@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/hooks/useRBAC.test.ts

@@ -84,16 +84,19 @@ describe('useRBAC', () => {
     mockUseOrganisations.mockReturnValue({ selectedOrganisation: null });
     mockUseEvents.mockReturnValue({ selectedEvent: null });
 
-    mockGetPermissionMap.mockResolvedValue({});
-    mockGetAccessLevel.mockResolvedValue('viewer');
-    mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
+    mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+    mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
+    mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
     mockGetRoleContext.mockResolvedValue({
-      globalRole: null,
-      organisationRole: null,
-      eventAppRole: null,
+      ok: true,
+      data: {
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      },
     });
-    mockIsPermittedCached.mockResolvedValue(false);
-    mockGetPageScopeType.mockResolvedValue('organisation');
+    mockIsPermittedCached.mockResolvedValue({ ok: true, data: false });
+    mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
     mockContextValidator.resolveScopeForPage.mockResolvedValue({
       isValid: true,
       resolvedScope: {
@@ -130,16 +133,19 @@ describe('useRBAC', () => {
     });
     mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
 
-    mockGetPermissionMap.mockResolvedValue({ 'read:dashboard': true });
-    mockGetAccessLevel.mockResolvedValue('viewer');
+    mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:dashboard': true } });
+    mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
     mockGetRoleContext.mockResolvedValue({
-      globalRole: null,
-      organisationRole: null,
-      eventAppRole: null,
+      ok: true,
+      data: {
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      },
     });
     // Ensure resolveAppContext returns a value so the hook continues
-    mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-    mockGetPageScopeType.mockResolvedValue('organisation');
+    mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+    mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
     mockContextValidator.resolveScopeForPage.mockResolvedValue({
       isValid: true,
       resolvedScope: {
@@ -197,7 +203,7 @@ describe('useRBAC', () => {
       selectedEvent: null,
       eventLoading: false,
     });
-    mockResolveAppContext.mockResolvedValue(null);
+    mockResolveAppContext.mockResolvedValue({ ok: true, data: null });
 
     const { result } = renderHook(() => useRBAC());
 
@@ -219,13 +225,16 @@ describe('useRBAC', () => {
       selectedEvent: null,
       eventLoading: false,
     });
-    mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-    mockGetPermissionMap.mockResolvedValue({});
-    mockGetAccessLevel.mockResolvedValue('viewer');
+    mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+    mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+    mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
     mockGetRoleContext.mockResolvedValue({
-      globalRole: 'super_admin',
-      organisationRole: null,
-      eventAppRole: null,
+      ok: true,
+      data: {
+        globalRole: 'super_admin',
+        organisationRole: null,
+        eventAppRole: null,
+      },
     });
 
     const { result } = renderHook(() => useRBAC());
@@ -260,13 +269,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: 'org_admin',
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: 'org_admin',
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -304,13 +316,16 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('admin');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'admin' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: 'event_admin',
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: 'event_admin',
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -349,13 +364,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ 'read:users': true, 'write:users': false });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:users': true, 'write:users': false } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -392,13 +410,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: 'org_admin',
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: 'org_admin',
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -433,13 +454,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: 'super_admin',
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: 'super_admin',
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -481,12 +505,15 @@ describe('useRBAC', () => {
       mockResolveAppContext.mockImplementation(() => 
         new Promise(resolve => setTimeout(() => resolve({ appId: 'app-123' as any, hasAccess: true }), 100))
       );
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -545,13 +572,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
       mockGetPermissionMap.mockRejectedValue(new Error('Failed to fetch permissions'));
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -588,9 +618,9 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockRejectedValue(new Error('Failed to fetch role context'));
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -653,13 +683,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: null });
-      mockResolveAppContext.mockResolvedValue(null); // PORTAL can proceed without appId
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: null }); // PORTAL can proceed without appId
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -695,13 +728,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: null });
-      mockResolveAppContext.mockResolvedValue(null); // ADMIN can proceed without appId
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: null }); // ADMIN can proceed without appId
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -737,13 +773,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ 'read:users': true });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:users': true } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: 'member',
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: 'member',
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -794,13 +833,16 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } });
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ '*': true }); // Wildcard permission
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { '*': true } }); // Wildcard permission
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -825,7 +867,7 @@ describe('useRBAC', () => {
 
   describe('Scope Resolution', () => {
     it('supports organisation page type scope resolution', async () => {
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -861,7 +903,7 @@ describe('useRBAC', () => {
     });
 
