@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/components/{__tests__/PagePermissionGuard.verification.test.tsx → PagePermissionGuard.verification.test.tsx}

@@ -10,7 +10,7 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import { vi, describe, it, expect, beforeEach } from 'vitest';
-import { PagePermissionGuard } from '../PagePermissionGuard';
+import { PagePermissionGuard } from './PagePermissionGuard';
 
 // Mock the hooks with simple implementations
 const mockUseUnifiedAuthFn = vi.fn(() => ({
@@ -33,7 +33,7 @@ const mockUseUnifiedAuthFn = vi.fn(() => ({
     }))
   }
 }));
-vi.mock('../../../providers/services/UnifiedAuthProvider', () => ({
+vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
   useUnifiedAuth: () => mockUseUnifiedAuthFn(),
   UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
 }));
@@ -41,17 +41,17 @@ vi.mock('../../../providers/services/UnifiedAuthProvider', () => ({
 // Mock individual hook file since barrel was removed
 // CRITICAL: Use hoisted mock so vi.mocked() works correctly
 const mockUseCanFn = vi.hoisted(() => vi.fn());
-vi.mock('../../hooks/usePermissions', () => ({
+vi.mock('../hooks/usePermissions', () => ({
   useCan: mockUseCanFn
 }));
 
-// Mock useResolvedScope hook
-vi.mock('../../hooks/useResolvedScope', () => ({
+// Mock useResolvedScope hook (same path as component: rbac/hooks)
+vi.mock('../hooks/useResolvedScope', () => ({
   useResolvedScope: vi.fn()
 }));
 
 // Mock the app name resolver
-vi.mock('../../../utils/app/appNameResolver', () => ({
+vi.mock('../../utils/app/appNameResolver', () => ({
   getCurrentAppName: () => 'test-app'
 }));
 
@@ -60,7 +60,7 @@ vi.mock('../api', () => ({
   isSuperAdmin: vi.fn().mockResolvedValue(false)
 }));
 
-import { useResolvedScope } from '../../hooks/useResolvedScope';
+import { useResolvedScope } from '../hooks/useResolvedScope';
 
 describe('PagePermissionGuard Verification', () => {
   const mockUseResolvedScope = vi.mocked(useResolvedScope);

package/src/rbac/config.ts

@@ -16,32 +16,72 @@ const logger = createLogger('RBAC');
 
 export type LogLevel = 'error' | 'warn' | 'info' | 'debug';
 
-export interface RBACConfig {
+/** Cache configuration for RBAC (TTL, enabled, sessionTtl). */
+export interface RBACCacheConfig {
+  ttl?: number;
+  enabled?: boolean;
+  /** Session cache TTL in milliseconds (default: 5 minutes) */
+  sessionTtl?: number;
+}
+
+/** Audit configuration for RBAC (enabled, logLevel, batched, batchWindow, batchSize). */
+export interface RBACAuditConfig {
+  enabled?: boolean;
+  logLevel?: LogLevel;
+  /** Enable batched audit logging (default: true) */
+  batched?: boolean;
+  /** Time window in milliseconds (default: 100ms) */
+  batchWindow?: number;
+  /** Maximum batch size (default: 10) */
+  batchSize?: number;
+}
+
+/** Performance configuration for RBAC (deduplication, batched audit, tracking). */
+export interface RBACPerformanceConfig {
+  /** Enable request deduplication (default: true) */
+  enableRequestDeduplication?: boolean;
+  /** Enable batched audit logging (default: true) */
+  enableBatchedAuditLogging?: boolean;
+  /** Enable performance tracking (default: false in production) */
+  enablePerformanceTracking?: boolean;
+}
+
+/** Core RBAC config (supabase, debug, logLevel, etc.) (ISP). */
+export interface RBACConfigCore {
   supabase: SupabaseClient<Database>;
   debug?: boolean;
   logLevel?: LogLevel;
   developmentMode?: boolean;
   mockPermissions?: Record<string, boolean>;
-  cache?: {
-    ttl?: number;
-    enabled?: boolean;
-    sessionTtl?: number; // Session cache TTL in milliseconds (default: 5 minutes)
-  };
-  audit?: {
-    enabled?: boolean;
-    logLevel?: LogLevel;
-    batched?: boolean; // Enable batched audit logging (default: true)
-    batchWindow?: number; // Time window in milliseconds (default: 100ms)
-    batchSize?: number; // Maximum batch size (default: 10)
-  };
+}
+
+/** Cache config slice for RBAC (ISP). */
+export interface RBACConfigCache {
+  cache?: RBACCacheConfig;
+}
+
+/** Audit config slice for RBAC (ISP). */
+export interface RBACConfigAudit {
+  audit?: RBACAuditConfig;
+}
+
+/** Security config slice for RBAC (ISP). */
+export interface RBACConfigSecurity {
   security?: Partial<RBACSecurityConfig>;
-  performance?: {
-    enableRequestDeduplication?: boolean; // Enable request deduplication (default: true)
-    enableBatchedAuditLogging?: boolean; // Enable batched audit logging (default: true)
-    enablePerformanceTracking?: boolean; // Enable performance tracking (default: false in production)
-  };
 }
 
