@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/secureClient.test.ts

@@ -13,7 +13,7 @@ import {
   createSecureClient, 
   fromSupabaseClient 
 } from './secureClient';
-import { UUID } from './types';
+import { UUID, OrganisationContextRequiredError } from './types';
 
 // Mock the Supabase createClient function
 vi.mock('@supabase/supabase-js', () => ({
@@ -24,22 +24,34 @@ import { createClient } from '@supabase/supabase-js';
 const mockCreateClient = vi.mocked(createClient);
 
 // Mock Supabase client
-const createMockSupabaseClient = () => ({
-  from: vi.fn(() => ({
-    select: vi.fn().mockReturnThis(),
-    insert: vi.fn().mockReturnThis(),
-    update: vi.fn().mockReturnThis(),
-    delete: vi.fn().mockReturnThis(),
-    eq: vi.fn().mockReturnThis(),
-    single: vi.fn().mockResolvedValue({ data: null, error: null }),
-    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null })
-  })),
-  rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
-  auth: {
-    getUser: vi.fn().mockResolvedValue({ data: { user: null }, error: null }),
-    getSession: vi.fn().mockResolvedValue({ data: { session: null }, error: null })
-  }
-});
+const createMockSupabaseClient = () => {
+  const createQueryBuilder = () => {
+    const promise = Promise.resolve({ data: null, error: null });
+    const builder = Object.assign(promise, {
+      select: vi.fn().mockReturnThis(),
+      insert: vi.fn().mockReturnThis(),
+      update: vi.fn().mockReturnThis(),
+      delete: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      or: vi.fn().mockReturnThis(),
+      single: vi.fn().mockResolvedValue({ data: null, error: null }),
+      maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null })
+    });
+    return builder;
+  };
+  
+  return {
+    from: vi.fn(() => createQueryBuilder()),
+    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+    functions: {
+      invoke: vi.fn().mockResolvedValue({ data: null, error: null })
+    },
+    auth: {
+      getUser: vi.fn().mockResolvedValue({ data: { user: null }, error: null }),
+      getSession: vi.fn().mockResolvedValue({ data: { session: null }, error: null })
+    }
+  };
+};
 
 describe('SecureSupabaseClient', () => {
   let mockSupabase: any;
@@ -280,38 +292,38 @@ describe('SecureSupabaseClient', () => {
   });
 });
 
-  describe('createSecureClient', () => {
-    beforeEach(() => {
-      const mockSupabase = createMockSupabaseClient();
-      mockCreateClient.mockReturnValue(mockSupabase as any);
-    });
+describe('createSecureClient', () => {
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
 
-    it('creates secure client with minimal parameters', () => {
-      const client = createSecureClient(
-        'https://test.supabase.co',
-        'test-key',
-        'org-123' as UUID
-      );
+  it('creates secure client with minimal parameters', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      'org-123' as UUID
+    );
 
-      expect(client).toBeInstanceOf(SecureSupabaseClient);
-      expect(client.getOrganisationId()).toBe('org-123');
-    });
+    expect(client).toBeInstanceOf(SecureSupabaseClient);
+    expect(client.getOrganisationId()).toBe('org-123');
+  });
 
-    it('creates secure client with all parameters', () => {
-      const client = createSecureClient(
-        'https://test.supabase.co',
-        'test-key',
-        'org-123' as UUID,
-        'event-456',
-        'app-789' as UUID
-      );
+  it('creates secure client with all parameters', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      'org-123' as UUID,
+      'event-456',
+      'app-789' as UUID
+    );
 
-      expect(client).toBeInstanceOf(SecureSupabaseClient);
-      expect(client.getOrganisationId()).toBe('org-123');
-      expect(client.getEventId()).toBe('event-456');
-      expect(client.getAppId()).toBe('app-789');
-    });
+    expect(client).toBeInstanceOf(SecureSupabaseClient);
+    expect(client.getOrganisationId()).toBe('org-123');
+    expect(client.getEventId()).toBe('event-456');
+    expect(client.getAppId()).toBe('app-789');
   });
+});
 
 describe('fromSupabaseClient', () => {
   it('converts existing Supabase client to secure client', () => {
@@ -349,53 +361,472 @@ describe('fromSupabaseClient', () => {
   });
 });
 
-  describe('Integration with RBAC', () => {
-    let mockSupabase: any;
+describe('Integration with RBAC', () => {
+  let mockSupabase: any;
 
-    beforeEach(() => {
-      mockSupabase = createMockSupabaseClient();
-      mockCreateClient.mockReturnValue(mockSupabase as any);
-    });
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
 
-    it('works with RBAC permission checks', async () => {
-      const client = createSecureClient(
-        'https://test.supabase.co',
-        'test-key',
-        'org-123' as UUID
-      );
+  it('works with RBAC permission checks', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      'org-123' as UUID
+    );
 
