@jmruthers/pace-core 0.5.76 → 0.5.78

package/src/rbac/hooks/useRBAC.test.ts

@@ -1,573 +1,187 @@
-/**
- * @file useRBAC Hook Tests
- * @package @jmruthers/pace-core
- * @module Hooks/useRBAC
- * @since 0.3.0
- * 
- * Comprehensive tests for the useRBAC hook covering all critical functionality.
- */
-
 import { renderHook, waitFor } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { useRBAC } from './useRBAC';
 
-// Mock the providers and dependencies
 vi.mock('../../providers/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: vi.fn()
+  useUnifiedAuth: vi.fn(),
 }));
 
 vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: vi.fn()
+  useUnifiedAuth: vi.fn(),
 }));
 
 vi.mock('../../hooks/useOrganisations', () => ({
-  useOrganisations: vi.fn()
+  useOrganisations: vi.fn(),
 }));
 
 vi.mock('../../hooks/useEvents', () => ({
-  useEvents: vi.fn()
+  useEvents: vi.fn(),
 }));
 
-// Mock Supabase client
-const mockSupabaseClient = {
-  rpc: vi.fn()
-};
+vi.mock('../api', () => ({
+  getPermissionMap: vi.fn(),
+  getAccessLevel: vi.fn(),
+  isPermittedCached: vi.fn(),
+  resolveAppContext: vi.fn(),
+  getRoleContext: vi.fn(),
+}));
 
-// Get the mocked functions
 import { useUnifiedAuth } from '../../providers';
 import { useOrganisations } from '../../hooks/useOrganisations';
 import { useEvents } from '../../hooks/useEvents';
+import {
+  getPermissionMap,
+  getAccessLevel,
+  isPermittedCached,
+  resolveAppContext,
+  getRoleContext,
+} from '../api';
 
 const mockUseUnifiedAuth = vi.mocked(useUnifiedAuth);
 const mockUseOrganisations = vi.mocked(useOrganisations);
 const mockUseEvents = vi.mocked(useEvents);
+const mockGetPermissionMap = vi.mocked(getPermissionMap);
+const mockGetAccessLevel = vi.mocked(getAccessLevel);
+const mockIsPermittedCached = vi.mocked(isPermittedCached);
+const mockResolveAppContext = vi.mocked(resolveAppContext);
+const mockGetRoleContext = vi.mocked(getRoleContext);
 
-describe('useRBAC Hook', () => {
-  const mockUser = {
-    id: 'user-123',
-    email: 'test@example.com'
-  };
-
-  const mockSession = {
-    access_token: 'mock-token'
-  };
-
-  const mockOrganisation = {
-    id: 'org-123',
-    name: 'Test Organisation'
-  };
-
-  const mockEvent = {
-    id: 'event-123',
-    name: 'Test Event'
-  };
-
+describe('useRBAC', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    
-    // Setup default mocks
+
     mockUseUnifiedAuth.mockReturnValue({
       user: null,
       session: null,
-      supabase: mockSupabaseClient,
-      appName: 'test-app'
+      appName: 'test-app',
     });
-    
-    mockUseOrganisations.mockReturnValue({
-      selectedOrganisation: null
-    });
-    
-    mockUseEvents.mockReturnValue({
-      selectedEvent: null
+
+    mockUseOrganisations.mockReturnValue({ selectedOrganisation: null });
+    mockUseEvents.mockReturnValue({ selectedEvent: null });
+
+    mockGetPermissionMap.mockResolvedValue({});
+    mockGetAccessLevel.mockResolvedValue('viewer');
+    mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
+    mockGetRoleContext.mockResolvedValue({
+      globalRole: null,
+      organisationRole: null,
+      eventAppRole: null,
     });
+    mockIsPermittedCached.mockResolvedValue(false);
   });
 
-    describe('Initialization', () => {
-    it('initializes with loading state when no user', () => {
-      const { result } = renderHook(() => useRBAC());
-      
-      expect(result.current.isLoading).toBe(false);
-      expect(result.current.user).toBeNull();
-      expect(result.current.globalRole).toBeNull();
-      expect(result.current.organisationRole).toBeNull();
-      expect(result.current.eventAppRole).toBeNull();
-      expect(result.current.error).toBeNull();
-    });
+  it('returns base state when unauthenticated', () => {
+    const { result } = renderHook(() => useRBAC());
 
-    it('initializes with authenticated state', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      mockUseEvents.mockReturnValue({
-        selectedEvent: mockEvent
-      });
-
-      // Mock successful RPC calls
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'all_permissions', role_name: 'super_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-      
-      expect(result.current.user).toEqual(mockUser);
-      
-      await waitFor(() => {
-        expect(result.current.isLoading).toBe(false);
-      });
-    });
+    expect(result.current.user).toBeNull();
+    expect(result.current.globalRole).toBeNull();
+    expect(result.current.isLoading).toBe(false);
   });
 
