@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/hooks/permissions/{__tests__/useMultiplePermissions.test.ts → useMultiplePermissions.test.ts}

@@ -14,19 +14,19 @@
 
 import { renderHook, waitFor } from '@testing-library/react';
 import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { useMultiplePermissions } from '../useMultiplePermissions';
+import { useMultiplePermissions } from './useMultiplePermissions';
 
 // Following testing standards: use timeout parameter to prevent hanging
 const TEST_TIMEOUT = 10000; // 10 seconds per test
 const WAIT_FOR_TIMEOUT = 5000; // 5 seconds for waitFor calls
 
 // Mock the RBAC API
-vi.mock('../../../api', () => ({
+vi.mock('../../api', () => ({
   isPermitted: vi.fn(),
   isPermittedCached: vi.fn(),
 }));
 
-import { isPermitted, isPermittedCached } from '../../../api';
+import { isPermitted, isPermittedCached } from '../../api';
 
 const mockUserId = 'user-123';
 const mockScope = {
@@ -45,9 +45,9 @@ describe('useMultiplePermissions Hook', () => {
     // Reset mock implementations to ensure clean state
     mockIsPermitted.mockReset();
     mockIsPermittedCached.mockReset();
-    // Set default implementations (will be overridden by mockResolvedValueOnce in tests)
-    mockIsPermitted.mockResolvedValue(true);
-    mockIsPermittedCached.mockResolvedValue(true);
+    // Set default implementations (ApiResult shape; will be overridden by mockResolvedValueOnce in tests)
+    mockIsPermitted.mockResolvedValue({ ok: true, data: true });
+    mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
   });
 
   afterEach(() => {
@@ -57,9 +57,9 @@ describe('useMultiplePermissions Hook', () => {
   describe('Permission Checking', () => {
     it('checks multiple permissions successfully', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)  // read:users
-        .mockResolvedValueOnce(true)  // create:users
-        .mockResolvedValueOnce(false); // update:users
+        .mockResolvedValueOnce({ ok: true, data: true })   // read:users
+        .mockResolvedValueOnce({ ok: true, data: true })  // create:users
+        .mockResolvedValueOnce({ ok: true, data: false }); // update:users
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -87,10 +87,10 @@ describe('useMultiplePermissions Hook', () => {
         const currentCall = callCount++;
         // Return specific values for first 3 calls (one per permission)
         // After that, return true to prevent hanging if hook re-runs
-        if (currentCall === 0) return true;  // read:users
-        if (currentCall === 1) return false; // create:users
-        if (currentCall === 2) return true;  // update:users
-        return true; // Default for any additional calls
+        if (currentCall === 0) return { ok: true, data: true };   // read:users
+        if (currentCall === 1) return { ok: true, data: false };  // create:users
+        if (currentCall === 2) return { ok: true, data: true };   // update:users
+        return { ok: true, data: true }; // Default for any additional calls
       });
 
       const { result } = renderHook(() =>
@@ -127,7 +127,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles single permission', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, ['read:users'])
@@ -143,7 +143,7 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles large permission arrays', async () => {
       const largePermissions = Array.from({ length: 10 }, (_, i) => `permission:${i}` as const);
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, largePermissions)
@@ -162,7 +162,7 @@ describe('useMultiplePermissions Hook', () => {
 
   describe('Caching Behavior', () => {
     it('uses cached permissions by default', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -177,7 +177,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('bypasses cache when useCache is false', async () => {
-      mockIsPermitted.mockResolvedValue(true);
+      mockIsPermitted.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions, false)
@@ -192,7 +192,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('calls permission checks with correct parameters', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -223,12 +223,12 @@ describe('useMultiplePermissions Hook', () => {
   describe('Refetch Functionality', () => {
     it('refetches permissions when refetch is called', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(false)
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(true);
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false })
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -249,7 +249,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('refetches when scope changes', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ userId, scope, permissions }) =>
@@ -280,7 +280,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('refetches when permissions array changes', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ userId, scope, permissions }) =>
@@ -313,7 +313,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('refetches when userId changes', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ userId, scope, permissions }) =>
@@ -361,9 +361,9 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles partial failures during permission checks', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce({ ok: true, data: true })
         .mockRejectedValueOnce(new Error('Check failed'))
-        .mockResolvedValueOnce(false);
+        .mockResolvedValueOnce({ ok: true, data: false });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -444,7 +444,7 @@ describe('useMultiplePermissions Hook', () => {
     });
 
     it('handles empty scope', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
       const emptyScope = {};
 
       const { result } = renderHook(() =>
@@ -463,7 +463,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles scope with partial values', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
       const partialScope = { organisationId: 'org-123' };
 
