@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/security.test.ts

@@ -480,3 +480,326 @@ describe('Default Security Config', () => {
     expect(DEFAULT_SECURITY_CONFIG.suspiciousActivityThreshold).toBeGreaterThan(0);
   });
 });
+
+describe('RBACSecurityValidator - Additional Edge Cases', () => {
+  describe('validatePermissionHierarchy', () => {
+    it('validates hierarchy correctly for all operations', () => {
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'update')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'delete')).toBe(true);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'update')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'delete')).toBe(false);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'update')).toBe(false);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'create')).toBe(false);
+    });
+
+    it('returns false for invalid permission in hierarchy check', () => {
+      expect(RBACSecurityValidator.validatePermissionHierarchy('invalid:users', 'read')).toBe(false);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'invalid')).toBe(false);
+    });
+  });
+
+  describe('sanitizeInput', () => {
+    it('removes HTML tags', () => {
+      // sanitizeInput removes HTML tags, then removes () characters, so alert("xss") becomes alertxss
+      expect(RBACSecurityValidator.sanitizeInput('test<script>alert("xss")</script>test')).toBe('testalertxsstest');
+      expect(RBACSecurityValidator.sanitizeInput('<div>content</div>')).toBe('content');
+    });
+
+    it('removes dangerous characters', () => {
+      expect(RBACSecurityValidator.sanitizeInput('test"quotes"')).toBe('testquotes');
+      expect(RBACSecurityValidator.sanitizeInput('test\'apostrophe\'')).toBe('testapostrophe');
+      expect(RBACSecurityValidator.sanitizeInput('test&ampersand&')).toBe('testampersand');
+      expect(RBACSecurityValidator.sanitizeInput('test;semicolon;')).toBe('testsemicolon');
+      expect(RBACSecurityValidator.sanitizeInput('test(parentheses)')).toBe('testparentheses');
+    });
+
+    it('removes javascript: protocol', () => {
+      // sanitizeInput removes javascript: protocol, then removes () characters
+      expect(RBACSecurityValidator.sanitizeInput('javascript:alert("xss")')).toBe('alertxss');
+      expect(RBACSecurityValidator.sanitizeInput('JAVASCRIPT:alert("xss")')).toBe('alertxss');
+    });
+
+    it('removes data: protocol', () => {
+      // sanitizeInput removes data: protocol, then removes HTML tags and () characters
+      expect(RBACSecurityValidator.sanitizeInput('data:text/html,<script>alert("xss")</script>')).toBe('text/html,alertxss');
+      expect(RBACSecurityValidator.sanitizeInput('DATA:text/html,content')).toBe('text/html,content');
+    });
+
+    it('trims whitespace', () => {
+      expect(RBACSecurityValidator.sanitizeInput('  test  ')).toBe('test');
+      expect(RBACSecurityValidator.sanitizeInput('\n\ttest\n\t')).toBe('test');
+    });
+  });
+
+  describe('validateScope - Edge Cases', () => {
+    it('rejects scope with empty string organisationId', () => {
+      const scope: Scope = {
+        organisationId: '' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(false);
+    });
+
+    it('rejects scope with whitespace-only organisationId', () => {
+      const scope: Scope = {
+        organisationId: '   ' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(false);
+    });
+
+    it('accepts scope with only eventId', () => {
+      const scope: Scope = {
+        eventId: 'event-123',
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(true);
+    });
+
+    it('accepts scope with only appId', () => {
+      const scope: Scope = {
+        appId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(true);
+    });
+  });
+
+  describe('logSecurityEvent - Event Types', () => {
+    beforeEach(() => {
+      vi.stubEnv('MODE', 'development');
+      vi.clearAllMocks();
+    });
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+    });
+
+    it('logs different event types with correct severity', () => {
+      const eventTypes = [
+        'permission_denied',
+        'invalid_input',
+        'rate_limit_exceeded',
+        'suspicious_activity',
+        'network_error',
+        'database_error',
+        'validation_error',
+        'rate_limit_error',
+        'authentication_error',
+        'unknown_error',
+      ] as const;
+
+      eventTypes.forEach(eventType => {
+        vi.clearAllMocks();
+        RBACSecurityValidator.logSecurityEvent({
+          type: eventType,
+          userId: 'user-123' as UUID,
+          details: { test: 'data' },
+        });
+
+        const logger = getMockLogger();
+        expect(vi.mocked(logger.warn)).toHaveBeenCalled();
+      });
+    });
+
+    it('includes timestamp in security events', () => {
+      const beforeTime = new Date();
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'invalid_input',
+        userId: 'user-123' as UUID,
+        details: { test: 'data' },
+      });
+      const afterTime = new Date();
+
+      const logger = getMockLogger();
+      const callArgs = vi.mocked(logger.warn).mock.calls[0];
+      const event = callArgs[1] as { timestamp?: Date };
+      
+      expect(event.timestamp).toBeInstanceOf(Date);
+      expect(event.timestamp!.getTime()).toBeGreaterThanOrEqual(beforeTime.getTime());
+      expect(event.timestamp!.getTime()).toBeLessThanOrEqual(afterTime.getTime());
+    });
+
+    it('includes severity in security events', () => {
