@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/providers/services/{__tests__/useUnifiedAuth.test.tsx → useUnifiedAuth.test.tsx}

@@ -1,7 +1,7 @@
 /**
  * @file useUnifiedAuth Hook Unit Tests
  * @package @jmruthers/pace-core
- * @module Providers/Services/__tests__
+ * @module Providers/Services
  * @since 0.1.0
  *
  * Comprehensive unit tests for useUnifiedAuth hook covering:
@@ -13,16 +13,16 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { useUnifiedAuth } from '../useUnifiedAuth';
-import { UnifiedAuthContext } from '../UnifiedAuthContext';
-import type { UnifiedAuthContextType } from '../UnifiedAuthContext';
-import { logger } from '../../../utils/core/logger';
+import { useUnifiedAuth } from './useUnifiedAuth';
+import { UnifiedAuthContext } from './UnifiedAuthContext';
+import type { UnifiedAuthContextType } from './UnifiedAuthContext';
+import { logger } from '../../utils/core/logger';
 
 // Following testing standards: use timeout parameter to prevent hanging
 const TEST_TIMEOUT = 10000; // 10 seconds per test
 
 // Mock logger
-vi.mock('../../../utils/core/logger', () => ({
+vi.mock('../../utils/core/logger', () => ({
   logger: {
     error: vi.fn(),
     warn: vi.fn(),

