@jmruthers/pace-core 0.6.10 → 0.6.11

package/dist/{chunk-KYURMOQM.js → chunk-V7FTM2LU.js}

@@ -1,9 +1,9 @@
-import { useAppConfig } from './chunk-3GWSPISD.js';
-import { OrganisationContextRequiredError, getAccessLevel, isPermittedCached, isPermitted, getRBACLogger, getPermissionMap } from './chunk-LNHFAF4X.js';
+import { useAppConfig } from './chunk-L5LFKKLJ.js';
+import { OrganisationContextRequiredError, getAccessLevel, getRBACLogger, isPermittedCached, isPermitted, getPermissionMap } from './chunk-7A6IMHH2.js';
 import { cn, getCurrentAppName } from './chunk-UZNAFKGW.js';
 import { createLogger } from './chunk-BTHN5MKC.js';
 import * as React3 from 'react';
-import { useState, useCallback, useEffect, useMemo, useRef } from 'react';
+import { useState, useEffect, useMemo, useCallback, useRef } from 'react';
 import * as TooltipPrimitive from '@radix-ui/react-tooltip';
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { Slot } from '@radix-ui/react-slot';
@@ -31,7 +31,7 @@ var Tooltip = React3.forwardRef(({ children, content, delayDuration = 200 }, ref
 ] }) }));
 Tooltip.displayName = "Tooltip";
 function getButtonClasses(variant = "default", size = "default") {
-  const baseClasses = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50";
+  const baseClasses = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 print:shadow-none";
   const variantClasses = {
     default: "bg-main-600 text-main-50 shadow hover:bg-acc-400",
     destructive: "bg-acc-600 text-acc-50 shadow-sm hover:bg-acc-400",
@@ -126,8 +126,25 @@ var IconButton = React3.forwardRef(
   }
 );
 IconButton.displayName = "IconButton";
+
+// src/utils/core/mergeRefs.ts
+function isMutableRefObject(ref) {
+  return ref != null && typeof ref === "object" && "current" in ref;
+}
+function mergeRefs(...refs) {
+  return (node) => {
+    refs.forEach((ref) => {
+      if (ref == null) return;
+      if (typeof ref === "function") {
+        ref(node);
+      } else if (isMutableRefObject(ref)) {
+        ref.current = node;
+      }
+    });
+  };
+}
 function getCardClasses(variant = "default", size = "default") {
-  const baseClasses = "rounded-lg border bg-card text-card-foreground shadow-sm";
+  const baseClasses = "rounded-lg border bg-card text-card-foreground shadow-sm print:shadow-none print:bg-transparent";
   const variantClasses = {
     default: "shadow-xl",
     outline: "border-2",
@@ -135,8 +152,8 @@ function getCardClasses(variant = "default", size = "default") {
   };
   const sizeClasses = {
     default: "",
-    sm: "text-sm",
-    lg: "text-lg"
+    sm: "card--sm",
+    lg: "card--lg"
   };
   return `${baseClasses} ${variantClasses[variant]} ${sizeClasses[size]}`;
 }
@@ -271,6 +288,18 @@ var HoverCard = React3.forwardRef(({ children, className, ...props }, ref) => {
 });
 HoverCard.displayName = "HoverCard";
 var HoverCardTrigger = React3.forwardRef(({ className, asChild, children, ...props }, ref) => {
+  if (asChild && React3.Children.count(children) === 1) {
+    const child = React3.Children.only(children);
+    if (React3.isValidElement(child)) {
+      const childEl = child;
+      const mergedRef = mergeRefs(ref, childEl.ref);
+      return React3.cloneElement(childEl, {
+        ...props,
+        className: cn("cursor-pointer", className, childEl.props?.className),
+        ref: mergedRef
+      });
+    }
+  }
   if (asChild) {
     return /* @__PURE__ */ jsx("span", { className: cn("cursor-pointer", className), children });
   }
@@ -294,7 +323,7 @@ var HoverCardContent = React3.forwardRef(({ className, ...props }, ref) => /* @_
   {
     ref,
     className: cn(
-      "absolute z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-4 text-popover-foreground shadow-md",
+      "absolute z-50 min-w-32 overflow-hidden rounded-md border bg-popover p-4 text-popover-foreground shadow-md",
       className
     ),
     role: "tooltip",
@@ -302,6 +331,125 @@ var HoverCardContent = React3.forwardRef(({ className, ...props }, ref) => /* @_
   }
 ));
 HoverCardContent.displayName = "HoverCardContent";
+var log = createLogger("useResolvedScope");
+var appIdCache = /* @__PURE__ */ new Map();
+var CACHE_TTL = 5 * 60 * 1e3;
+function useResolvedScope({
+  supabase,
+  selectedOrganisationId,
+  selectedEventId,
+  selectedEventOrganisationId
+}) {
+  const immediateOrganisationId = selectedEventOrganisationId || selectedOrganisationId || void 0;
