@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/components/NavigationMenu/useNavigationFiltering.ts

@@ -1,16 +1,153 @@
 import * as React from "react";
 import { useUnifiedAuth } from "../../providers/services/UnifiedAuthProvider";
 import { useRBAC } from "../../rbac/hooks/useRBAC";
-import { useResolvedScope } from "../../rbac/hooks/useResolvedScope";
 import { usePermissions } from "../../rbac/hooks/usePermissions";
-import type {
-  Permission,
-  AccessLevel as RBACAccessLevel,
-  UUID,
-  PermissionMap,
-} from "../../rbac/types";
+import type { Permission, UUID, PermissionMap } from "../../rbac/types";
 import { logger } from "../../utils/core/logger";
+import {
+  navigationItemHasPermission,
+  type NavigationRBACContext,
+} from "./navigationPermissionHelper";
 import type { NavigationItem } from "./types";
+import { useNavigationScope } from "./useNavigationScope";
+
+/**
+ * Recursively filter a single navigation item and its children by permission.
+ * Used inside computeFilteredNavigationItems.
+ */
+function filterNavigationItem(
+  item: NavigationItem,
+  rbacContext: NavigationRBACContext,
+  permissionMap: PermissionMap,
+  hasAnyPermission: ((permissions: Permission[]) => boolean) | null
+): NavigationItem | null {
+  if (item.meta?.hidden) return null;
+  if (
+    !navigationItemHasPermission(item, rbacContext, permissionMap, hasAnyPermission)
+  ) {
+    return null;
+  }
+  let filteredChildren: NavigationItem[] | undefined;
+  if (item.children && item.children.length > 0) {
+    filteredChildren = item.children
+      .map((child) =>
+        filterNavigationItem(child, rbacContext, permissionMap, hasAnyPermission)
+      )
+      .filter((child): child is NavigationItem => child !== null);
+    if (filteredChildren.length === 0 && !item.href) return null;
+  }
+  return { ...item, children: filteredChildren };
+}
+
+interface ComputeFilteredNavigationItemsParams {
+  items: NavigationItem[];
+  itemsPreFiltered: boolean;
+  authContext: ReturnType<typeof useUnifiedAuth>;
+  rbacContext: ReturnType<typeof useRBAC>;
+  permissionMap: PermissionMap;
+  hasAnyPermission: ((permissions: Permission[]) => boolean) | null;
+  scopeLoading: boolean;
+  scopeError: Error | null;
+  permissionsLoading: boolean;
+  eventLoadingRaw: boolean | undefined;
+  eventLoading: boolean;
+  orgContextReady: boolean;
+  selectedOrganisationId: string | undefined;
+  permissionsError: Error | null;
+  stableScope: { organisationId: string; eventId: string | undefined; appId: string | undefined };
+  previousFilteredRef: React.MutableRefObject<NavigationItem[]>;
+}
+
+function getPreFilteredVisibleItems(
+  items: NavigationItem[],
+  itemsPreFiltered: boolean,
+  previousFilteredRef: React.MutableRefObject<NavigationItem[]>
+): NavigationItem[] | null {
+  if (!itemsPreFiltered || !items?.length) return null;
+  const visibleItems = (items || []).filter((item) => !item.meta?.hidden);
+  previousFilteredRef.current = visibleItems;
+  return visibleItems;
+}
+
+/**
+ * Pure function to compute filtered navigation items. Uses early returns to keep complexity low.
+ */
+function computeFilteredNavigationItems(
+  params: ComputeFilteredNavigationItemsParams
+): NavigationItem[] {
+  const {
+    items,
+    itemsPreFiltered,
+    authContext,
+    rbacContext,
+    permissionMap,
+    hasAnyPermission,
+    scopeLoading,
+    scopeError,
+    permissionsLoading,
+    eventLoadingRaw,
+    eventLoading,
+    orgContextReady,
+    selectedOrganisationId,
+    permissionsError,
+    stableScope,
+    previousFilteredRef,
+  } = params;
+
+  const preFiltered = getPreFilteredVisibleItems(items, itemsPreFiltered, previousFilteredRef);
+  if (preFiltered !== null) return preFiltered;
+
+  const isOrgContextReady = orgContextReady && selectedOrganisationId;
+  const isEventContextReady = eventLoadingRaw === undefined ? true : !eventLoading;
+  const hasValidContext = isOrgContextReady && isEventContextReady;
+  const shouldWaitForScope = scopeLoading || !hasValidContext;
+  const shouldRetryAfterError = scopeError && hasValidContext && !scopeLoading;
+
+  if (!authContext || !rbacContext || (shouldWaitForScope && !shouldRetryAfterError)) {
+    return [];
+  }
+
+  if (permissionsLoading) {
+    if (previousFilteredRef.current.length > 0) {
+      return previousFilteredRef.current;
+    }
+    if (items?.length > 0 && stableScope.organisationId) {
+      return (items || []).filter((item) => !item.meta?.hidden);
+    }
+    return [];
+  }
+
+  if (permissionsError) {
+    logger.warn("NavigationMenu", "Permission check error - showing no items for security", {
+      permissionsError: permissionsError?.message,
+    });
+    return [];
+  }
+
+  if (!permissionMap || Object.keys(permissionMap).length === 0) {
+    if (stableScope.organisationId && items?.length > 0) {
+      return (items || []).filter((item) => !item.meta?.hidden);
+    }
+    if (stableScope.organisationId) {
+      logger.warn("NavigationMenu", "Permission map is empty and no items provided - showing nothing", {
+        permissionMapSize: 0,
+        organisationId: stableScope.organisationId,
+        eventId: stableScope.eventId,
+        appId: stableScope.appId,
+      });
+    }
+    return [];
+  }
+
+  const filtered = (items || [])
+    .map((item) =>
+      filterNavigationItem(item, rbacContext, permissionMap, hasAnyPermission ?? null)
+    )
+    .filter((item): item is NavigationItem => item !== null);
+
+  previousFilteredRef.current = filtered;
+  return filtered;
+}
 
