@jmruthers/pace-core 0.6.10 → 0.6.11

package/src/rbac/utils/eventContext.ts

@@ -11,6 +11,7 @@
 import type { PostgrestError, SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../../types/database';
 import { UUID, Scope } from '../types';
+import { ok, err, type ApiResult } from '../../types/api-result';
 
 /**
  * Cache for organisation derivation from event
@@ -48,41 +49,42 @@ export function clearAllOrgDerivationCache(): void {
 export async function getOrganisationFromEvent(
   supabase: SupabaseClient<Database>,
   eventId: string
-): Promise<UUID | null> {
+): Promise<ApiResult<UUID | null>> {
   // Check cache first
   if (orgDerivationCache.has(eventId)) {
-    return orgDerivationCache.get(eventId) ?? null;
+    return ok(orgDerivationCache.get(eventId) ?? null);
   }
 
-  // Query database
-  const { data, error } = await supabase
-    .from('core_events')
-    .select('organisation_id')
-    .eq('event_id', eventId)
-    .single() as { data: { organisation_id: string } | null; error: PostgrestError | null };
+  try {
+    // Query database
+    const { data, error } = await supabase
+      .from('core_events')
+      .select('organisation_id')
+      .eq('event_id', eventId)
+      .single() as { data: { organisation_id: string } | null; error: PostgrestError | null };
 
-  let organisationId: UUID | null = null;
+    let organisationId: UUID | null = null;
 
-  if (error || !data) {
-    organisationId = null;
-  } else if (data.organisation_id) {
-    organisationId = data.organisation_id;
-  } else {
-    // organisation_id is null or undefined
-    organisationId = null;
-  }
+    if (error) {
+      return err({ code: 'ORG_FROM_EVENT_FAILED', message: error.message ?? 'Failed to get organisation from event' });
+    }
+    if (data?.organisation_id) {
+      organisationId = data.organisation_id;
+    }
 
-  // Cache the result (with size limit to prevent memory leaks)
-  if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
-    // Remove oldest entry (first key in Map)
-    const firstKey = orgDerivationCache.keys().next().value;
-    if (firstKey) {
-      orgDerivationCache.delete(firstKey);
+    // Cache the result (with size limit to prevent memory leaks)
+    if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
+      const firstKey = orgDerivationCache.keys().next().value;
+      if (firstKey) {
+        orgDerivationCache.delete(firstKey);
+      }
     }
-  }
-  orgDerivationCache.set(eventId, organisationId);
+    orgDerivationCache.set(eventId, organisationId);
 
-  return organisationId;
+    return ok(organisationId);
+  } catch (e) {
+    return err({ code: 'ORG_FROM_EVENT_FAILED', message: e instanceof Error ? e.message : String(e) });
+  }
 }
 
 /**
@@ -97,18 +99,20 @@ export async function createScopeFromEvent(
   supabase: SupabaseClient<Database>,
   eventId: string,
   appId?: UUID
-): Promise<Scope | null> {
-  const organisationId = await getOrganisationFromEvent(supabase, eventId);
-  
+): Promise<ApiResult<Scope | null>> {
+  const result = await getOrganisationFromEvent(supabase, eventId);
+  if (!result.ok) {
+    return result;
+  }
+  const organisationId = result.data;
   if (!organisationId) {
-    return null;
+    return ok(null);
   }
-
-  return {
+  return ok({
     organisationId,
     eventId,
     appId
-  };
+  });
 }
 
 /**

package/src/rbac/utils/fetchPermissionMap.ts

@@ -0,0 +1,13 @@
+import type { ApiResult } from '../../types/api-result';
+import type { PermissionMap, Scope, UUID } from '../types';
+import { getPermissionMap } from '../api';
+
+/**
+ * Fetches the permission map for a user in a scope. Pure async helper; no React state.
+ */
+export async function fetchPermissionMapForScope(params: {
+  userId: UUID;
+  scope: Scope;
+}): Promise<ApiResult<PermissionMap>> {
+  return getPermissionMap({ userId: params.userId, scope: params.scope });
+}

package/src/rbac/utils/permissionMapHelpers.ts

@@ -0,0 +1,34 @@
+import type { Permission, PermissionMap } from '../types';
+
+export interface PermissionMapHelpers {
+  hasPermission: (permission: Permission) => boolean;
+  hasAnyPermission: (permissionList: Permission[]) => boolean;
+  hasAllPermissions: (permissionList: Permission[]) => boolean;
+}
+
+/**
+ * Creates helper functions to query a permission map (wildcard and per-permission).
+ * Pure helper; no React.
+ */
+export function createPermissionMapHelpers(permissions: PermissionMap): PermissionMapHelpers {
+  return {
+    hasPermission(permission: Permission): boolean {
+      if (permissions['*']) {
+        return true;
+      }
+      return permissions[permission] === true;
+    },
+    hasAnyPermission(permissionList: Permission[]): boolean {
+      if (permissions['*']) {
+        return true;
+      }
+      return permissionList.some(p => permissions[p] === true);
+    },
+    hasAllPermissions(permissionList: Permission[]): boolean {
+      if (permissions['*']) {
+        return true;
+      }
+      return permissionList.every(p => permissions[p] === true);
+    }
+  };
+}