+  const immediateEventId = selectedEventId || void 0;
+  const [appId, setAppId] = useState(void 0);
+  const [isResolvingAppId, setIsResolvingAppId] = useState(false);
+  const [error, setError] = useState(null);
+  const appName = getCurrentAppName();
+  useEffect(() => {
+    let cancelled = false;
+    const resolveAppId = async () => {
+      if (!supabase && !selectedOrganisationId && !selectedEventId) {
+        if (!cancelled) {
+          setAppId(void 0);
+          setIsResolvingAppId(false);
+          setError(null);
+        }
+        return;
+      }
+      setIsResolvingAppId(true);
+      setError(null);
+      try {
+        const appName2 = getCurrentAppName();
+        let resolvedAppId = void 0;
+        if (supabase && appName2) {
+          try {
+            const { data: session } = await supabase.auth.getSession();
+            if (!session?.session) {
+              log.debug(`Skipping app resolution for "${appName2}" - user not authenticated`);
+            } else {
+              const cached = appIdCache.get(appName2);
+              const now = Date.now();
+              if (cached && now - cached.timestamp < CACHE_TTL) {
+                resolvedAppId = cached.appId;
+              } else {
+                const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).eq("is_active", true).single();
+                if (error2) {
+                  if (error2.code === "406" || error2.code === "PGRST116" || error2.message?.includes("406")) {
+                    log.debug(`App resolution blocked by RLS for "${appName2}" - user may not be authenticated`);
+                    resolvedAppId = void 0;
+                  } else {
+                    const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).single();
+                    if (inactiveApp) {
+                      log.error(`App "${appName2}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
+                      resolvedAppId = void 0;
+                    } else {
+                      log.error(`App "${appName2}" not found in rbac_apps table`, { error: error2 });
+                      resolvedAppId = void 0;
+                    }
+                  }
+                } else if (app) {
+                  resolvedAppId = app.id;
+                  appIdCache.set(appName2, { appId: resolvedAppId, timestamp: now });
+                }
+              }
+            }
+          } catch (error2) {
+            const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+            if (!errorMessage.includes("406") && !errorMessage.includes("PGRST116")) {
+              log.error("Unexpected error resolving app ID:", error2);
+            } else {
+              log.debug("App resolution skipped - authentication required");
+            }
+          }
+        }
+        if (!cancelled) {
+          setAppId(resolvedAppId);
+          setIsResolvingAppId(false);
+          setError(null);
+        }
+      } catch (err) {
+        if (!cancelled) {
+          setError(err);
+          setIsResolvingAppId(false);
+        }
+      }
+    };
+    resolveAppId();
+    return () => {
+      cancelled = true;
+    };
+  }, [supabase, selectedOrganisationId, selectedEventId]);
+  const immediateScope = useMemo(() => {
+    if (appName === "PORTAL" || appName === "ADMIN") {
+      return {
+        organisationId: void 0,
+        eventId: void 0,
+        appId: appId || void 0
+      };
+    }
+    const scope = {};
+    if (immediateOrganisationId) {
+      scope.organisationId = immediateOrganisationId;
+    }
+    if (immediateEventId) {
+      scope.eventId = immediateEventId;
+    }
+    if (appId) {
+      scope.appId = appId;
+    }
+    if (!scope.organisationId && !scope.appId) {
+      return null;
+    }
+    return scope;
+  }, [immediateOrganisationId, immediateEventId, appId, appName]);
+  return {
+    resolvedScope: immediateScope,
+    isLoading: isResolvingAppId,
+    // Only true while appId resolves
+    error
+  };
+}
 function useAccessLevel(userId, scope) {
   const [accessLevel, setAccessLevel] = useState("viewer");
   const [isLoading, setIsLoading] = useState(true);
@@ -316,9 +464,15 @@ function useAccessLevel(userId, scope) {
     try {
       setIsLoading(true);
       setError(null);
-      const { isSuperAdmin: checkSuperAdmin } = await import('./api-F47QJ7FX.js');