package/src/providers/services/useUnifiedAuthContextValue.ts

@@ -0,0 +1,279 @@
+/**
+ * @file useUnifiedAuthContextValue
+ * @package @jmruthers/pace-core
+ * @module Providers/Services
+ *
+ * Hooks used by UnifiedAuthContextProvider to stay under max-lines-per-function.
+ */
+
+import { useMemo, useCallback, useRef, useEffect, useState, useReducer } from 'react';
+import type { SupabaseClient, User, Session, AuthError } from '@supabase/supabase-js';
+import type { Event } from '../../types/event';
+import type { SessionRestorationState } from '../../types/auth';
+import type { Organisation, OrganisationMembership } from '../../types/organisation';
+import type { ApiResult } from '../../types/api-result';
+import type { AuthSessionData } from '../../services/interfaces/IAuthService';
+import { logger } from '../../utils/core/logger';
+import type { UnifiedAuthContextType } from './UnifiedAuthContext';
+
+/** Resolve appId when user logs in. Extracted to keep UnifiedAuthContextProvider under max-lines. */
+export function useAppIdResolution(
+  supabase: SupabaseClient,
+  appName: string,
+  isAuth: boolean,
+  currentUserId: string | undefined
+): string | undefined {
+  const [appId, setAppId] = useState<string | undefined>(undefined);
+  const isResolvingAppIdRef = useRef(false);
+  const resolvedAppIdRef = useRef<string | undefined>(undefined);
+  const resolvedUserIdRef = useRef<string | undefined>(undefined);
+
+  useEffect(() => {
+    if (!isAuth) {
+      resolvedAppIdRef.current = undefined;
+      resolvedUserIdRef.current = undefined;
+      setAppId(undefined);
+      return;
+    }
+    if (currentUserId && resolvedUserIdRef.current && resolvedUserIdRef.current !== currentUserId) {
+      resolvedAppIdRef.current = undefined;
+      resolvedUserIdRef.current = undefined;
+      setAppId(undefined);
+    }
+    const shouldResolve =
+      isAuth &&
+      currentUserId &&
+      supabase &&
+      appName &&
+      resolvedUserIdRef.current !== currentUserId &&
+      !isResolvingAppIdRef.current;
+    if (!shouldResolve) return;
+
+    isResolvingAppIdRef.current = true;
+    resolvedUserIdRef.current = currentUserId;
+    const userId = currentUserId;
+    const appNameValue = appName;
+
+    import('../../rbac/api').then(async ({ resolveAppContext, setupRBAC }) => {
+      try {
+        setupRBAC(supabase);
+        const result = await resolveAppContext({ userId, appName: appNameValue });
+        if (result.ok && result.data?.appId) {
+          const appIdValue = result.data.appId;
+          resolvedAppIdRef.current = appIdValue;
+          setAppId(appIdValue);
+        } else {
+          resolvedUserIdRef.current = undefined;
+        }
+      } catch (error) {
+        logger.error('UnifiedAuthProvider', 'Failed to resolve appId on login', {
+          error: error instanceof Error ? error.message : String(error),
+          appName: appNameValue,
+          userId,
+        });
+        resolvedUserIdRef.current = undefined;
+      } finally {
+        isResolvingAppIdRef.current = false;
+      }
+    }).catch((importError) => {
+      logger.error('UnifiedAuthProvider', 'Failed to import RBAC API', importError);
+      isResolvingAppIdRef.current = false;
+      resolvedUserIdRef.current = undefined;
+    });
+  }, [isAuth, currentUserId, supabase, appName]);
+
+  return appId;
+}
+
+/** Subscribe to all auth-related services and trigger re-renders. Extracted to keep provider under max-lines. */
+export function useUnifiedAuthSubscriptions(
+  authService: { subscribe: (fn: () => void) => () => void },
+  organisationService: { subscribe: (fn: () => void) => () => void },
+  eventService: { subscribe: (fn: () => void) => () => void },
+  inactivityService: { subscribe: (fn: () => void) => () => void }
+): void {
+  const [, forceUpdate] = useReducer((x: number) => x + 1, 0);
+  const forceUpdateTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const debouncedForceUpdate = useCallback(() => {
+    if (forceUpdateTimeoutRef.current) clearTimeout(forceUpdateTimeoutRef.current);
+    forceUpdateTimeoutRef.current = setTimeout(() => {
+      forceUpdate();
+      forceUpdateTimeoutRef.current = null;
+    }, 100);
+  }, [forceUpdate]);
+
+  const authServiceRef = useRef(authService);
+  const organisationServiceRef = useRef(organisationService);
+  const eventServiceRef = useRef(eventService);
+  const inactivityServiceRef = useRef(inactivityService);
+  useEffect(() => {
+    authServiceRef.current = authService;
+    organisationServiceRef.current = organisationService;
+    eventServiceRef.current = eventService;
+    inactivityServiceRef.current = inactivityService;
+  }, [authService, organisationService, eventService, inactivityService]);
+
+  useEffect(() => {
+    const unsubAuth = authServiceRef.current.subscribe(debouncedForceUpdate);
+    const unsubOrg = organisationServiceRef.current.subscribe(debouncedForceUpdate);
+    const unsubEvent = eventServiceRef.current.subscribe(debouncedForceUpdate);
+    const unsubInactivity = inactivityServiceRef.current.subscribe(debouncedForceUpdate);
+    return () => {
+      unsubAuth();
+      unsubOrg();
+      unsubEvent();
+      unsubInactivity();
+      if (forceUpdateTimeoutRef.current) clearTimeout(forceUpdateTimeoutRef.current);
+    };
+  }, [debouncedForceUpdate]);
+}
+
+/** State passed into the context value memo. */
+export interface UnifiedAuthContextState {
+  currentUser: User | null;
+  currentSession: Session | null;
+  isAuth: boolean;
+  authLoading: boolean;
+  authError: AuthError | null;
+  selectedOrganisation: Organisation | null;
+  organisations: Organisation[];
