@jmruthers/pace-core 0.6.1 → 0.6.3

package/src/rbac/hooks/useRBAC.test.ts

@@ -115,11 +115,7 @@ describe('useRBAC', () => {
           eventId: undefined,
           appId: 'app-123'
         }
-      },
-      {
-        requires_event: false,
-      },
-      'test-app'
+      }
     );
   });
 

package/src/rbac/hooks/useRBAC.ts

@@ -19,6 +19,7 @@ import {
   getAccessLevel,
   resolveAppContext,
   getRoleContext,
+  getPageScopeType,
 } from '../api';
 import { getRBACLogger } from '../config';
 import { ContextValidator } from '../utils/contextValidator';
@@ -58,7 +59,6 @@ export function useRBAC(pageId?: string): UserRBACContext {
     session, 
     supabase,
     appName, 
-    appConfig,
     appId: contextAppId,
     selectedOrganisation,
     isContextReady: orgContextReady,
@@ -94,30 +94,21 @@ export function useRBAC(pageId?: string): UserRBACContext {
     }
 
     // Build initial scope from available context
-    // For event-required apps: use organisation_id from selectedEvent if available (faster than deriving)
-    // For org-required apps: use selectedOrganisation.id
+    // Scope is now page-level only - use whatever context is available
     const initialScope: Scope = {
-      organisationId: appConfig?.requires_event 
-        ? (selectedEvent?.organisation_id || selectedOrganisation?.id) 
-        : selectedOrganisation?.id,
+      organisationId: selectedEvent?.organisation_id || selectedOrganisation?.id || undefined,
       eventId: selectedEvent?.event_id || undefined,
       appId: undefined
     };
 
-    // Check if context is ready using ContextValidator
-    const contextReady = ContextValidator.isContextReady(
-      initialScope,
-      appConfig,
-      appName,
-      !!selectedEvent,
-      !!selectedOrganisation
-    );
-
     // PORTAL/ADMIN special case: context is always ready
-    if (appName !== 'PORTAL' && appName !== 'ADMIN' && !contextReady) {
-      // Wait for appropriate context based on app config
-      setIsLoading(true);
-      return;
+    // For other apps, we need at least one context (org or event) for page-level scope validation
+    if (appName !== 'PORTAL' && appName !== 'ADMIN') {
+      if (!selectedOrganisation && !selectedEvent) {
+        // Wait for context to be available
+        setIsLoading(true);
+        return;
+      }
     }
 
     setIsLoading(true);
@@ -135,14 +126,8 @@ export function useRBAC(pageId?: string): UserRBACContext {
           // For PORTAL/ADMIN apps, allow access even if hasAccess is false (users can view their own profile, super admins have global access)
           if (!resolved) {
             if (appName === 'PORTAL' || appName === 'ADMIN') {
-              // For PORTAL/ADMIN, try to get appId directly from database
-              try {
-                const { getAppConfigByName } = await import('../api');
-                await getAppConfigByName(appName);
-                // We can't get appId from config, but that's OK - use contextAppId or proceed without
-              } catch (err) {
-                // Proceed without appId for page-level permissions
-              }
+              // For PORTAL/ADMIN, proceed without appId - it's optional for these apps
+              // Use contextAppId if available
             } else {
               throw new Error(`User does not have access to app "${appName}"`);
             }
@@ -180,11 +165,25 @@ export function useRBAC(pageId?: string): UserRBACContext {
         appId: appId || contextAppId,
       };
       