-      const isSuperAdminUser = await checkSuperAdmin(userId);
-      if (isSuperAdminUser) {
+      const { isSuperAdmin: checkSuperAdmin } = await import('./api-BZR2CYXL.js');
+      const superResult = await checkSuperAdmin(userId);
+      if (!superResult.ok) {
+        setError(new Error(superResult.error.message));
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      if (superResult.data) {
         setAccessLevel("super");
         setIsLoading(false);
         return;
@@ -330,8 +484,14 @@ function useAccessLevel(userId, scope) {
         setIsLoading(false);
         return;
       }
-      const level = await getAccessLevel({ userId, scope }, appName);
-      setAccessLevel(level);
+      const result = await getAccessLevel({ userId, scope }, appName);
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      setAccessLevel(result.data);
     } catch (err) {
       const error2 = err instanceof Error ? err : new Error("Failed to fetch access level");
       setError(error2);
@@ -362,91 +522,132 @@ function scopeEqual(a, b) {
   return a.organisationId === b.organisationId && a.eventId === b.eventId && a.appId === b.appId;
 }
 
+// src/rbac/hooks/permissions/runPermissionCheck.ts
+var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isEmptyString(s) {
+  return s === null || s === void 0 || typeof s === "string" && s.trim() === "";
+}
+async function runPermissionCheck(params) {
+  const { userId, scope, permission, pageId, useCache, appName, isSuperAdmin } = params;
+  if (!userId) {
+    return { ok: true, data: false };
+  }
+  if (isSuperAdmin === true) {
+    return { ok: true, data: true };
+  }
+  if (isSuperAdmin === null) {
+    return { ok: true, data: false };
+  }
+  if (!scope || typeof scope !== "object") {
+    return { ok: true, data: false };
+  }
+  const organisationId = scope.organisationId;
+  const eventId = scope.eventId;
+  const appId = scope.appId;
+  const isPagePermission = permission.includes(":page.") || !!pageId;
+  const requiresOrgId = !isPagePermission;
+  if (requiresOrgId && isEmptyString(organisationId)) {
+    return { ok: true, data: false };
+  }
+  const isPageName = pageId && typeof pageId === "string" && !UUID_REGEX.test(pageId);
+  const needsAppIdForPageName = isPagePermission && !!isPageName;
+  if (needsAppIdForPageName && isEmptyString(appId)) {
+    return { ok: true, data: false };
+  }
+  const validScope = {
+    ...organisationId ? { organisationId } : {},
+    ...eventId ? { eventId } : {},
+    ...appId ? { appId } : {}
+  };
+  if (useCache) {
+    return isPermittedCached({ userId, scope: validScope, permission, pageId }, appName);
+  }
+  return isPermitted(
+    { userId, scope: validScope, permission, pageId },
+    appName,
+    isSuperAdmin === false ? false : null
+  );
+}
+
 // src/rbac/hooks/permissions/useCan.ts
-function useCan(userId, scope, permission, pageId, useCache = true, precomputedSuperAdmin = null, appName) {
+function useSuperAdminForCan(userId, precomputedSuperAdmin) {
   const [isSuperAdmin, setIsSuperAdmin] = useState(precomputedSuperAdmin ?? null);
-  const initialCan = precomputedSuperAdmin === true ? true : false;
-  const initialIsLoading = precomputedSuperAdmin === true ? false : true;
-  const [can, setCan] = useState(initialCan);
-  const [isLoading, setIsLoading] = useState(initialIsLoading);
-  const [error, setError] = useState(null);
-  const isValidScope = scope && typeof scope === "object";
-  const organisationId = isValidScope ? scope.organisationId : void 0;
-  const eventId = isValidScope ? scope.eventId : void 0;
-  const appId = isValidScope ? scope.appId : void 0;
   useEffect(() => {
     if (precomputedSuperAdmin === true && isSuperAdmin !== true) {
       setIsSuperAdmin(true);
-      setCan(true);
-      setIsLoading(false);
-      setError(null);
     } else if (precomputedSuperAdmin === false && isSuperAdmin !== false) {
       setIsSuperAdmin(false);
     }
   }, [precomputedSuperAdmin, isSuperAdmin]);
   useEffect(() => {
-    if (precomputedSuperAdmin === null) {
-      if (!userId) {
-        setIsSuperAdmin(false);
-        return;
-      }
-      let cancelled = false;
-      const checkSuperAdmin = async () => {
-        const startTime = Date.now();
-        try {
-          const { isSuperAdmin: checkSuperAdmin2 } = await import('./api-F47QJ7FX.js');
-          const timeoutWarning = setTimeout(() => {