package/src/rbac/utils/roleManagementRpc.ts

@@ -0,0 +1,303 @@
+/**
+ * RBAC Role Management RPC Layer
+ * @package @jmruthers/pace-core
+ * @module RBAC/Utils/RoleManagementRpc
+ * @since 2.1.0
+ *
+ * Pure RPC functions for role management (event app, global, organisation).
+ * No React; used by useRoleManagement hook.
+ */
+
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type {
+  RevokeEventAppRoleParams,
+  GrantEventAppRoleParams,
+  RevokeGlobalRoleParams,
+  GrantGlobalRoleParams,
+  RevokeOrganisationRoleParams,
+  GrantOrganisationRoleParams,
+  RoleManagementResult,
+} from '../types/roleManagement';
+import type { UUID } from '../types';
+import { createLogger } from '../../utils/core/logger';
+
+const logger = createLogger('roleManagementRpc');
+
+function logIfDev(message: string, data?: unknown): void {
+  if (import.meta.env.MODE === 'development') {
+    if (data !== undefined) {
+      logger.debug(message, data);
+    } else {
+      logger.debug(message);
+    }
+  }
+}
+
+function formatRpcError(rpcError: { message?: string; details?: string; hint?: string; code?: string }): string {
+  const parts = [
+    rpcError.message,
+    rpcError.details,
+    rpcError.hint,
+    rpcError.code ? `Error code: ${rpcError.code}` : null,
+  ].filter(Boolean);
+  return parts.length > 0 ? parts.join(' | ') : 'Unknown RPC error';
+}
+
+type RevokeRpcRow = { success?: boolean; message?: string; error_code?: string; revoked_count?: number };
+
+function parseRevokeResponse(data: unknown): RoleManagementResult {
+  if (!data || !Array.isArray(data) || data.length === 0) {
+    logIfDev('Empty or null revoke response', { data });
+    return { success: false, error: 'No response from database - role revocation may have failed' };
+  }
+  const result = data[0] as RevokeRpcRow | undefined;
+  logIfDev('Revoke RPC result', result);
+  if (!result || result.success !== true) {
+    const errorMessage = result?.message || result?.error_code || 'Role revocation failed';
+    return {
+      success: false,
+      message: result?.message,
+      error: errorMessage,
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? 'Role revoked successfully',
+    error: undefined,
+  };
+}
+
+/**
+ * Revoke an event app role via rbac_role_revoke RPC.
+ */
+export async function revokeEventAppRoleRpc(
+  supabase: SupabaseClient,
+  params: RevokeEventAppRoleParams,
+  revokedBy?: UUID
+): Promise<RoleManagementResult> {
+  const contextId = `${params.event_id}:${params.app_id}`;
+  const rpcParams = {
+    p_user_id: params.user_id,
+    p_role_type: 'event_app' as const,
+    p_role_name: params.role,
+    p_context_id: contextId,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? undefined,
+  };
+  logIfDev('revokeEventAppRole called with', rpcParams);
+
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', rpcParams);
+
+  if (rpcError) {
+    logIfDev('RPC error', { message: rpcError.message, code: rpcError.code });
+    throw new Error(rpcError.message || 'Failed to revoke role - unknown RPC error');
+  }
+
+  logIfDev('RPC response', { dataType: Array.isArray(data) ? 'array' : typeof data });
+  return parseRevokeResponse(data);
+}
+
+type GrantRpcRow = { success?: boolean; message?: string; role_id?: UUID; error_code?: string };
+
+/**
+ * Grant an event app role via rbac_role_grant RPC.
+ * Uses rbac_role_grant (p_user_id, p_role_type, p_role_name, p_context_id, p_granted_by)
+ * which exists in the DB; grant_event_app_role is not present.
+ */
+export async function grantEventAppRoleRpc(
+  supabase: SupabaseClient,
+  params: GrantEventAppRoleParams,
+  grantedBy?: UUID
+): Promise<RoleManagementResult> {
+  const contextId = `${params.event_id}:${params.app_id}`;
+  const rpcParams = {
+    p_user_id: params.user_id,
+    p_role_type: 'event_app' as const,
+    p_role_name: params.role,
+    p_context_id: contextId,
+    p_granted_by: params.granted_by ?? grantedBy ?? undefined,
+  };
+  logIfDev('grantEventAppRole called with', rpcParams);
+
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_grant', rpcParams);
+
+  if (rpcError) {
+    throw new Error(rpcError.message || 'Failed to grant role');
+  }
+  if (!data || !Array.isArray(data) || data.length === 0) {
+    return { success: false, error: 'No response from database - role grant may have failed' };
+  }
+  const result = data[0] as GrantRpcRow | undefined;
+  if (!result || result.success !== true) {
+    const errorMessage = result?.message ?? result?.error_code ?? 'Role grant failed';
+    return {
+      success: false,
+      message: result?.message,
+      error: errorMessage,
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? 'Role granted successfully',
+    roleId: result.role_id,
+  };
+}
+
+/**
+ * Revoke an event app role by role ID (fetches role then calls rbac_role_revoke).
+ */