 /**
  * Options for the useNavigationFiltering hook.
@@ -35,7 +172,7 @@ interface UseNavigationFilteringResult {
 /**
  * Hook for filtering navigation items based on RBAC permissions.
  * Filters navigation items to show only those the user has access to.
- * 
+ *
  * @param options - Navigation filtering configuration
  * @returns Filtered navigation items and permission context
  */
@@ -44,15 +181,7 @@ export function useNavigationFiltering({
   itemsPreFiltered = false,
   auditLog: _auditLog = true,
 }: UseNavigationFilteringOptions): UseNavigationFilteringResult {
-  // Call all hooks unconditionally at the top level
-  // Hooks must be called in the same order on every render
-  // These hooks will throw if providers are not available - that should be handled by error boundaries
-  const [resolvedAppId, setResolvedAppId] = React.useState<string | undefined>(undefined);
   const previousFilteredItemsRef = React.useRef<NavigationItem[]>([]);
-
-  // Call hooks unconditionally - if providers are missing, these will throw
-  // Errors should be handled by error boundaries at a higher level
-  // We cannot use try-catch here as it makes hook calls conditional
   const authContext = useUnifiedAuth();
   const rbacContext = useRBAC();
 
@@ -61,85 +190,24 @@ export function useNavigationFiltering({
   const selectedEvent = authContext?.selectedEvent || null;
   const orgContextReady =
     authContext?.isContextReady ?? (authContext?.selectedOrganisation?.id ? true : false);
-
   const { supabase } = authContext || {};
   const { selectedOrganisation } = authContext || {};
-  const { resolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
-    supabase: itemsPreFiltered ? null : supabase || null,
-    selectedOrganisationId: itemsPreFiltered ? null : selectedOrganisation?.id || null,
-    selectedEventId: itemsPreFiltered ? null : selectedEvent?.event_id || null,
-    selectedEventOrganisationId: itemsPreFiltered ? null : selectedEvent?.organisation_id || null
-  });
-
-  React.useEffect(() => {
-    if (
-      !scopeLoading &&
-      !resolvedScope?.appId &&
-      selectedOrganisation?.id &&
-      authContext?.appName &&
-      authContext?.user?.id &&
-      !resolvedAppId
-    ) {
-      if (!authContext.user || !authContext.appName) {
-        return;
-      }
-      const userId = authContext.user.id;
-      const appName = authContext.appName;
-      import("../../rbac/api")
-        .then(({ resolveAppContext }) => {
-          resolveAppContext({
-            userId,
-            appName,
-          })
-            .then((result) => {
-              if (result?.appId) {
-                setResolvedAppId(result.appId);
-              }
-            })
-            .catch(() => {});
-        })
-        .catch(() => {});
-    }
-  }, [
-    scopeLoading,
-    resolvedScope?.appId,
-    selectedOrganisation?.id,
-    authContext?.appName,
-    authContext?.user,
-    resolvedAppId,
-  ]);
-
-  const effectiveScope = React.useMemo(() => {
-    if (resolvedScope?.organisationId) {
-      return resolvedScope;
-    }
-
-    if (selectedOrganisation?.id) {
-      const fallbackScope = {
-        organisationId: selectedOrganisation.id,
-        eventId: selectedEvent?.event_id || undefined,
-        appId: resolvedAppId,
-      };
-      return fallbackScope;
-    }
 