+  userMemberships: OrganisationMembership[];
+  orgLoading: boolean;
+  organisationError: Error | null;
+  hasValidOrganisationContext: boolean;
+  isContextReady: boolean;
+  events: Event[];
+  selectedEvent: Event | null;
+  eventLoading: boolean;
+  eventError: Error | null;
+  inactivityState: {
+    showInactivityWarning: boolean;
+    inactivityTimeRemaining: number;
+    isIdle: boolean;
+    timeRemaining: number;
+    showWarning: boolean;
+    isTracking: boolean;
+  };
+  totalLoading: boolean;
+  hasErrors: boolean;
+  sessionRestoration: SessionRestorationState;
+  sessionRestorationTimedOut: boolean;
+  sessionRestorationTimeoutMs: number;
+}
+
+/** Auth callbacks passed into the context value memo. */
+interface UnifiedAuthCallbacks {
+  signIn: (email: string, password?: string) => Promise<ApiResult<AuthSessionData>>;
+  signUp: (email: string, password: string) => Promise<ApiResult<AuthSessionData>>;
+  signOut: () => Promise<ApiResult<AuthSessionData>>;
+  resetPassword: (email: string) => Promise<ApiResult<AuthSessionData>>;
+  updatePassword: (password: string) => Promise<ApiResult<AuthSessionData>>;
+  refreshSession: () => Promise<ApiResult<AuthSessionData>>;
+}
+
+/** Organisation callbacks passed into the context value memo. */
+interface UnifiedOrganisationCallbacks {
+  switchOrganisation: (orgId: string) => Promise<void>;
+  getUserRole: (orgId?: string) => string;
+  validateOrganisationAccess: (orgId: string) => boolean;
+  refreshOrganisations: () => Promise<void>;
+  ensureOrganisationContext: () => Organisation;
+  isOrganisationSecure: () => boolean;
+  getPrimaryOrganisation: () => Organisation | null;
+}
+
+/** Event callbacks passed into the context value memo. */
+interface UnifiedEventCallbacks {
+  setSelectedEvent: (event: Event | null) => void;
+  refreshEvents: () => Promise<void>;
+}
+
+/** Inactivity callbacks passed into the context value memo. */
+interface UnifiedInactivityCallbacks {
+  resetActivity: () => void;
+  startTracking: () => void;
+  stopTracking: () => void;
+  handleIdleLogout: () => Promise<void>;
+  handleStaySignedIn: () => void;
+  handleSignOutNow: () => Promise<void>;
+}
+
+/** Callbacks passed into the context value memo (composed from focused interfaces). */
+export type UnifiedAuthContextCallbacks = UnifiedAuthCallbacks &
+  UnifiedOrganisationCallbacks &
+  UnifiedEventCallbacks &
+  UnifiedInactivityCallbacks;
+
+/** Build the unified auth context value from state and callbacks. Extracted to keep provider under max-lines. */
+export function useUnifiedAuthContextValue(
+  state: UnifiedAuthContextState,
+  callbacks: UnifiedAuthContextCallbacks,
+  appId: string | undefined,
+  appName: string,
+  supabase: SupabaseClient
+): UnifiedAuthContextType {
+  return useMemo<UnifiedAuthContextType>(
+    () => {
+      const selectedOrganisationId =
+        state.selectedOrganisation?.id ??
+        (state.selectedEvent as { organisation_id?: string | null } | undefined)?.organisation_id ??
+        null;
+      return {
+        user: state.currentUser,
+        session: state.currentSession,
+        isAuthenticated: state.isAuth,
+        authLoading: state.authLoading,
+        authError: state.authError,
+        supabase,
+        signIn: callbacks.signIn,
+        signUp: callbacks.signUp,
+        signOut: callbacks.signOut,
+        resetPassword: callbacks.resetPassword,
+        updatePassword: callbacks.updatePassword,
+        refreshSession: callbacks.refreshSession,
+        selectedOrganisation: state.selectedOrganisation,
+        selectedOrganisationId,
+        organisations: state.organisations,
+      userMemberships: state.userMemberships,
+      organisationLoading: state.orgLoading,
+      organisationError: state.organisationError,
+      hasValidOrganisationContext: state.hasValidOrganisationContext,
+      isContextReady: state.isContextReady,
+      switchOrganisation: callbacks.switchOrganisation,
+      getUserRole: callbacks.getUserRole,
+      validateOrganisationAccess: callbacks.validateOrganisationAccess,
+      refreshOrganisations: callbacks.refreshOrganisations,
+      ensureOrganisationContext: callbacks.ensureOrganisationContext,
+      isOrganisationSecure: callbacks.isOrganisationSecure,
+      getPrimaryOrganisation: callbacks.getPrimaryOrganisation,
+      events: state.events,
+      selectedEvent: state.selectedEvent,
+      selectedEventId: state.selectedEvent?.event_id ?? null,
+      eventLoading: state.eventLoading,
+      eventError: state.eventError,
+      setSelectedEvent: callbacks.setSelectedEvent,
+      refreshEvents: callbacks.refreshEvents,
+      showInactivityWarning: state.inactivityState.showInactivityWarning,
+      inactivityTimeRemaining: state.inactivityState.inactivityTimeRemaining,
+      isIdle: state.inactivityState.isIdle,
+      timeRemaining: state.inactivityState.timeRemaining,
+      showWarning: state.inactivityState.showWarning,
+      isTracking: state.inactivityState.isTracking,
+      resetActivity: callbacks.resetActivity,
+      startTracking: callbacks.startTracking,
+      stopTracking: callbacks.stopTracking,
+      handleIdleLogout: callbacks.handleIdleLogout,
+      handleStaySignedIn: callbacks.handleStaySignedIn,
+      handleSignOutNow: callbacks.handleSignOutNow,
+      appName,
+      appId,
+      isLoading: state.totalLoading,
+      hasErrors: state.hasErrors,
+      sessionRestoration: state.sessionRestoration,
+      sessionRestorationTimedOut: state.sessionRestorationTimedOut,
+      sessionRestorationTimeoutMs: state.sessionRestorationTimeoutMs,
+      };
+    },
+    [state, callbacks, appId, appName, supabase]
+  );
+}