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'database_error',
+        userId: 'user-123' as UUID,
+        details: { test: 'data' },
+      });
+
+      const logger = getMockLogger();
+      const callArgs = vi.mocked(logger.warn).mock.calls[0];
+      const event = callArgs[1] as { severity?: string };
+      
+      expect(event.severity).toBe('critical');
+    });
+  });
+});
+
+describe('RBACSecurityMiddleware - Additional Tests', () => {
+  let middleware: RBACSecurityMiddleware;
+
+  beforeEach(() => {
+    middleware = new RBACSecurityMiddleware(DEFAULT_SECURITY_CONFIG);
+  });
+
+  describe('Rate Limiting - Edge Cases', () => {
+    it('disables rate limiting when config disabled', async () => {
+      const disabledMiddleware = new RBACSecurityMiddleware({
+        ...DEFAULT_SECURITY_CONFIG,
+        enableRateLimiting: false,
+      });
+
+      const context = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+        timestamp: new Date(),
+      };
+
+      // Make many requests - should all be allowed
+      for (let i = 0; i < 2000; i++) {
+        const result = await disabledMiddleware.checkRateLimit(context);
+        expect(result.isAllowed).toBe(true);
+        expect(result.remaining).toBe(DEFAULT_SECURITY_CONFIG.maxPermissionChecksPerMinute);
+      }
+    });
+
+    it('clears expired entries periodically', async () => {
+      const context = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+        timestamp: new Date(),
+      };
+
+      // Make requests to populate cache
+      for (let i = 0; i < 10; i++) {
+        await middleware.checkRateLimit(context);
+      }
+
+      // The cleanup interval should eventually clear old entries
+      // We can't easily test the interval, but we can verify the method exists
+      expect(middleware).toBeDefined();
+    });
+  });
+
+  describe('Input Validation - Additional Cases', () => {
+    it('validates IP address format when enabled', async () => {
+      const result = await middleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          ipAddress: 123 as any, // Invalid IP
+          timestamp: new Date(),
+        }
+      );
+
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Invalid IP address format');
+    });
+
+    it('validates user agent format when enabled', async () => {
+      const result = await middleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          userAgent: 123 as any, // Invalid user agent
+          timestamp: new Date(),
+        }
+      );
+
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Invalid user agent format');
+    });
+
+    it('skips IP and user agent validation when disabled', async () => {
+      const disabledMiddleware = new RBACSecurityMiddleware({
+        ...DEFAULT_SECURITY_CONFIG,
+        enableInputValidation: false,
+      });
+
+      const result = await disabledMiddleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          ipAddress: 123 as any, // Invalid but should be ignored
+          userAgent: 123 as any, // Invalid but should be ignored
+          timestamp: new Date(),
+        }
+      );
+
+      // Should still validate core fields (userId, permission, scope)
+      expect(result.isValid).toBe(true);
+    });
+  });
+
+  describe('Rate Limit Throttling - Additional Cases', () => {
+    beforeEach(() => {
+      vi.stubEnv('MODE', 'development');
+      vi.clearAllMocks();
+      // Note: The static rateLimitWarningCount Map persists across tests
+      // This is expected behavior - the throttling is per-user and persists
+      // Tests should use different userIds or account for previous test state
+    });
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+    });
+
+    it('throttles multiple warnings within time window', () => {
+      // Use a unique userId for this test to avoid interference from other tests
+      const userId = 'throttle-test-user-1' as UUID;
+
+      // Make many rate limit events quickly
+      for (let i = 0; i < 20; i++) {
+        RBACSecurityValidator.logSecurityEvent({
+          type: 'rate_limit_exceeded',
+          userId,
+          details: { remaining: 0 },
+        });
+      }
+
+      const logger = getMockLogger();
+      // Should only log once (first event) due to throttling
+      // Note: If this test runs after another test with the same userId, it may log more than once
+      expect(vi.mocked(logger.warn)).toHaveBeenCalledTimes(1);
+    });
+
+    it('logs suppressed warnings after throttle window', async () => {
+      // Use a unique userId for this test to avoid interference from other tests
+      const userId = 'throttle-test-user-2' as UUID;
+      vi.clearAllMocks();
+
+      // Make multiple events
+      for (let i = 0; i < 5; i++) {
+        RBACSecurityValidator.logSecurityEvent({
+          type: 'rate_limit_exceeded',
+          userId,
+          details: { remaining: 0 },
+        });
+      }
+
+      // Wait for throttle window to expire (5 seconds)
+      await new Promise(resolve => setTimeout(resolve, 5100));
+
+      // Make another event - should log with suppressed count
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'rate_limit_exceeded',
+        userId,
+        details: { remaining: 0 },
+      });
+
+      const logger = getMockLogger();
+      // Should have logged at least twice (first + after throttle)
+      expect(vi.mocked(logger.warn).mock.calls.length).toBeGreaterThanOrEqual(2);
+    });
+  });
+});