-      // Resolve required context using ContextValidator
-      // Pass supabase client to allow deriving organisation from event for event-required apps
-      const validation = await ContextValidator.resolveRequiredContext(
+      // Resolve scope based on page-level scope type
+      // If pageId is provided, use its scope type; otherwise default to 'organisation'
+      let pageScopeType: 'event' | 'organisation' | 'both' = 'organisation';
+      if (pageId && scope.appId) {
+        try {
+          pageScopeType = await getPageScopeType(pageId, scope.appId, appName);
+        } catch (error) {
+          logger.warn('[useRBAC] Failed to get page scope type, defaulting to organisation', {
+            pageId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          // Default to organisation scope on error
+        }
+      }
+      
+      // Resolve required context using page-level scope type
+      const validation = await ContextValidator.resolveScopeForPage(
         scope,
-        appConfig,
+        pageScopeType,
         appName,
         supabase || null
       );
@@ -196,11 +195,11 @@ export function useRBAC(pageId?: string): UserRBACContext {
       const resolvedScope = validation.resolvedScope;
       setCurrentScope(resolvedScope);
 
-      // Pass appConfig and appName to API calls for context validation
+      // API calls no longer need appConfig (scope is page-level)
       const [map, roleContext, accessLevel] = await Promise.all([
-        getPermissionMap({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
-        getRoleContext({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
-        getAccessLevel({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
+        getPermissionMap({ userId: user.id as UUID, scope: resolvedScope }),
+        getRoleContext({ userId: user.id as UUID, scope: resolvedScope }),
+        getAccessLevel({ userId: user.id as UUID, scope: resolvedScope }),
       ]);
 
       setPermissionMap(map);
@@ -225,7 +224,7 @@ export function useRBAC(pageId?: string): UserRBACContext {
     } finally {
       setIsLoading(false);
     }
-  }, [appName, logger, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, eventLoading, appConfig, orgContextReady, orgLoading]);
+  }, [appName, logger, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, eventLoading, orgContextReady, orgLoading]);
 
   const hasGlobalPermission = useCallback(
     (permission: string): boolean => {
@@ -254,7 +253,7 @@ export function useRBAC(pageId?: string): UserRBACContext {
 
   useEffect(() => {
     loadRBACContext();
-  }, [loadRBACContext, appName, appConfig, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
+  }, [loadRBACContext, appName, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
 
   return {
     user,

package/src/rbac/hooks/useResolvedScope.test.ts

@@ -24,14 +24,24 @@ vi.mock('../../utils/app/appNameResolver', () => ({
   getCurrentAppName: vi.fn(),
 }));
 
+vi.mock('../utils/contextValidator', () => ({
+  ContextValidator: {
+    resolveScopeForPage: vi.fn(),
+    deriveOrgFromEvent: vi.fn(),
+  },
+}));
+
 import { createScopeFromEvent, getOrganisationFromEvent } from '../utils/eventContext';
 import { getCurrentAppName } from '../../utils/app/appNameResolver';
 import { createMockSupabaseClient } from '../../__tests__/helpers/supabaseMock';
+import { ContextValidator } from '../utils/contextValidator';
+import { OrganisationContextRequiredError } from '../types';
 
 describe('useResolvedScope Hook', () => {
   const mockCreateScopeFromEvent = vi.mocked(createScopeFromEvent);
   const mockGetOrganisationFromEvent = vi.mocked(getOrganisationFromEvent);
   const mockGetCurrentAppName = vi.mocked(getCurrentAppName);
+  const mockContextValidator = vi.mocked(ContextValidator);
 
   let mockSupabase: SupabaseClient<Database>;
   let sharedMockQuery: any;
@@ -55,11 +65,32 @@ describe('useResolvedScope Hook', () => {
     mockSupabase = {
       from: vi.fn().mockReturnValue(sharedMockQuery),
       rpc: vi.fn(),
+      auth: {
+        getSession: vi.fn().mockResolvedValue({
+          data: { session: { access_token: 'test-token' } },
+          error: null
+        })
+      }
     } as any;
     
     mockGetCurrentAppName.mockReturnValue('test-app');
     // Default mock for getOrganisationFromEvent
     mockGetOrganisationFromEvent.mockResolvedValue(null);
+    // Default mock for ContextValidator - fails validation when no orgId for organisation scope
+    mockContextValidator.resolveScopeForPage.mockImplementation(async (scope, scopeType) => {
+      if (!scope.organisationId && scopeType === 'organisation') {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    });
   });
 
