@jmruthers/pace-core 0.6.10 → 0.6.11

package/dist/{chunk-LNHFAF4X.js → chunk-7A6IMHH2.js}

@@ -1,5 +1,6 @@
-import { emitAuditEvent, createAuditManager, setGlobalAuditManager } from './chunk-NIU6DPQV.js';
+import { emitAuditEvent, createAuditManager, setGlobalAuditManager } from './chunk-QRYSEPHB.js';
 import { createLogger } from './chunk-BTHN5MKC.js';
+import { ok, err } from './chunk-44CNXN4P.js';
 
 // src/rbac/types.ts
 var RBACError = class extends Error {
@@ -588,7 +589,7 @@ function normalize(value) {
   }
   return String(value).toLowerCase();
 }
-function categorizeError(error) {
+function categorizeByErrorClass(error) {
   if (error instanceof PermissionDeniedError) {
     return "authorization_error" /* AUTHORIZATION */;
   }
@@ -598,55 +599,75 @@ function categorizeError(error) {
   if (error instanceof MissingUserContextError) {
     return "authentication_error" /* AUTHENTICATION */;
   }
-  if (error instanceof RBACError) {
-    switch (error.code) {
-      case "PERMISSION_DENIED":
-        return "authorization_error" /* AUTHORIZATION */;
-      case "ORGANISATION_CONTEXT_REQUIRED":
-      case "INVALID_SCOPE":
-        return "validation_error" /* VALIDATION */;
-      case "MISSING_USER_CONTEXT":
-        return "authentication_error" /* AUTHENTICATION */;
-    }
-  }
-  if (error && typeof error === "object") {
-    const status = error.status;
-    if (typeof status === "number") {
-      if (RATE_LIMIT_STATUS_CODES.has(status)) {
-        return "rate_limit_error" /* RATE_LIMIT */;
-      }
-      if (AUTH_STATUS_CODES.has(status)) {
-        return "authentication_error" /* AUTHENTICATION */;
-      }
-      if (AUTHZ_STATUS_CODES.has(status)) {
-        return "authorization_error" /* AUTHORIZATION */;
-      }
-      if (status >= 500) {
-        return "database_error" /* DATABASE */;
-      }
-    }
-    const codeValue = normalize(error.code);
-    if (codeValue) {
-      if (codeValue.includes("network")) {
-        return "network_error" /* NETWORK */;
-      }
-      if (codeValue.includes("postgres") || codeValue.includes("database") || codeValue.includes("db")) {
-        return "database_error" /* DATABASE */;
-      }
-      if (codeValue.includes("rate")) {
-        return "rate_limit_error" /* RATE_LIMIT */;
-      }
-      if (codeValue.includes("auth")) {
-        return "authentication_error" /* AUTHENTICATION */;
-      }
-      if (codeValue.includes("permission")) {
-        return "authorization_error" /* AUTHORIZATION */;
-      }
-      if (codeValue.includes("scope") || codeValue.includes("invalid")) {
-        return "validation_error" /* VALIDATION */;
-      }
-    }
+  return null;
+}
+function categorizeByRBACErrorCode(error) {
+  if (!(error instanceof RBACError)) {
+    return null;
   }
+  switch (error.code) {
+    case "PERMISSION_DENIED":
+      return "authorization_error" /* AUTHORIZATION */;
+    case "ORGANISATION_CONTEXT_REQUIRED":
+    case "INVALID_SCOPE":
+      return "validation_error" /* VALIDATION */;
+    case "MISSING_USER_CONTEXT":
+      return "authentication_error" /* AUTHENTICATION */;
+    default:
+      return null;
+  }
+}
+function categorizeByHttpStatus(error) {
+  if (!error || typeof error !== "object") {
+    return null;
+  }
+  const status = error.status;
+  if (typeof status !== "number") {
+    return null;
+  }
+  if (RATE_LIMIT_STATUS_CODES.has(status)) {
+    return "rate_limit_error" /* RATE_LIMIT */;
+  }
+  if (AUTH_STATUS_CODES.has(status)) {
+    return "authentication_error" /* AUTHENTICATION */;
+  }
+  if (AUTHZ_STATUS_CODES.has(status)) {
+    return "authorization_error" /* AUTHORIZATION */;
+  }
+  if (status >= 500) {
+    return "database_error" /* DATABASE */;
+  }
+  return null;
+}
+function categorizeByCodeString(error) {
+  if (!error || typeof error !== "object") {
+    return null;
+  }
+  const codeValue = normalize(error.code);
+  if (!codeValue) {
+    return null;
+  }
+  if (codeValue.includes("network")) {
+    return "network_error" /* NETWORK */;
+  }
+  if (codeValue.includes("postgres") || codeValue.includes("database") || codeValue.includes("db")) {