-            if (!cancelled) {
-              const logger = getRBACLogger();
-              logger.warn("[useCan] Super admin check taking longer than 5 seconds", {
-                userId,
-                elapsedMs: Date.now() - startTime
-              });
-            }
-          }, 5e3);
-          const isSuper = await checkSuperAdmin2(userId);
-          clearTimeout(timeoutWarning);
+    if (precomputedSuperAdmin !== null) return;
+    if (!userId) {
+      setIsSuperAdmin(false);
+      return;
+    }
+    let cancelled = false;
+    const checkSuperAdmin = async () => {
+      const startTime = Date.now();
+      try {
+        const { isSuperAdmin: checkSuperAdminFn } = await import('./api-BZR2CYXL.js');
+        const timeoutWarning = setTimeout(() => {
           if (!cancelled) {
-            const elapsed = Date.now() - startTime;
-            if (elapsed > 1e3) {
-              const logger = getRBACLogger();
-              logger.warn("[useCan] Super admin check took longer than expected", {
-                userId,
-                elapsedMs: elapsed
-              });
-            }
-            setIsSuperAdmin(isSuper);
-            if (isSuper) {
-              setCan(true);
-              setIsLoading(false);
-              setError(null);
-            }
+            getRBACLogger().warn("[useCan] Super admin check taking longer than 5 seconds", {
+              userId,
+              elapsedMs: Date.now() - startTime
+            });
           }
-        } catch (err) {
-          if (!cancelled) {
-            const elapsed = Date.now() - startTime;
-            const logger = getRBACLogger();
-            logger.error("[useCan] Error checking super admin", {
+        }, 5e3);
+        const superResult = await checkSuperAdminFn(userId);
+        clearTimeout(timeoutWarning);
+        if (!cancelled) {
+          const elapsed = Date.now() - startTime;
+          if (elapsed > 1e3) {
+            getRBACLogger().warn("[useCan] Super admin check took longer than expected", {
               userId,
-              error: err,
               elapsedMs: elapsed
             });
+          }
+          if (!superResult.ok) {
             setIsSuperAdmin(false);
+            return;
           }
+          const isSuper = superResult.data;
+          setIsSuperAdmin(isSuper);
         }
-      };
-      checkSuperAdmin();
-      return () => {
-        cancelled = true;
-      };
-    }
+      } catch (err) {
+        if (!cancelled) {
+          getRBACLogger().error("[useCan] Error checking super admin", {
+            userId,
+            error: err,
+            elapsedMs: Date.now() - startTime
+          });
+          setIsSuperAdmin(false);
+        }
+      }
+    };
+    checkSuperAdmin();
+    return () => {
+      cancelled = true;
+    };
   }, [userId, precomputedSuperAdmin]);
+  return { isSuperAdmin };
+}
+function useCan(userId, scope, permission, pageId, useCache = true, precomputedSuperAdmin = null, appName) {
+  const { isSuperAdmin } = useSuperAdminForCan(userId, precomputedSuperAdmin);
+  const initialCan = precomputedSuperAdmin === true ? true : false;
+  const initialIsLoading = precomputedSuperAdmin === true ? false : true;
+  const [can, setCan] = useState(initialCan);
+  const [isLoading, setIsLoading] = useState(initialIsLoading);
+  const [error, setError] = useState(null);
+  const isValidScope = scope && typeof scope === "object";
+  const organisationId = isValidScope ? scope.organisationId : void 0;
+  const eventId = isValidScope ? scope.eventId : void 0;
+  const appId = isValidScope ? scope.appId : void 0;
   useEffect(() => {
+    if (isSuperAdmin === true) return;
     const isPagePermission = permission.includes(":page.") || !!pageId;
     const requiresOrgId = !isPagePermission;
-    if (isSuperAdmin === true) {
-      return;
-    }
     if (requiresOrgId && (!isValidScope || !organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
       const timeoutId = setTimeout(() => {
         setError(new Error("Organisation context is required for permission checks"));
@@ -460,23 +661,22 @@ function useCan(userId, scope, permission, pageId, useCache = true, precomputedS
     }
   }, [isValidScope, organisationId, error, permission, pageId, isSuperAdmin]);
   const lastUserIdRef = useRef(null);
-  useRef(null);
   const lastPermissionRef = useRef(null);
   const lastPageIdRef = useRef(null);
