@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/hooks/useRBAC.ts

@@ -19,8 +19,10 @@ import {
   getRoleContext,
   getPageScopeType,
 } from '../api';
+import type { SupabaseClient } from '@supabase/supabase-js';
 import { getRBACLogger } from '../config';
 import { ContextValidator } from '../utils/contextValidator';
+import type { Database } from '../../types/database';
 import type {
   UserRBACContext,
   GlobalRole,
@@ -30,6 +32,7 @@ import type {
   Scope,
   PermissionMap,
   UUID,
+  RBACRoleContext,
 } from '../types';
 
 function mapAccessLevelToEventRole(level: string | null): EventAppRole | null {
@@ -48,6 +51,127 @@ function mapAccessLevelToEventRole(level: string | null): EventAppRole | null {
   }
 }
 
+interface ResolveAppIdOptions {
+  logger: { warn: (msg: string, meta?: object) => void };
+  eventLoading: boolean;
+  hasSelectedEvent: boolean;
+}
+
+async function resolveAppIdForRBAC(
+  userId: UUID,
+  appName: string | undefined,
+  contextAppId: UUID | undefined,
+  options: ResolveAppIdOptions
+): Promise<{ appId: UUID | undefined; shouldRetry: boolean }> {
+  if (!appName || contextAppId) {
+    return { appId: contextAppId, shouldRetry: false };
+  }
+  try {
+    const resolvedResult = await resolveAppContext({ userId, appName });
+    if (!resolvedResult.ok) {
+      throw new Error(resolvedResult.error.message);
+    }
+    const resolved = resolvedResult.data;
+    if (!resolved) {
+      if (appName === 'PORTAL' || appName === 'ADMIN') {
+        return { appId: contextAppId, shouldRetry: false };
+      }
+      throw new Error(`User does not have access to app "${appName}"`);
+    }
+    if (!resolved.hasAccess && appName !== 'PORTAL' && appName !== 'ADMIN') {
+      throw new Error(`User does not have access to app "${appName}"`);
+    }
+    return { appId: resolved.appId, shouldRetry: false };
+  } catch (rpcError: unknown) {
+    const errorMessage = rpcError instanceof Error ? rpcError.message : String(rpcError);
+    if (errorMessage.includes('NetworkError') || errorMessage.includes('fetch')) {
+      options.logger.warn('[useRBAC] NetworkError resolving app context - may be timing issue, will retry when context is ready', {
+        appName,
+        error: errorMessage,
+        eventLoading: options.eventLoading,
+        hasSelectedEvent: options.hasSelectedEvent,
+      });
+      return { appId: undefined, shouldRetry: true };
+    }
+    if (appName === 'PORTAL' || appName === 'ADMIN') {
+      return { appId: contextAppId, shouldRetry: false };
+    }
+    throw rpcError;
+  }
+}
+
+interface ResolveScopeForRBACParams {
+  initialScope: Scope;
+  appId: UUID | undefined;
+  contextAppId: UUID | undefined;
+  pageId: string | undefined;
+  appName: string | undefined;
+  supabase: unknown;
+  logger: { warn: (msg: string, meta?: object) => void };
+}
+
+async function resolveScopeForRBAC(params: ResolveScopeForRBACParams): Promise<Scope> {
+  const { initialScope, appId, contextAppId, pageId, appName, supabase, logger } = params;
+  const scope: Scope = {
+    ...initialScope,
+    appId: appId || contextAppId,
+  };
+  let pageScopeType: 'event' | 'organisation' | 'both' = 'organisation';
+  if (pageId && scope.appId) {
+    const scopeTypeResult = await getPageScopeType(pageId, scope.appId, appName);
+    if (scopeTypeResult.ok) {
+      pageScopeType = scopeTypeResult.data;
+    } else {
+      logger.warn('[useRBAC] Failed to get page scope type, defaulting to organisation', {
+        pageId,
+        error: scopeTypeResult.error.message,
+      });
+    }
+  }
+  const validation = await ContextValidator.resolveScopeForPage(
+    scope,
+    pageScopeType,
+    appName,
+    (supabase ?? null) as SupabaseClient<Database> | null
+  );
+  if (!validation.isValid || !validation.resolvedScope) {
+    throw validation.error || new Error('Context validation failed');
+  }
+  return validation.resolvedScope;
+}
+
+interface FetchRBACContextDataResult {
+  map: PermissionMap;
+  roleContext: RBACRoleContext;
+  accessLevel: string | null;
+}
+
+async function fetchRBACContextData(
+  userId: UUID,
+  resolvedScope: Scope,
+  appName: string | undefined
+): Promise<FetchRBACContextDataResult> {
+  const [mapResult, roleResult, accessResult] = await Promise.all([
+    getPermissionMap({ userId, scope: resolvedScope }, appName),
+    getRoleContext({ userId, scope: resolvedScope }, appName),
+    getAccessLevel({ userId, scope: resolvedScope }, appName),
+  ]);
+  if (!mapResult.ok) {
+    throw new Error(mapResult.error.message);
+  }
+  if (!roleResult.ok) {
+    throw new Error(roleResult.error.message);
+  }
+  if (!accessResult.ok) {
+    throw new Error(accessResult.error.message);
+  }
+  return {
+    map: mapResult.data,
+    roleContext: roleResult.data,
+    accessLevel: accessResult.data,
+  };
+}
+
 export function useRBAC(pageId?: string): UserRBACContext {
   const logger = getRBACLogger();
   // Get all context from UnifiedAuth - it already provides selectedOrganisation, isContextReady, selectedEvent, and eventLoading
@@ -113,98 +237,38 @@ export function useRBAC(pageId?: string): UserRBACContext {
     // Loading RBAC context
 
