@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/components/PaceAppLayout/usePaceAppLayoutPermissions.ts

@@ -0,0 +1,162 @@
+/**
+ * @file PaceAppLayout Permissions Hook
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout
+ * @since 0.1.0
+ *
+ * Derives permission state and context error for PaceAppLayout gate/layout.
+ */
+
+import { useEffect, useMemo } from 'react';
+import { useLocation } from 'react-router-dom';
+import { useCan } from '../../rbac/hooks/usePermissions';
+import {
+  EventContextRequiredError,
+  OrganisationContextRequiredError,
+  type Permission,
+  type Scope,
+} from '../../rbac/types';
+import { logger } from '../../utils/core/logger';
+import type { NormalizedPaceAppLayoutConfig } from './usePaceAppLayoutConfig';
+
+export interface UsePaceAppLayoutPermissionsParams {
+  config: Pick<
+    NormalizedPaceAppLayoutConfig,
+    | 'enforcePermissions'
+    | 'defaultPermission'
+    | 'routePermissions'
+    | 'pageIdMapping'
+    | 'strictMode'
+    | 'onPageAccessDenied'
+    | 'onStrictModeViolation'
+  >;
+  user: { id: string } | null | undefined;
+  scope: Scope;
+  appName: string;
+  isSuperAdminFromRBAC: boolean;
+  isSuperAdminDirect: boolean;
+  isCheckingSuperAdminDirect: boolean;
+  isSuperAdmin: boolean;
+}
+
+export interface UsePaceAppLayoutPermissionsResult {
+  hasPermission: boolean;
+  permissionError: Error | null;
+  isContextError: boolean;
+  isCheckingPermission: boolean;
+  currentPageId: string;
+  currentRoutePermission: string;
+}
+
+/**
+ * Hook that derives permission state for the current route and runs audit/callbacks.
+ */
+export function usePaceAppLayoutPermissions({
+  config,
+  user,
+  scope,
+  appName,
+  isSuperAdminFromRBAC,
+  isSuperAdminDirect,
+  isCheckingSuperAdminDirect,
+  isSuperAdmin,
+}: UsePaceAppLayoutPermissionsParams): UsePaceAppLayoutPermissionsResult {
+  const location = useLocation();
+  const {
+    enforcePermissions,
+    defaultPermission,
+    routePermissions,
+    pageIdMapping,
+    strictMode,
+    onPageAccessDenied,
+    onStrictModeViolation,
+  } = config;
+
+  const currentRoutePermission = useMemo(() => {
+    return routePermissions[location.pathname] || defaultPermission;
+  }, [location.pathname, routePermissions, defaultPermission]);
+
+  const currentPageId = useMemo(() => {
+    const currentPath = location.pathname;
+    if (pageIdMapping[currentPath]) return pageIdMapping[currentPath];
+    const pathSegments = currentPath.slice(1).split('/').filter(Boolean);
+    return pathSegments[0] || '';
+  }, [location.pathname, pageIdMapping]);
+
+  const currentPermission = useMemo<Permission>(() => {
+    if (!enforcePermissions || !currentPageId) return '' as Permission;
+    return `${currentRoutePermission}:page.${currentPageId}` as Permission;
+  }, [enforcePermissions, currentRoutePermission, currentPageId]);
+
+  const shouldCheckPermission =
+    enforcePermissions && !!currentPermission && !!currentPageId;
+  const superAdminStatus = isSuperAdminFromRBAC
+    ? true
+    : isCheckingSuperAdminDirect
+      ? null
+      : isSuperAdminDirect;
+
+  const {
+    can: canFromHook,
+    isLoading: isCheckingPermission,
+    error: permissionError,
+  } = useCan(
+    user?.id || '',
+    scope,
+    shouldCheckPermission ? currentPermission : ('' as Permission),
+    shouldCheckPermission ? currentPageId : '',
+    true,
+    superAdminStatus,
+    appName
+  );
+
+  const can = isSuperAdmin ? true : canFromHook;
+  const hasPermission = enforcePermissions ? can : true;
+
+  const isContextError = useMemo(() => {
+    if (!permissionError) return false;
+    return (
+      permissionError instanceof EventContextRequiredError ||
+      permissionError instanceof OrganisationContextRequiredError ||
+      permissionError.name === 'EventContextRequiredError' ||
+      permissionError.name === 'OrganisationContextRequiredError'
+    );
+  }, [permissionError]);
+
+  useEffect(() => {
+    if (!enforcePermissions || isCheckingPermission) return;
+    if (strictMode && !isSuperAdmin && !can) {
+      logger.error('PaceAppLayout', 'STRICT MODE VIOLATION: User attempted to access protected page without permission', {
+        pageName: currentPageId,
+        operation: currentRoutePermission,
+        userId: user?.id,
+        isSuperAdmin,
+        timestamp: new Date().toISOString(),
+      });
+      onStrictModeViolation?.(currentPageId, currentRoutePermission);
+    }
+    if (!isSuperAdmin && !can && onPageAccessDenied) {
+      onPageAccessDenied(currentPageId, currentRoutePermission);
+    }
+  }, [
+    enforcePermissions,
+    can,
+    isCheckingPermission,
+    isSuperAdmin,
+    currentPageId,
+    currentRoutePermission,
+    user?.id,
+    strictMode,
+    onPageAccessDenied,
+    onStrictModeViolation,
+  ]);
+
+  return {
+    hasPermission,
+    permissionError: permissionError ?? null,
+    isContextError,
+    isCheckingPermission,
+    currentPageId,
+    currentRoutePermission,
+  };
+}

