@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/cache-invalidation.test.ts

@@ -0,0 +1,715 @@
+/**
+ * @file RBAC Cache Invalidation Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/CacheInvalidation
+ * @since 1.0.0
+ * 
+ * Comprehensive tests for the RBAC cache invalidation system.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createMockSupabaseClient } from '@test/helpers';
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from './types/database';
+import {
+  RBACCacheInvalidationManager,
+  INVALIDATION_PATTERNS,
+  initializeCacheInvalidation,
+  getCacheInvalidationManager,
+  cleanupCacheInvalidation,
+} from './cache-invalidation';
+import { rbacCache } from './cache';
+import { emitAuditEvent } from './audit';
+
+// Mock the Logger module
+vi.mock('../utils/core/logger', () => {
+  const mockLoggerInstance = {
+    warn: vi.fn(),
+    debug: vi.fn(),
+    error: vi.fn(),
+  };
+  return {
+    createLogger: vi.fn(() => mockLoggerInstance),
+  };
+});
+
+// Get the mock instance after mock is set up
+import { createLogger } from '../utils/core/logger';
+const getMockLogger = () => createLogger('test');
+
+// Mock the cache module - use ./cache so it applies to cache-invalidation's import
+vi.mock('./cache', () => ({
+  rbacCache: {
+    invalidate: vi.fn(),
+    clear: vi.fn(),
+  },
+  CACHE_PATTERNS: {
+    USER: (userId: string) => `:${userId}:`,
+    ORGANISATION: (orgId: string) => `:${orgId}:`,
+    EVENT: (eventId: string) => `:${eventId}:`,
+    APP: (appId: string) => `:${appId}`,
+  },
+}));
+
+// Mock the audit module - use ./audit so it applies to cache-invalidation's import
+vi.mock('./audit', () => ({
+  emitAuditEvent: vi.fn(() => Promise.resolve(undefined)),
+}));
+
+describe('RBAC Cache Invalidation', () => {
+  let mockSupabase: ReturnType<typeof createMockSupabaseClient>;
+  let manager: RBACCacheInvalidationManager;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockSupabase = createMockSupabaseClient();
+    manager = new RBACCacheInvalidationManager(mockSupabase as unknown as SupabaseClient<Database>);
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('INVALIDATION_PATTERNS', () => {
+    describe('USER_ROLES_CHANGED', () => {
+      it('generates correct patterns for user invalidation', () => {
+        const userId = 'user-123' as const;
+        const patterns = INVALIDATION_PATTERNS.USER_ROLES_CHANGED(userId);
+        
+        expect(patterns).toContain(':user-123:');
+        expect(patterns).toContain('perm:user-123:*');
+        expect(patterns).toContain('access:user-123:*');
+        expect(patterns).toContain('map:user-123:*');
+      });
+    });
+
+    describe('ORGANISATION_PERMISSIONS_CHANGED', () => {
+      it('generates correct patterns for organisation invalidation', () => {
+        const orgId = 'org-456' as const;
+        const patterns = INVALIDATION_PATTERNS.ORGANISATION_PERMISSIONS_CHANGED(orgId);
+        
+        expect(patterns).toContain(':org-456:');
+        expect(patterns).toContain('perm:*:org-456:*');
+        expect(patterns).toContain('access:*:org-456:*');
+        expect(patterns).toContain('map:*:org-456:*');
+      });
+    });
+
+    describe('EVENT_PERMISSIONS_CHANGED', () => {
+      it('generates correct patterns for event invalidation', () => {
+        const eventId = 'event-789';
+        const patterns = INVALIDATION_PATTERNS.EVENT_PERMISSIONS_CHANGED(eventId);
+        
+        expect(patterns).toContain(':event-789:');
+        expect(patterns).toContain('perm:*:*:event-789:*');
+        expect(patterns).toContain('access:*:*:event-789:*');
+        expect(patterns).toContain('map:*:*:event-789:*');
+      });
+    });
+
+    describe('APP_PERMISSIONS_CHANGED', () => {
+      it('generates correct patterns for app invalidation', () => {
+        const appId = 'app-abc' as const;
+        const patterns = INVALIDATION_PATTERNS.APP_PERMISSIONS_CHANGED(appId);
+        
+        expect(patterns).toContain(':app-abc');
+        expect(patterns).toContain('perm:*:*:*:app-abc:*');
+        expect(patterns).toContain('access:*:*:*:app-abc');
+        expect(patterns).toContain('map:*:*:*:app-abc');
+      });
+    });
+
+    describe('PAGE_PERMISSIONS_CHANGED', () => {
+      it('generates correct patterns for page invalidation', () => {
+        const pageId = 'page-xyz' as const;
+        const patterns = INVALIDATION_PATTERNS.PAGE_PERMISSIONS_CHANGED(pageId);
+        
+        expect(patterns).toContain('perm:*:*:*:*:page-xyz');
+        expect(patterns).toContain('map:*:*:*:*');
+      });
+    });
+  });
+
+  describe('RBACCacheInvalidationManager', () => {
+    describe('onInvalidation', () => {