     try {
-      let appId: UUID | undefined = contextAppId; // Use contextAppId as default (already resolved in UnifiedAuthProvider)
-      
-      if (appName && !appId) {
-        // Wrap RPC call in try-catch to handle NetworkError gracefully
-        try {
-          const resolved = await resolveAppContext({ userId: user.id as UUID, appName });
-          // For PORTAL/ADMIN apps, allow access even if hasAccess is false (users can view their own profile, super admins have global access)
-          if (!resolved) {
-            if (appName === 'PORTAL' || appName === 'ADMIN') {
-              // For PORTAL/ADMIN, proceed without appId - it's optional for these apps
-              // Use contextAppId if available
-            } else {
-              throw new Error(`User does not have access to app "${appName}"`);
-            }
-          } else if (!resolved.hasAccess && appName !== 'PORTAL' && appName !== 'ADMIN') {
-            throw new Error(`User does not have access to app "${appName}"`);
-          } else {
-            appId = resolved.appId;
-          }
-        } catch (rpcError: unknown) {
-          // Handle NetworkError - might be due to timing issue
-          const errorMessage = rpcError instanceof Error ? rpcError.message : String(rpcError);
-          if (errorMessage.includes('NetworkError') || errorMessage.includes('fetch')) {
-            logger.warn('[useRBAC] NetworkError resolving app context - may be timing issue, will retry when context is ready', {
-              appName,
-              error: errorMessage,
-              eventLoading,
-              hasSelectedEvent: !!selectedEvent
-            });
-            // Don't throw - let it retry when dependencies change
-            setIsLoading(false);
-            return;
-          }
-          // For PORTAL/ADMIN, allow proceeding without app access check (for profile pages, super admin access)
-          if (appName === 'PORTAL' || appName === 'ADMIN') {
-            // appId will use contextAppId or be undefined, which is OK for PORTAL/ADMIN page-level permissions
-          } else {
-            // Re-throw other errors for non-PORTAL apps
-            throw rpcError;
-          }
-        }
-      }
-
-      // Update scope with appId (use contextAppId as fallback for PORTAL)
-      const scope: Scope = {
-        ...initialScope,
-        appId: appId || contextAppId,
-      };
-      
-      // Resolve scope based on page-level scope type
-      // If pageId is provided, use its scope type; otherwise default to 'organisation'
-      let pageScopeType: 'event' | 'organisation' | 'both' = 'organisation';
-      if (pageId && scope.appId) {
-        try {
-          pageScopeType = await getPageScopeType(pageId, scope.appId, appName);
-        } catch (error) {
-          logger.warn('[useRBAC] Failed to get page scope type, defaulting to organisation', {
-            pageId,
-            error: error instanceof Error ? error.message : String(error)
-          });
-          // Default to organisation scope on error
-        }
-      }
-      
-      // Resolve required context using page-level scope type
-      const validation = await ContextValidator.resolveScopeForPage(
-        scope,
-        pageScopeType,
+      const { appId, shouldRetry } = await resolveAppIdForRBAC(
+        user.id as UUID,
         appName,
-        supabase || null
+        contextAppId,
+        { logger, eventLoading, hasSelectedEvent: !!selectedEvent }
       );
-
-      if (!validation.isValid || !validation.resolvedScope) {
-        throw validation.error || new Error('Context validation failed');
+      if (shouldRetry) {
+        setIsLoading(false);
+        return;
       }
 
