@jmruthers/pace-core 0.6.1 → 0.6.3

package/src/hooks/__tests__/useSecureDataAccess.unit.test.tsx

@@ -1,680 +0,0 @@
-import { renderHook, act } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach } from 'vitest';
-import { useSecureDataAccess } from '../useSecureDataAccess';
-import { useUnifiedAuth } from '../../providers';
-import { useOrganisations } from '../../hooks/useOrganisations';
-import { testDataGenerators } from '../../__tests__/helpers/test-utils';
-import { useResolvedScope } from '../../rbac/hooks/useResolvedScope';
-import { useOrganisationSecurity } from '../useOrganisationSecurity';
-
-// Mock dependencies
-vi.mock('../../providers', () => ({
-  useUnifiedAuth: vi.fn(),
-}));
-
-vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: vi.fn(),
-}));
-
-vi.mock('../../hooks/useOrganisations', () => ({
-  useOrganisations: vi.fn(),
-}));
-
-vi.mock('../../utils/context/organisationContext', () => ({
-  setOrganisationContext: vi.fn().mockResolvedValue(undefined),
-}));
-
-vi.mock('../../rbac/hooks/useResolvedScope', () => ({
-  useResolvedScope: vi.fn(),
-}));
-
-vi.mock('../useOrganisationSecurity', () => ({
-  useOrganisationSecurity: vi.fn(),
-}));
-
-const mockUseUnifiedAuth = {
-  user: null,
-  session: null,
-  supabase: null,
-  selectedOrganisation: null,
-  selectedEvent: null,
-};
-
-const mockUseOrganisations = vi.fn(() => ({
-  selectedOrganisation: null,
-  organisations: [],
-  userMemberships: [],
-  isLoading: false,
-  error: null,
-  hasValidOrganisationContext: false,
-  isContextReady: false,
-  switchOrganisation: vi.fn(),
-  getUserRole: vi.fn(),
-  validateOrganisationAccess: vi.fn(),
-  refreshOrganisations: vi.fn(),
-  ensureOrganisationContext: vi.fn(),
-  isOrganisationSecure: vi.fn(),
-  getPrimaryOrganisation: vi.fn(),
-}));
-
-// Helper function to create authenticated context
-const createAuthenticatedContext = (supabase = { auth: {} }, org = { id: 'org-123' }) => {
-  const mockUser = testDataGenerators.createUser(1, { id: 'user-123' });
-  const mockSession = testDataGenerators.createSession(1, { access_token: 'test-token' });
-  
-  vi.mocked(useUnifiedAuth).mockReturnValue({
-    ...mockUseUnifiedAuth,
-    user: mockUser,
-    session: mockSession,
-    supabase,
-    selectedOrganisation: org,
-  } as any);
-  
-  // Create a fresh mock with ensureOrganisationContext that returns the org
-  const mockOrgs = {
-    selectedOrganisation: null,
-    organisations: [],
-    userMemberships: [],
-    isLoading: false,
-    error: null,
-    hasValidOrganisationContext: false,
-    isContextReady: false,
-    switchOrganisation: vi.fn(),
-    getUserRole: vi.fn(),
-    validateOrganisationAccess: vi.fn(),
-    refreshOrganisations: vi.fn(),
-    ensureOrganisationContext: vi.fn().mockReturnValue(org),
-    isOrganisationSecure: vi.fn(),
-    getPrimaryOrganisation: vi.fn(),
-  };
-  
-  vi.mocked(useOrganisations).mockReturnValue(mockOrgs as any);
-  
-  // Mock resolved scope with organisationId
-  vi.mocked(useResolvedScope).mockReturnValue({
-    resolvedScope: {
-      organisationId: org.id,
-      eventId: undefined,
-      appId: undefined,
-    },
-    isLoading: false,
-    error: null,
-  });
-};
-
-describe('useSecureDataAccess', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    vi.mocked(useUnifiedAuth).mockReturnValue(mockUseUnifiedAuth as any);
-    // Set up useOrganisations to return the default mock (which throws for org context)
-    vi.mocked(useOrganisations).mockReturnValue(mockUseOrganisations() as any);
-    // Default mock for useResolvedScope - returns null scope (no context)
-    vi.mocked(useResolvedScope).mockReturnValue({
-      resolvedScope: null,
-      isLoading: false,
-      error: null,
-    });
-    // Default mock for useOrganisationSecurity - not super admin
-    vi.mocked(useOrganisationSecurity).mockReturnValue({
-      superAdminContext: { isSuperAdmin: false, hasGlobalAccess: false, canManageAllOrganisations: false },
-      validateOrganisationAccess: vi.fn(),
-      hasMinimumRole: vi.fn(),
-      canAccessChildOrganisations: vi.fn(),
-      checkPermission: vi.fn(),
-      getPermissions: vi.fn(),
-      logOrganisationAccess: vi.fn(),
-      canManageOrganisation: vi.fn(),
-    } as any);
-  });
-
-  describe('validateContext', () => {
-    it('should throw error when no supabase client', () => {
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      expect(() => result.current.validateContext()).toThrow('No Supabase client available');
-    });
-
-    it('should throw error when no organisation context', () => {
-      const mockSupabase = { auth: {} };
-      const mockUser = testDataGenerators.createUser(1, { id: 'user-123' });
-      const mockSession = testDataGenerators.createSession(1, { access_token: 'test-token' });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        supabase: mockSupabase,
-        user: mockUser,
-        session: mockSession,
-      } as any);
-      