package/src/rbac/types/roleManagement.ts

@@ -0,0 +1,66 @@
+/**
+ * RBAC Role Management Types
+ * @package @jmruthers/pace-core
+ * @module RBAC/Types/RoleManagement
+ * @since 2.1.0
+ *
+ * Types for role management RPC params and results (event app, global, organisation).
+ */
+
+import type { UUID } from '../types';
+
+export interface EventAppRoleData {
+  user_id: UUID;
+  organisation_id: UUID;
+  event_id: string;
+  app_id: UUID;
+  role: 'viewer' | 'participant' | 'planner' | 'event_admin';
+}
+
+export interface OrganisationRoleData {
+  user_id: UUID;
+  organisation_id: UUID;
+  role: 'supporter' | 'member' | 'leader' | 'org_admin';
+}
+
+export interface GlobalRoleData {
+  user_id: UUID;
+  role: 'super_admin';
+}
+
+export interface RevokeEventAppRoleParams extends EventAppRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantEventAppRoleParams extends EventAppRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RevokeOrganisationRoleParams extends OrganisationRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantOrganisationRoleParams extends OrganisationRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RevokeGlobalRoleParams extends GlobalRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantGlobalRoleParams extends GlobalRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RoleManagementResult {
+  success: boolean;
+  message?: string;
+  error?: string;
+  roleId?: UUID;
+}

package/src/rbac/utils/{__tests__/clientSecurity.test.ts → clientSecurity.test.ts}

@@ -1,7 +1,7 @@
 /**
  * @file Client Security Tests
  * @package @jmruthers/pace-core
- * @module RBAC/Utils/__tests__
+ * @module RBAC/Utils
  * @since 1.0.0
  */
 