-  describe('Role Detection', () => {
-    it('detects super admin role from RPC response', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock super admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'all_permissions', role_name: 'super_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.globalRole).toBe('super_admin');
-        expect(result.current.isSuperAdmin).toBe(true);
-      });
+  it('loads permissions through RBAC engine', async () => {
+    mockUseUnifiedAuth.mockReturnValue({
+      user: { id: 'user-1' },
+      session: { access_token: 'token' },
+      appName: 'test-app',
     });
+    mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
 
-    it('detects organisation admin role', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock org admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'organisation_access', role_name: 'org_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.organisationRole).toBe('org_admin');
-        expect(result.current.isOrgAdmin).toBe(true);
-      });
+    mockGetPermissionMap.mockResolvedValue({ 'read:dashboard': true });
+    mockGetRoleContext.mockResolvedValue({
+      globalRole: null,
+      organisationRole: null,
+      eventAppRole: null,
     });
 
-    it('detects event admin role', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      mockUseEvents.mockReturnValue({
-        selectedEvent: mockEvent
-      });
-
-      // Mock event admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'event_app_access', role_name: 'event_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.eventAppRole).toBe('event_admin');
-        expect(result.current.isEventAdmin).toBe(true);
-      });
-    });
+    const { result } = renderHook(() => useRBAC('dashboard'));
 
-    it('handles role hierarchy correctly', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      mockUseEvents.mockReturnValue({
-        selectedEvent: mockEvent
-      });
-
-      // Mock super admin with all roles
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [
-              { permission_type: 'all_permissions', role_name: 'super_admin' },
-              { permission_type: 'organisation_access', role_name: 'org_admin' },
-              { permission_type: 'event_app_access', role_name: 'event_admin' }
-            ],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.globalRole).toBe('super_admin');
-        expect(result.current.organisationRole).toBe('org_admin');
-        expect(result.current.eventAppRole).toBe('event_admin');
-        expect(result.current.isSuperAdmin).toBe(true);
-        expect(result.current.isOrgAdmin).toBe(true);
-        expect(result.current.isEventAdmin).toBe(true);
-      });
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+      expect(result.current.hasPermission).toBeTypeOf('function');
     });
+
+    expect(mockResolveAppContext).toHaveBeenCalledWith({ userId: 'user-1', appName: 'test-app' });
+    expect(mockGetPermissionMap).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: 'user-1',
+        scope: expect.objectContaining({ organisationId: 'org-1' }),
+      }),
+    );
   });
 
-  describe('Permission Checking', () => {
-    it('hasPermission returns true for super admin', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock super admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'all_permissions', role_name: 'super_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.isSuperAdmin).toBe(true);
-      });
-
-      // Test hasPermission function
-      const canRead = await result.current.hasPermission('read', 'users');
-      expect(canRead).toBe(true);
+  it('uses cached permission map before hitting engine', async () => {
+    mockUseUnifiedAuth.mockReturnValue({
+      user: { id: 'user-1' },
+      session: { access_token: 'token' },
+      appName: 'test-app',
     });
+    mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
+    mockGetPermissionMap.mockResolvedValue({ 'read:dashboard': true });
 
-    it('hasPermission checks database for regular users', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock regular user RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'organisation_access', role_name: 'member' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.organisationRole).toBe('member');
-      });
-
-      // Test hasPermission function
-      const canDelete = await result.current.hasPermission('delete', 'users');
-      expect(canDelete).toBe(false);
-    });
+    const { result } = renderHook(() => useRBAC('dashboard'));
 
-    it('hasGlobalPermission works correctly', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock super admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'all_permissions', role_name: 'super_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.globalRole).toBe('super_admin');
-      });
-
-      // Test hasGlobalPermission function
-      expect(result.current.hasGlobalPermission('super_admin')).toBe(true);
-      expect(result.current.hasGlobalPermission('org_admin')).toBe(true);
-      expect(result.current.hasGlobalPermission('invalid_permission')).toBe(true); // Super admin has all permissions
-    });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    mockIsPermittedCached.mockClear();
+    const allowed = await result.current.hasPermission('read', 'dashboard');
+
+    expect(allowed).toBe(true);
+    expect(mockIsPermittedCached).not.toHaveBeenCalled();
   });
 
-  describe('Error Handling', () => {
-    it('handles RPC errors gracefully', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
+  it('falls back to engine when permission not cached', async () => {
+    mockUseUnifiedAuth.mockReturnValue({
+      user: { id: 'user-1' },
+      session: { access_token: 'token' },
+      appName: 'test-app',
+    });
+    mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
+    mockGetPermissionMap.mockResolvedValue({});
+    mockIsPermittedCached.mockResolvedValue(true);
 
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
+    const { result } = renderHook(() => useRBAC('dashboard'));
 