package/src/providers/useInactivity.test-helper.ts

@@ -0,0 +1,27 @@
+/**
+ * Test helper hook for InactivityProvider tests.
+ * Exposes InactivityService state in the format tests expect.
+ */
+
+import { useInactivityService } from '../hooks/services/useInactivityService';
+
+export function useInactivity() {
+  const service = useInactivityService();
+
+  return {
+    showInactivityWarning: service.getShowInactivityWarning(),
+    inactivityTimeRemaining: service.getInactivityTimeRemaining(),
+    isIdle: service.isIdle(),
+    timeRemaining: service.getTimeRemaining(),
+    showWarning: service.isWarningShown(),
+    isTracking: service.isTracking(),
+
+    // Methods
+    resetActivity: () => service.resetActivity(),
+    startTracking: () => service.startTracking(),
+    stopTracking: () => service.stopTracking(),
+    handleIdleLogout: () => service.handleIdleLogout(),
+    handleStaySignedIn: () => service.handleStaySignedIn(),
+    handleSignOutNow: () => service.handleSignOutNow(),
+  };
+}

package/src/rbac/{__tests__/adapters.comprehensive.test.tsx → adapters.comprehensive.test.tsx}

@@ -11,21 +11,21 @@ import {
   withRoleGuard,
   createRBACMiddleware,
   createRBACExpressMiddleware
-} from '../adapters';
-import { UUID, Permission } from '../types';
-import { rbacCache } from '../cache';
+} from './adapters';
+import { UUID, Permission } from './types';
+import { rbacCache } from './cache';
 
 // Mock the hooks that the adapters use - mock individual files since barrel was removed
 // CRITICAL: Use hoisted mocks so they can be accessed in tests
 const mockUseCanFn = vi.hoisted(() => vi.fn());
 const mockUseAccessLevelFn = vi.hoisted(() => vi.fn());
-vi.mock('../hooks/usePermissions', () => ({
+vi.mock('./hooks/usePermissions', () => ({
   useCan: mockUseCanFn,
   useAccessLevel: mockUseAccessLevelFn,
 }));
 