+    return "database_error" /* DATABASE */;
+  }
+  if (codeValue.includes("rate")) {
+    return "rate_limit_error" /* RATE_LIMIT */;
+  }
+  if (codeValue.includes("auth")) {
+    return "authentication_error" /* AUTHENTICATION */;
+  }
+  if (codeValue.includes("permission")) {
+    return "authorization_error" /* AUTHORIZATION */;
+  }
+  if (codeValue.includes("scope") || codeValue.includes("invalid")) {
+    return "validation_error" /* VALIDATION */;
+  }
+  return null;
+}
+function categorizeByMessage(error) {
   const message = normalize(error);
   if (message.includes("timeout") || message.includes("network") || message.includes("fetch")) {
     return "network_error" /* NETWORK */;
@@ -666,6 +687,19 @@ function categorizeError(error) {
   if (message.includes("invalid") || message.includes("scope") || message.includes("validation")) {
     return "validation_error" /* VALIDATION */;
   }
+  return null;
+}
+function categorizeError(error) {
+  const byClass = categorizeByErrorClass(error);
+  if (byClass !== null) return byClass;
+  const byCode = categorizeByRBACErrorCode(error);
+  if (byCode !== null) return byCode;
+  const byStatus = categorizeByHttpStatus(error);
+  if (byStatus !== null) return byStatus;
+  const byCodeString = categorizeByCodeString(error);
+  if (byCodeString !== null) return byCodeString;
+  const byMessage = categorizeByMessage(error);
+  if (byMessage !== null) return byMessage;
   return "unknown_error" /* UNKNOWN */;
 }
 function mapErrorCategoryToSecurityEventType(category) {
@@ -1482,12 +1516,12 @@ var RBACEngine = class {
       const isSuperAdmin2 = !error && data && data.length > 0;
       rbacCache.set(cacheKey, isSuperAdmin2, 6e4);
       return Boolean(isSuperAdmin2);
-    } catch (err) {
+    } catch (err2) {
       const elapsed = Date.now() - startTime;
       const logger2 = getRBACLogger();
       logger2.error("[RBACEngine] Error checking super admin", {
         userId,
-        error: err,
+        error: err2,
         elapsedMs: elapsed
       });
       return false;
@@ -1699,25 +1733,28 @@ var orgDerivationCache = /* @__PURE__ */ new Map();
 var MAX_CACHE_SIZE = 100;
 async function getOrganisationFromEvent(supabase, eventId) {
   if (orgDerivationCache.has(eventId)) {
-    return orgDerivationCache.get(eventId) ?? null;
-  }
-  const { data, error } = await supabase.from("core_events").select("organisation_id").eq("event_id", eventId).single();
-  let organisationId = null;
-  if (error || !data) {
-    organisationId = null;
-  } else if (data.organisation_id) {
-    organisationId = data.organisation_id;
-  } else {
-    organisationId = null;
+    return ok(orgDerivationCache.get(eventId) ?? null);
   }
-  if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
-    const firstKey = orgDerivationCache.keys().next().value;
-    if (firstKey) {
-      orgDerivationCache.delete(firstKey);
+  try {
+    const { data, error } = await supabase.from("core_events").select("organisation_id").eq("event_id", eventId).single();
+    let organisationId = null;
+    if (error) {
+      return err({ code: "ORG_FROM_EVENT_FAILED", message: error.message ?? "Failed to get organisation from event" });
     }
+    if (data?.organisation_id) {
+      organisationId = data.organisation_id;
+    }
+    if (orgDerivationCache.size >= MAX_CACHE_SIZE) {
+      const firstKey = orgDerivationCache.keys().next().value;
+      if (firstKey) {
+        orgDerivationCache.delete(firstKey);
+      }
+    }
+    orgDerivationCache.set(eventId, organisationId);
+    return ok(organisationId);
+  } catch (e) {
+    return err({ code: "ORG_FROM_EVENT_FAILED", message: e instanceof Error ? e.message : String(e) });
   }
-  orgDerivationCache.set(eventId, organisationId);
-  return organisationId;
 }
 
 // src/rbac/utils/contextValidator.ts
@@ -1734,7 +1771,11 @@ var ContextValidator = class {
    * @returns Organisation ID or null
    */
   static async deriveOrgFromEvent(supabase, eventId) {
-    return getOrganisationFromEvent(supabase, eventId);
+    const result = await getOrganisationFromEvent(supabase, eventId);