     it('supports event page type scope resolution', async () => {
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -915,12 +957,15 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
@@ -991,15 +1036,18 @@ describe('useRBAC', () => {
         eventLoading: false,
         supabase: {} as any,
       });
-      mockResolveAppContext.mockResolvedValue({ appId: 'portal-app-id' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ 'read:profile': true });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'portal-app-id' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:profile': true } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1033,15 +1081,18 @@ describe('useRBAC', () => {
         eventLoading: false,
         supabase: {} as any,
       });
-      mockResolveAppContext.mockResolvedValue({ appId: 'admin-app-id' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ 'read:admin': true });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'admin-app-id' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:admin': true } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1079,14 +1130,17 @@ describe('useRBAC', () => {
       // Simulate NetworkError
       const networkError = new Error('NetworkError: Failed to fetch');
       mockResolveAppContext.mockRejectedValue(networkError);
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1120,15 +1174,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ 'read:page.dashboard': true });
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { 'read:page.dashboard': true } });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1162,15 +1219,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockRejectedValue(new Error('Failed to get page scope type'));
+      mockGetPageScopeType.mockResolvedValue({ ok: false, error: { code: 'RBAC_ERROR', message: 'Failed to get page scope type' } });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1187,7 +1247,7 @@ describe('useRBAC', () => {
         expect(result.current.isLoading).toBe(false);
       }, { timeout: 3000 });
 
-      // Should default to organisation scope on error
+      // Should default to organisation scope on error (ApiResult error, not thrown)
       expect(result.current.error).toBeNull();
     });
 
@@ -1204,7 +1264,7 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: false,
         resolvedScope: null,
@@ -1257,15 +1317,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1307,15 +1370,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({}); // Empty permission map
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} }); // Empty permission map
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1355,15 +1421,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('admin'); // Should map to event_admin
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'admin' }); // Should map to event_admin
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null, // No role from getRoleContext
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null, // No role from getRoleContext
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1398,15 +1467,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('super'); // Should map to event_admin
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'super' }); // Should map to event_admin
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1441,15 +1513,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1484,15 +1559,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('participant');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'participant' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1527,15 +1605,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('planner');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'planner' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1570,15 +1651,18 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       mockUseEvents.mockReturnValue({ selectedEvent: { event_id: 'event-1', organisation_id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('unknown' as any);
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'unknown' as any });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('event');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'event' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1612,15 +1696,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({ '*': true }); // Wildcard permission
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: { '*': true } }); // Wildcard permission
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1655,15 +1742,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: 'org_admin',
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: 'org_admin',
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1697,15 +1787,18 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: true });
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: true } });
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: 'super_admin',
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: 'super_admin',
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {
@@ -1739,7 +1832,7 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue({ appId: 'app-123' as any, hasAccess: false }); // No access
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: { appId: 'app-123' as any, hasAccess: false } }); // No access
 
       const { result } = renderHook(() => useRBAC());
 
@@ -1765,7 +1858,7 @@ describe('useRBAC', () => {
         supabase: {} as any,
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
-      mockResolveAppContext.mockResolvedValue(null); // No app context
+      mockResolveAppContext.mockResolvedValue({ ok: true, data: null }); // No app context
 
       const { result } = renderHook(() => useRBAC());
 
@@ -1793,14 +1886,17 @@ describe('useRBAC', () => {
       });
       mockUseOrganisations.mockReturnValue({ selectedOrganisation: { id: 'org-1' } } as any);
       // Don't call resolveAppContext since appId is already available
-      mockGetPermissionMap.mockResolvedValue({});
-      mockGetAccessLevel.mockResolvedValue('viewer');
+      mockGetPermissionMap.mockResolvedValue({ ok: true, data: {} });
+      mockGetAccessLevel.mockResolvedValue({ ok: true, data: 'viewer' });
       mockGetRoleContext.mockResolvedValue({
-        globalRole: null,
-        organisationRole: null,
-        eventAppRole: null,
+        ok: true,
+        data: {
+          globalRole: null,
+          organisationRole: null,
+          eventAppRole: null,
+        },
       });
-      mockGetPageScopeType.mockResolvedValue('organisation');
+      mockGetPageScopeType.mockResolvedValue({ ok: true, data: 'organisation' });
       mockContextValidator.resolveScopeForPage.mockResolvedValue({
         isValid: true,
         resolvedScope: {