package/src/components/PaceAppLayout/usePaceAppLayoutScope.ts

@@ -0,0 +1,79 @@
+/**
+ * @file PaceAppLayout Scope and Nav Hook
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout
+ * @since 0.1.0
+ *
+ * Resolves scope and base menu items for PaceAppLayout.
+ */
+
+import { useMemo } from 'react';
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '../../types/database';
+import { useResolvedScope } from '../../rbac/hooks/useResolvedScope';
+import type { Scope } from '../../rbac/types';
+import type { NavigationItem } from '../NavigationMenu/NavigationMenu';
+
+const DEFAULT_NAV_ITEMS: NavigationItem[] = [
+  { id: 'home', label: 'Home', href: '/', icon: 'Home' },
+  { id: 'dashboard', label: 'Dashboard', href: '/dashboard', icon: 'LayoutDashboard' },
+  { id: 'settings', label: 'Settings', href: '/settings', icon: 'Settings' },
+  { id: 'ui-showcase', label: 'UI Showcase', href: '/ui-showcase', icon: 'Component' },
+  { id: 'data-table-showcase', label: 'DataTable Showcase', href: '/data-table-showcase', icon: 'Table' },
+];
+
+export interface UsePaceAppLayoutScopeParams {
+  supabase: unknown;
+  selectedOrganisation: { id: string } | null | undefined;
+  selectedEvent: { event_id?: string; organisation_id?: string } | null | undefined;
+  contextAppId: string | undefined;
+  navItems: NavigationItem[] | undefined;
+}
+
+export function usePaceAppLayoutScope({
+  supabase,
+  selectedOrganisation,
+  selectedEvent,
+  contextAppId,
+  navItems,
+}: UsePaceAppLayoutScopeParams): {
+  scope: Scope;
+  resolvedAppId: string | undefined;
+  scopeLoading: boolean;
+  baseMenuItems: NavigationItem[];
+} {
+  const organisationId = useMemo(
+    () =>
+      selectedOrganisation?.id ??
+      (selectedEvent as { organisation_id?: string | null } | undefined)?.organisation_id ??
+      undefined,
+    [selectedOrganisation?.id, selectedEvent]
+  );
+
+  const { resolvedScope, isLoading: scopeLoading } = useResolvedScope({
+    supabase: (supabase ?? null) as SupabaseClient<Database> | null,
+    selectedOrganisationId: organisationId ?? null,
+    selectedEventId: selectedEvent?.event_id || null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id || null,
+  });
+
+  const resolvedAppId = contextAppId || resolvedScope?.appId;
+  const scopeOrgId = resolvedScope?.organisationId || organisationId || '';
+  const scopeEventId = resolvedScope?.eventId || selectedEvent?.event_id || undefined;
+  const scopeAppId = resolvedScope?.appId || resolvedAppId || undefined;
+
+  const scope = useMemo<Scope>(() => {
+    const newScope: Scope = {};
+    if (scopeOrgId) newScope.organisationId = scopeOrgId;
+    if (scopeEventId) newScope.eventId = scopeEventId;
+    if (scopeAppId) newScope.appId = scopeAppId;
+    return newScope;
+  }, [scopeOrgId, scopeEventId, scopeAppId]);
+
+  const baseMenuItems = useMemo(
+    () => navItems ?? DEFAULT_NAV_ITEMS,
+    [navItems]
+  );
+
+  return { scope, resolvedAppId, scopeLoading, baseMenuItems };
+}