+    if (!result.ok) {
+      return null;
+    }
+    return result.data;
   }
   /**
    * Resolve scope based on page-level scope_type
@@ -1879,6 +1920,16 @@ var ContextValidator = class {
 
 // src/rbac/api.ts
 var log4 = createLogger("RBACAPI");
+function toApiError(error) {
+  if (error instanceof RBACNotInitializedError) {
+    return { code: "RBAC_NOT_INITIALIZED", message: error.message };
+  }
+  if (error instanceof OrganisationContextRequiredError) {
+    return { code: "ORGANISATION_CONTEXT_REQUIRED", message: error.message };
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return { code: "RBAC_ERROR", message };
+}
 var globalEngine = null;
 function setupRBAC(supabase, config) {
   const isDevelopment = import.meta.env.MODE === "development";
@@ -1922,7 +1973,7 @@ async function getAccessLevel(input, appName) {
     const engine = getEngine();
     const isSuperAdminUser = await engine["checkSuperAdmin"](input.userId);
     if (isSuperAdminUser) {
-      return "super";
+      return ok("super");
     }
     const validation = await ContextValidator.resolveScopeForPage(
       input.scope,
@@ -1934,12 +1985,13 @@ async function getAccessLevel(input, appName) {
     if (!validation.isValid || !validation.resolvedScope) {
       throw validation.error || new OrganisationContextRequiredError();
     }
-    return engine.getAccessLevel({
+    const accessLevel = await engine.getAccessLevel({
       ...input,
       scope: validation.resolvedScope
     });
+    return ok(accessLevel);
   } catch (error) {
-    throw error;
+    return err(toApiError(error));
   }
 }
 async function getPermissionMap(input, appName) {
@@ -1955,138 +2007,148 @@ async function getPermissionMap(input, appName) {
     if (!validation.isValid || !validation.resolvedScope) {
       throw validation.error || new OrganisationContextRequiredError();
     }
-    return engine.getPermissionMap({
+    const permissionMap = await engine.getPermissionMap({
       ...input,
       scope: validation.resolvedScope
     });
+    return ok(permissionMap);
   } catch (error) {
-    throw error;
+    return err(toApiError(error));
   }
 }
 async function resolveAppContext(input) {
   try {
     const engine = getEngine();
-    return await engine.resolveAppContext(input);
+    const context = await engine.resolveAppContext(input);
+    return ok(context);
   } catch (error) {
-    throw error;
+    return err(toApiError(error));
   }
 }
 async function getRoleContext(input, appName) {
-  const engine = getEngine();
-  const validation = await ContextValidator.resolveScopeForPage(
-    input.scope,
-    "organisation",
-    // Default to organisation scope when no page context
-    appName,
-    engine["supabase"]
-  );
-  if (!validation.isValid || !validation.resolvedScope) {
-    throw validation.error || new OrganisationContextRequiredError();
-  }
-  return engine.getRoleContext({
-    ...input,
-    scope: validation.resolvedScope
-  });
+  try {
+    const engine = getEngine();
+    const validation = await ContextValidator.resolveScopeForPage(
+      input.scope,
+      "organisation",
+      // Default to organisation scope when no page context
+      appName,
+      engine["supabase"]
+    );
+    if (!validation.isValid || !validation.resolvedScope) {
+      throw validation.error || new OrganisationContextRequiredError();
+    }
+    const roleContext = await engine.getRoleContext({
+      ...input,
+      scope: validation.resolvedScope
+    });
+    return ok(roleContext);
+  } catch (error) {
+    return err(toApiError(error));
+  }
 }
 async function isPermitted(input, appName, precomputedSuperAdmin = null) {
-  const engine = getEngine();
-  if (precomputedSuperAdmin === true) {
-    return true;
-  }
-  if (precomputedSuperAdmin === null) {
-    const isSuperAdminUser = await engine["checkSuperAdmin"](input.userId);
-    if (isSuperAdminUser) {
-      return true;
+  try {
+    const engine = getEngine();
+    if (precomputedSuperAdmin === true) {
+      return ok(true);
     }
-  }
-  let resolvedAppName = appName;
-  if (!resolvedAppName && input.scope.appId) {
