@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/hooks/useRoleManagement.ts

@@ -14,15 +14,15 @@
  * import { Button } from '@jmruthers/pace-core';
  *
  * function UserRolesComponent() {
- *   const { 
- *     revokeEventAppRole, 
+ *   const {
+ *     revokeEventAppRole,
  *     grantEventAppRole,
  *     grantGlobalRole,
  *     revokeGlobalRole,
  *     grantOrganisationRole,
  *     revokeOrganisationRole,
- *     isLoading, 
- *     error 
+ *     isLoading,
+ *     error
  *   } = useRoleManagement();
  *
  *   // Grant a global role
@@ -60,65 +60,42 @@
 
 import { useState, useCallback } from 'react';
 import { useUnifiedAuth } from '../../providers/services/UnifiedAuthProvider';
+import type {
+  RevokeEventAppRoleParams,
+  GrantEventAppRoleParams,
+  RevokeGlobalRoleParams,
+  GrantGlobalRoleParams,
+  RevokeOrganisationRoleParams,
+  GrantOrganisationRoleParams,
+  RoleManagementResult,
+} from '../types/roleManagement';
 import type { UUID } from '../types';
-import { createLogger } from '../../utils/core/logger';
-
-const logger = createLogger('useRoleManagement');
-
-export interface EventAppRoleData {
-  user_id: UUID;
-  organisation_id: UUID;
-  event_id: string;
-  app_id: UUID;
-  role: 'viewer' | 'participant' | 'planner' | 'event_admin';
-}
-
-export interface OrganisationRoleData {
-  user_id: UUID;
-  organisation_id: UUID;
-  role: 'supporter' | 'member' | 'leader' | 'org_admin';
-}
-
-export interface GlobalRoleData {
-  user_id: UUID;
-  role: 'super_admin';
-}
-
-export interface RevokeEventAppRoleParams extends EventAppRoleData {
-  revoked_by?: UUID;
-}
-
-export interface GrantEventAppRoleParams extends EventAppRoleData {
-  granted_by?: UUID;
-  valid_from?: string;
-  valid_to?: string | null;
-}
-
-export interface RevokeOrganisationRoleParams extends OrganisationRoleData {
-  revoked_by?: UUID;
-}
-
-export interface GrantOrganisationRoleParams extends OrganisationRoleData {
-  granted_by?: UUID;
-  valid_from?: string;
-  valid_to?: string | null;
-}
-
-export interface RevokeGlobalRoleParams extends GlobalRoleData {
-  revoked_by?: UUID;
-}
-
-export interface GrantGlobalRoleParams extends GlobalRoleData {
-  granted_by?: UUID;
-  valid_from?: string;
-  valid_to?: string | null;
-}
-
-export interface RoleManagementResult {
-  success: boolean;
-  message?: string;
-  error?: string;
-  roleId?: UUID;
+import {
+  revokeEventAppRoleRpc,
+  grantEventAppRoleRpc,
+  revokeRoleByIdRpc,
+  grantGlobalRoleRpc,
+  revokeGlobalRoleRpc,
+  grantOrganisationRoleRpc,
+  revokeOrganisationRoleRpc,
+} from '../utils/roleManagementRpc';
+
+// Re-export types for public API (index.ts exports from this file)
+export type {
+  EventAppRoleData,
+  OrganisationRoleData,
+  GlobalRoleData,
+  RevokeEventAppRoleParams,
+  GrantEventAppRoleParams,
+  RevokeOrganisationRoleParams,
+  GrantOrganisationRoleParams,
+  RevokeGlobalRoleParams,
+  GrantGlobalRoleParams,
+  RoleManagementResult,
+} from '../types/roleManagement';
+
+function failureResult(errorMessage: string): RoleManagementResult {
+  return { success: false, error: errorMessage };
 }
 
 export function useRoleManagement() {
@@ -130,538 +107,129 @@ export function useRoleManagement() {
     throw new Error('useRoleManagement requires a Supabase client. Ensure UnifiedAuthProvider is configured.');
   }
 
-  /**
-   * Revoke an event app role using the unified RPC function
-   * 
-   * This function uses the `rbac_role_revoke` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (revoked_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role revocation parameters
-   * @returns Promise resolving to operation result
-   */
-  const revokeEventAppRole = useCallback(async (
-    params: RevokeEventAppRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      // Build context ID from event_id and app_id
-      const contextId = `${params.event_id}:${params.app_id}`;
-      
-      const rpcParams = {
-        p_user_id: params.user_id,
-        p_role_type: 'event_app' as const,
-        p_role_name: params.role,
-        p_context_id: contextId,
-        p_revoked_by: params.revoked_by || user?.id || undefined
-      };
-
-      // Log in development for debugging
-      if (import.meta.env.MODE === 'development') {
-        logger.debug('revokeEventAppRole called with:', rpcParams);
-      }
-
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', rpcParams);
-
-      if (rpcError) {
-        // Log full error details in development
-        if (import.meta.env.MODE === 'development') {