+      it('adds callback and returns unsubscribe function', () => {
+        const callback = vi.fn();
+        const unsubscribe = manager.onInvalidation(callback);
+        
+        expect(typeof unsubscribe).toBe('function');
+        
+        // Trigger invalidation
+        manager.invalidateUser('user-123' as const, 'test');
+        
+        expect(callback).toHaveBeenCalled();
+        
+        // Unsubscribe
+        unsubscribe();
+        
+        // Clear mocks
+        vi.clearAllMocks();
+        
+        // Trigger again - callback should not be called
+        manager.invalidateUser('user-123' as const, 'test');
+        expect(callback).not.toHaveBeenCalled();
+      });
+
+      it('handles multiple callbacks', () => {
+        const callback1 = vi.fn();
+        const callback2 = vi.fn();
+        
+        manager.onInvalidation(callback1);
+        manager.onInvalidation(callback2);
+        
+        manager.invalidateUser('user-123' as const, 'test');
+        
+        expect(callback1).toHaveBeenCalled();
+        expect(callback2).toHaveBeenCalled();
+      });
+    });
+
+    describe('invalidateUser', () => {
+      it('invalidates cache for user with correct patterns', () => {
+        const userId = 'user-123' as const;
+        manager.invalidateUser(userId, 'test-reason');
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':user-123:');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('perm:user-123:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('access:user-123:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('map:user-123:*');
+      });
+
+      it('emits audit event for user invalidation', async () => {
+        const userId = 'user-123' as const;
+        manager.invalidateUser(userId, 'test-reason');
+        
+        await vi.waitFor(() => {
+          expect(emitAuditEvent).toHaveBeenCalled();
+        });
+        
+        const auditCall = vi.mocked(emitAuditEvent).mock.calls[0][0];
+        expect(auditCall.type).toBe('permission_check');
+        expect(auditCall.permission).toBe('cache:invalidate');
+        expect(auditCall.metadata?.reason).toBe('test-reason');
+      });
+    });
+
+    describe('invalidateOrganisation', () => {
+      it('invalidates cache for organisation with correct patterns', () => {
+        const orgId = 'org-456' as const;
+        manager.invalidateOrganisation(orgId, 'test-reason');
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':org-456:');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('perm:*:org-456:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('access:*:org-456:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('map:*:org-456:*');
+      });
+    });
+
+    describe('invalidateEvent', () => {
+      it('invalidates cache for event with correct patterns', () => {
+        const eventId = 'event-789';
+        manager.invalidateEvent(eventId, 'test-reason');
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':event-789:');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('perm:*:*:event-789:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('access:*:*:event-789:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('map:*:*:event-789:*');
+      });
+    });
+
+    describe('invalidateApp', () => {
+      it('invalidates cache for app with correct patterns', () => {
+        const appId = 'app-abc' as const;
+        manager.invalidateApp(appId, 'test-reason');
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':app-abc');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('perm:*:*:*:app-abc:*');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('access:*:*:*:app-abc');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('map:*:*:*:app-abc');
+      });
+    });
+
+    describe('invalidatePage', () => {
+      it('invalidates cache for page with correct patterns', () => {
+        const pageId = 'page-xyz' as const;
+        manager.invalidatePage(pageId, 'test-reason');
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('perm:*:*:*:*:page-xyz');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith('map:*:*:*:*');
+      });
+    });
+
+    describe('invalidateAllUsersInOrganisation', () => {
+      it('invalidates cache for all users in organisation', async () => {
+        const orgId = 'org-456' as const;
+        const mockUsers = [
+          { user_id: 'user-1' as const },
+          { user_id: 'user-2' as const },
+        ];
+        
+        mockSupabase.from.mockReturnValue({
+          select: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              eq: vi.fn().mockResolvedValue({
+                data: mockUsers,
+                error: null,
+              }),
+            }),