-    try {
-      const { data } = await engine["supabase"].from("rbac_apps").select("name").eq("id", input.scope.appId).eq("is_active", true).single();
-      if (data) {
-        resolvedAppName = data.name;
+    if (precomputedSuperAdmin === null) {
+      const isSuperAdminUser = await engine["checkSuperAdmin"](input.userId);
+      if (isSuperAdminUser) {
+        return ok(true);
       }
-    } catch (_err) {
     }
-  }
-  let pageScopeType;
-  if (input.pageId) {
-    try {
-      const scopeType = await getPageScopeType(
+    let resolvedAppName = appName;
+    if (!resolvedAppName && input.scope.appId) {
+      try {
+        const { data } = await engine["supabase"].from("rbac_apps").select("name").eq("id", input.scope.appId).eq("is_active", true).single();
+        if (data) {
+          resolvedAppName = data.name;
+        }
+      } catch (_err) {
+      }
+    }
+    let pageScopeType;
+    if (input.pageId) {
+      const scopeResult = await getPageScopeType(
         input.pageId,
         input.scope.appId,
         resolvedAppName
       );
-      if (!scopeType) {
-        throw new Error(`Page ${input.pageId} does not have scope_type set`);
+      if (!scopeResult.ok) {
+        log4.error("Failed to get page scope type:", scopeResult.error);
+        return err(scopeResult.error);
       }
-      pageScopeType = scopeType;
-    } catch (err) {
-      log4.error("Failed to get page scope type:", err);
-      throw new Error(`Failed to determine page scope type: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  } else {
-    pageScopeType = "organisation";
-  }
-  const validation = await ContextValidator.resolveScopeForPage(
-    input.scope,
-    pageScopeType,
-    resolvedAppName,
-    engine["supabase"]
-  );
-  if (!validation.isValid || !validation.resolvedScope) {
-    throw validation.error || new OrganisationContextRequiredError();
-  }
-  const validatedScope = validation.resolvedScope;
-  if (pageScopeType === "both" && input.pageId) {
-    const eventScope = {
-      organisationId: validatedScope.organisationId,
-      // Org derived from event
-      eventId: validatedScope.eventId,
-      appId: validatedScope.appId
-    };
-    const eventSecurityContext = {
-      userId: input.userId,
-      organisationId: eventScope.organisationId || null,
-      timestamp: /* @__PURE__ */ new Date()
-    };
-    const eventInput = {
-      ...input,
-      scope: eventScope
-    };
-    const hasEventPermission = await engine.isPermitted(eventInput, eventSecurityContext);
-    if (validatedScope.organisationId && validatedScope.eventId) {
-      const orgScope = {
+      if (!scopeResult.data) {
+        return err({ code: "PAGE_SCOPE_TYPE_MISSING", message: `Page ${input.pageId} does not have scope_type set` });
+      }
+      pageScopeType = scopeResult.data;
+    } else {
+      pageScopeType = "organisation";
+    }
+    const validation = await ContextValidator.resolveScopeForPage(
+      input.scope,
+      pageScopeType,
+      resolvedAppName,
+      engine["supabase"]
+    );
+    if (!validation.isValid || !validation.resolvedScope) {
+      throw validation.error || new OrganisationContextRequiredError();
+    }
+    const validatedScope = validation.resolvedScope;
+    if (pageScopeType === "both" && input.pageId) {
+      const eventScope = {
         organisationId: validatedScope.organisationId,
-        eventId: void 0,
-        // Clear event for org-only check
+        // Org derived from event
+        eventId: validatedScope.eventId,
         appId: validatedScope.appId
       };
-      const orgSecurityContext = {
+      const eventSecurityContext = {
         userId: input.userId,
-        organisationId: orgScope.organisationId || null,
+        organisationId: eventScope.organisationId || null,
         timestamp: /* @__PURE__ */ new Date()
       };
-      const orgInput = {
+      const eventInput = {
         ...input,
-        scope: orgScope
+        scope: eventScope
       };
-      const hasOrgPermission = await engine.isPermitted(orgInput, orgSecurityContext);
-      return hasEventPermission || hasOrgPermission;