@@ -9,7 +9,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 
 // Mock Logger - use vi.hoisted() pattern that works in other tests
 const mockLoggerWarn = vi.hoisted(() => vi.fn());
-vi.mock('../../../utils/core/logger', () => ({
+vi.mock('../../utils/core/logger', () => ({
   Logger: {
     warn: mockLoggerWarn,
   },
@@ -26,9 +26,9 @@ import {
   warnIfInsecureClient,
   markClientAsSecure,
   SECURE_CLIENT_SYMBOL,
-} from '../clientSecurity';
+} from './clientSecurity';
 import type { SupabaseClient } from '@supabase/supabase-js';
-import type { Database } from '../../../types/database';
+import type { Database } from '../../types/database';
 
 describe('Client Security', () => {
   let mockClient: SupabaseClient<Database>;

package/src/rbac/utils/{__tests__/contextValidator.test.ts → contextValidator.test.ts}

@@ -1,8 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { SupabaseClient } from '@supabase/supabase-js';
-import { ContextValidator } from '../contextValidator';
-import { EventContextRequiredError, OrganisationContextRequiredError, type Scope } from '../../types';
-import type { Database } from '../../../types/database';
+import { ContextValidator } from './contextValidator';
+import { EventContextRequiredError, OrganisationContextRequiredError, type Scope } from '../types';
+import type { Database } from '../../types/database';
 
 describe('ContextValidator', () => {
 
@@ -20,7 +20,7 @@ describe('ContextValidator', () => {
     it('derives organisation ID from event ID', async () => {
       const supabase = createSupabaseMock();
       // Mock the underlying function
-      vi.spyOn(await import('../eventContext'), 'getOrganisationFromEvent').mockResolvedValue('derived-org' as any);
+      vi.spyOn(await import('./eventContext'), 'getOrganisationFromEvent').mockResolvedValue({ ok: true, data: 'derived-org' as any });
 
       const result = await ContextValidator.deriveOrgFromEvent(supabase, 'event-1');
 

package/src/rbac/utils/contextValidator.ts

@@ -60,7 +60,11 @@ export class ContextValidator {
     supabase: SupabaseClient<Database>,
     eventId: string
   ): Promise<UUID | null> {
-    return getOrganisationFromEvent(supabase, eventId);
+    const result = await getOrganisationFromEvent(supabase, eventId);
+    if (!result.ok) {
+      return null;
+    }
+    return result.data;
   }
 
   /**

package/src/rbac/utils/{__tests__/deep-equal.test.ts → deep-equal.test.ts}

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { deepEqual, scopeEqual } from '../deep-equal';
+import { deepEqual, scopeEqual } from './deep-equal';
 import type { Scope } from '../../types';
 
 describe('deepEqual', () => {

package/src/rbac/utils/{__tests__/eventContext.test.ts → eventContext.test.ts}

@@ -9,7 +9,7 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { Database } from '../../../types/database';
+import { Database } from '../../types/database';
 import { Scope } from '../../types';
 import {
   getOrganisationFromEvent,
@@ -17,7 +17,7 @@ import {
   isEventBasedScope,
   isValidEventBasedScope,
   clearAllOrgDerivationCache
-} from '../eventContext';
+} from './eventContext';
 
 // Mock Supabase client
 const createMockSupabaseClient = () => {
@@ -62,7 +62,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, eventId);
 
-      expect(result).toBe(organisationId);
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBe(organisationId);
       expect(mockSupabase.from).toHaveBeenCalledWith('core_events');
       expect(mockQuery.select).toHaveBeenCalledWith('organisation_id');
       expect(mockQuery.eq).toHaveBeenCalledWith('event_id', eventId);
@@ -79,7 +80,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, eventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.code).toBe('ORG_FROM_EVENT_FAILED');
     });
 
     it('should return null when data is null', async () => {
@@ -92,7 +94,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, eventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBeNull();
     });
 
     it('should handle database errors gracefully', async () => {
@@ -101,8 +104,9 @@ describe('Event Context Utilities', () => {
       
       mockQuery.single.mockRejectedValue(dbError);
 