+          }),
+        } as any);
+        
+        await manager.invalidateAllUsersInOrganisation(orgId, 'test-reason');
+        
+        // Should invalidate each user
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':user-1:');
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(':user-2:');
+      });
+
+      it('handles empty or null user data gracefully', async () => {
+        const orgId = 'org-456' as const;
+        
+        // Test empty array
+        mockSupabase.from.mockReturnValue({
+          select: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              eq: vi.fn().mockResolvedValue({
+                data: [],
+                error: null,
+              }),
+            }),
+          }),
+        } as any);
+        
+        await manager.invalidateAllUsersInOrganisation(orgId, 'test-reason');
+        
+        // Should not throw, but should not call invalidate for users
+        expect(rbacCache.invalidate).not.toHaveBeenCalledWith(expect.stringContaining('user:'));
+        
+        vi.clearAllMocks();
+        
+        // Test null data
+        mockSupabase.from.mockReturnValue({
+          select: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              eq: vi.fn().mockResolvedValue({
+                data: null,
+                error: null,
+              }),
+            }),
+          }),
+        } as any);
+        
+        await manager.invalidateAllUsersInOrganisation(orgId, 'test-reason');
+        
+        // Should not throw
+        expect(rbacCache.invalidate).not.toHaveBeenCalledWith(expect.stringContaining('user:'));
+      });
+    });
+
+    describe('clearAllCache', () => {
+      it('clears all cache entries', () => {
+        manager.clearAllCache();
+        expect(rbacCache.clear).toHaveBeenCalled();
+      });
+    });
+
+    describe('setupRealtimeSubscriptions', () => {
+      it('skips subscriptions when realtime is not available', () => {
+        const mockSupabaseNoRealtime = createMockSupabaseClient();
+        mockSupabaseNoRealtime.channel = undefined;
+        
+        const managerNoRealtime = new RBACCacheInvalidationManager(
+          mockSupabaseNoRealtime as unknown as SupabaseClient<Database>
+        );
+        
+        // Should not throw and should log that realtime is not available
+        expect(managerNoRealtime).toBeDefined();
+      });
+
+      it('sets up subscriptions when realtime is available', () => {
+        const mockChannel = {
+          on: vi.fn().mockReturnThis(),
+          subscribe: vi.fn(),
+        };
+        
+        const mockSupabaseWithRealtime = createMockSupabaseClient();
+        mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+        
+        new RBACCacheInvalidationManager(
+          mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+        );
+        
+        expect(mockSupabaseWithRealtime.channel).toHaveBeenCalled();
+        expect(mockChannel.on).toHaveBeenCalled();
+        expect(mockChannel.subscribe).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('Global Functions', () => {
+    describe('initializeCacheInvalidation', () => {
+      it('initializes and returns cache invalidation manager', () => {
+        const manager = initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+        
+        expect(manager).toBeInstanceOf(RBACCacheInvalidationManager);
+      });
+
+      it('sets global manager instance', () => {
+        initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+        
+        const globalManager = getCacheInvalidationManager();
+        expect(globalManager).toBeInstanceOf(RBACCacheInvalidationManager);
+      });
+    });
+
+    describe('getCacheInvalidationManager', () => {
+      it('returns manager instance after initialization', () => {
+        const manager = initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+        const retrieved = getCacheInvalidationManager();
+        
+        expect(retrieved).toBe(manager);
+        expect(retrieved).toBeInstanceOf(RBACCacheInvalidationManager);
+      });
+    });
+  });
+
+  describe('Realtime Subscriptions', () => {
+    it('handles organisation role changes', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: vi.fn() }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const _managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Simulate a postgres change event
+      const onCallback = mockChannel.on.mock.calls.find(
+        (call: unknown[]) => Array.isArray(call) && call[0] === 'postgres_changes'
+      )?.[2] as ((payload: unknown) => void) | undefined;
+      
+      if (onCallback) {
+        onCallback({
+          new: { organisation_id: 'org-123', user_id: 'user-456' },