   afterEach(() => {
@@ -204,6 +235,13 @@ describe('useResolvedScope Hook', () => {
       // Set up mock implementation
       // Note: Don't clear all mocks here as it would clear the getOrganisationFromEvent mock
       mockGetOrganisationFromEvent.mockResolvedValue('org-456');
+      // Ensure ContextValidator fails validation for this test (no orgId, but has eventId)
+      // This will cause the hook to return scope with just eventId
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      });
       (mockSupabase.from as any).mockImplementation((table: string) => {
         if (table === 'event') {
           return eventQueryBuilder;
@@ -223,39 +261,37 @@ describe('useResolvedScope Hook', () => {
       );
 
       // Wait for async resolution to complete
+      // The hook should set resolvedScope to eventScope when validation fails but eventId exists
       await waitFor(
         () => {
           expect(result.current.isLoading).toBe(false);
         },
-        { timeout: 3000 }
+        { timeout: 3000, interval: 10 }
       );
 
-      // Check if we got an error - this test expects the hook to derive organisation from event
-      // However, the hook requires organisation context for event-required apps
-      // Skip this test as it's testing invalid state (event without org context)
-      if (result.current.error) {
-        // Expected: Organisation context is required even when deriving from event
-        expect(result.current.error.message).toContain('Organisation context is required');
-        return; // Test expects this to work, but it's actually invalid state
-      }
-
-      // Force rerender to pick up ref update
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
       rerender();
 
-      // Wait for stable scope ref to update
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      // The scope will have eventId and appId, but no organisationId
       await waitFor(
         () => {
+          // Hook should return scope with eventId when validation fails but eventId is present
           expect(result.current.resolvedScope).not.toBeNull();
         },
-        { timeout: 3000, interval: 10 }
+        { timeout: 2000, interval: 10 }
       );
 
-      expect(result.current.resolvedScope).toEqual({
-        organisationId: 'org-456',
-        eventId: 'event-123',
-        appId: 'app-123',
-      });
-      expect(result.current.error).toBeNull();
+      // Hook should return scope with eventId even if org derivation hasn't happened yet
+      // The organisation will be derived during permission checks
+      // When event is provided but validation fails, hook returns scope with just eventId (no error)
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.resolvedScope.appId).toBe('app-123');
+        // organisationId may be undefined - will be derived during permission checks
+        expect(result.current.error).toBeNull(); // No error when event is provided
+      }
     });
 
     it('handles no context available', async () => {
@@ -497,10 +533,20 @@ describe('useResolvedScope Hook', () => {
 
   describe('Error Handling', () => {
     it('handles error when event scope resolution fails', async () => {
-      const error = new Error('Failed to resolve event scope');
-      mockCreateScopeFromEvent.mockResolvedValue(null);
+      // Ensure appId is resolved so scope is valid
+      sharedMockQuery.single.mockResolvedValue({
+        data: { id: 'app-123', name: 'test-app', is_active: true },
+        error: null,
+      });
+      
+      // Ensure ContextValidator fails validation (no orgId)
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      });
 
-      const { result } = renderHook(() =>
+      const { result, rerender } = renderHook(() =>
         useResolvedScope({
           supabase: mockSupabase,
           selectedOrganisationId: null,
@@ -515,22 +561,43 @@ describe('useResolvedScope Hook', () => {
         { timeout: 2000 }
       );
 
-      expect(result.current.resolvedScope).toBeNull();
-      expect(result.current.error).toBeInstanceOf(Error);
-      // When event context resolution fails, it returns OrganisationContextRequiredError
-      expect(result.current.error?.message).toBe(
-        'Organisation context is required for this operation'
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
+      rerender();
+
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      await waitFor(
+        () => {
+          // When event is provided but validation fails, hook returns scope with just eventId
+          // appId must be resolved for scope to be valid
+          expect(result.current.resolvedScope).not.toBeNull();
+        },
+        { timeout: 2000, interval: 10 }
       );
+
+      // When event is provided but validation fails, hook returns scope with just eventId
+      // (no error - org will be derived during permission checks)
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.error).toBeNull();
+      }
     });
 
     it('handles error when createScopeFromEvent throws', async () => {
-      // Mock the database query to fail when trying to derive org from event
+      // Ensure appId is resolved so scope is valid
       sharedMockQuery.single.mockResolvedValue({
-        data: null,
-        error: { message: 'Database error' },
+        data: { id: 'app-123', name: 'test-app', is_active: true },
+        error: null,
+      });
+      
+      // Ensure ContextValidator fails validation (no orgId)
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
       });
 