-      // Mock RPC error
-      mockSupabaseClient.rpc.mockRejectedValue(new Error('RPC Error'));
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
 
-      const { result } = renderHook(() => useRBAC());
+    const allowed = await result.current.hasPermission('read', 'dashboard');
 
-      await waitFor(() => {
-        expect(result.current.error).toBeDefined();
-        expect(result.current.isLoading).toBe(false);
-      });
-    });
+    expect(allowed).toBe(true);
+    expect(mockIsPermittedCached).toHaveBeenCalled();
+  });
 
-    it('handles missing EventProvider gracefully', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock EventProvider throwing error
-      mockUseEvents.mockImplementation(() => {
-        throw new Error('EventProvider not available');
-      });
-
-      // Mock successful RPC calls
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [{ permission_type: 'all_permissions', role_name: 'super_admin' }],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      // Should not throw error and continue without event context
-      expect(result.current.user).toEqual(mockUser);
-      
-      await waitFor(() => {
-        expect(result.current.isLoading).toBe(false);
-      });
+  it('handles denied app resolution securely', async () => {
+    mockUseUnifiedAuth.mockReturnValue({
+      user: { id: 'user-1' },
+      session: { access_token: 'token' },
+      appName: 'test-app',
     });
+    mockResolveAppContext.mockResolvedValue(null);
+
+    const { result } = renderHook(() => useRBAC());
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    expect(result.current.error).toBeInstanceOf(Error);
+    expect(result.current.globalRole).toBeNull();
   });
 
-  describe('Hook Properties', () => {
-    it('has all required properties', () => {
-      const { result } = renderHook(() => useRBAC());
-      
-      expect(result.current).toHaveProperty('user');
-      expect(result.current).toHaveProperty('globalRole');
-      expect(result.current).toHaveProperty('organisationRole');
-      expect(result.current).toHaveProperty('eventAppRole');
-      expect(result.current).toHaveProperty('hasPermission');
-      expect(result.current).toHaveProperty('hasGlobalPermission');
-      expect(result.current).toHaveProperty('isSuperAdmin');
-      expect(result.current).toHaveProperty('isOrgAdmin');
-      expect(result.current).toHaveProperty('isEventAdmin');
-      expect(result.current).toHaveProperty('canManageOrganisation');
-      expect(result.current).toHaveProperty('canManageEvent');
-      expect(result.current).toHaveProperty('isLoading');
-      expect(result.current).toHaveProperty('error');
+  it('treats super admin role as having all permissions', async () => {
+    mockUseUnifiedAuth.mockReturnValue({
+      user: { id: 'user-1' },
+      session: { access_token: 'token' },
+      appName: 'test-app',
     });
-
-    it('hasPermission is a function', () => {
-      const { result } = renderHook(() => useRBAC());
-      
-      expect(typeof result.current.hasPermission).toBe('function');
-      expect(typeof result.current.hasGlobalPermission).toBe('function');
+    mockGetRoleContext.mockResolvedValue({
+      globalRole: 'super_admin',
+      organisationRole: null,
+      eventAppRole: null,
     });
 
-    it('computed properties work correctly', async () => {
-      mockUseUnifiedAuth.mockReturnValue({
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabaseClient,
-        appName: 'test-app'
-      });
-
-      mockUseOrganisations.mockReturnValue({
-        selectedOrganisation: mockOrganisation
-      });
-
-      // Mock super admin RPC response
-      mockSupabaseClient.rpc.mockImplementation((functionName: string) => {
-        if (functionName === 'util_app_resolve') {
-          return Promise.resolve({
-            data: [{ app_id: 'test-app-id', has_access: true }],
-            error: null
-          });
-        }
-        if (functionName === 'rbac_permissions_get') {
-          return Promise.resolve({
-            data: [
-              { permission_type: 'all_permissions', role_name: 'super_admin' },
-              { permission_type: 'organisation_access', role_name: 'org_admin' },
-              { permission_type: 'event_app_access', role_name: 'event_admin' }
-            ],
-            error: null
-          });
-        }
-        return Promise.resolve({ data: null, error: null });
-      });
-
-      const { result } = renderHook(() => useRBAC());
-
-      await waitFor(() => {
-        expect(result.current.globalRole).toBe('super_admin');
-        expect(result.current.organisationRole).toBe('org_admin');
-        expect(result.current.eventAppRole).toBe('event_admin');
-      });
-
-      // Test computed properties
-      expect(result.current.isSuperAdmin).toBe(true);
-      expect(result.current.isOrgAdmin).toBe(true);
-      expect(result.current.isEventAdmin).toBe(true);
-      expect(result.current.canManageOrganisation).toBe(true);
-      expect(result.current.canManageEvent).toBe(true);
-    });
+    const { result } = renderHook(() => useRBAC());
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    expect(result.current.isSuperAdmin).toBe(true);
+    expect(result.current.hasGlobalPermission('any')).toBe(true);
   });
-});
+});