@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/adapters.tsx

@@ -74,16 +74,17 @@ export function withPermissionGuard<T extends readonly [ServerRequest, ...unknow
       throw new Error('User context required for permission check');
     }
 
-    // Check permission
     const { isPermitted } = await import('./api');
-    const hasPermission = await isPermitted({
+    const result = await isPermitted({
       userId,
       scope: { organisationId, eventId, appId },
       permission: config.permission,
       pageId: config.pageId,
     });
-
-    if (!hasPermission) {
+    if (!result.ok) {
+      throw new Error(result.error.message);
+    }
+    if (!result.data) {
       throw new Error(`Permission denied: ${config.permission}`);
     }
 
@@ -128,12 +129,15 @@ export function withAccessLevelGuard<T extends readonly [ServerRequest, ...unkno
       throw new Error('User context required for access level check');
     }
 
-    // Check access level
     const { getAccessLevel } = await import('./api');
-    const accessLevel = await getAccessLevel({
+    const result = await getAccessLevel({
       userId,
       scope: { organisationId, eventId, appId },
     });
+    if (!result.ok) {
+      throw new Error(result.error.message);
+    }
+    const accessLevel = result.data;
 
     const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];
     const userLevelIndex = levelHierarchy.indexOf(accessLevel);
@@ -194,12 +198,10 @@ export function withRoleGuard<T extends readonly [ServerRequest, ...unknown[]],
       throw new Error('User context required for role check');
     }
 
-    // Check global roles first (super_admin bypasses all)
     if (config.globalRoles && config.globalRoles.length > 0) {
       const { isSuperAdmin } = await import('./api');
-      const isSuper = await isSuperAdmin(userId);
-      
-      if (isSuper) {
+      const superResult = await isSuperAdmin(userId);
+      if (superResult.ok && superResult.data) {
         // Log bypass for super admin - only if we have a valid organisation ID
         if (organisationId) {
           const { emitAuditEvent } = await import('./audit');
@@ -225,22 +227,24 @@ export function withRoleGuard<T extends readonly [ServerRequest, ...unknown[]],
       }
     }
 
-    // Check organisation roles
     if (config.organisationRoles && config.organisationRoles.length > 0) {
       const { isOrganisationAdmin } = await import('./api');
-      const isOrgAdmin = await isOrganisationAdmin(userId, organisationId);
-      
-      if (!isOrgAdmin && config.requireAll !== false) {
+      const orgResult = await isOrganisationAdmin(userId, organisationId);
+      if (!orgResult.ok) {
+        throw new Error(orgResult.error.message);
+      }
+      if (!orgResult.data && config.requireAll !== false) {
         throw new Error(`Organisation admin role required`);
       }
     }
 
-    // Check event-app roles if event and app context provided
     if (config.eventAppRoles && config.eventAppRoles.length > 0 && eventId && appId) {
       const { isEventAdmin } = await import('./api');
-      const isEventAdminUser = await isEventAdmin(userId, { organisationId, eventId, appId });
-      
-      if (!isEventAdminUser && config.requireAll !== false) {
+      const eventResult = await isEventAdmin(userId, { organisationId, eventId, appId });
+      if (!eventResult.ok) {
+        throw new Error(eventResult.error.message);
+      }
+      if (!eventResult.data && config.requireAll !== false) {
         throw new Error(`Event admin role required`);
       }
     }
@@ -321,20 +325,18 @@ export function createRBACMiddleware(config: {
     if (protectedRoute) {
       try {
         const { isPermitted } = await import('./api');
-        const hasPermission = await isPermitted({
+        const result = await isPermitted({
           userId,
           scope: { organisationId },
           permission: protectedRoute.permission,
           pageId: protectedRoute.pageId,
         });
-
-        if (!hasPermission) {
+        if (!result.ok || !result.data) {
           return res.redirect(config.fallbackUrl || '/access-denied');
         }
-    } catch (_error) {
-      // Permission check failed - error logged via RBAC logger
-      return res.redirect(config.fallbackUrl || '/access-denied');
-    }
+      } catch (_error) {
+        return res.redirect(config.fallbackUrl || '/access-denied');
+      }
     }
 
     next();
@@ -379,17 +381,15 @@ export function createRBACExpressMiddleware(config: {
 
     try {
       const { isPermitted } = await import('./api');
-      const hasPermission = await isPermitted({
+      const result = await isPermitted({
         userId,
         scope: { organisationId, eventId, appId },
         permission: config.permission,
         pageId: config.pageId,
       });
-
-      if (!hasPermission) {
+      if (!result.ok || !result.data) {
         return res.status(403).json({ error: 'Permission denied' });
       }
-
       next();
     } catch (_error) {
       // Permission check failed - error logged via RBAC logger