package/src/components/PaceAppLayout/useRoleBasedRouteAccess.ts

@@ -0,0 +1,157 @@
+/**
+ * @file Role-Based Route Access Hook
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout
+ * @since 0.1.0
+ *
+ * Handles role-based routing: checks current route against config and redirects when access is denied.
+ * Used by PaceAppLayout so layout only composes; route access logic lives here.
+ */
+
+import { useEffect } from 'react';
+import type { NavigateFunction } from 'react-router-dom';
+import type { Permission, Scope } from '../../rbac/types';
+import { logger } from '../../utils/core/logger';
+
+export interface RouteConfigItem {
+  path: string;
+  component: React.ComponentType;
+  permissions: string[];
+  roles?: string[];
+  accessLevel?: string;
+  pageId?: string;
+  strictMode?: boolean;
+  meta?: {
+    title?: string;
+    description?: string;
+    requiresAuth?: boolean;
+    hidden?: boolean;
+  };
+}
+
+export interface UseRoleBasedRouteAccessOptions {
+  roleBasedRouting: boolean;
+  routeConfig: RouteConfigItem[];
+  currentPath: string;
+  user: { id: string } | null | undefined;
+  scope: Scope;
+  strictMode: boolean;
+  fallbackRoute: string;
+  navigate: NavigateFunction;
+  onRouteAccessDenied?: (route: string, reason: string) => void;
+  onRouteStrictModeViolation?: (route: string, reason: string) => void;
+}
+
+/**
+ * Hook that enforces role-based route access: when enabled, checks current path
+ * against routeConfig and redirects to fallbackRoute when access is denied.
+ * Role check is currently a stub (hasAccess remains true when only roles are required).
+ *
+ * @param options - All inputs needed for route access check and redirect.
+ */
+export function useRoleBasedRouteAccess(options: UseRoleBasedRouteAccessOptions): void {
+  const {
+    roleBasedRouting,
+    routeConfig,
+    currentPath,
+    user,
+    scope,
+    strictMode,
+    fallbackRoute,
+    navigate,
+    onRouteAccessDenied,
+    onRouteStrictModeViolation,
+  } = options;
+
+  useEffect(() => {
+    if (!roleBasedRouting || routeConfig.length === 0) return;
+
+    let isMounted = true;
+
+    const checkRouteAccess = async () => {
+      const currentRoute = routeConfig.find((route) => route.path === currentPath);
+
+      if (!currentRoute) {
+        if (strictMode) {
+          logger.error('PaceAppLayout', 'STRICT MODE VIOLATION: Route not found in configuration', {
+            route: currentPath,
+            userId: user?.id,
+            timestamp: new Date().toISOString()
+          });
+          if (onRouteStrictModeViolation) {
+            onRouteStrictModeViolation(currentPath, 'Route not found in configuration');
+          }
+        }
+        return;
+      }
+
+      let hasAccess = true;
+
+      if (currentRoute.pageId && currentRoute.permissions && currentRoute.permissions.length > 0) {
+        try {
+          const { isPermittedCached } = await import('../../rbac/api');
+          const hasPagePermission = await isPermittedCached({
+            userId: user?.id || '',
+            scope,
+            permission: currentRoute.permissions[0] as Permission,
+            pageId: currentRoute.pageId,
+          });
+          if (!isMounted) return;
+          hasAccess = hasPagePermission.ok ? hasPagePermission.data : false;
+        } catch (error) {
+          logger.error('PaceAppLayout', 'Failed to check page permission', {
+            route: currentPath,
+            pageId: currentRoute.pageId,
+            error
+          });
+          if (!isMounted) return;
+          hasAccess = false;
+        }
+      }
+
+      // Role check: stub until auth context is available in this flow
+      if (hasAccess && currentRoute.roles && currentRoute.roles.length > 0 && user?.id) {
+        hasAccess = true;
+      }
+
+      if (!isMounted) return;
+
+      if (!hasAccess) {
+        if (onRouteAccessDenied) {
+          onRouteAccessDenied(currentPath, 'Insufficient permissions');
+        }
+        if (strictMode) {
+          logger.error('PaceAppLayout', 'STRICT MODE VIOLATION: User attempted to access protected route without permission', {
+            route: currentPath,
+            userId: user?.id,
+            permissions: currentRoute.permissions,
+            roles: currentRoute.roles,
+            accessLevel: currentRoute.accessLevel,
+            timestamp: new Date().toISOString()
+          });
+          if (onRouteStrictModeViolation) {
+            onRouteStrictModeViolation(currentPath, 'Insufficient permissions');
+          }
+        }
+        navigate(fallbackRoute, { replace: true });
+      }
+    };
+
+    checkRouteAccess();
+
+    return () => {
+      isMounted = false;
+    };
+  }, [
+    roleBasedRouting,
+    routeConfig,
+    currentPath,
+    strictMode,
+    user?.id,
+    fallbackRoute,
+    scope,
+    navigate,
+    onRouteAccessDenied,
+    onRouteStrictModeViolation,
+  ]);
+}