-      // Mock permission check
-      const rpcSpy = vi
-        .spyOn(client.getClient() as any, 'rpc')
-        .mockResolvedValue({
-          data: [{ permission: 'read:users', allowed: true }],
-          error: null
-        });
-
-      const result = await client.getClient().rpc('check_permission', {
-        user_id: 'user-123',
-        permission: 'read:users'
+    // Mock permission check
+    const rpcSpy = vi
+      .spyOn(client.getClient() as any, 'rpc')
+      .mockResolvedValue({
+        data: [{ permission: 'read:users', allowed: true }],
+        error: null
       });
 
-      expect(result.data).toBeDefined();
-      expect(result.error).toBeNull();
-      rpcSpy.mockRestore();
+    const result = await client.getClient().rpc('check_permission', {
+      user_id: 'user-123',
+      permission: 'read:users'
     });
 
-    it('maintains separate organisation contexts for different clients', () => {
-      const client1 = createSecureClient(
-        'https://test.supabase.co',
-        'test-key',
-        'org-123' as UUID
-      );
+    expect(result.data).toBeDefined();
+    expect(result.error).toBeNull();
+    rpcSpy.mockRestore();
+  });
 
-      const client2 = createSecureClient(
-        'https://test.supabase.co',
-        'test-key',
-        'org-456' as UUID
-      );
+  it('maintains separate organisation contexts for different clients', () => {
+    const client1 = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      'org-123' as UUID
+    );
+
+    const client2 = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      'org-456' as UUID
+    );
+
+    expect(client1.getOrganisationId()).toBe('org-123');
+    expect(client2.getOrganisationId()).toBe('org-456');
+  });
+});
+
+describe('RPC Parameter Injection', () => {
+  const mockOrgId = 'org-123' as UUID;
+  const mockEventId = 'event-456';
+  const mockAppId = 'app-789' as UUID;
+  let mockSupabase: any;
+
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+
+  it('injects context parameters for whitelisted RPCs', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('data_rbac_roles_list', {});
+    
+    // data_rbac_roles_list: only p_organisation_id is injected (not p_event_id/p_app_id)
+    // so that Edit User can load all event-app roles for a user
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({
+        p_organisation_id: mockOrgId,
+      }),
+      undefined
+    );
+  });
+
+  it('does not inject parameters for non-whitelisted RPCs', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('some_other_function', {});
+    
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'some_other_function',
+      {},
+      undefined
+    );
+  });
 