+export async function revokeRoleByIdRpc(
+  supabase: SupabaseClient,
+  roleId: UUID,
+  revokedBy?: UUID
+): Promise<RoleManagementResult> {
+  const { data: roleData, error: fetchError } = await supabase
+    .from('rbac_event_app_roles')
+    .select('user_id, role, event_id, app_id')
+    .eq('id', roleId)
+    .single();
+
+  if (fetchError || !roleData) {
+    throw new Error(fetchError?.message || 'Role not found');
+  }
+
+  const contextId = `${roleData.event_id}:${roleData.app_id}`;
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
+    p_user_id: roleData.user_id,
+    p_role_type: 'event_app',
+    p_role_name: roleData.role,
+    p_context_id: contextId,
+    p_revoked_by: revokedBy ?? undefined,
+  });
+
+  if (rpcError) {
+    throw new Error(rpcError.message || 'Failed to revoke role - unknown RPC error');
+  }
+
+  const result = Array.isArray(data) && data.length > 0 ? (data[0] as RevokeRpcRow) : null;
+  if (!result) {
+    return { success: false, error: undefined };
+  }
+  if (result.success === false) {
+    const errorMessage = result.message || result.error_code || 'Role revocation failed';
+    return { success: false, message: result.message, error: errorMessage };
+  }
+  return {
+    success: true,
+    message: result.message ?? 'Role revoked successfully',
+    error: undefined,
+  };
+}
+
+function parseGrantResponse(data: unknown, fallbackError: string): RoleManagementResult {
+  const result = Array.isArray(data) && data.length > 0 ? (data[0] as GrantRpcRow) : null;
+  if (!result || !result.success) {
+    return {
+      success: false,
+      error: result?.message || result?.error_code || fallbackError,
+      message: result?.message,
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? 'Role granted successfully',
+    roleId: result.role_id,
+  };
+}
+
+/**
+ * Grant a global role via rbac_role_grant RPC.
+ */
+export async function grantGlobalRoleRpc(
+  supabase: SupabaseClient,
+  params: GrantGlobalRoleParams,
+  grantedBy?: UUID
+): Promise<RoleManagementResult> {
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_grant', {
+    p_user_id: params.user_id,
+    p_role_type: 'global',
+    p_role_name: params.role,
+    p_context_id: null,
+    p_granted_by: params.granted_by ?? grantedBy ?? undefined,
+  });
+
+  if (rpcError) {
+    throw new Error(rpcError.message || 'Failed to grant role');
+  }
+  return parseGrantResponse(data, 'Failed to grant role');
+}
+
+/**
+ * Revoke a global role via rbac_role_revoke RPC.
+ */
+export async function revokeGlobalRoleRpc(
+  supabase: SupabaseClient,
+  params: RevokeGlobalRoleParams,
+  revokedBy?: UUID
+): Promise<RoleManagementResult> {
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
+    p_user_id: params.user_id,
+    p_role_type: 'global',
+    p_role_name: params.role,
+    p_context_id: null,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? undefined,
+  });
+
+  if (rpcError) {
+    throw new Error(formatRpcError(rpcError));
+  }
+  const result = Array.isArray(data) && data.length > 0 ? (data[0] as RevokeRpcRow) : null;
+  return {
+    success: result?.success === true,
+    message: result?.message,
+    error: result?.success === false ? (result?.message || result?.error_code || 'Unknown error') : undefined,
+  };
+}
+
+/**
+ * Grant an organisation role via rbac_role_grant RPC.
+ */
+export async function grantOrganisationRoleRpc(
+  supabase: SupabaseClient,
+  params: GrantOrganisationRoleParams,
+  grantedBy?: UUID
+): Promise<RoleManagementResult> {
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_grant', {
+    p_user_id: params.user_id,
+    p_role_type: 'organisation',
+    p_role_name: params.role,
+    p_context_id: params.organisation_id,
+    p_granted_by: params.granted_by ?? grantedBy ?? undefined,
+  });
+
+  if (rpcError) {
+    throw new Error(rpcError.message || 'Failed to grant role');
+  }
+  return parseGrantResponse(data, 'Failed to grant role');
+}
+
+/**
+ * Revoke an organisation role via rbac_role_revoke RPC.
+ */
+export async function revokeOrganisationRoleRpc(
+  supabase: SupabaseClient,
+  params: RevokeOrganisationRoleParams,
+  revokedBy?: UUID
+): Promise<RoleManagementResult> {
+  const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', {
+    p_user_id: params.user_id,
+    p_role_type: 'organisation',
+    p_role_name: params.role,
+    p_context_id: params.organisation_id,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? undefined,
+  });
+
+  if (rpcError) {
+    throw new Error(formatRpcError(rpcError));
+  }
+  const result = Array.isArray(data) && data.length > 0 ? (data[0] as RevokeRpcRow) : null;
+  return {
+    success: result?.success === true,
+    message: result?.message,
+    error: result?.success === false ? (result?.message || result?.error_code || 'Unknown error') : undefined,
+  };
+}