       const { result } = renderHook(() =>
@@ -476,7 +476,7 @@ describe('useMultiplePermissions Hook', () => {
     });
 
     it('handles duplicate permissions in array', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
       const duplicatePermissions = ['read:users', 'read:users', 'create:users'] as const;
 
       const { result } = renderHook(() =>
@@ -492,7 +492,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles rapid refetch calls', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -516,7 +516,7 @@ describe('useMultiplePermissions Hook', () => {
 
   describe('Performance', () => {
     it('maintains stable references for same inputs', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ userId, scope, permissions }) =>
@@ -551,7 +551,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles concurrent permission checks efficiently', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions)
@@ -583,7 +583,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles single permission array', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, ['read:users'] as any)
@@ -597,7 +597,7 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles very large permission arrays', async () => {
       const largePermissions = Array.from({ length: 100 }, (_, i) => `permission:${i}` as any);
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, largePermissions)
@@ -614,7 +614,7 @@ describe('useMultiplePermissions Hook', () => {
       mockIsPermittedCached.mockImplementation(() => {
         const currentCall = callCount++;
         // Return true for even indices, false for odd
-        return Promise.resolve(currentCall % 2 === 0);
+        return Promise.resolve({ ok: true, data: currentCall % 2 === 0 });
       });
 
       const { result } = renderHook(() =>
@@ -631,9 +631,9 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles permission check error for one permission', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce({ ok: true, data: true })
         .mockRejectedValueOnce(new Error('Permission check failed'))
-        .mockResolvedValueOnce(true);
+        .mockResolvedValueOnce({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, ['read:users', 'create:users', 'update:users'] as any)
@@ -647,7 +647,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles rapid permission array changes', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ permissions }) => useMultiplePermissions(mockUserId, mockScope, permissions),
@@ -686,7 +686,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles useCache=true correctly', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, mockPermissions, true) // useCache = true
@@ -701,7 +701,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles scope changes correctly', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ scope }) => useMultiplePermissions(mockUserId, scope, mockPermissions),
@@ -725,7 +725,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles userId changes correctly', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result, rerender } = renderHook(
         ({ userId }) => useMultiplePermissions(userId, mockScope, mockPermissions),
@@ -761,8 +761,8 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles refetch correctly', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(false);
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, ['read:users'] as any)
@@ -783,7 +783,7 @@ describe('useMultiplePermissions Hook', () => {
 
     it('handles refetch error gracefully', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce({ ok: true, data: true })
         .mockRejectedValueOnce(new Error('Refetch error'));
 
       const { result } = renderHook(() =>
@@ -808,7 +808,7 @@ describe('useMultiplePermissions Hook', () => {
       let checkCount = 0;
       mockIsPermittedCached.mockImplementation(() => {
         checkCount++;
-        return new Promise((resolve) => setTimeout(() => resolve(true), 100));
+        return new Promise((resolve) => setTimeout(() => resolve({ ok: true, data: true }), 100));
       });
 
       const { rerender } = renderHook(
@@ -827,7 +827,7 @@ describe('useMultiplePermissions Hook', () => {
     }, TEST_TIMEOUT);
 
     it('handles permission array with duplicate permissions', async () => {
-      mockIsPermittedCached.mockResolvedValue(true);
+      mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
 
       const { result } = renderHook(() =>
         useMultiplePermissions(mockUserId, mockScope, ['read:users', 'read:users', 'read:users'] as any)

package/src/rbac/hooks/permissions/useMultiplePermissions.ts

@@ -88,12 +88,16 @@ export function useMultiplePermissions(
 
       const permissionResults: Record<Permission, boolean> = {} as Record<Permission, boolean>;
 
-      // Check each permission
       for (const permission of permissions) {
         const result = useCache
           ? await isPermittedCached({ userId, scope, permission })
           : await isPermitted({ userId, scope, permission });
-        permissionResults[permission] = result;
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setResults({} as Record<Permission, boolean>);
+          return;
+        }
+        permissionResults[permission] = result.data;
       }
 
       setResults(permissionResults);

package/src/rbac/hooks/permissions/{__tests__/usePermissions.test.ts → usePermissions.test.ts}

@@ -24,7 +24,7 @@ const WAIT_FOR_TIMEOUT = 5000; // 5 seconds for waitFor calls
 const renderedHooks: Array<() => void> = [];
 
 // Mock the RBAC API
-vi.mock('../../../api', () => ({
+vi.mock('../../api', () => ({
   getPermissionMap: vi.fn(),
 }));
 
@@ -36,11 +36,11 @@ const mockLogger = {
   debug: vi.fn(),
 };
 
-vi.mock('../../../config', () => ({
+vi.mock('../../config', () => ({
   getRBACLogger: vi.fn(() => mockLogger), // Return same instance every time
 }));
 