-      expect(client1.getOrganisationId()).toBe('org-123');
-      expect(client2.getOrganisationId()).toBe('org-456');
+  it('does not overwrite explicitly provided RPC parameters', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('data_rbac_roles_list', {
+      p_organisation_id: 'different-org' as UUID,
     });
+    
+    // data_rbac_roles_list: only p_organisation_id is injected (not p_event_id/p_app_id)
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({
+        p_organisation_id: 'different-org',
+      }),
+      undefined
+    );
+  });
+
+  it('allows global RPCs without organisation context', async () => {
+    const clientWithoutOrg = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      false
+    );
+
+    const rpcSpy = vi.spyOn(clientWithoutOrg.getClient() as any, 'rpc');
+    
+    await expect(
+      clientWithoutOrg.getClient().rpc('data_rbac_apps_list', {})
+    ).resolves.toBeDefined();
+    
+    expect(rpcSpy).toHaveBeenCalled();
   });
+
+  it('rejects data_rbac_roles_list when organisationId is null and caller is not super admin', () => {
+    const clientWithoutOrg = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      false
+    );
+
+    expect(() => {
+      clientWithoutOrg.getClient().rpc('data_rbac_roles_list', { p_user_id: 'user-123' as UUID });
+    }).toThrow(OrganisationContextRequiredError);
+  });
+});
+
+describe('Super Admin Bypass', () => {
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('allows queries without organisation context for super admins', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    expect(() => {
+      superAdminClient.getClient().from('users').select('*');
+    }).not.toThrow();
+  });
+
+  it('allows inserts without organisation context for super admins', async () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    await expect(
+      superAdminClient.getClient().from('users').insert({ name: 'Test' })
+    ).resolves.toBeDefined();
+  });
+
+  it('allows queries to system-wide tables for super admins', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    expect(() => {
+      superAdminClient.getClient().from('core_organisations').select('*');
+    }).not.toThrow();
+  });
+
+  it('allows data_rbac_roles_list when organisationId is null and caller is super admin', async () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    const rpcSpy = vi.spyOn(superAdminClient.getClient() as any, 'rpc');
+
+    await expect(
+      superAdminClient.getClient().rpc('data_rbac_roles_list', { p_user_id: 'user-123' as UUID })
+    ).resolves.toBeDefined();
+
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({ p_user_id: 'user-123' })
+    );
+  });
+});
+
+describe('Table-Specific Logic', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('skips organisation filter for core_organisations table', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('core_organisations').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('skips organisation filter for rbac_apps table', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('rbac_apps').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('handles rbac_user_profiles with conditional filtering', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('rbac_user_profiles').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('allows super admin to query rbac_user_profiles without filter', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    const query = superAdminClient.getClient().from('rbac_user_profiles').select('*');
+    
+    expect(query).toBeDefined();
+  });
+});
+
+describe('Edge Function Client', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('returns edge function client without custom headers', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const edgeClient = client.getEdgeFunctionClient();
+    
+    expect(edgeClient).toBeDefined();
+    expect(edgeClient).not.toBe(client.getClient());
+  });
+
+  it('uses existing client for edge functions when reusing client', () => {
+    const existingClient = createMockSupabaseClient();
+    const secureClient = fromSupabaseClient(
+      existingClient as any,
+      mockOrgId
+    );
+
+    const edgeClient = secureClient.getEdgeFunctionClient();
+    
+    expect(edgeClient).toBe(existingClient);
+  });
+
+  it('proxies functions.invoke to edge function client', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const proxiedClient = client.getClient();
+    
+    expect(proxiedClient.functions).toBeDefined();
+  });
+});
+
+describe('Insert Context Injection', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('injects organisation_id for regular tables', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').insert({ name: 'Test' })
+    ).resolves.toBeDefined();
+  });
+
+  it('does not inject organisation_id for tables without it', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('rbac_apps').insert({ name: 'Test App' })
+    ).resolves.toBeDefined();
+  });
+
+  it('handles array inserts with organisation context', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').insert([
+        { name: 'User 1' },
+        { name: 'User 2' }
+      ])
+    ).resolves.toBeDefined();
+  });
+});
+
+describe('Update and Delete Context Filtering', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('adds organisation filter to update queries', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').update({ name: 'Updated' }).eq('id', 'user-123')
+    ).resolves.toBeDefined();
+  });
+
+  it('adds organisation filter to delete queries', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').delete().eq('id', 'user-123')
+    ).resolves.toBeDefined();
+  });
+});
+
+describe('withContext', () => {
+  const mockOrgId = 'org-123' as UUID;
+  const mockEventId = 'event-456';
+  const mockAppId = 'app-789' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('creates new client with updated super admin status', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const superAdminClient = client.withContext({ isSuperAdmin: true });
+    
+    expect(superAdminClient).toBeInstanceOf(SecureSupabaseClient);
+    expect(superAdminClient).not.toBe(client);
+  });
+
+  it('preserves all context when updating one field', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+
+    const newClient = client.withContext({ organisationId: 'new-org' as UUID });
+    
+    expect(newClient.getOrganisationId()).toBe('new-org');
+    expect(newClient.getEventId()).toBe(mockEventId);
+    expect(newClient.getAppId()).toBe(mockAppId);
+  });
+});

package/src/rbac/secureClient.ts

@@ -48,6 +48,10 @@ export class SecureSupabaseClient {
    *
    * This allowlist enables compliant consuming apps to use `secureSupabase.rpc(...)`
    * even before an organisation is selected (common during initial page load/refresh).
+   *
+   * IMPORTANT: Do NOT add `data_rbac_roles_list` here. Only super admins may call
+   * that RPC without org context (e.g. "All Organizations" / event roles). The
+   * org check is skipped in validateContextForRpc when isSuperAdmin is true.
    */
   private static readonly GLOBAL_RPC_ALLOWLIST = new Set<string>([
     'data_rbac_apps_list',
@@ -555,8 +559,10 @@ export class SecureSupabaseClient {
     //    SELECT pg_get_function_identity_arguments(oid) FROM pg_proc WHERE proname = 'function_name';
     // 2. Add it here with the parameters it accepts
     const rpcContextWhitelist: Record<string, Set<string>> = {
-      // RPCs that accept all three context parameters
-      'data_rbac_roles_list': new Set(['p_organisation_id', 'p_event_id', 'p_app_id']),
+      // Only inject p_organisation_id for data_rbac_roles_list. Do NOT inject p_event_id/p_app_id:
+      // when editing a user we need all event-app roles for that user; injecting current event/app
+      // would filter to a single event-app and show only one role instead of all (e.g. 3).
+      'data_rbac_roles_list': new Set(['p_organisation_id']),
       
       // RPCs that accept only p_organisation_id (not p_app_id or p_event_id)
       'data_file_reference_by_category_list': new Set(['p_organisation_id']),