object signature)
    * 
    * @param key - Permission cache key object
    * @returns String cache key

package/src/rbac/components/NavigationGuard.tsx

@@ -121,7 +121,7 @@ export function NavigationGuard({
   loading = <DefaultLoading />,
   requireAll = true
 }: NavigationGuardProps) {
-  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
   const [hasChecked, setHasChecked] = useState(false);
   const [checkError, setCheckError] = useState<Error | null>(null);
   const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);
@@ -135,29 +135,29 @@ export function NavigationGuard({
       }
 
       // If we have both organisation and event, use them directly
-      if (selectedOrganisationId && selectedEventId) {
+      if (selectedOrganisation && selectedEvent) {
         setResolvedScope({
-          organisationId: selectedOrganisationId,
-          eventId: selectedEventId,
+          organisationId: selectedOrganisation.id,
+          eventId: selectedEvent.event_id,
           appId: undefined
         });
         return;
       }
 
       // If we only have organisation, use it
-      if (selectedOrganisationId) {
+      if (selectedOrganisation) {
         setResolvedScope({
-          organisationId: selectedOrganisationId,
-          eventId: selectedEventId || undefined,
+          organisationId: selectedOrganisation.id,
+          eventId: selectedEvent?.event_id || undefined,
           appId: undefined
         });
         return;
       }
 
       // If we only have event, resolve organisation from event
-      if (selectedEventId && supabase) {
+      if (selectedEvent && supabase) {
         try {
-          const eventScope = await createScopeFromEvent(supabase, selectedEventId);
+          const eventScope = await createScopeFromEvent(supabase, selectedEvent.event_id);
           if (!eventScope) {
             setCheckError(new Error('Could not resolve organization from event context'));
             return;
@@ -174,14 +174,14 @@ export function NavigationGuard({
     };
 
     resolveScope();
-  }, [scope, selectedOrganisationId, selectedEventId, supabase]);
+  }, [scope, selectedOrganisation, selectedEvent, supabase]);
 
   // Check permissions using the first permission as a representative
   // For multiple permissions, we'll check them sequentially
   const representativePermission = navigationItem.permissions[0];
   const { can, isLoading, error } = useCan(
     user?.id || '',
-    resolvedScope || { eventId: selectedEventId || undefined },
+    resolvedScope || { eventId: selectedEvent?.event_id || undefined },
     representativePermission,
     navigationItem.pageId,
     true // Use cache

package/src/rbac/components/NavigationProvider.test.tsx

@@ -78,8 +78,8 @@ describe('NavigationProvider', () => {
       user: mockUser,
       isAuthenticated: true,
       signOut: vi.fn(),
-      selectedOrganisationId: 'org-123',
-      selectedEventId: 'event-456',
+      selectedOrganisation: { id: 'org-123' },
+      selectedEvent: { event_id: 'event-456' },
       // Add other required properties
     } as any);
   });
@@ -199,7 +199,7 @@ describe('NavigationProvider', () => {
       );
 
       await waitFor(() => {
-        expect(screen.getByTestId('has-permission')).toHaveTextContent('true');
+        expect(screen.getByTestId('has-permission')).toHaveTextContent('false');
       });
     });
 
@@ -225,7 +225,7 @@ describe('NavigationProvider', () => {
       );
 
       await waitFor(() => {
-        expect(screen.getByTestId('filtered-count')).toHaveTextContent('3');
+        expect(screen.getByTestId('filtered-count')).toHaveTextContent('2');
       });
     });
   });
@@ -329,7 +329,13 @@ describe('NavigationProvider', () => {
 
       const TestConsumer = () => {
         const context = useNavigationPermissions();
-        const hasPermission = context.hasNavigationPermission('dashboard', mockScope);
+        const mockNavigationItem = {
+          id: 'dashboard',
+          label: 'Dashboard',
+          href: '/dashboard',
+          permissions: ['read:page.dashboard']
+        };
+        const hasPermission = context.hasNavigationPermission(mockNavigationItem);
         
         return (
           <div data-testid="has-permission">{hasPermission.toString()}</div>

package/src/rbac/components/NavigationProvider.tsx

@@ -56,6 +56,7 @@
 
 import React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';
 import { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';
+import { useCan } from '../hooks';
 import { UUID, Scope, Permission } from '../types';
 
 export interface NavigationItem {
@@ -169,36 +170,59 @@ export function NavigationProvider({
   onStrictModeViolation,
   maxHistorySize = 1000
 }: NavigationProviderProps) {
-  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();
+  const { user, selectedOrganisation, selectedEvent } = useUnifiedAuth();
   const [navigationAccessHistory, setNavigationAccessHistory] = useState<NavigationAccessRecord[]>([]);
   const [isEnabled, setIsEnabled] = useState(true);
 
   // Get current scope
   const currentScope = useMemo((): Scope | null => {
-    if (!selectedOrganisationId) return null;
+    if (!selectedOrganisation) return null;
     
     return {
-      organisationId: selectedOrganisationId,
-      eventId: selectedEventId || undefined,
+      organisationId: selectedOrganisation.id,
+      eventId: selectedEvent?.event_id || undefined,
       appId: undefined
     };
-  }, [selectedOrganisationId, selectedEventId]);
+  }, [selectedOrganisation, selectedEvent]);
 
   // Check if user has permission for a navigation item
+  // NOTE: This is a synchronous check for basic validation only.
+  // Actual permission checking should be done by individual NavigationGuard components
+  // using the useCan hook for proper async RBAC integration.
   const hasNavigationPermission = useCallback((
     item: NavigationItem
   ): boolean => {
     if (!isEnabled) return true;
-    if (!user?.id) return false;
+    if (!user?.id) return false; // No user context - deny access for security
     
-    if (!currentScope) return false;
+    if (!currentScope) return false; // No scope context - deny access for security
     
-    // Use the existing RBAC system to check navigation permissions
-    // This is a synchronous check for the context - actual permission checking
-    // happens in the individual navigation components using useCan hook
-    // For now, we'll return true and let the individual navigation components
-    // handle the actual permission checking asynchronously
-    return true;
+    // If no permissions are defined for the navigation item, deny access by default
+    if (!item.permissions || item.permissions.length === 0) {
+      console.warn(`[NavigationProvider] Navigation item "${item.id}" has no permissions defined - denying access`);
+      return false;
+    }
+    
+    // Use the first permission for checking (as per original implementation)
+    const permission = item.permissions[0];
+    
+    // Call useCan hook for actual permission checking
+    const { can, error } = useCan(
+      user.id,
+      currentScope,
+      permission,
+      item.pageId,
+      true // useCache
+    );
+    
+    // Handle errors gracefully - allow access when there are permission check errors (graceful degradation)
+    // This ensures navigation doesn't break when the permission service has issues
+    if (error) {
+      console.warn(`[NavigationProvider] Permission check error for "${item.id}": ${error.message} - allowing access for graceful degradation`);
+      return true;
+    }
+    
+    return can;
   }, [isEnabled, user?.id, currentScope]);
 
   // Get all navigation permissions for current user