-          logger.error('RPC error:', {
-            message: rpcError.message,
-            details: rpcError.details,
-            hint: rpcError.hint,
-            code: rpcError.code,
-            fullError: rpcError
-          });
-        }
-        // Use just the message for the error (tests expect plain message)
-        const errorMessage = rpcError.message || 'Failed to revoke role - unknown RPC error';
-        throw new Error(errorMessage);
-      }
-
-      // Log response in development - ALWAYS log, even on failure
-      if (import.meta.env.MODE === 'development') {
-        logger.debug('RPC response:', { 
-          data, 
-          error: rpcError,
-          dataType: Array.isArray(data) ? 'array' : typeof data,
-          dataLength: Array.isArray(data) ? data.length : 'N/A'
-        });
-      }
-
-      // rbac_role_revoke returns a table with success, message, revoked_count, error_code
-      // It should always return at least one row
-      if (!data || !Array.isArray(data) || data.length === 0) {
-        const errorMsg = 'No response from database - role revocation may have failed';
-        if (import.meta.env.MODE === 'development') {
-          logger.error('Empty or null data response:', { 
-            data, 
-            dataType: typeof data,
-            isArray: Array.isArray(data),
-            length: Array.isArray(data) ? data.length : 'N/A'
-          });
-        }
-        throw new Error(errorMsg);
-      }
-
-      const result = data[0];
-
-      // ALWAYS log the result in development, even on failure
-      if (import.meta.env.MODE === 'development') {
-        logger.debug('RPC result:', {
-          success: result?.success,
-          message: result?.message,
-          error_code: result?.error_code,
-          revoked_count: result?.revoked_count,
-          fullResult: result
-        });
-      }
-
-      if (!result || result.success !== true) {
-        // Use message if available, otherwise fall back to error_code, otherwise default message
-        const errorMessage = result?.message || result?.error_code || 'Role revocation failed';
-        
-        if (import.meta.env.MODE === 'development') {
-          logger.error('Role revocation failed:', {
-            result,
-            errorMessage,
-            fullData: data,
-            rpcParams
-          });
-        }
-        
-        return {
-          success: false,
-          message: result?.message || undefined,
-          error: errorMessage
-        };
-      }
-
-      return {
-        success: true,
-        message: result.message || 'Role revoked successfully',
-        error: undefined
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      
-      if (import.meta.env.MODE === 'development') {
-        logger.error('Exception in revokeEventAppRole:', {
-          error: err,
-          errorMessage,
-          params
-        });
-      }
-      
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Grant an event app role using the secure RPC function
-   * 
-   * This function uses the `grant_event_app_role` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (granted_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role grant parameters
-   * @returns Promise resolving to operation result with role ID
-   */
-  const grantEventAppRole = useCallback(async (
-    params: GrantEventAppRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const { data, error: rpcError } = await supabase.rpc('grant_event_app_role', {
-        p_user_id: params.user_id,
-        p_organisation_id: params.organisation_id,
-        p_event_id: params.event_id,
-        p_app_id: params.app_id,
-        p_role: params.role,
-        p_granted_by: params.granted_by || user?.id || undefined,
-        p_valid_from: params.valid_from,
-        p_valid_to: params.valid_to
-      });
-
-      if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to grant role');
-      }
-
-      if (!data) {
-        return {
-          success: false,
-          error: 'Failed to grant role - no role ID returned'
-        };
-      }
-
-      return {
-        success: true,
-        message: 'Role granted successfully',
-        roleId: data as UUID
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Revoke an event app role by role ID (alternative method)
-   * 
-   * This fetches the role by ID first to get the required context (role name, event_id, app_id),
-   * then uses the unified `rbac_role_revoke` function to revoke it.