   const lastUseCacheRef = useRef(null);
   const lastIsSuperAdminRef = useRef(null);
+  const prevScopeRef = useRef(null);
   const stableScope = useMemo(() => {
-    if (!isValidScope) {
-      return null;
-    }
-    return {
-      organisationId,
-      eventId,
-      appId
-    };
+    if (!isValidScope) return null;
+    return { organisationId, eventId, appId };
   }, [isValidScope, organisationId, eventId, appId]);
-  const prevScopeRef = useRef(null);
   useEffect(() => {
+    if (precomputedSuperAdmin === true) {
+      setCan(true);
+      setIsLoading(false);
+      setError(null);
+      return;
+    }
     const scopeChanged = !scopeEqual(prevScopeRef.current, stableScope);
     const isSuperAdminChanged = lastIsSuperAdminRef.current !== isSuperAdmin;
     if (lastUserIdRef.current !== userId || scopeChanged || lastPermissionRef.current !== permission || lastPageIdRef.current !== pageId || lastUseCacheRef.current !== useCache || isSuperAdminChanged) {
@@ -486,75 +686,55 @@ function useCan(userId, scope, permission, pageId, useCache = true, precomputedS
       lastPermissionRef.current = permission;
       lastPageIdRef.current = pageId;
       lastUseCacheRef.current = useCache;
-      const checkPermission = async () => {
-        if (!userId) {
-          setCan(false);
-          setIsLoading(false);
-          return;
-        }
-        if (isSuperAdmin === true) {
-          setCan(true);
-          setIsLoading(false);
-          setError(null);
-          return;
-        }
-        if (isSuperAdmin === null) {
-          setIsLoading(true);
-          setCan(false);
-          setError(null);
-          return;
-        }
-        if (!isValidScope) {
-          setIsLoading(true);
-          setCan(false);
-          setError(null);
-          return;
-        }
-        const isPagePermission = permission.includes(":page.") || !!pageId;
-        const requiresOrgId = !isPagePermission;
-        const isPageName = pageId && typeof pageId === "string" && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(pageId);
-        const needsAppIdForPageName = isPagePermission && isPageName;
-        if (requiresOrgId && (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
-          setIsLoading(true);
-          setCan(false);
-          setError(null);
-          return;
-        }
-        if (needsAppIdForPageName && (!appId || appId === null || typeof appId === "string" && appId.trim() === "")) {
-          setIsLoading(true);
+      if (!userId) {
+        setCan(false);
+        setIsLoading(false);
+        return;
+      }
+      if (isSuperAdmin === true) {
+        setCan(true);
+        setIsLoading(false);
+        setError(null);
+        return;
+      }
+      if (isSuperAdmin === null || !isValidScope) {
+        setIsLoading(true);
+        setCan(false);
+        setError(null);
+        return;
+      }
+      setIsLoading(true);
+      setError(null);
+      runPermissionCheck({
+        userId,
+        scope: stableScope,
+        permission,
+        pageId,
+        useCache,
+        appName,
+        isSuperAdmin
+      }).then((result) => {
+        if (!result.ok) {
+          setError(new Error(result.error.message));
           setCan(false);
-          setError(null);
           return;
         }
-        try {
-          setIsLoading(true);
-          setError(null);
-          const validScope = {
-            ...organisationId ? { organisationId } : {},
-            ...eventId ? { eventId } : {},
-            ...appId ? { appId } : {}
-          };
-          const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, appName) : await isPermitted({ userId, scope: validScope, permission, pageId }, appName, isSuperAdmin === false ? false : null);
-          setCan(result);
-        } catch (err) {
-          const logger = getRBACLogger();
-          logger.error("Permission check error:", { userId, permission, error: err });
-          setError(err instanceof Error ? err : new Error("Failed to check permission"));
-          setCan(false);
-        } finally {
-          setIsLoading(false);
-        }
-      };
-      checkPermission();
+        setCan(result.data);
+        setError(null);
+      }).catch((err) => {
+        getRBACLogger().error("Permission check error:", { userId, permission, error: err });