-      const resolvedScope = validation.resolvedScope;
+      const resolvedScope = await resolveScopeForRBAC({
+        initialScope,
+        appId,
+        contextAppId,
+        pageId,
+        appName,
+        supabase,
+        logger,
+      });
 
-      // API calls no longer need appConfig (scope is page-level)
-      // Pass appName to allow PORTAL/ADMIN apps to work without organisation context
-      const [map, roleContext, accessLevel] = await Promise.all([
-        getPermissionMap({ userId: user.id as UUID, scope: resolvedScope }, appName),
-        getRoleContext({ userId: user.id as UUID, scope: resolvedScope }, appName),
-        getAccessLevel({ userId: user.id as UUID, scope: resolvedScope }, appName),
-      ]);
+      const { map, roleContext, accessLevel } = await fetchRBACContextData(
+        user.id as UUID,
+        resolvedScope,
+        appName
+      );
 
       setPermissionMap(map);
       setGlobalRole(roleContext.globalRole);
       setOrganisationRole(roleContext.organisationRole);
       setEventAppRole(roleContext.eventAppRole || mapAccessLevelToEventRole(accessLevel));
       
-      // Only log on first successful load or if there's an issue
       const permissionCount = Object.keys(map).length;
       if (permissionCount === 0) {
         logger.warn('[useRBAC] RBAC context loaded but returned 0 permissions', {

package/src/rbac/hooks/useResourcePermissions.test.ts

@@ -102,7 +102,7 @@ describe('useResourcePermissions Hook', () => {
     });
 
     // Mock isSuperAdmin to resolve immediately (prevents isLoading from being true due to super admin check)
-    mockIsSuperAdmin.mockResolvedValue(false);
+    mockIsSuperAdmin.mockResolvedValue({ ok: true, data: false });
 
     // Default useCan mocks - all permissions allowed
     mockUseCan.mockReturnValue({
@@ -167,49 +167,50 @@ describe('useResourcePermissions Hook', () => {
       
       // When appId is available in resolvedScope, permission strings include page. prefix
       // and resource name is passed as pageId to enable page permission checks
+      // precomputedSuperAdmin (6th arg) can be null, false, or true depending on async timing
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
-        mockScope, // resolvedScope is used when available
+        mockScope,
         'create:page.contacts',
-        'contacts', // pageId is resource name when appId is available in resolvedScope
+        'contacts',
         true,
-        false, // precomputedSuperAdmin (resolved after async check)
-        undefined // appName
+        expect.anything(),
+        undefined
       );
-      
-      // Verify all four permission types are checked
-      const permissions = calls.map(call => call[2]); // permission is the 3rd argument
-      expect(permissions).toContain('create:page.contacts');
-      expect(permissions).toContain('update:page.contacts');
-      expect(permissions).toContain('delete:page.contacts');
-      expect(permissions).toContain('read:page.contacts');
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'update:page.contacts',
-        'contacts', // pageId is resource name when appId is available
+        'contacts',
         true,
-        null, // precomputedSuperAdmin
-        undefined // appName
+        expect.anything(),
+        undefined
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'delete:page.contacts',
-        'contacts', // pageId is resource name when appId is available
+        'contacts',
         true,
-        null, // precomputedSuperAdmin
-        undefined // appName
+        expect.anything(),
+        undefined
       );
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
         mockScope,
         'read:page.contacts',
-        'contacts', // pageId is resource name when appId is available
+        'contacts',
         true,
-        null, // precomputedSuperAdmin
-        undefined // appName
+        expect.anything(),
+        undefined
       );
+      
+      // Verify all four permission types are checked
+      const permissions = calls.map(call => call[2]);
+      expect(permissions).toContain('create:page.contacts');
+      expect(permissions).toContain('update:page.contacts');
+      expect(permissions).toContain('delete:page.contacts');
+      expect(permissions).toContain('read:page.contacts');
     });
   });
 