-      const { result } = renderHook(() =>
+      const { result, rerender } = renderHook(() =>
         useResolvedScope({
           supabase: mockSupabase,
           selectedOrganisationId: null,
@@ -545,10 +612,28 @@ describe('useResolvedScope Hook', () => {
         { timeout: 2000 }
       );
 
-      expect(result.current.resolvedScope).toBeNull();
-      // When org derivation fails, it returns OrganisationContextRequiredError
-      expect(result.current.error).toBeInstanceOf(Error);
-      expect(result.current.error?.message).toContain('Organisation context is required');
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
+      rerender();
+
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      await waitFor(
+        () => {
+          // When event is provided but validation fails, hook returns scope with just eventId
+          // appId must be resolved for scope to be valid
+          expect(result.current.resolvedScope).not.toBeNull();
+        },
+        { timeout: 2000, interval: 10 }
+      );
+
+      // When event is provided but org derivation fails, hook returns scope with just eventId
+      // (no error - org will be derived during permission checks)
+      // appId must be present for scope to be valid
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.resolvedScope.appId).toBe('app-123');
+        expect(result.current.error).toBeNull();
+      }
     });
 
     it('handles database error when resolving app ID', async () => {

package/src/rbac/hooks/useResolvedScope.ts

@@ -13,8 +13,6 @@ import { useEffect, useState, useRef, useMemo } from 'react';
 import { SupabaseClient } from '@supabase/supabase-js';
 import type { Database } from '../../types/database';
 import type { Scope } from '../types';
-import { ContextValidator } from '../utils/contextValidator';
-import type { AppConfig } from '../utils/contextValidator';
 import { getCurrentAppName } from '../../utils/app/appNameResolver';
 import { createLogger } from '../../utils/core/logger';
 
@@ -22,12 +20,12 @@ const log = createLogger('useResolvedScope');
 
 // Cache app config to avoid repeated database queries
 // App config rarely changes during a session, so we can cache it
-const appConfigCache = new Map<string, { appId: string; appConfig: AppConfig; timestamp: number }>();
+const appIdCache = new Map<string, { appId: string; timestamp: number }>();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 
 // Export function to clear cache (for testing)
 export function clearAppConfigCache(): void {
-  appConfigCache.clear();
+  appIdCache.clear();
 }
 
 export interface UseResolvedScopeOptions {
@@ -138,12 +136,11 @@ export function useResolvedScope({
       setError(null);
       
       try {
-        // Get app name and config
+        // Get app name and resolve appId
         const appName = getCurrentAppName();
         let appId: string | undefined = undefined;
-        let appConfig: AppConfig | null = null;
         
-        // Try to resolve app config from database (with caching)
+        // Try to resolve appId from database (with caching)
         // Only query if user is authenticated (RLS policies require authentication)
         if (supabase && appName) {
           try {
@@ -156,19 +153,18 @@ export function useResolvedScope({
               log.debug(`Skipping app resolution for "${appName}" - user not authenticated`);
             } else {
               // Check cache first
-              const cached = appConfigCache.get(appName);
+              const cached = appIdCache.get(appName);
               const now = Date.now();
               if (cached && (now - cached.timestamp) < CACHE_TTL) {
                 appId = cached.appId;
-                appConfig = cached.appConfig;
               } else {
                 // Cache miss or expired - fetch from database
                 const { data: app, error } = await supabase
                   .from('rbac_apps')
-                  .select('id, name, requires_event, is_active')
+                  .select('id, name, is_active')
                   .eq('name', appName)
                   .eq('is_active', true)
-                  .single() as { data: { id: string; name: string; requires_event: boolean; is_active: boolean } | null; error: any };
+                  .single() as { data: { id: string; name: string; is_active: boolean } | null; error: any };
                 