-    return null;
-  }, [resolvedScope, selectedOrganisation?.id, selectedEvent?.event_id, resolvedAppId]);
+  const { stableScope, scopeLoading, scopeError } = useNavigationScope({
+    itemsPreFiltered,
+    supabase,
+    selectedOrganisation,
+    selectedEvent,
+    authContext,
+  });
 
-  const stableScope = React.useMemo(() => {
-    if (effectiveScope?.organisationId) {
-      return {
-        organisationId: effectiveScope.organisationId,
-        eventId: effectiveScope.eventId,
-        appId: effectiveScope.appId,
-      };
-    }
-    return {
-      organisationId: "",
-      eventId: undefined,
-      appId: undefined,
-    };
-  }, [effectiveScope]);
+  const organisationId = React.useMemo(
+    () =>
+      selectedOrganisation?.id ??
+      (selectedEvent as { organisation_id?: string | null } | undefined)?.organisation_id ??
+      undefined,
+    [selectedOrganisation?.id, selectedEvent]
+  );
 
   const userId = (authContext?.user?.id || "") as UUID;
   const {
@@ -154,211 +222,44 @@ export function useNavigationFiltering({
     itemsPreFiltered ? undefined : stableScope.appId,
   );
 
-  const filteredItems = React.useMemo(() => {
-    if (itemsPreFiltered && items && items.length > 0) {
-      const visibleItems = (items || []).filter((item) => !item.meta?.hidden);
-      previousFilteredItemsRef.current = visibleItems;
-      return visibleItems;
-    }
-
-    const isOrgContextReady = orgContextReady && selectedOrganisation?.id;
-    const isEventContextReady = eventLoadingRaw === undefined ? true : !eventLoading;
-    const hasValidContext = isOrgContextReady && isEventContextReady;
-    const shouldWaitForScope = scopeLoading || !hasValidContext;
-    const shouldRetryAfterError = scopeError && hasValidContext && !scopeLoading;
-
-    if (items && items.length > 0 && selectedOrganisation?.id) {
-      const visibleItems = (items || []).filter((item) => !item.meta?.hidden);
-      previousFilteredItemsRef.current = visibleItems;
-      return visibleItems;
-    }
-
-    if (!authContext || !rbacContext || (shouldWaitForScope && !shouldRetryAfterError)) {
-      return [];
-    }
-
-    if (permissionsLoading) {
-      if (previousFilteredItemsRef.current.length > 0) {
-        return previousFilteredItemsRef.current;
-      }
-      if (items && items.length > 0 && stableScope.organisationId) {
-        return (items || []).filter((item) => !item.meta?.hidden);
-      }
-      return [];
-    }
-
-    if (permissionsError) {
-      logger.warn(
-        "NavigationMenu",
-        "Permission check error - showing no items for security",
-        {
-          permissionsError: permissionsError?.message,
-        },
-      );
-      return [];
-    }
-
-    if (!permissionMap || Object.keys(permissionMap).length === 0) {
-      if (stableScope.organisationId && items && items.length > 0) {
-        return (items || []).filter((item) => !item.meta?.hidden);
-      }
-
-      if (stableScope.organisationId) {
-        logger.warn("NavigationMenu", "Permission map is empty and no items provided - showing nothing", {
-          permissionMapSize: 0,
-          organisationId: stableScope.organisationId,
-          eventId: stableScope.eventId,
-          appId: stableScope.appId,
-        });
-      }
-      return [];
-    }
-
-    const getPageIdFromHref = (href?: string): string | null => {
-      if (!href) return null;
-      const path = href.split("?")[0].split("#")[0].replace(/^\//, "");
-      return path || "home";
-    };
-
-    const hasItemPermission = (item: NavigationItem): boolean => {
-      if (item.permissions && item.permissions.length > 0 && !item.href) {
-        const permissions = item.permissions
-          .filter((p): p is string => typeof p === "string")
-          .map((p) => p as Permission);
-
-        if (permissions.length > 0) {
-          const hasPermission = hasAnyPermission?.(permissions);
-          if (!hasPermission) {
-            return false;
-          }
-        }
-      }
-
-      if (item.roles && item.roles.length > 0) {
-        const hasRole = item.roles.some((role) => {
-          if (typeof role !== "string") return true;
-
-          switch (role.toLowerCase()) {
-            case "super_admin":
-            case "super admin":
-              return rbacContext.isSuperAdmin;
-            case "org_admin":
-            case "org admin":
-            case "admin":