-import { getPermissionMap } from '../../../api';
+import { getPermissionMap } from '../../api';
 
 const mockUserId = 'user-123';
 const mockOrganisationId = 'org-123';
@@ -55,9 +55,7 @@ const mockPermissionMap = {
 } as const;
 
 // Helper to track and cleanup hooks
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 function renderHookWithCleanup(callback: any, options?: any): any {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const hook = renderHook(callback, options);
   renderedHooks.push(hook.unmount);
   return hook;
@@ -74,7 +72,7 @@ describe('usePermissions Hook', () => {
     mockLogger.info.mockClear();
     mockLogger.debug.mockClear();
     vi.useRealTimers(); // Use real timers for tests
-    mockGetPermissionMap.mockResolvedValue(mockPermissionMap);
+    mockGetPermissionMap.mockResolvedValue({ ok: true, data: mockPermissionMap });
   });
 
   afterEach(() => {
@@ -123,7 +121,7 @@ describe('usePermissions Hook', () => {
 
     it('handles empty permission map', async () => {
       const emptyMap = {};
-      mockGetPermissionMap.mockResolvedValue(emptyMap as any);
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: emptyMap });
 
       const { result } = renderHookWithCleanup(() =>
         usePermissions(mockUserId, mockOrganisationId, mockEventId, mockAppId)
@@ -299,7 +297,7 @@ describe('usePermissions Hook', () => {
   describe('Wildcard Permissions', () => {
     it('hasPermission returns true when wildcard permission exists', async () => {
       const wildcardMap = { '*': true };
-      mockGetPermissionMap.mockResolvedValue(wildcardMap as any);
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: wildcardMap } as any);
 
       const { result } = renderHookWithCleanup(() =>
         usePermissions(mockUserId, mockOrganisationId, mockEventId, mockAppId)
@@ -314,7 +312,7 @@ describe('usePermissions Hook', () => {
 
     it('hasAnyPermission returns true when wildcard permission exists', async () => {
       const wildcardMap = { '*': true };
-      mockGetPermissionMap.mockResolvedValue(wildcardMap as any);
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: wildcardMap } as any);
 
       const { result } = renderHookWithCleanup(() =>
         usePermissions(mockUserId, mockOrganisationId, mockEventId, mockAppId)
@@ -331,7 +329,7 @@ describe('usePermissions Hook', () => {
 
     it('hasAllPermissions returns true when wildcard permission exists', async () => {
       const wildcardMap = { '*': true };
-      mockGetPermissionMap.mockResolvedValue(wildcardMap as any);
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: wildcardMap } as any);
 
       const { result } = renderHookWithCleanup(() =>
         usePermissions(mockUserId, mockOrganisationId, mockEventId, mockAppId)
@@ -354,8 +352,8 @@ describe('usePermissions Hook', () => {
         'update:users': true,
       };
       mockGetPermissionMap
-        .mockResolvedValueOnce(mockPermissionMap)
-        .mockResolvedValueOnce(updatedMap as any);
+        .mockResolvedValueOnce({ ok: true, data: mockPermissionMap })
+        .mockResolvedValueOnce({ ok: true, data: updatedMap } as any);
 
       const { result } = renderHookWithCleanup(() =>
         usePermissions(mockUserId, mockOrganisationId, mockEventId, mockAppId)

package/src/rbac/hooks/permissions/usePermissions.ts

@@ -1,8 +1,9 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
-import { Permission, PermissionMap, Scope, UUID } from '../../types';
-import { getPermissionMap } from '../../api';
+import { PermissionMap, Scope, UUID } from '../../types';
 import { getRBACLogger } from '../../config';
+import { createPermissionMapHelpers } from '../../utils/permissionMapHelpers';
+import { fetchPermissionMapForScope } from '../../utils/fetchPermissionMap';
 
 /**
  * Hook to get user's permissions in a scope
@@ -110,17 +111,7 @@ export function usePermissions(
         return;
       }
 
-      // Don't fetch permissions if scope is invalid (e.g., organisationId is null/empty)
-      // Wait for organisation context to resolve
-      // IMPORTANT: Don't clear existing permissions here - keep them until we have new ones
-      // OPTIMIZATION: If userId is null/undefined, immediately set loading to false
-      // This indicates pre-filtered mode where we don't need to wait for organisation context
-      if (!userId) {
-        setPermissions({} as PermissionMap);
-        setIsLoading(false);
-        return;
-      }
-
+      // Don't fetch if scope is invalid; wait for organisation context
       if (!orgId || orgId === null || (typeof orgId === 'string' && orgId.trim() === '')) {
         // Keep existing permissions, just mark as loading
         setIsLoading(true);
@@ -133,19 +124,22 @@ export function usePermissions(
         setIsLoading(true);
         setError(null);
 