@@ -714,15 +715,14 @@ describe('useResourcePermissions Hook', () => {
       });
 
       // Should call useCan for read permission with page. prefix when appId is available in resolvedScope
-      // Note: precomputedSuperAdmin starts as null before async check completes, then becomes false/true
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
         expect.any(Object),
         'read:page.contacts',
-        'contacts', // pageId is resource name when appId is available in resolvedScope
+        'contacts',
         true,
         expect.anything(), // precomputedSuperAdmin (null initially, then false/true after async check)
-        undefined // appName
+        undefined
       );
     });
 
@@ -928,7 +928,7 @@ describe('useResourcePermissions Hook', () => {
 
   describe('Edge Cases and Boundary Conditions', () => {
     it('handles super admin bypassing all permission checks', async () => {
-      mockIsSuperAdmin.mockResolvedValue(true);
+      mockIsSuperAdmin.mockResolvedValue({ ok: true, data: true });
       mockUseResolvedScope.mockReturnValue({
         resolvedScope: mockScope,
         isLoading: false,

package/src/rbac/hooks/useResourcePermissions.ts

@@ -40,15 +40,14 @@
  * - Missing user context results in all permissions being denied
  */
 
-import { useMemo, useState, useEffect, useRef } from 'react';
+import { useMemo } from 'react';
 import { useUnifiedAuth } from '../../providers/services/UnifiedAuthProvider';
 import { useOrganisations } from '../../hooks/useOrganisations';
 import { useEvents } from '../../hooks/useEvents';
 import type { Event } from '../../types/event';
 import { useResolvedScope } from './useResolvedScope';
 import { useCan } from './usePermissions';
-import { isSuperAdmin } from '../api';
-import { createLogger } from '../../utils/core/logger';
+import { useResourcePermissionsSuperAdmin } from './useResourcePermissionsSuperAdmin';
 import type { Scope, Permission } from '../types';
 