-              return rbacContext.isOrgAdmin || rbacContext.isSuperAdmin;
-            case "event_admin":
-            case "event admin":
-              return rbacContext.isEventAdmin || rbacContext.isSuperAdmin;
-            default:
-              return (
-                rbacContext.organisationRole === role ||
-                rbacContext.eventAppRole === role ||
-                rbacContext.isSuperAdmin
-              );
-          }
-        });
-        if (!hasRole) {
-          return false;
-        }
-      }
-
-      if (item.accessLevel) {
-        if (typeof item.accessLevel === "string") {
-          const accessLevel = item.accessLevel.toLowerCase() as RBACAccessLevel;
-          const userEventRole = rbacContext.eventAppRole;
-
-          if (!rbacContext.isSuperAdmin) {
-            const roleToAccessLevel: Record<string, RBACAccessLevel> = {
-              viewer: "viewer",
-              participant: "participant",
-              planner: "planner",
-              event_admin: "admin",
-            };
-            const userAccessLevel = userEventRole ? roleToAccessLevel[userEventRole] || "viewer" : null;
-
-            const levelHierarchy: Record<RBACAccessLevel, number> = {
-              viewer: 1,
-              participant: 2,
-              planner: 3,
-              admin: 4,
-              super: 5,
-            };
-            const requiredLevel = levelHierarchy[accessLevel] || 0;
-            const userLevel = userAccessLevel ? levelHierarchy[userAccessLevel] || 0 : 0;
-
-            if (userLevel < requiredLevel) {
-              return false;
-            }
-          }
-        }
-      }
-
-      if (item.href) {
-        const pageId = item.pageId || getPageIdFromHref(item.href);
-        if (pageId) {
-          const pagePermission: Permission = `read:page.${pageId}` as Permission;
-
-          const isSuperAdmin = permissionMap["*"] === true;
-          const hasPagePermission = permissionMap[pagePermission] === true;
-          const finalHasPermission = isSuperAdmin || hasPagePermission;
-
-          if (!finalHasPermission) {
-            return false;
-          }
-        }
-      }
-
-      return true;
-    };
-
-    const filterItem = (item: NavigationItem): NavigationItem | null => {
-      if (item.meta?.hidden) return null;
-
-      if (!hasItemPermission(item)) return null;
-
-      let filteredChildren: NavigationItem[] | undefined;
-      if (item.children && item.children.length > 0) {
-        filteredChildren = item.children
-          .map((child) => filterItem(child))
-          .filter((child): child is NavigationItem => child !== null);
-
-        if (filteredChildren.length === 0 && !item.href) {
-          return null;
-        }
-      }
-
-      return {
-        ...item,
-        children: filteredChildren,
-      };
-    };
-
-    const filtered = (items || [])
-      .map((item) => filterItem(item))
-      .filter((item): item is NavigationItem => item !== null);
-
-    previousFilteredItemsRef.current = filtered;
-
-    return filtered;
-  }, [
-    items,
-    itemsPreFiltered,
-    authContext,
-    rbacContext,
-    permissionMap,
-    hasAnyPermission,
-    scopeLoading,
-    scopeError,
-    permissionsLoading,
-    eventLoadingRaw,
-    eventLoading,
-    orgContextReady,
-    selectedOrganisation?.id,
-    permissionsError,
-    stableScope.organisationId,
-    stableScope.eventId,
-    stableScope.appId,
-  ]);
+  const filteredItems = React.useMemo(
+    () =>
+      computeFilteredNavigationItems({
+        items,
+        itemsPreFiltered,
+        authContext,
+        rbacContext,
+        permissionMap,
+        hasAnyPermission: hasAnyPermission ?? null,
+        scopeLoading,
+        scopeError: scopeError ?? null,
+        permissionsLoading,
+        eventLoadingRaw,
+        eventLoading,
+        orgContextReady,
+        selectedOrganisationId: organisationId,
+        permissionsError: permissionsError ?? null,
+        stableScope,
+        previousFilteredRef: previousFilteredItemsRef,
+      }),
+    [
+      items,
+      itemsPreFiltered,
+      authContext,
+      rbacContext,
+      permissionMap,
+      hasAnyPermission,
+      scopeLoading,
+      scopeError,
+      permissionsLoading,
+      eventLoadingRaw,
+      eventLoading,
+      orgContextReady,
+      organisationId,
+      permissionsError,
+      stableScope,
+    ]
+  );
 