+/** Performance config slice for RBAC (ISP). */
+export interface RBACConfigPerformance {
+  performance?: RBACPerformanceConfig;
+}
+
+/** RBAC config (ISP: composed from focused interfaces). */
+export type RBACConfig = RBACConfigCore
+  & RBACConfigCache
+  & RBACConfigAudit
+  & RBACConfigSecurity
+  & RBACConfigPerformance;
+
 export interface RBACLogger {
   error: (message: string, ...args: unknown[]) => void;
   warn: (message: string, ...args: unknown[]) => void;

package/src/rbac/{__tests__/engine.comprehensive.test.ts → engine.comprehensive.test.ts}

@@ -4,14 +4,14 @@
  */
 
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { RBACEngine, createRBACEngine } from '../engine';
+import { RBACEngine, createRBACEngine } from './engine';
 import { 
   UUID, 
   Permission, 
   Scope, 
   PermissionCheck
-} from '../types';
-import { rbacCache } from '../cache';
+} from './types';
+import { rbacCache } from './cache';
 
 // Mock Supabase client with comprehensive mocking
 const createMockSupabaseClient = () => ({

package/src/rbac/engine.test.ts

@@ -584,5 +584,499 @@ describe('RBACEngine', () => {
         eventAppRole: null,
       });
     });
+
+    it('handles non-array data', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: null,
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      });
+    });
+
+    it('maps event app roles correctly', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          { permission_type: 'event_app_access', role_name: 'viewer' },
+          { permission_type: 'event_app_access', role_name: 'participant' },
+          { permission_type: 'event_app_access', role_name: 'planner' },
+          { permission_type: 'event_app_access', role_name: 'admin' },
+        ],
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      // Should use the last one (admin maps to event_admin)
+      expect(roleContext.eventAppRole).toBe('event_admin');
+    });
+
+    it('maps organisation roles correctly', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          { permission_type: 'organisation_access', role_name: 'supporter' },
+          { permission_type: 'organisation_access', role_name: 'member' },
+          { permission_type: 'organisation_access', role_name: 'leader' },
+          { permission_type: 'organisation_access', role_name: 'org_admin' },
+        ],
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      // Should use the last one
+      expect(roleContext.organisationRole).toBe('org_admin');
+    });
+
+    it('handles exceptions in getRoleContext', async () => {
+      mockSupabase.rpc.mockRejectedValue(new Error('Network error'));
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      });
+    });
+  });
+
+  describe('getAccessLevel - Organisation Roles', () => {
+    it('returns admin for org_admin role', async () => {
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return false; // Not super admin (cached) - this means checkSuperAdmin won't call from()
+        }
+        return null;
+      });
+
+      // Create a query builder that chains properly
+      // The engine uses .limit(1) which returns { data: Array, error }
+      // The engine calls: from('rbac_organisation_roles').select('role').eq(...).limit(1)
+      // which returns { data: [{ role: 'org_admin' }], error: null }
+      const createOrgQueryBuilder = () => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          limit: vi.fn().mockResolvedValue({
+            data: [{ role: 'org_admin' }],
+            error: null,
+          }),
+        };
+        return builder;
+      };
+
+      // Since checkSuperAdmin returns false from cache, it won't call from()
+      // So we only need to mock the org role query
+      mockSupabase.from.mockReturnValueOnce(createOrgQueryBuilder());
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('admin');
+    });
+
+    it('returns viewer when no org role found', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('viewer');
+    });
+  });
+
+  describe('getAccessLevel - Event App Roles', () => {
+    it('returns admin for event_admin role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'event_admin' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery) // Super admin check
+        .mockReturnValueOnce(mockOrgQuery) // Org role check
+        .mockReturnValueOnce(mockEventQuery); // Event role check