+        setError(err instanceof Error ? err : new Error("Failed to check permission"));
+        setCan(false);
+      }).finally(() => setIsLoading(false));
     }
-  }, [userId, stableScope, permission, pageId, useCache, appName, isSuperAdmin, organisationId, eventId, appId, isValidScope]);
+  }, [userId, stableScope, permission, pageId, useCache, appName, isSuperAdmin, isValidScope, precomputedSuperAdmin]);
   const refetch = useCallback(async () => {
     if (!userId) {
       setCan(false);
       setIsLoading(false);
       return;
     }
-    if (!isValidScope) {
+    if (!isValidScope || !stableScope) {
       setCan(false);
       setIsLoading(true);
       setError(null);
@@ -562,35 +742,46 @@ function useCan(userId, scope, permission, pageId, useCache = true, precomputedS
     }
     const isPagePermission = permission.includes(":page.") || !!pageId;
     const requiresOrgId = !isPagePermission;
-    if (requiresOrgId && (!organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
+    if (requiresOrgId && (!organisationId || typeof organisationId === "string" && organisationId.trim() === "")) {
       setCan(false);
       setIsLoading(true);
       setError(null);
       return;
     }
+    setIsLoading(true);
+    setError(null);
     try {
-      setIsLoading(true);
-      setError(null);
-      const validScope = {
-        ...organisationId ? { organisationId } : {},
-        ...eventId ? { eventId } : {},
-        ...appId ? { appId } : {}
-      };
-      const result = useCache ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, appName) : await isPermitted({ userId, scope: validScope, permission, pageId }, appName, null);
-      setCan(result);
+      const result = await runPermissionCheck({
+        userId,
+        scope: stableScope,
+        permission,
+        pageId,
+        useCache,
+        appName,
+        isSuperAdmin
+      });
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        setCan(false);
+        return;
+      }
+      setCan(result.data);
     } catch (err) {
       setError(err instanceof Error ? err : new Error("Failed to check permission"));
       setCan(false);
     } finally {
       setIsLoading(false);
     }
-  }, [userId, isValidScope, organisationId, eventId, appId, permission, pageId, useCache, appName]);
-  return useMemo(() => ({
-    can,
-    isLoading,
-    error,
-    refetch
-  }), [can, isLoading, error, refetch]);
+  }, [userId, isValidScope, stableScope, organisationId, permission, pageId, useCache, appName, isSuperAdmin]);
+  return useMemo(
+    () => ({
+      can,
+      isLoading,
+      error,
+      refetch
+    }),
+    [can, isLoading, error, refetch]
+  );
 }
 function useMultiplePermissions(userId, scope, permissions, useCache = true) {
   const [results, setResults] = useState({});
@@ -621,7 +812,12 @@ function useMultiplePermissions(userId, scope, permissions, useCache = true) {
       const permissionResults = {};
       for (const permission of permissions) {
         const result = useCache ? await isPermittedCached({ userId, scope, permission }) : await isPermitted({ userId, scope, permission });
-        permissionResults[permission] = result;
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setResults({});
+          return;
+        }
+        permissionResults[permission] = result.data;
       }
       setResults(permissionResults);
     } catch (err) {
@@ -654,6 +850,37 @@ function useMultiplePermissions(userId, scope, permissions, useCache = true) {
     refetch: checkPermissions
   }), [results, isLoading, error, checkPermissions]);
 }
+
+// src/rbac/utils/permissionMapHelpers.ts
+function createPermissionMapHelpers(permissions) {
+  return {
+    hasPermission(permission) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissions[permission] === true;
+    },
+    hasAnyPermission(permissionList) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissionList.some((p) => permissions[p] === true);
+    },
+    hasAllPermissions(permissionList) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissionList.every((p) => permissions[p] === true);
+    }
+  };
+}
+
+// src/rbac/utils/fetchPermissionMap.ts
+async function fetchPermissionMapForScope(params) {
+  return getPermissionMap({ userId: params.userId, scope: params.scope });
+}
+
+// src/rbac/hooks/permissions/usePermissions.ts
 function usePermissions(userId, organisationId, eventId, appId) {