   return {
     authContext,

package/src/components/NavigationMenu/useNavigationScope.ts

@@ -0,0 +1,125 @@
+/**
+ * @file Navigation Scope Hook
+ * @package @jmruthers/pace-core
+ * @module NavigationMenu/useNavigationScope
+ * @since 0.1.0
+ *
+ * Resolves effective scope and stableScope for navigation permission filtering.
+ * Extracted from useNavigationFiltering to reduce complexity.
+ */
+
+import * as React from "react";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "../../types/database";
+import { useResolvedScope } from "../../rbac/hooks/useResolvedScope";
+
+interface UseNavigationScopeOptions {
+  itemsPreFiltered: boolean;
+  supabase: unknown;
+  selectedOrganisation: { id: string } | null | undefined;
+  selectedEvent: { event_id: string; organisation_id: string } | null | undefined;
+  authContext: { user?: { id: string } | null; appName?: string } | null | undefined;
+}
+
+interface StableScope {
+  organisationId: string;
+  eventId: string | undefined;
+  appId: string | undefined;
+}
+
+const EMPTY_STABLE_SCOPE: StableScope = {
+  organisationId: "",
+  eventId: undefined,
+  appId: undefined,
+};
+
+/**
+ * Hook that resolves effective scope and stableScope for navigation filtering.
+ * Handles appId resolution when resolvedScope has no appId.
+ */
+export function useNavigationScope({
+  itemsPreFiltered,
+  supabase,
+  selectedOrganisation,
+  selectedEvent,
+  authContext,
+}: UseNavigationScopeOptions): {
+  stableScope: StableScope;
+  scopeLoading: boolean;
+  scopeError: Error | null;
+} {
+  const [resolvedAppId, setResolvedAppId] = React.useState<string | undefined>(undefined);
+
+  const organisationId = React.useMemo(
+    () =>
+      selectedOrganisation?.id ??
+      (selectedEvent as { organisation_id?: string | null } | undefined)?.organisation_id ??
+      undefined,
+    [selectedOrganisation?.id, selectedEvent]
+  );
+
+  const { resolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase: itemsPreFiltered ? null : (supabase ?? null) as SupabaseClient<Database> | null,
+    selectedOrganisationId: itemsPreFiltered ? null : organisationId ?? null,
+    selectedEventId: itemsPreFiltered ? null : selectedEvent?.event_id || null,
+    selectedEventOrganisationId: itemsPreFiltered ? null : selectedEvent?.organisation_id || null,
+  });
+
+  React.useEffect(() => {
+    if (
+      scopeLoading ||
+      resolvedScope?.appId ||
+      !organisationId ||
+      !authContext?.appName ||
+      !authContext?.user?.id ||
+      resolvedAppId
+    ) {
+      return;
+    }
+    const userId = authContext.user.id;
+    const appName = authContext.appName;
+    import("../../rbac/api")
+      .then(({ resolveAppContext }) => {
+        resolveAppContext({ userId, appName })
+          .then((result) => {
+            if (result?.ok && result.data?.appId) {
+              setResolvedAppId(result.data.appId);
+            }
+          })
+          .catch(() => {});
+      })
+      .catch(() => {});
+  }, [
+    scopeLoading,
+    resolvedScope?.appId,
+    organisationId,
+    authContext?.appName,
+    authContext?.user?.id,
+    resolvedAppId,
+  ]);
+
+  const effectiveScope = React.useMemo(() => {
+    if (resolvedScope?.organisationId) return resolvedScope;
+    if (organisationId) {
+      return {
+        organisationId,
+        eventId: selectedEvent?.event_id || undefined,
+        appId: resolvedAppId,
+      };
+    }
+    return null;
+  }, [resolvedScope, organisationId, selectedEvent?.event_id, resolvedAppId]);
+
+  const stableScope = React.useMemo((): StableScope => {
+    if (effectiveScope?.organisationId) {
+      return {
+        organisationId: effectiveScope.organisationId,
+        eventId: effectiveScope.eventId,
+        appId: effectiveScope.appId,
+      };
+    }
+    return EMPTY_STABLE_SCOPE;
+  }, [effectiveScope]);
+
+  return { stableScope, scopeLoading, scopeError: scopeError ?? null };
+}