+          eventType: 'INSERT'
+        });
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('org-123'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('user-456'));
+      }
+    });
+
+    it('handles event app role changes', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: vi.fn() }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const _managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Find the event app roles callback
+      const onCalls = mockChannel.on.mock.calls;
+      const eventAppCallback = onCalls.find(
+        (call: unknown[]) => Array.isArray(call) && 
+        call[0] === 'postgres_changes' &&
+        (call[1] as { table?: string })?.table === 'rbac_event_app_roles'
+      )?.[2] as ((payload: unknown) => void) | undefined;
+      
+      if (eventAppCallback) {
+        eventAppCallback({
+          new: { 
+            organisation_id: 'org-123', 
+            user_id: 'user-456',
+            event_id: 'event-789',
+            app_id: 'app-101'
+          },
+          eventType: 'UPDATE'
+        });
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('org-123'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('user-456'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('event-789'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('app-101'));
+      }
+    });
+
+    it('handles global role changes', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: vi.fn() }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const _managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Find the global roles callback
+      const onCalls = mockChannel.on.mock.calls;
+      const globalRolesCallback = onCalls.find(
+        (call: unknown[]) => Array.isArray(call) && 
+        call[0] === 'postgres_changes' &&
+        (call[1] as { table?: string })?.table === 'rbac_global_roles'
+      )?.[2] as ((payload: unknown) => void) | undefined;
+      
+      if (globalRolesCallback) {
+        globalRolesCallback({
+          new: { user_id: 'user-456' },
+          eventType: 'DELETE'
+        });
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('user-456'));
+      }
+    });
+
+    it('handles page permission changes', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: vi.fn() }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const _managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Find the page permissions callback
+      const onCalls = mockChannel.on.mock.calls;
+      const pagePermissionsCallback = onCalls.find(
+        (call: unknown[]) => Array.isArray(call) && 
+        call[0] === 'postgres_changes' &&
+        (call[1] as { table?: string })?.table === 'rbac_page_permissions'
+      )?.[2] as ((payload: unknown) => void) | undefined;
+      
+      if (pagePermissionsCallback) {
+        pagePermissionsCallback({
+          new: { 
+            organisation_id: 'org-123',
+            app_page_id: 'page-456'
+          },
+          eventType: 'INSERT'
+        });
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('org-123'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('page-456'));
+      }
+    });
+
+    it('handles old record in DELETE events', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: vi.fn() }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const _managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Find the organisation roles callback
+      const onCalls = mockChannel.on.mock.calls;
+      const orgRolesCallback = onCalls.find(
+        (call: unknown[]) => Array.isArray(call) && 
+        call[0] === 'postgres_changes' &&
+        (call[1] as { table?: string })?.table === 'rbac_organisation_roles'
+      )?.[2] as ((payload: unknown) => void) | undefined;
+      
+      if (orgRolesCallback) {
+        orgRolesCallback({
+          old: { organisation_id: 'org-123', user_id: 'user-456' },
+          eventType: 'DELETE'
+        });
+        
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('org-123'));
+        expect(rbacCache.invalidate).toHaveBeenCalledWith(expect.stringContaining('user-456'));
+      }
+    });
+  });
+
+  describe('Cleanup', () => {
+    it('cleans up subscriptions on cleanup', () => {
+      const mockUnsubscribe = vi.fn();
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: mockUnsubscribe }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      managerWithRealtime.cleanup();
+      
+      expect(mockUnsubscribe).toHaveBeenCalled();
+    });
+
+    it('clears callbacks on cleanup', () => {
+      const callback = vi.fn();
+      manager.onInvalidation(callback);
+      
+      manager.cleanup();
+      
+      // Clear mocks
+      vi.clearAllMocks();