-      // Create a mock that throws
-      const mockOrgsThrowing = {
-        ...mockUseOrganisations(),
-        ensureOrganisationContext: vi.fn().mockImplementation(() => {
-          throw new Error('Organisation context is required');
-        }),
-      };
-      vi.mocked(useOrganisations).mockReturnValue(mockOrgsThrowing as any);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      expect(() => result.current.validateContext()).toThrow('Organisation context is required');
-    });
-
-    it('should not throw when context is valid', () => {
-      const mockSupabase = { auth: {} };
-      const mockUser = testDataGenerators.createUser(1, { id: 'user-123' });
-      const mockSession = testDataGenerators.createSession(1, { access_token: 'test-token' });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabase,
-        selectedOrganisation: { id: 'org-123' },
-      } as any);
-      
-      // Mock useResolvedScope to return resolved scope with organisationId
-      vi.mocked(useResolvedScope).mockReturnValue({
-        resolvedScope: {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: undefined,
-        },
-        isLoading: false,
-        error: null,
-      });
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      expect(() => result.current.validateContext()).not.toThrow();
-    });
-  });
-
-  describe('getCurrentOrganisationId', () => {
-    it('should return organisation ID when context is valid', () => {
-      const mockSupabase = { auth: {} };
-      const mockUser = testDataGenerators.createUser(1, { id: 'user-123' });
-      const mockSession = testDataGenerators.createSession(1, { access_token: 'test-token' });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabase,
-        selectedOrganisation: { id: 'org-123' },
-      } as any);
-      
-      // Mock resolved scope with organisationId
-      vi.mocked(useResolvedScope).mockReturnValue({
-        resolvedScope: {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: undefined,
-        },
-        isLoading: false,
-        error: null,
-      });
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      expect(result.current.getCurrentOrganisationId()).toBe('org-123');
-    });
-
-    it('should throw error when context is invalid', () => {
-      const mockSupabase = { auth: {} };
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        supabase: mockSupabase
-      } as any);
-      
-      const mockOrgsThrowing = {
-        ...mockUseOrganisations(),
-        ensureOrganisationContext: vi.fn().mockImplementation(() => {
-          throw new Error('Organisation context is required');
-        }),
-      };
-      vi.mocked(useOrganisations).mockReturnValue(mockOrgsThrowing as any);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      expect(() => result.current.getCurrentOrganisationId()).toThrow('User must be authenticated with valid session');
-    });
-  });
-
-  describe('secureQuery', () => {
-    it('should execute query with organisation filter', async () => {
-      // Create a mock that returns a promise when awaited
-      const mockQuery = {
-        eq: vi.fn().mockReturnThis(),
-        order: vi.fn().mockReturnThis(),
-        limit: vi.fn().mockReturnThis(),
-        range: vi.fn().mockReturnThis()
-      };
-      
-      // Create a promise that resolves to the expected data
-      const mockPromise = Promise.resolve({ data: [{ id: 1, name: 'Test' }], error: null });
-      
-      // Make the mock query chain behave like a promise
-      Object.defineProperty(mockQuery, 'then', {
-        value: mockPromise.then.bind(mockPromise),
-        writable: true,
-        configurable: true
-      });
-      
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue(mockQuery)
-        })
-      };
-      
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureQuery('test_table', '*');
-
-      expect(data).toEqual([{ id: 1, name: 'Test' }]);
-      expect(mockSupabase.from).toHaveBeenCalledWith('test_table');
-    });
-
-    it('should handle query errors', async () => {
-      // Create a mock that returns a promise with an error
-      const mockQuery = {
-        eq: vi.fn().mockReturnThis(),
-        order: vi.fn().mockReturnThis(),
-        limit: vi.fn().mockReturnThis(),
-        range: vi.fn().mockReturnThis()
-      };
-      
-      // Create a promise that resolves to an error
-      const mockPromise = Promise.resolve({ data: null, error: new Error('Query failed') });
-      
-      // Make the mock query chain behave like a promise
-      Object.defineProperty(mockQuery, 'then', {
-        value: mockPromise.then.bind(mockPromise),
-        writable: true,
-        configurable: true
-      });
-      
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue(mockQuery)
-        })
-      };
-      
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await expect(result.current.secureQuery('test_table', '*')).rejects.toThrow('Query failed');
-    });
-