package/src/services/{__tests__/AuthService.edge-cases.test.ts → AuthService.edge-cases.test.ts}

@@ -1,7 +1,7 @@
 /**
  * @file AuthService Edge Cases and Complex Scenarios Tests
  * @package @jmruthers/pace-core
- * @module Services/__tests__
+ * @module Services
  * @since 0.1.0
  *
  * Comprehensive edge case and complex scenario tests for AuthService.
@@ -15,9 +15,9 @@
  */
 
 import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
-import { AuthService } from '../AuthService';
+import { AuthService } from './AuthService';
 import { AuthError } from '@supabase/supabase-js';
-import { Logger } from '../../utils/core/logger';
+import { Logger } from '../utils/core/logger';
 
 // Mock Supabase client
 const createMockSupabaseClient = () => ({
@@ -616,8 +616,9 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await authService.refreshSession();
 
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toBeNull();
+      expect(result.data?.session).toBeNull();
       expect(authService.getUser()).toBeNull();
       expect(authService.getSession()).toBeNull();
     });
@@ -632,8 +633,9 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await authService.refreshSession();
 
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toBeNull();
+      expect(result.data?.session).toBeNull();
       expect(authService.getUser()).toBeNull();
       expect(authService.getSession()).toBeNull();
     });
@@ -663,10 +665,10 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
       }
 
       const originalClear = sessionStorage.clear;
-      let clearCallCount = 0;
+      let _clearCallCount = 0;
       let clearThrew = false;
       sessionStorage.clear = vi.fn(() => {
-        clearCallCount++;
+        _clearCallCount++;
         clearThrew = true;
         throw new Error('Storage error');
       });
@@ -702,10 +704,8 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await authService.updatePassword('newpassword');
 
-      // The error is cast to AuthError in the catch block
-      expect(result.error).toBeTruthy();
-      // The error message should be preserved
-      expect(result.error?.message).toContain('Network error');
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toContain('Network error');
     });
 
     it('handles updatePassword when Supabase client is null', async () => {
@@ -713,8 +713,8 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await serviceWithoutClient.updatePassword('newpassword');
 
-      expect(result.error).toBeTruthy();
-      expect(result.error?.message).toBe('Supabase client not available');
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
 
       serviceWithoutClient.cleanup();
     });
@@ -728,8 +728,8 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await authService.resetPassword('test@example.com');
 
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Network error');
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Network error');
     });
 
     it('handles resetPassword when Supabase client is null', async () => {
@@ -737,8 +737,8 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
 
       const result = await serviceWithoutClient.resetPassword('test@example.com');
 
-      expect(result.error).toBeTruthy();
-      expect(result.error?.message).toBe('Supabase client not available');
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
 
       serviceWithoutClient.cleanup();
     });

package/src/services/{__tests__/AuthService.restoreSession.test.ts → AuthService.restoreSession.test.ts}

@@ -1,7 +1,7 @@
 /**
  * @file AuthService Restore Session Tests
  * @package @jmruthers/pace-core
- * @module Services/__tests__
+ * @module Services
  * @since 0.1.0
  *
  * Focused tests for session restoration behavior.
@@ -13,7 +13,7 @@
  */
 
 import { describe, it, expect, vi, afterEach } from 'vitest';
-import { AuthService } from '../AuthService';
+import { AuthService } from './AuthService';
 
 // Minimal Supabase auth mock sufficient for restoreSession/initialize paths
 function createSupabaseMock() {