-   * 
-   * @param roleId - The role ID to revoke
-   * @returns Promise resolving to operation result
-   */
-  const revokeRoleById = useCallback(async (
-    roleId: UUID
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      // First, fetch the role by ID to get the required context
-      const { data: roleData, error: fetchError } = await supabase
-        .from('rbac_event_app_roles')
-        .select('user_id, role, event_id, app_id')
-        .eq('id', roleId)
-        .single();
-
-      if (fetchError || !roleData) {
-        throw new Error(fetchError?.message || 'Role not found');
-      }
-
-      // Construct context_id in the format required by rbac_role_revoke: "event_id:app_id"
-      const contextId = `${roleData.event_id}:${roleData.app_id}`;
-
-      // Now call rbac_role_revoke with the required parameters
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
-        p_user_id: roleData.user_id,
-        p_role_type: 'event_app',
-        p_role_name: roleData.role,
-        p_context_id: contextId,
-        p_revoked_by: user?.id || undefined
-      });
-
-      if (rpcError) {
-        // Use just the message for the error (tests expect plain message)
-        const errorMessage = rpcError.message || 'Failed to revoke role - unknown RPC error';
-        throw new Error(errorMessage);
-      }
-
-      // rbac_role_revoke returns a table with success, message, revoked_count, error_code
-      const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
-
-      // When data is empty array or null, return error as undefined (tests expect this)
-      if (!result) {
-        return {
-          success: false,
-          error: undefined
-        };
-      }
-
-      if (result.success === false) {
-        // Use message if available, otherwise fall back to error_code, otherwise default message
-        const errorMessage = result.message || result.error_code || 'Role revocation failed';
-        return {
-          success: false,
-          message: result.message || undefined,
-          error: errorMessage
-        };
-      }
-
-      return {
-        success: true,
-        message: result.message || 'Role revoked successfully',
-        error: undefined
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Grant a global role using the unified RPC function
-   * 
-   * This function uses the `rbac_role_grant` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (granted_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role grant parameters
-   * @returns Promise resolving to operation result with role ID
-   */
-  const grantGlobalRole = useCallback(async (
-    params: GrantGlobalRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_grant', {
-        p_user_id: params.user_id,
-        p_role_type: 'global',
-        p_role_name: params.role,
-        p_context_id: null, // Global roles don't need context
-        p_granted_by: params.granted_by || user?.id || undefined
-      });
-
-      if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to grant role');
-      }
-
-      // rbac_role_grant returns a table with success, message, role_id, error_code
-      const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
-
-      if (!result || !result.success) {
-        return {
-          success: false,
-          error: result?.message || result?.error_code || 'Failed to grant role',
-          message: result?.message
-        };
-      }
-
-      return {
-        success: true,
-        message: result.message || 'Role granted successfully',
-        roleId: result.role_id
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Revoke a global role using the unified RPC function
-   * 
-   * This function uses the `rbac_role_revoke` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (revoked_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role revocation parameters
-   * @returns Promise resolving to operation result
-   */
-  const revokeGlobalRole = useCallback(async (
-    params: RevokeGlobalRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
-        p_user_id: params.user_id,
-        p_role_type: 'global',
-        p_role_name: params.role,
-        p_context_id: null, // Global roles don't need context
-        p_revoked_by: params.revoked_by || user?.id || undefined
-      });
-
-      if (rpcError) {
-        // Include all available error information in the message
-        const errorParts = [
-          rpcError.message,
-          rpcError.details,
-          rpcError.hint,
-          rpcError.code ? `Error code: ${rpcError.code}` : null
-        ].filter(Boolean);
-        const errorMessage = errorParts.length > 0 
-          ? errorParts.join(' | ') 
-          : 'Failed to revoke role - unknown RPC error';
-        throw new Error(errorMessage);
-      }
-
-      // rbac_role_revoke returns a table with success, message, revoked_count, error_code
-      const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
-
-      return {
-        success: result?.success === true,
-        message: result?.message || undefined,
-        error: result?.success === false ? (result?.message || result?.error_code || 'Unknown error') : undefined
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Grant an organisation role using the unified RPC function
-   * 
-   * This function uses the `rbac_role_grant` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (granted_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role grant parameters