 // Mock the API functions
-vi.mock('../api', () => ({
+vi.mock('./api', () => ({
   isPermitted: vi.fn(),
   getAccessLevel: vi.fn(),
   isSuperAdmin: vi.fn(),
@@ -34,12 +34,12 @@ vi.mock('../api', () => ({
 }));
 
 // Mock the audit functions
-vi.mock('../audit', () => ({
+vi.mock('./audit', () => ({
   emitAuditEvent: vi.fn(),
 }));
 
 // Mock the logger
-vi.mock('../config', () => ({
+vi.mock('./config', () => ({
   getRBACLogger: vi.fn(() => ({
     debug: vi.fn(),
     info: vi.fn(),
@@ -48,8 +48,8 @@ vi.mock('../config', () => ({
 }));
 
 // Import the mocked functions
-import { isPermitted, getAccessLevel, isSuperAdmin, isOrganisationAdmin, isEventAdmin } from '../api';
-import { emitAuditEvent } from '../audit';
+import { isPermitted, getAccessLevel, isSuperAdmin, isOrganisationAdmin, isEventAdmin } from './api';
+import { emitAuditEvent } from './audit';
 const mockIsPermitted = isPermitted as any;
 const mockGetAccessLevel = getAccessLevel as any;
 const mockIsSuperAdmin = isSuperAdmin as any;
@@ -94,7 +94,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsPermitted.mockResolvedValue(true);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           user: { id: 'user-123' },
@@ -122,7 +122,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsPermitted.mockResolvedValue(false);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: false });
 
         const req = {
           user: { id: 'user-123' },
@@ -152,7 +152,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         const handler = vi.fn().mockResolvedValue({ success: true });
         const wrappedHandler = withAccessLevelGuard('admin', handler);
 
-        mockGetAccessLevel.mockResolvedValue('admin');
+        mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'admin' });
 
         const req = {
           user: { id: 'user-123' },
@@ -175,7 +175,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
         const handler = vi.fn();
         const wrappedHandler = withAccessLevelGuard('admin', handler);
 
-        mockGetAccessLevel.mockResolvedValue('viewer');
+        mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
 
         const req = {
           user: { id: 'user-123' },
@@ -195,7 +195,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsSuperAdmin.mockResolvedValue(true);
+        mockIsSuperAdmin.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           user: { id: 'user-123' },
@@ -226,8 +226,8 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsSuperAdmin.mockResolvedValue(false);
-        mockIsOrganisationAdmin.mockResolvedValue(true);
+        mockIsSuperAdmin.mockResolvedValue({ ok: true, data: false });
+        mockIsOrganisationAdmin.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           user: { id: 'user-123' },
@@ -248,8 +248,8 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsSuperAdmin.mockResolvedValue(false);
-        mockIsEventAdmin.mockResolvedValue(true);
+        mockIsSuperAdmin.mockResolvedValue({ ok: true, data: false });
+        mockIsEventAdmin.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           user: { id: 'user-123' },
@@ -272,8 +272,8 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           handler
         );
 
-        mockIsSuperAdmin.mockResolvedValue(false);
-        mockIsOrganisationAdmin.mockResolvedValue(false);
+        mockIsSuperAdmin.mockResolvedValue({ ok: true, data: false });
+        mockIsOrganisationAdmin.mockResolvedValue({ ok: true, data: false });
 
         const req = {
           user: { id: 'user-123' },
@@ -296,7 +296,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           fallbackUrl: '/access-denied'
         });
 
-        mockIsPermitted.mockResolvedValue(false);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: false });
 
         const req = {
           nextUrl: { pathname: '/admin' },
@@ -320,7 +320,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           fallbackUrl: '/access-denied'
         });
 