package/src/components/PaceAppLayout/useSuperAdminFallback.ts

@@ -0,0 +1,58 @@
+/**
+ * @file Super Admin Fallback Hook
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout
+ * @since 0.1.0
+ *
+ * Fallback check for super admin status when RBAC hasn't loaded yet.
+ * Used by PaceAppLayout so super admins can proceed before useRBAC resolves.
+ */
+
+import { useState, useEffect } from 'react';
+import { isSuperAdmin as checkSuperAdminApi } from '../../rbac/api';
+import { logger } from '../../utils/core/logger';
+
+/**
+ * Hook that performs a direct super-admin check as fallback when RBAC is still loading.
+ *
+ * @param userId - Current user id (when absent, returns false/not checking).
+ * @param isSuperAdminFromRBAC - Result from useRBAC; when true, skips the direct check.
+ * @returns { isSuperAdminDirect, isCheckingSuperAdminDirect }
+ */
+export function useSuperAdminFallback(
+  userId: string | undefined,
+  isSuperAdminFromRBAC: boolean
+): { isSuperAdminDirect: boolean; isCheckingSuperAdminDirect: boolean } {
+  const [isSuperAdminDirect, setIsSuperAdminDirect] = useState<boolean>(false);
+  const [isCheckingSuperAdminDirect, setIsCheckingSuperAdminDirect] = useState<boolean>(false);
+
+  useEffect(() => {
+    const checkSuperAdminDirect = async () => {
+      if (!userId) {
+        setIsSuperAdminDirect(false);
+        setIsCheckingSuperAdminDirect(false);
+        return;
+      }
+
+      if (isSuperAdminFromRBAC) {
+        setIsCheckingSuperAdminDirect(false);
+        return;
+      }
+
+      setIsCheckingSuperAdminDirect(true);
+      try {
+        const superAdminStatus = await checkSuperAdminApi(userId);
+        setIsSuperAdminDirect(superAdminStatus.ok ? superAdminStatus.data : false);
+      } catch (error) {
+        logger.error('PaceAppLayout', 'Error checking super admin status directly', { userId, error });
+        setIsSuperAdminDirect(false);
+      } finally {
+        setIsCheckingSuperAdminDirect(false);
+      }
+    };
+
+    checkSuperAdminDirect();
+  }, [userId, isSuperAdminFromRBAC]);
+
+  return { isSuperAdminDirect, isCheckingSuperAdminDirect };
+}

package/src/components/PaceLoginPage/PaceLoginPage.test.tsx

@@ -113,9 +113,9 @@ vi.mock('../../theming/runtime', () => ({
   clearPalette: vi.fn(),
 }));
 
-// Mock isSuperAdmin from RBAC API
+// Mock isSuperAdmin from RBAC API (returns ApiResult<boolean>)
 vi.mock('../../rbac/api', () => ({
-  isSuperAdmin: vi.fn().mockResolvedValue(false)
+  isSuperAdmin: vi.fn().mockResolvedValue({ ok: true, data: false })
 }));
 
 import { isSuperAdmin } from '../../rbac/api';
@@ -318,7 +318,7 @@ describe('PaceLoginPage Component', () => {
       mockAuthContext.hasRole.mockReturnValue(true);
       mockAuthContext.getUserRole.mockReturnValue('super_admin');
       
-      vi.mocked(isSuperAdmin).mockResolvedValue(true);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: true });
       
       renderWithProviders(
         <UnifiedAuthContext.Provider value={mockAuthContext as any}>
@@ -354,7 +354,7 @@ describe('PaceLoginPage Component', () => {
       mockAuthContext.hasRole.mockReturnValue(true);
       mockAuthContext.getUserRole.mockReturnValue('super_admin');
       