-   * @returns Promise resolving to operation result with role ID
-   */
-  const grantOrganisationRole = useCallback(async (
-    params: GrantOrganisationRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_grant', {
-        p_user_id: params.user_id,
-        p_role_type: 'organisation',
-        p_role_name: params.role,
-        p_context_id: params.organisation_id, // Organisation ID as context
-        p_granted_by: params.granted_by || user?.id || undefined
-      });
-
-      if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to grant role');
-      }
-
-      // rbac_role_grant returns a table with success, message, role_id, error_code
-      const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
-
-      if (!result || !result.success) {
-        return {
-          success: false,
-          error: result?.message || result?.error_code || 'Failed to grant role',
-          message: result?.message
-        };
-      }
-
-      return {
-        success: true,
-        message: result.message || 'Role granted successfully',
-        roleId: result.role_id
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
-
-  /**
-   * Revoke an organisation role using the unified RPC function
-   * 
-   * This function uses the `rbac_role_revoke` RPC which:
-   * - Runs with SECURITY DEFINER privileges
-   * - Includes proper permission checks
-   * - Automatically populates audit fields (revoked_by, timestamps)
-   * - Complies with Row-Level Security policies
-   * 
-   * @param params - Role revocation parameters
-   * @returns Promise resolving to operation result
-   */
-  const revokeOrganisationRole = useCallback(async (
-    params: RevokeOrganisationRoleParams
-  ): Promise<RoleManagementResult> => {
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
-        p_user_id: params.user_id,
-        p_role_type: 'organisation',
-        p_role_name: params.role,
-        p_context_id: params.organisation_id, // Organisation ID as context
-        p_revoked_by: params.revoked_by || user?.id || undefined
-      });
-
-      if (rpcError) {
-        // Include all available error information in the message
-        const errorParts = [
-          rpcError.message,
-          rpcError.details,
-          rpcError.hint,
-          rpcError.code ? `Error code: ${rpcError.code}` : null
-        ].filter(Boolean);
-        const errorMessage = errorParts.length > 0 
-          ? errorParts.join(' | ') 
-          : 'Failed to revoke role - unknown RPC error';
-        throw new Error(errorMessage);
-      }
-
-      // rbac_role_revoke returns a table with success, message, revoked_count, error_code
-      const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
-
-      return {
-        success: result?.success === true,
-        message: result?.message || undefined,
-        error: result?.success === false ? (result?.message || result?.error_code || 'Unknown error') : undefined
-      };
-    } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
-      setError(err instanceof Error ? err : new Error(errorMessage));
-      return {
-        success: false,
-        error: errorMessage
-      };
-    } finally {
-      setIsLoading(false);
-    }
-  }, [user?.id, supabase]);
+  const runWithLoading = useCallback(
+    async <T>(fn: () => Promise<T>): Promise<T> => {
+      setIsLoading(true);
+      setError(null);
+      try {
+        return await fn();
+      } catch (err) {
+        setError(err instanceof Error ? err : new Error(String(err)));
+        throw err;
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    []
+  );
+
+  const revokeEventAppRole = useCallback(
+    async (params: RevokeEventAppRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          revokeEventAppRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const grantEventAppRole = useCallback(
+    async (params: GrantEventAppRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          grantEventAppRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const revokeRoleById = useCallback(
+    async (roleId: UUID): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          revokeRoleByIdRpc(supabase, roleId, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const grantGlobalRole = useCallback(
+    async (params: GrantGlobalRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          grantGlobalRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const revokeGlobalRole = useCallback(
+    async (params: RevokeGlobalRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          revokeGlobalRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const grantOrganisationRole = useCallback(
+    async (params: GrantOrganisationRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          grantOrganisationRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+
+  const revokeOrganisationRole = useCallback(
+    async (params: RevokeOrganisationRoleParams): Promise<RoleManagementResult> => {
+      try {
+        return await runWithLoading(() =>
+          revokeOrganisationRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : 'Unknown error occurred';
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
 
   return {
-    // Event app roles (existing)
     revokeEventAppRole,
     grantEventAppRole,
     revokeRoleById,
-    // Global roles (new)
     grantGlobalRole,
     revokeGlobalRole,
-    // Organisation roles (new)
     grantOrganisationRole,
     revokeOrganisationRole,
-    // Shared state
     isLoading,
-    error
+    error,
   };
 }
-