-      await expect(getOrganisationFromEvent(mockSupabase, eventId))
-        .rejects.toThrow('Database connection failed');
+      const result = await getOrganisationFromEvent(mockSupabase, eventId);
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.message).toContain('Database connection failed');
     });
 
     it('should handle empty organisation_id', async () => {
@@ -115,7 +119,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, eventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBeNull();
     });
   });
 
@@ -132,7 +137,8 @@ describe('Event Context Utilities', () => {
 
       const result = await createScopeFromEvent(mockSupabase, eventId, appId);
 
-      expect(result).toEqual({
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toEqual({
         organisationId,
         eventId,
         appId
@@ -150,7 +156,8 @@ describe('Event Context Utilities', () => {
 
       const result = await createScopeFromEvent(mockSupabase, eventId);
 
-      expect(result).toEqual({
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toEqual({
         organisationId,
         eventId,
         appId: undefined
@@ -167,7 +174,7 @@ describe('Event Context Utilities', () => {
 
       const result = await createScopeFromEvent(mockSupabase, eventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(false);
     });
 
     it('should return null when organisation lookup fails', async () => {
@@ -180,7 +187,8 @@ describe('Event Context Utilities', () => {
 
       const result = await createScopeFromEvent(mockSupabase, eventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBeNull();
     });
 
     it('should handle database errors gracefully', async () => {
@@ -189,8 +197,9 @@ describe('Event Context Utilities', () => {
       
       mockQuery.single.mockRejectedValue(dbError);
 
-      await expect(createScopeFromEvent(mockSupabase, eventId))
-        .rejects.toThrow('Database connection failed');
+      const result = await createScopeFromEvent(mockSupabase, eventId);
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.message).toContain('Database connection failed');
     });
   });
 
@@ -282,7 +291,7 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, malformedEventId);
 
-      expect(result).toBeNull();
+      expect(result.ok).toBe(false);
     });
 
     it('should handle very long event IDs', async () => {
@@ -296,7 +305,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, longEventId);
 
-      expect(result).toBe(organisationId);
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBe(organisationId);
       expect(mockQuery.eq).toHaveBeenCalledWith('event_id', longEventId);
     });
 
@@ -311,7 +321,8 @@ describe('Event Context Utilities', () => {
 
       const result = await getOrganisationFromEvent(mockSupabase, specialEventId);
 
-      expect(result).toBe(organisationId);
+      expect(result.ok).toBe(true);
+      expect(result.ok && result.data).toBe(organisationId);
       expect(mockQuery.eq).toHaveBeenCalledWith('event_id', specialEventId);
     });
 
@@ -336,8 +347,10 @@ describe('Event Context Utilities', () => {
         getOrganisationFromEvent(mockSupabase, eventId2)
       ]);
 
-      expect(result1).toBe(organisationId1);
-      expect(result2).toBe(organisationId2);
+      expect(result1.ok).toBe(true);
+      expect(result1.ok && result1.data).toBe(organisationId1);
+      expect(result2.ok).toBe(true);
+      expect(result2.ok && result2.data).toBe(organisationId2);
     });
 
     it('should handle concurrent calls to createScopeFromEvent', async () => {
@@ -363,12 +376,14 @@ describe('Event Context Utilities', () => {
         createScopeFromEvent(mockSupabase, eventId2, appId2)
       ]);
 
-      expect(result1).toEqual({
+      expect(result1.ok).toBe(true);
+      expect(result1.ok && result1.data).toEqual({
         organisationId: organisationId1,
         eventId: eventId1,
         appId: appId1
       });
-      expect(result2).toEqual({
+      expect(result2.ok).toBe(true);
+      expect(result2.ok && result2.data).toEqual({
         organisationId: organisationId2,
         eventId: eventId2,
         appId: appId2