-      vi.mocked(isSuperAdmin).mockResolvedValue(true);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: true });
       
       mockNavigate.mockImplementation(() => {
         throw new Error('Navigation failed');
@@ -385,7 +385,11 @@ describe('PaceLoginPage Component', () => {
   describe('Form Submission', () => {
     it('handles successful login submission', async () => {
       const user = userEvent.setup();
-      mockAuthContext.signIn.mockResolvedValue({ error: null });
+      mockAuthContext.signIn.mockImplementation(async () => {
+        mockAuthContext.isAuthenticated = true;
+        mockAuthContext.user = { id: '1', email: 'test@example.com' } as User;
+        return { error: null };
+      });
       
       renderWithAuthContext(
         <PaceLoginPage 
@@ -413,8 +417,8 @@ describe('PaceLoginPage Component', () => {
 
     it('handles failed login submission', async () => {
       const user = userEvent.setup();
-      const signInError = new Error('Invalid credentials');
-      mockAuthContext.signIn.mockResolvedValue({ error: signInError });
+      // signIn returns ApiResult; ok: false causes handleSubmit to throw, LoginForm catches and displays message
+      mockAuthContext.signIn.mockResolvedValue({ ok: false, error: { code: 'INVALID_CREDENTIALS', message: 'Invalid credentials' } });
       
       renderWithAuthContext(<PaceLoginPage appName="Test App" />, { withRouter: false });
       
@@ -439,14 +443,17 @@ describe('PaceLoginPage Component', () => {
 
     it('handles navigation error after successful login', async () => {
       const user = userEvent.setup();
-      mockAuthContext.signIn.mockResolvedValue({ error: null });
+      mockAuthContext.signIn.mockImplementation(async () => {
+        mockAuthContext.isAuthenticated = true;
+        mockAuthContext.user = { id: '1', email: 'test@example.com' } as User;
+        return { error: null };
+      });
       mockNavigate.mockImplementation(() => {
         throw new Error('Navigation failed');
       });
       
-      
       renderWithAuthContext(
-        <PaceLoginPage appName="Test App" requireAppAccess={false} />, 
+        <PaceLoginPage appName="Test App" requireAppAccess={false} onSuccessRedirectPath="/" />, 
         { withRouter: false }
       );
       
@@ -458,14 +465,13 @@ describe('PaceLoginPage Component', () => {
       await user.type(passwordInput, 'password123');
       await user.click(submitButton);
       
-      // Wait for navigation to be attempted (which will throw)
+      await waitFor(() => {
+        expect(mockAuthContext.signIn).toHaveBeenCalledWith('test@example.com', 'password123');
+      });
+      
       await waitFor(() => {
         expect(mockNavigate).toHaveBeenCalled();
       }, { timeout: 3000 });
-      
-      // Check if error was logged (may or may not be called depending on timing)
-      // The important thing is that navigation was attempted and the error was handled gracefully
-      expect(mockNavigate).toHaveBeenCalled();
     });
 
     it('manages loading state during form submission', async () => {
@@ -671,7 +677,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('shows access error when required app configuration is missing', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-1' } as User;
@@ -713,7 +719,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('shows organisation access error when user lacks active organisations', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-2' } as User;
@@ -788,7 +794,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('shows access error when user has no page permissions', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-3' } as User;
@@ -862,7 +868,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('shows access error when app has no pages configured', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-4' } as User;
@@ -914,7 +920,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('handles app access check error gracefully', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-5' } as User;
@@ -938,7 +944,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('grants access when user has permission on any page', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-6' } as User;
@@ -1128,7 +1134,7 @@ describe('PaceLoginPage Component', () => {
   describe('Form Submission Edge Cases', () => {
     it('clears access error on new form submission', async () => {
       const user = userEvent.setup();
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-7' } as User;
@@ -1221,7 +1227,7 @@ describe('PaceLoginPage Component', () => {
 
   describe('Access Error Display', () => {
     it('displays access error with correct styling', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-9' } as User;
@@ -1310,7 +1316,7 @@ describe('PaceLoginPage Component', () => {
 
   describe('RBAC Permission Checking Details', () => {
     it('checks all pages when user has no permission on first page', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-11' } as User;
@@ -1399,7 +1405,7 @@ describe('PaceLoginPage Component', () => {
     });
 
     it('stops checking pages once permission is found', async () => {
-      vi.mocked(isSuperAdmin).mockResolvedValue(false);
+      vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
       mockAuthContext.isAuthenticated = true;
       mockAuthContext.isLoading = false;
       mockAuthContext.user = { id: 'user-12' } as User;