-    it('should handle null/undefined filter values', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockResolvedValue({ data: [], error: null })
-            })
-          })
-        })
-      };
-      
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureQuery('test_table', '*', {
-        status: 'active',
-        category: null,
-        type: undefined
-      });
-
-      expect(data).toEqual([]);
-    });
-
-    it('should return empty array when no data', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockResolvedValue({ data: null, error: null })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureQuery('test_table', '*');
-
-      expect(data).toEqual([]);
-    });
-  });
-
-  describe('secureInsert', () => {
-    it('should insert data with organisation ID', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          insert: vi.fn().mockReturnValue({
-            select: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({ data: { id: 1, name: 'Test', organisation_id: 'org-123' }, error: null })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureInsert('test_table', { name: 'Test' });
-
-      expect(data).toEqual({ id: 1, name: 'Test', organisation_id: 'org-123' });
-      expect(mockSupabase.from).toHaveBeenCalledWith('test_table');
-    });
-
-    it('should handle insert errors', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          insert: vi.fn().mockReturnValue({
-            select: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({ data: null, error: new Error('Insert failed') })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await expect(result.current.secureInsert('test_table', { name: 'Test' })).rejects.toThrow('Insert failed');
-    });
-  });
-
-  describe('secureUpdate', () => {
-    it('should update data with organisation filter', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          update: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                select: vi.fn().mockResolvedValue({ data: [{ id: 1, name: 'Updated', organisation_id: 'org-123' }], error: null })
-              })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureUpdate('core_events', { name: 'Updated' }, { id: 1 });
-
-      expect(data).toEqual([{ id: 1, name: 'Updated', organisation_id: 'org-123' }]);
-    });
-
-    it('should handle update errors', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          update: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                select: vi.fn().mockResolvedValue({ data: null, error: new Error('Update failed') })
-              })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await expect(result.current.secureUpdate('core_events', { name: 'Updated' }, { id: 1 })).rejects.toThrow('Update failed');
-    });
-
-    it('should return empty array when no data updated', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          update: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                select: vi.fn().mockResolvedValue({ data: null, error: null })
-              })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureUpdate('core_events', { name: 'Updated' }, { id: 1 });
-
-      expect(data).toEqual([]);
-    });
-  });
-
-  describe('secureDelete', () => {
-    it('should delete data with organisation filter', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          delete: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockResolvedValue({ error: null })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await result.current.secureDelete('core_events', { id: 1 });
-
-      expect(mockSupabase.from).toHaveBeenCalledWith('core_events');
-    });
-
-    it('should handle delete errors', async () => {
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          delete: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockResolvedValue({ error: new Error('Delete failed') })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // The implementation throws the error, so the promise should reject
-      await expect(result.current.secureDelete('core_events', { id: 1 })).rejects.toThrow('Delete failed');
-    });
-  });
-
-  describe('secureRpc', () => {
-    it('should call RPC with organisation ID', async () => {
-      const mockSupabase = {
-        rpc: vi.fn().mockResolvedValue({ data: { result: 'success' }, error: null })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      const data = await result.current.secureRpc('test_function', { param1: 'value1' });
-
-      expect(data).toEqual({ result: 'success' });
-      expect(mockSupabase.rpc).toHaveBeenCalledWith('test_function', {
-        param1: 'value1',
-        p_user_id: 'user-123',
-        organisation_id: 'org-123'
-      });
-    });
-
-    it('should handle RPC errors', async () => {
-      const mockSupabase = {
-        rpc: vi.fn().mockResolvedValue({ data: null, error: new Error('RPC failed') })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await expect(result.current.secureRpc('test_function')).rejects.toThrow('RPC failed');