   const [permissions, setPermissions] = useState({});
   const [isLoading, setIsLoading] = useState(true);
@@ -696,11 +923,6 @@ function usePermissions(userId, organisationId, eventId, appId) {
         setIsLoading(false);
         return;
       }
-      if (!userId) {
-        setPermissions({});
-        setIsLoading(false);
-        return;
-      }
       if (!orgId || orgId === null || typeof orgId === "string" && orgId.trim() === "") {
         setIsLoading(true);
         setError(null);
@@ -715,7 +937,14 @@ function usePermissions(userId, organisationId, eventId, appId) {
           eventId,
           appId
         };
-        const permissionMap = await getPermissionMap({ userId, scope });
+        const result = await fetchPermissionMapForScope({ userId, scope });
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setIsLoading(false);
+          isFetchingRef.current = false;
+          return;
+        }
+        const permissionMap = result.data;
         const permissionCount = Object.keys(permissionMap).length;
         setPermissions((prevPermissions) => {
           if (permissionCount === 0 && Object.keys(prevPermissions).length > 0) {
@@ -735,24 +964,10 @@ function usePermissions(userId, organisationId, eventId, appId) {
     };
     fetchPermissions();
   }, [fetchTrigger, userId, organisationId, eventId, appId, logger, orgId]);
-  const hasPermission = useCallback((permission) => {
-    if (permissions["*"]) {
-      return true;
-    }
-    return permissions[permission] === true;
-  }, [permissions]);
-  const hasAnyPermission = useCallback((permissionList) => {
-    if (permissions["*"]) {
-      return true;
-    }
-    return permissionList.some((p) => permissions[p] === true);
-  }, [permissions]);
-  const hasAllPermissions = useCallback((permissionList) => {
-    if (permissions["*"]) {
-      return true;
-    }
-    return permissionList.every((p) => permissions[p] === true);
-  }, [permissions]);
+  const { hasPermission, hasAnyPermission, hasAllPermissions } = useMemo(
+    () => createPermissionMapHelpers(permissions),
+    [permissions]
+  );
   const refetch = useCallback(async () => {
     if (isFetchingRef.current) {
       return;
@@ -776,145 +991,33 @@ function usePermissions(userId, organisationId, eventId, appId) {
         eventId,
         appId
       };
-      const permissionMap = await getPermissionMap({ userId, scope });
-      setPermissions(permissionMap);
+      const result = await fetchPermissionMapForScope({ userId, scope });
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        return;
+      }
+      setPermissions(result.data);
     } catch (err) {
-      const logger2 = getRBACLogger();
-      logger2.error("Failed to refetch permissions:", err);
+      const refetchLogger = getRBACLogger();
+      refetchLogger.error("Failed to refetch permissions:", err);
       setError(err instanceof Error ? err : new Error("Failed to fetch permissions"));
     } finally {
       setIsLoading(false);
       isFetchingRef.current = false;
     }
   }, [userId, eventId, appId, orgId]);
-  return useMemo(() => ({
-    permissions,
-    isLoading,
-    error,
-    hasPermission,
-    hasAnyPermission,
-    hasAllPermissions,
-    refetch
-  }), [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]);
-}
-var log = createLogger("useResolvedScope");
-var appIdCache = /* @__PURE__ */ new Map();
-var CACHE_TTL = 5 * 60 * 1e3;
-function useResolvedScope({
-  supabase,
-  selectedOrganisationId,
-  selectedEventId,
-  selectedEventOrganisationId
-}) {
-  const immediateOrganisationId = selectedEventOrganisationId || selectedOrganisationId || void 0;
-  const immediateEventId = selectedEventId || void 0;
-  const [appId, setAppId] = useState(void 0);
-  const [isResolvingAppId, setIsResolvingAppId] = useState(false);
-  const [error, setError] = useState(null);
-  const appName = getCurrentAppName();
-  useEffect(() => {
-    let cancelled = false;
-    const resolveAppId = async () => {
-      if (!supabase && !selectedOrganisationId && !selectedEventId) {
-        if (!cancelled) {
-          setAppId(void 0);
-          setIsResolvingAppId(false);
-          setError(null);
-        }
-        return;
-      }
-      setIsResolvingAppId(true);
-      setError(null);
-      try {
-        const appName2 = getCurrentAppName();
-        let resolvedAppId = void 0;
-        if (supabase && appName2) {