-        // Build scope object for API call
         const scope: Scope = {
           organisationId: orgId,
           eventId: eventId,
           appId: appId
         };
 
-        // Fetch new permissions - don't clear old ones until we have new ones
-        const permissionMap = await getPermissionMap({ userId, scope });
+        const result = await fetchPermissionMapForScope({ userId, scope });
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setIsLoading(false);
+          isFetchingRef.current = false;
+          return;
+        }
+        const permissionMap = result.data;
 
-        // Only log if there's a significant change or error
         const permissionCount = Object.keys(permissionMap).length;
-        // Use a ref to track previous permissions count to avoid dependency on permissions state
         setPermissions(prevPermissions => {
           if (permissionCount === 0 && Object.keys(prevPermissions).length > 0) {
             logger.warn('[usePermissions] Permissions fetched but returned empty map', {
@@ -155,11 +149,8 @@ export function usePermissions(
           return permissionMap;
         });
       } catch (err) {
-        // On error, keep existing permissions but set error state
-        // This prevents the UI from losing all items when there's a transient error
         logger.error('[usePermissions] Failed to fetch permissions:', err);
         setError(err instanceof Error ? err : new Error('Failed to fetch permissions'));
-        // Don't clear permissions on error - keep what we had
       } finally {
         setIsLoading(false);
         isFetchingRef.current = false;
@@ -169,29 +160,12 @@ export function usePermissions(
     fetchPermissions();
   }, [fetchTrigger, userId, organisationId, eventId, appId, logger, orgId]);
 
-  const hasPermission = useCallback((permission: Permission): boolean => {
-    if (permissions['*']) {
-      return true;
-    }
-    return permissions[permission] === true;
-  }, [permissions]);
-
-  const hasAnyPermission = useCallback((permissionList: Permission[]): boolean => {
-    if (permissions['*']) {
-      return true;
-    }
-    return permissionList.some(p => permissions[p] === true);
-  }, [permissions]);
-
-  const hasAllPermissions = useCallback((permissionList: Permission[]): boolean => {
-    if (permissions['*']) {
-      return true;
-    }
-    return permissionList.every(p => permissions[p] === true);
-  }, [permissions]);
+  const { hasPermission, hasAnyPermission, hasAllPermissions } = useMemo(
+    () => createPermissionMapHelpers(permissions),
+    [permissions]
+  );
 
   const refetch = useCallback(async () => {
-    // Prevent multiple simultaneous fetches
     if (isFetchingRef.current) {
       return;
     }
@@ -202,10 +176,7 @@ export function usePermissions(
       return;
     }
 
-    // Don't fetch permissions if scope is invalid (e.g., organisationId is null/empty)
-    // IMPORTANT: Don't clear existing permissions - keep them until we have new ones
     if (!orgId || orgId === null || (typeof orgId === 'string' && orgId.trim() === '')) {
-      // Keep existing permissions, just mark as loading
       setIsLoading(true);
       setError(null);
       return;
@@ -216,25 +187,22 @@ export function usePermissions(
       setIsLoading(true);
       setError(null);
 
-      // Build scope object for API call
       const scope: Scope = {
         organisationId: orgId,
         eventId: eventId,
         appId: appId
       };
 
-      // Fetch new permissions - don't clear old ones until we have new ones
-      const permissionMap = await getPermissionMap({ userId, scope });
-
-      // Only update permissions if fetch was successful
-      setPermissions(permissionMap);
+      const result = await fetchPermissionMapForScope({ userId, scope });
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        return;
+      }
+      setPermissions(result.data);
     } catch (err) {
-      // On error, keep existing permissions but set error state
-      // This prevents the UI from losing all items when there's a transient error
-      const logger = getRBACLogger();
-      logger.error('Failed to refetch permissions:', err);
+      const refetchLogger = getRBACLogger();
+      refetchLogger.error('Failed to refetch permissions:', err);
       setError(err instanceof Error ? err : new Error('Failed to fetch permissions'));
-      // Don't clear permissions on error - keep what we had
     } finally {
       setIsLoading(false);
       isFetchingRef.current = false;
@@ -242,13 +210,16 @@ export function usePermissions(
   }, [userId, eventId, appId, orgId]);
 
   // Memoize the return object to prevent unnecessary re-renders
-  return useMemo(() => ({
-    permissions,
-    isLoading,
-    error,
-    hasPermission,
-    hasAnyPermission,
-    hasAllPermissions,
-    refetch
-  }), [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]);
+  return useMemo(
+    () => ({
+      permissions,
+      isLoading,
+      error,
+      hasPermission,
+      hasAnyPermission,
+      hasAllPermissions,
+      refetch
+    }),
+    [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]
+  );
 }