+      
+      // Trigger invalidation - callback should not be called
+      manager.invalidateUser('user-123' as const, 'test');
+      expect(callback).not.toHaveBeenCalled();
+    });
+
+    it('handles cleanup errors gracefully', () => {
+      const mockUnsubscribe = vi.fn().mockImplementation(() => {
+        throw new Error('Unsubscribe error');
+      });
+      
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockReturnValue({ unsubscribe: mockUnsubscribe }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      const managerWithRealtime = new RBACCacheInvalidationManager(
+        mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+      );
+      
+      // Should not throw
+      expect(() => {
+        managerWithRealtime.cleanup();
+      }).not.toThrow();
+    });
+
+    it('cleans up existing manager when initializing new one', () => {
+      const cleanupSpy = vi.spyOn(RBACCacheInvalidationManager.prototype, 'cleanup');
+      
+      const manager1 = initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+      const manager2 = initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+      
+      expect(cleanupSpy).toHaveBeenCalled();
+      expect(manager2).not.toBe(manager1);
+      
+      cleanupSpy.mockRestore();
+    });
+  });
+
+  describe('Global Functions', () => {
+    it('cleanupCacheInvalidation cleans up global manager', () => {
+      initializeCacheInvalidation(mockSupabase as unknown as SupabaseClient<Database>);
+      
+      const globalManager = getCacheInvalidationManager();
+      expect(globalManager).not.toBeNull();
+      
+      cleanupCacheInvalidation();
+      
+      const managerAfterCleanup = getCacheInvalidationManager();
+      expect(managerAfterCleanup).toBeNull();
+    });
+
+    it('getCacheInvalidationManager returns null when not initialized', () => {
+      // Clean up any existing manager
+      cleanupCacheInvalidation();
+      
+      const manager = getCacheInvalidationManager();
+      expect(manager).toBeNull();
+    });
+  });
+
+  describe('invalidatePatterns - Internal Logic', () => {
+    it('notifies all callbacks for each pattern', () => {
+      const callback1 = vi.fn();
+      const callback2 = vi.fn();
+      
+      manager.onInvalidation(callback1);
+      manager.onInvalidation(callback2);
+      
+      manager.invalidateUser('user-123' as const, 'test');
+      
+      // Each callback should be called for each pattern
+      expect(callback1).toHaveBeenCalledTimes(4); // 4 patterns
+      expect(callback2).toHaveBeenCalledTimes(4);
+    });
+
+    it('logs debug message when invalidating', () => {
+      const logger = getMockLogger();
+      vi.clearAllMocks();
+      
+      manager.invalidateUser('user-123' as const, 'test-reason');
+      
+      expect(vi.mocked(logger.debug)).toHaveBeenCalledWith(
+        expect.stringContaining('Invalidating patterns:')
+      );
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('handles audit event errors gracefully', async () => {
+      vi.clearAllMocks();
+      vi.mocked(emitAuditEvent).mockRejectedValue(new Error('Audit error'));
+      
+      manager.invalidateUser('user-123' as const, 'test');
+      
+      await vi.waitFor(() => {
+        const logger = getMockLogger();
+        expect(vi.mocked(logger.warn)).toHaveBeenCalledWith(
+          'Failed to log cache invalidation audit event:',
+          expect.any(Error)
+        );
+      });
+    });
+
+    it('handles subscription errors gracefully', () => {
+      const mockChannel = {
+        on: vi.fn().mockReturnThis(),
+        subscribe: vi.fn().mockImplementation(() => {
+          // Return an object with unsubscribe that throws, but the constructor should handle it
+          return { unsubscribe: vi.fn() };
+        }),
+      };
+      
+      const mockSupabaseWithRealtime = createMockSupabaseClient();
+      mockSupabaseWithRealtime.channel = vi.fn(() => mockChannel);
+      
+      // Should not throw - errors in subscribe are caught
+      expect(() => {
+        new RBACCacheInvalidationManager(
+          mockSupabaseWithRealtime as unknown as SupabaseClient<Database>
+        );
+      }).not.toThrow();
+    });
+
+    it('handles database errors in invalidateAllUsersInOrganisation', async () => {
+      mockSupabase.from.mockReturnValue({
+        select: vi.fn().mockReturnValue({
+          eq: vi.fn().mockReturnValue({
+            eq: vi.fn().mockRejectedValue(new Error('Database error')),
+          }),
+        }),
+      } as any);
+      
+      await expect(
+        manager.invalidateAllUsersInOrganisation('org-456' as const, 'test')
+      ).rejects.toThrow('Database error');
+    });
+  });
+});
+