-          try {
-            const { data: session } = await supabase.auth.getSession();
-            if (!session?.session) {
-              log.debug(`Skipping app resolution for "${appName2}" - user not authenticated`);
-            } else {
-              const cached = appIdCache.get(appName2);
-              const now = Date.now();
-              if (cached && now - cached.timestamp < CACHE_TTL) {
-                resolvedAppId = cached.appId;
-              } else {
-                const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).eq("is_active", true).single();
-                if (error2) {
-                  if (error2.code === "406" || error2.code === "PGRST116" || error2.message?.includes("406")) {
-                    log.debug(`App resolution blocked by RLS for "${appName2}" - user may not be authenticated`);
-                    resolvedAppId = void 0;
-                  } else {
-                    const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).single();
-                    if (inactiveApp) {
-                      log.error(`App "${appName2}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
-                      resolvedAppId = void 0;
-                    } else {
-                      log.error(`App "${appName2}" not found in rbac_apps table`, { error: error2 });
-                      resolvedAppId = void 0;
-                    }
-                  }
-                } else if (app) {
-                  resolvedAppId = app.id;
-                  appIdCache.set(appName2, { appId: resolvedAppId, timestamp: now });
-                }
-              }
-            }
-          } catch (error2) {
-            const errorMessage = error2 instanceof Error ? error2.message : String(error2);
-            if (!errorMessage.includes("406") && !errorMessage.includes("PGRST116")) {
-              log.error("Unexpected error resolving app ID:", error2);
-            } else {
-              log.debug("App resolution skipped - authentication required");
-            }
-          }
-        }
-        if (!cancelled) {
-          setAppId(resolvedAppId);
-          setIsResolvingAppId(false);
-          setError(null);
-        }
-      } catch (err) {
-        if (!cancelled) {
-          setError(err);
-          setIsResolvingAppId(false);
-        }
-      }
-    };
-    resolveAppId();
-    return () => {
-      cancelled = true;
-    };
-  }, [supabase, selectedOrganisationId, selectedEventId]);
-  const immediateScope = useMemo(() => {
-    if (appName === "PORTAL" || appName === "ADMIN") {
-      return {
-        organisationId: void 0,
-        eventId: void 0,
-        appId: appId || void 0
-      };
-    }
-    const scope = {};
-    if (immediateOrganisationId) {
-      scope.organisationId = immediateOrganisationId;
-    }
-    if (immediateEventId) {
-      scope.eventId = immediateEventId;
-    }
-    if (appId) {
-      scope.appId = appId;
-    }
-    if (!scope.organisationId && !scope.appId) {
-      return null;
-    }
-    return scope;
-  }, [immediateOrganisationId, immediateEventId, appId, appName]);
-  return {
-    resolvedScope: immediateScope,
-    isLoading: isResolvingAppId,
-    // Only true while appId resolves
-    error
-  };
+  return useMemo(
+    () => ({
+      permissions,
+      isLoading,
+      error,
+      hasPermission,
+      hasAnyPermission,
+      hasAllPermissions,
+      refetch
+    }),
+    [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]
+  );
 }
 var AlertContext = React3.createContext({ variant: "default" });
 var getAlertClasses = (variant = "default") => {
@@ -974,4 +1077,4 @@ var AlertDescription = React3.forwardRef(({ className, ...props }, ref) => {
 });
 AlertDescription.displayName = "AlertDescription";
 
-export { Alert, AlertDescription, AlertTitle, Button, ButtonGroup, Card, CardActions, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Tooltip, TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger, scopeEqual, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useResolvedScope };
+export { Alert, AlertDescription, AlertTitle, Button, ButtonGroup, Card, CardActions, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, IconButton, Tooltip, TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger, mergeRefs, scopeEqual, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useResolvedScope };