 export interface UseResourcePermissionsOptions {
@@ -138,80 +137,51 @@ export interface ResourcePermissions {
  * }
  * ```
  */
+
+function buildResourcePermissions(params: {
+  resource: string;
+  enableRead: boolean;
+  isSuperAdminUser: boolean | null;
+  isCheckingSuperAdmin: boolean;
+  canCreateResult: boolean;
+  canUpdateResult: boolean;
+  canDeleteResult: boolean;
+  canReadResult: boolean;
+  scope: Scope;
+  isLoading: boolean;
+  error: Error | null;
+}): ResourcePermissions {
+  const createSuperAdminAwarePermission = (result: boolean) => {
+    if (params.isSuperAdminUser === true) return true;
+    return result;
+  };
+
+  return {
+    canCreate: (res: string) =>
+      res !== params.resource ? false : createSuperAdminAwarePermission(params.canCreateResult),
+    canUpdate: (res: string) =>
+      res !== params.resource ? false : createSuperAdminAwarePermission(params.canUpdateResult),
+    canDelete: (res: string) =>
+      res !== params.resource ? false : createSuperAdminAwarePermission(params.canDeleteResult),
+    canRead: (res: string) => {
+      if (!params.enableRead) return true;
+      if (res !== params.resource) return false;
+      return createSuperAdminAwarePermission(params.canReadResult);
+    },
+    scope: params.scope,
+    isLoading: params.isCheckingSuperAdmin || params.isLoading,
+    error: params.error,
+  };
+}
+
 export function useResourcePermissions(
   resource: string,
   options: UseResourcePermissionsOptions = {}
 ): ResourcePermissions {
   const { enableRead = false, requireScope = true } = options;
-  const logger = createLogger('ResourcePermissions');
-
-  // Get user and supabase client from UnifiedAuth
   const { user, supabase } = useUnifiedAuth();
+  const { isSuperAdminUser, isCheckingSuperAdmin } = useResourcePermissionsSuperAdmin(user?.id);
 
-  // Super admin status - check if user has super admin privileges
-  // Super admins bypass all permission checks (similar to useDataTablePermissions)
-  // PERFORMANCE OPTIMIZATION: Check super admin once and share with all useCan hooks to avoid duplicate queries
-  // Use null to indicate "not checked yet" vs false which means "checked and not super admin"
-  const [isSuperAdminUser, setIsSuperAdminUser] = useState<boolean | null>(null);
-  const [isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState<boolean>(() => !!user?.id);
-  const lastCheckedUserIdRef = useRef<string | null>(null);
-  const isCheckingRef = useRef<boolean>(false);
-
-  useEffect(() => {
-    // Skip if already checked for this user ID
-    if (lastCheckedUserIdRef.current === user?.id && isSuperAdminUser !== null) {
-      return;
-    }
-
-    // Skip if already checking
-    if (isCheckingRef.current) {
-      return;
-    }
-
-    const checkSuperAdminStatus = async () => {
-      if (!user?.id) {
-        setIsSuperAdminUser(false); // No user = not super admin
-        setIsCheckingSuperAdmin(false);
-        lastCheckedUserIdRef.current = null;
-        return;
-      }
-
-      // Mark as checking and track user ID
-      isCheckingRef.current = true;
-      lastCheckedUserIdRef.current = user.id;
-
-      const startTime = Date.now();
-      setIsCheckingSuperAdmin(true);
-      
-      // Add timeout to prevent infinite hanging
-      const timeoutId = setTimeout(() => {
-        logger.warn('useResourcePermissions', 'Super admin check taking longer than 5 seconds', {
-          userId: user?.id,
-          elapsedMs: Date.now() - startTime,
-        });
-      }, 5000);
-
-      try {
-        const superAdminStatus = await isSuperAdmin(user.id);
-        setIsSuperAdminUser(superAdminStatus);
-      } catch (error) {
-        const elapsed = Date.now() - startTime;
-        logger.error('useResourcePermissions', 'Error checking super admin status', {
-          userId: user?.id,
-          error,
-          elapsedMs: elapsed,
-        });
-        setIsSuperAdminUser(false); // Error = assume not super admin for security
-      } finally {
-        clearTimeout(timeoutId);
-        setIsCheckingSuperAdmin(false);
-        isCheckingRef.current = false;
-      }
-    };
-
-    checkSuperAdminStatus();
-  }, [user?.id, logger, isSuperAdminUser]);
-  
   // Get selected organisation
   const { selectedOrganisation } = useOrganisations();
   
@@ -332,70 +302,34 @@ export function useResourcePermissions(
     return null;
   }, [scopeError, createError, updateError, deleteError, readError, enableRead]);
 
-  // Return wrapper functions that take resource name and return permission result
-  // Note: The resource parameter in the function is for consistency with the API,
-  // but we're checking permissions for the resource passed to the hook
-  // CRITICAL FIX: When isSuperAdminUser is true, immediately grant all permissions without waiting
-  // for useCan results. This ensures super admins can use resource operations immediately.