-    });
-
-    it('should call RPC without additional params', async () => {
-      const mockSupabase = {
-        rpc: vi.fn().mockResolvedValue({ data: { result: 'success' }, error: null })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      await result.current.secureRpc('test_function');
-
-      expect(mockSupabase.rpc).toHaveBeenCalledWith('test_function', {
-        p_user_id: 'user-123',
-        organisation_id: 'org-123'
-      });
-    });
-  });
-
-  describe('Logging', () => {
-    it('should log secure query operations', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockResolvedValue({ data: [], error: null })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // Verify the actual behavior: secure query works correctly
-      const queryResult = await result.current.secureQuery('test_table', '*', { status: 'active' });
-
-      // Test the actual functionality: query executes and returns results
-      expect(queryResult).toEqual([]);
-      // Verify security: organisation context is used
-      expect(result.current.getCurrentOrganisationId()).toBe('org-123');
-      // Verify the query was executed
-      expect(mockSupabase.from).toHaveBeenCalledWith('test_table');
-
-      consoleSpy.mockRestore();
-    });
-
-    it('should log secure insert operations', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          insert: vi.fn().mockReturnValue({
-            select: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({ data: { id: 1 }, error: null })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // Verify the actual behavior: secure insert works correctly
-      const insertResult = await result.current.secureInsert('test_table', { name: 'Test' });
-
-      // Test the actual functionality: insert executes and returns result
-      expect(insertResult).toEqual({ id: 1 });
-      // Verify security: organisation_id is automatically added
-      expect(mockSupabase.from).toHaveBeenCalledWith('test_table');
-      // Verify the operation completed successfully (organisation_id is added internally)
-
-      consoleSpy.mockRestore();
-    });
-
-    it('should log secure update operations', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          update: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                select: vi.fn().mockResolvedValue({ data: [{ id: 1, name: 'Updated' }], error: null })
-              })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // Verify the actual behavior: secure update works correctly
-      const updateResult = await result.current.secureUpdate('core_events', { name: 'Updated' }, { id: 1 });
-
-      // Test the actual functionality: update executes and returns results
-      expect(updateResult).toEqual([{ id: 1, name: 'Updated' }]);
-      // Verify security: organisation filter is applied
-      expect(mockSupabase.from).toHaveBeenCalledWith('core_events');
-      // Verify the operation completed successfully (organisation filter is applied internally)
-
-      consoleSpy.mockRestore();
-    });
-
-    it('should log secure delete operations', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          delete: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockResolvedValue({ error: null })
-            })
-          })
-        })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // Verify the actual behavior: secure delete works correctly
-      await result.current.secureDelete('test_table', { id: 1 });
-
-      // Test the actual functionality: delete executes without error
-      expect(mockSupabase.from).toHaveBeenCalledWith('test_table');
-      // Verify security: organisation filter is applied (operation completed without error)
-      // The delete operation succeeded, which means organisation context was validated
-
-      consoleSpy.mockRestore();
-    });
-
-    it('should log secure RPC operations', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const mockSupabase = {
-        rpc: vi.fn().mockResolvedValue({ data: { result: 'success' }, error: null })
-      };
-      createAuthenticatedContext(mockSupabase);
-
-      const { result } = renderHook(() => useSecureDataAccess());
-
-      // Verify the actual behavior: secure RPC works correctly
-      const rpcResult = await result.current.secureRpc('test_function', { param1: 'value1' });
-
-      // Test the actual functionality: RPC executes and returns result
-      expect(rpcResult).toEqual({ result: 'success' });
-      // Verify security: organisation_id is included in RPC params
-      expect(mockSupabase.rpc).toHaveBeenCalledWith(
-        'test_function',
-        expect.objectContaining({
-          organisation_id: 'org-123'
-        })
-      );
-      // Verify RPC was called correctly (may be called multiple times due to React strict mode or other effects)
-      expect(mockSupabase.rpc).toHaveBeenCalled();
-
-      consoleSpy.mockRestore();
-    });
-  });
-});