                 if (error) {
                   // HTTP 406 is expected when not authenticated (RLS blocks query)
@@ -197,9 +193,8 @@ export function useResolvedScope({
                   }
                 } else if (app) {
                   appId = app.id;
-                  appConfig = { requires_event: app.requires_event ?? false };
                   // Only cache successful lookups of active apps
-                  appConfigCache.set(appName, { appId, appConfig, timestamp: now });
+                  appIdCache.set(appName, { appId, timestamp: now });
                 }
               }
             }
@@ -208,7 +203,7 @@ export function useResolvedScope({
             // Don't log 406 errors as they're expected when not authenticated
             const errorMessage = error instanceof Error ? error.message : String(error);
             if (!errorMessage.includes('406') && !errorMessage.includes('PGRST116')) {
-              log.error('Unexpected error resolving app config:', error);
+              log.error('Unexpected error resolving app ID:', error);
             } else {
               log.debug('App resolution skipped - authentication required');
             }
@@ -216,44 +211,44 @@ export function useResolvedScope({
         }
 
         // Build initial scope from available context
-        // For event-required apps: Only use eventId (org will be derived)
-        // For org-required apps: Only use organisationId (event is optional)
+        // Scope is now page-level only - use whatever context is available
+        // Default to organisation scope if both are available (safest default)
         const initialScope: Scope = {
-          organisationId: appConfig?.requires_event ? undefined : (selectedOrganisationId || undefined),
+          organisationId: selectedOrganisationId || undefined,
           eventId: selectedEventId || undefined,
           appId: appId
         };
 
-        // Use ContextValidator to resolve required context
-        // For PORTAL, always allow scope resolution even if appConfig is null
-        const validation = await ContextValidator.resolveRequiredContext(
+        // For PORTAL/ADMIN apps, allow scope without org/event
+        if (appName === 'PORTAL' || appName === 'ADMIN') {
+          if (!cancelled) {
+            const optionalContextScope: Scope = {
+              organisationId: undefined,
+              eventId: undefined,
+              appId: appId || undefined
+            };
+            setResolvedScope(optionalContextScope);
+            setError(null);
+            setIsLoading(false);
+          }
+          return;
+        }
+        
+        // For other apps, default to organisation scope validation (safest default)
+        // Page-level scope will be validated during permission checks
+        // ContextValidator is already imported at the top
+        const { ContextValidator } = await import('../utils/contextValidator');
+        const validation = await ContextValidator.resolveScopeForPage(
           initialScope,
-          appConfig,
+          'organisation', // Default to organisation scope when no page context
           appName || undefined,
           supabase
         );
 
         if (!validation.isValid) {
-          // For PORTAL/ADMIN apps, allow scope without org/event even if validation fails
-          if (appName === 'PORTAL' || appName === 'ADMIN') {
-            if (!cancelled) {
-              // For PORTAL/ADMIN, we need at least an appId. If we don't have it from the query,
-              // we'll set it to undefined and let the component handle it (it can use contextAppId)
-              const optionalContextScope: Scope = {
-                organisationId: undefined,
-                eventId: undefined,
-                appId: appId || undefined // appId might be undefined if query failed, that's OK
-              };
-              setResolvedScope(optionalContextScope);
-              setError(null);
-              setIsLoading(false);
-            }
-            return;
-          }
-          
-          // For event-required apps: if validation fails but we have an eventId, return scope with eventId
+          // If validation fails but we have an eventId, return scope with eventId
           // The organisation will be derived later during permission checks
-          if (appConfig?.requires_event && selectedEventId) {
+          if (selectedEventId) {
             if (!cancelled) {
               const eventScope: Scope = {
                 organisationId: undefined, // Will be derived from event during permission check