-  return useMemo(() => {
-    // Helper to create a permission result that bypasses for super admins
-    const createSuperAdminAwarePermission = (result: boolean) => {
-      // CRITICAL: If super admin is confirmed, immediately grant permission
-      // Don't wait for useCan results - super admins bypass all checks
-      if (isSuperAdminUser === true) {
-        return true;
-      }
-      
-      // For non-super-admins or while checking, use normal permission results
-      return result;
-    };
-
-    return {
-      canCreate: (res: string) => {
-        // For now, we only check the resource passed to the hook
-        // Future enhancement could support checking different resources
-        if (res !== resource) {
-          return false;
-        }
-        return createSuperAdminAwarePermission(canCreateResult);
-      },
-      canUpdate: (res: string) => {
-        if (res !== resource) {
-          return false;
-        }
-        return createSuperAdminAwarePermission(canUpdateResult);
-      },
-      canDelete: (res: string) => {
-        if (res !== resource) {
-          return false;
-        }
-        return createSuperAdminAwarePermission(canDeleteResult);
-      },
-      canRead: (res: string) => {
-        if (!enableRead) {
-          return true; // If read checking is disabled, allow read
-        }
-        if (res !== resource) {
-          return false;
-        }
-        return createSuperAdminAwarePermission(canReadResult);
-      },
+  return useMemo(
+    () =>
+      buildResourcePermissions({
+        resource,
+        enableRead,
+        isSuperAdminUser,
+        isCheckingSuperAdmin,
+        canCreateResult,
+        canUpdateResult,
+        canDeleteResult,
+        canReadResult,
+        scope,
+        isLoading,
+        error,
+      }),
+    [
+      resource,
+      enableRead,
+      isSuperAdminUser,
+      isCheckingSuperAdmin,
+      canCreateResult,
+      canUpdateResult,
+      canDeleteResult,
+      canReadResult,
       scope,
-      isLoading: isCheckingSuperAdmin || isLoading,
-      error
-    };
-  }, [
-    resource,
-    isSuperAdminUser,
-    isCheckingSuperAdmin,
-    canCreateResult,
-    canUpdateResult,
-    canDeleteResult,
-    canReadResult,
-    enableRead,
-    scope,
-    isLoading,
-    error
-  ]);
+      isLoading,
+      error,
+    ]
+  );
 }
 

package/src/rbac/hooks/useResourcePermissionsSuperAdmin.ts

@@ -0,0 +1,67 @@
+import { useState, useEffect, useRef } from 'react';
+import { isSuperAdmin } from '../api';
+import { createLogger } from '../../utils/core/logger';
+
+/**
+ * Hook that owns super-admin state and the effect that checks super-admin status.
+ * Used by useResourcePermissions to avoid duplicate super-admin checks across useCan calls.
+ *
+ * @param userId - User ID (e.g. user?.id)
+ * @returns { isSuperAdminUser, isCheckingSuperAdmin }
+ */
+export function useResourcePermissionsSuperAdmin(
+  userId: string | undefined
+): { isSuperAdminUser: boolean | null; isCheckingSuperAdmin: boolean } {
+  const logger = createLogger('ResourcePermissionsSuperAdmin');
+  const [isSuperAdminUser, setIsSuperAdminUser] = useState<boolean | null>(null);
+  const [isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState<boolean>(() => !!userId);
+  const lastCheckedUserIdRef = useRef<string | null>(null);
+  const isCheckingRef = useRef<boolean>(false);
+
+  useEffect(() => {
+    if (lastCheckedUserIdRef.current === userId && isSuperAdminUser !== null) return;
+    if (isCheckingRef.current) return;
+
+    const checkSuperAdminStatus = async () => {
+      if (!userId) {
+        setIsSuperAdminUser(false);
+        setIsCheckingSuperAdmin(false);
+        lastCheckedUserIdRef.current = null;
+        return;
+      }
+
+      isCheckingRef.current = true;
+      lastCheckedUserIdRef.current = userId;
+      const startTime = Date.now();
+      setIsCheckingSuperAdmin(true);
+
+      const timeoutId = setTimeout(() => {
+        logger.warn('useResourcePermissions', 'Super admin check taking longer than 5 seconds', {
+          userId,
+          elapsedMs: Date.now() - startTime,
+        });
+      }, 5000);
+
+      try {
+        const result = await isSuperAdmin(userId);
+        setIsSuperAdminUser(result.ok && result.data);
+      } catch (error) {
+        const elapsed = Date.now() - startTime;
+        logger.error('useResourcePermissions', 'Error checking super admin status', {
+          userId,
+          error,
+          elapsedMs: elapsed,
+        });
+        setIsSuperAdminUser(false);
+      } finally {
+        clearTimeout(timeoutId);
+        setIsCheckingSuperAdmin(false);
+        isCheckingRef.current = false;
+      }
+    };
+
+    checkSuperAdminStatus();
+  }, [userId, logger, isSuperAdminUser]);
+
+  return { isSuperAdminUser, isCheckingSuperAdmin };
+}