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('admin');
+    });
+
+    it('returns planner for planner role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'planner' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockOrgQuery)
+        .mockReturnValueOnce(mockEventQuery);
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('planner');
+    });
+
+    it('returns participant for participant role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'participant' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockOrgQuery)
+        .mockReturnValueOnce(mockEventQuery);
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('participant');
+    });
+  });
+
+  describe('getPermissionMap - Edge Cases', () => {
+    it('handles empty pages array', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockPagesQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockPagesQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({});
+    });
+
+    it('handles null pages data', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockPagesQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockResolvedValue({
+          data: null,
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockPagesQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({});
+    });
+  });
+
+  describe('isPermitted - resolvePageId', () => {
+    it('resolves page name to UUID for audit logging', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+      mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+      const mockPageQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        maybeSingle: vi.fn().mockResolvedValue({
+          data: { id: '123e4567-e89b-12d3-a456-426614174000' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from.mockReturnValue(mockPageQuery);
+
+      const permissionCheck: PermissionCheck = {
+        userId: mockUserId,
+        scope: baseScope,
+        permission: 'read:users' as Permission,
+        pageId: 'test-page-name',
+      };
+
+      await engine.isPermitted(permissionCheck, validSecurityContext);
+
+      expect(emitAuditEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          pageId: '123e4567-e89b-12d3-a456-426614174000',
+        })
+      );
+    });
+
+    it('handles page resolution errors gracefully', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+      mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+      const mockPageQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        maybeSingle: vi.fn().mockResolvedValue({
+          data: null,
+          error: { message: 'Page not found', code: 'PGRST116' },
+        }),
+      };
+
+      mockSupabase.from.mockReturnValue(mockPageQuery);
+
+      const permissionCheck: PermissionCheck = {
+        userId: mockUserId,
+        scope: baseScope,
+        permission: 'read:users' as Permission,
+        pageId: 'nonexistent-page',
+      };
+
+      // Should not throw, should use original pageId
+      await engine.isPermitted(permissionCheck, validSecurityContext);
+
+      expect(emitAuditEvent).toHaveBeenCalled();
+    });
+  });
+
+  describe('checkSuperAdmin - Indirect Tests', () => {
+    it('caches super admin status', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [{ role: 'super_admin' }],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // First call
+      await engine.getAccessLevel({ userId: mockUserId, scope });
+      
+      // Second call should use cache
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return true;
+        }
+        return null;
+      });
+
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+      expect(accessLevel).toBe('super');
+      expect(mockSupabase.from).toHaveBeenCalledTimes(1); // Only called once
+    });
+
+    it('handles super admin check errors', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockRejectedValue(new Error('Database error')),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // Should handle error gracefully and return viewer
+      await expect(engine.getAccessLevel({ userId: mockUserId, scope })).rejects.toThrow('Database error');
+    });
+
+    it('handles slow super admin checks without throwing', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // Should complete without throwing
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+      expect(accessLevel).toBe('viewer');
+    });
   });
 });