-        mockIsPermitted.mockResolvedValue(true);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           nextUrl: { pathname: '/admin' },
@@ -364,7 +364,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           pageId: 'api-page-123' as UUID
         });
 
-        mockIsPermitted.mockResolvedValue(true);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: true });
 
         const req = {
           user: { id: 'user-123' },
@@ -391,7 +391,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           permission: 'read:api' as Permission
         });
 
-        mockIsPermitted.mockResolvedValue(false);
+        mockIsPermitted.mockResolvedValue({ ok: true, data: false });
 
         const req = {
           user: { id: 'user-123' },

package/src/rbac/adapters.test.tsx

@@ -39,7 +39,7 @@ describe('withPermissionGuard', () => {
 
   it('allows handler execution when permission is granted', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const handler = vi.fn().mockResolvedValue({ success: true });
     const protectedHandler = withPermissionGuard(
@@ -67,7 +67,7 @@ describe('withPermissionGuard', () => {
 
   it('throws error when permission is denied', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(false);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: false });
 
     const handler = vi.fn();
     const protectedHandler = withPermissionGuard(
@@ -101,7 +101,7 @@ describe('withPermissionGuard', () => {
 
   it('handles pageId in config', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const handler = vi.fn().mockResolvedValue({ success: true });
     const protectedHandler = withPermissionGuard(
@@ -131,7 +131,7 @@ describe('withAccessLevelGuard', () => {
 
   it('allows handler when access level is sufficient', async () => {
     const { getAccessLevel } = await import('./api');
-    vi.mocked(getAccessLevel).mockResolvedValue('admin');
+    vi.mocked(getAccessLevel).mockResolvedValue({ ok: true, data: 'admin' });
 
     const handler = vi.fn().mockResolvedValue({ success: true });
     const protectedHandler = withAccessLevelGuard('planner', handler);
@@ -155,7 +155,7 @@ describe('withAccessLevelGuard', () => {
 
   it('throws error when access level is insufficient', async () => {
     const { getAccessLevel } = await import('./api');
-    vi.mocked(getAccessLevel).mockResolvedValue('viewer');
+    vi.mocked(getAccessLevel).mockResolvedValue({ ok: true, data: 'viewer' });
 
     const handler = vi.fn();
     const protectedHandler = withAccessLevelGuard('admin', handler);
@@ -177,7 +177,7 @@ describe('withAccessLevelGuard', () => {
 
     for (let i = 0; i < levels.length; i++) {
       for (let j = 0; j <= i; j++) {
-        vi.mocked(getAccessLevel).mockResolvedValue(levels[i]);
+        vi.mocked(getAccessLevel).mockResolvedValue({ ok: true, data: levels[i] });
         const protectedHandler = withAccessLevelGuard(levels[j], handler);
 
         const req = {
@@ -199,7 +199,7 @@ describe('withRoleGuard', () => {
   it('allows super admin to bypass all checks', async () => {
     const { isSuperAdmin } = await import('./api');
     const { emitAuditEvent: emitAudit } = await import('./audit');
-    vi.mocked(isSuperAdmin).mockResolvedValue(true);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: true });
     vi.mocked(emitAudit).mockResolvedValue(undefined);
 
     const handler = vi.fn().mockResolvedValue({ success: true });
@@ -235,8 +235,8 @@ describe('withRoleGuard', () => {
   it('checks organisation admin role', async () => {
     const { isSuperAdmin, isOrganisationAdmin } = await import('./api');
     const { emitAuditEvent: emitAudit } = await import('./audit');
-    vi.mocked(isSuperAdmin).mockResolvedValue(false);
-    vi.mocked(isOrganisationAdmin).mockResolvedValue(true);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
+    vi.mocked(isOrganisationAdmin).mockResolvedValue({ ok: true, data: true });
     vi.mocked(emitAudit).mockResolvedValue(undefined);
 
     const handler = vi.fn().mockResolvedValue({ success: true });
@@ -259,8 +259,8 @@ describe('withRoleGuard', () => {
 
   it('throws error when organisation admin role is missing', async () => {
     const { isSuperAdmin, isOrganisationAdmin } = await import('./api');
-    vi.mocked(isSuperAdmin).mockResolvedValue(false);
-    vi.mocked(isOrganisationAdmin).mockResolvedValue(false);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
+    vi.mocked(isOrganisationAdmin).mockResolvedValue({ ok: true, data: false });
 
     const handler = vi.fn();
     const protectedHandler = withRoleGuard(
@@ -280,8 +280,8 @@ describe('withRoleGuard', () => {
   it('checks event admin role when event and app context provided', async () => {
     const { isSuperAdmin, isEventAdmin } = await import('./api');
     const { emitAuditEvent: emitAudit } = await import('./audit');
-    vi.mocked(isSuperAdmin).mockResolvedValue(false);
-    vi.mocked(isEventAdmin).mockResolvedValue(true);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
+    vi.mocked(isEventAdmin).mockResolvedValue({ ok: true, data: true });
     vi.mocked(emitAudit).mockResolvedValue(undefined);
 
     const handler = vi.fn().mockResolvedValue({ success: true });
@@ -311,7 +311,7 @@ describe('withRoleGuard', () => {
   it('skips event admin check when event or app context missing', async () => {
     const { isSuperAdmin, isEventAdmin } = await import('./api');
     const { emitAuditEvent: emitAudit } = await import('./audit');
-    vi.mocked(isSuperAdmin).mockResolvedValue(false);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
     vi.mocked(emitAudit).mockResolvedValue(undefined);
 
     const handler = vi.fn().mockResolvedValue({ success: true });
@@ -336,8 +336,8 @@ describe('withRoleGuard', () => {
   it('handles requireAll option', async () => {
     const { isSuperAdmin, isOrganisationAdmin } = await import('./api');
     const { emitAuditEvent: emitAudit } = await import('./audit');
-    vi.mocked(isSuperAdmin).mockResolvedValue(false);
-    vi.mocked(isOrganisationAdmin).mockResolvedValue(true);
+    vi.mocked(isSuperAdmin).mockResolvedValue({ ok: true, data: false });
+    vi.mocked(isOrganisationAdmin).mockResolvedValue({ ok: true, data: true });
     vi.mocked(emitAudit).mockResolvedValue(undefined);
 
     const handler = vi.fn().mockResolvedValue({ success: true });
@@ -390,7 +390,7 @@ describe('createRBACMiddleware', () => {
 
   it('checks permission for protected routes', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const middleware = createRBACMiddleware({
       protectedRoutes: [
@@ -419,7 +419,7 @@ describe('createRBACMiddleware', () => {
 
   it('redirects when permission is denied', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(false);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: false });
 
     const middleware = createRBACMiddleware({
       protectedRoutes: [
@@ -472,7 +472,7 @@ describe('createRBACMiddleware', () => {
 
   it('handles pageId in route config', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const middleware = createRBACMiddleware({
       protectedRoutes: [
@@ -509,7 +509,7 @@ describe('createRBACExpressMiddleware', () => {
 
   it('allows request when permission is granted', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const middleware = createRBACExpressMiddleware({
       permission: 'read:api' as Permission,
@@ -543,7 +543,7 @@ describe('createRBACExpressMiddleware', () => {
 
   it('returns 403 when permission is denied', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(false);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: false });
 
     const middleware = createRBACExpressMiddleware({
       permission: 'read:api' as Permission,
@@ -623,7 +623,7 @@ describe('createRBACExpressMiddleware', () => {
 
   it('handles pageId in config', async () => {
     const { isPermitted } = await import('./api');
-    vi.mocked(isPermitted).mockResolvedValue(true);
+    vi.mocked(isPermitted).mockResolvedValue({ ok: true, data: true });
 
     const middleware = createRBACExpressMiddleware({
       permission: 'read:api' as Permission,