+      const hasEventPermission = await engine.isPermitted(eventInput, eventSecurityContext);
+      if (validatedScope.organisationId && validatedScope.eventId) {
+        const orgScope = {
+          organisationId: validatedScope.organisationId,
+          eventId: void 0,
+          // Clear event for org-only check
+          appId: validatedScope.appId
+        };
+        const orgSecurityContext = {
+          userId: input.userId,
+          organisationId: orgScope.organisationId || null,
+          timestamp: /* @__PURE__ */ new Date()
+        };
+        const orgInput = {
+          ...input,
+          scope: orgScope
+        };
+        const hasOrgPermission = await engine.isPermitted(orgInput, orgSecurityContext);
+        return ok(hasEventPermission || hasOrgPermission);
+      }
+      return ok(hasEventPermission);
     }
-    return hasEventPermission;
+    const securityContext = {
+      userId: input.userId,
+      organisationId: validatedScope.organisationId || null,
+      timestamp: /* @__PURE__ */ new Date()
+    };
+    const validatedInput = {
+      ...input,
+      scope: validatedScope
+    };
+    const permitted = await engine.isPermitted(validatedInput, securityContext);
+    return ok(permitted);
+  } catch (error) {
+    return err(toApiError(error));
   }
-  const securityContext = {
-    userId: input.userId,
-    organisationId: validatedScope.organisationId || null,
-    timestamp: /* @__PURE__ */ new Date()
-    // Optional fields can be omitted
-  };
-  const validatedInput = {
-    ...input,
-    scope: validatedScope
-  };
-  return engine.isPermitted(validatedInput, securityContext);
 }
 async function isPermittedCached(input, appName) {
   const { userId, scope, permission, pageId } = input;
@@ -2100,48 +2162,62 @@ async function isPermittedCached(input, appName) {
   });
   const cached = rbacCache.get(cacheKey, true);
   if (cached !== null) {
-    return cached;
+    return ok(cached);
   }
   return getOrCreateRequest(input, async (checkInput) => {
     const result = await isPermitted(checkInput, appName, null);
+    if (!result.ok) {
+      return result;
+    }
     const isPageLevelCheck = !!pageId || permission.includes("page.");
-    rbacCache.set(cacheKey, result, void 0, isPageLevelCheck);
-    return result;
+    rbacCache.set(cacheKey, result.data, void 0, isPageLevelCheck);
+    return ok(result.data);
   });
 }
 async function hasAnyPermission(input) {
   const { permissions, ...baseInput } = input;
   for (const permission of permissions) {
-    const hasPermission = await isPermitted({
+    const result = await isPermitted({
       ...baseInput,
       permission
     });
-    if (hasPermission) {
-      return true;
+    if (!result.ok) {
+      return result;
+    }
+    if (result.data) {
+      return ok(true);
     }
   }
-  return false;
+  return ok(false);
 }
 async function hasAllPermissions(input) {
   const { permissions, ...baseInput } = input;
   for (const permission of permissions) {
-    const hasPermission = await isPermitted({
+    const result = await isPermitted({
       ...baseInput,
       permission
     });
-    if (!hasPermission) {
-      return false;
+    if (!result.ok) {
+      return result;
+    }
+    if (!result.data) {
+      return ok(false);
     }
   }
-  return true;
+  return ok(true);
 }
 async function isSuperAdmin(userId) {
-  const engine = getEngine();
-  return engine["checkSuperAdmin"](userId);
+  try {
+    const engine = getEngine();
+    const value = await engine["checkSuperAdmin"](userId);
+    return ok(value);
+  } catch (error) {
+    return err(toApiError(error));
+  }
 }
 async function getPageScopeType(pageId, appId, appName) {
-  const engine = getEngine();
   try {
+    const engine = getEngine();
     let resolvedAppId = appId;
     if (!resolvedAppId && appName) {
       const { data: app, error: appError } = await engine["supabase"].from("rbac_apps").select("id, name, is_active").eq("name", appName).eq("is_active", true).maybeSingle();
@@ -2152,104 +2228,70 @@ async function getPageScopeType(pageId, appId, appName) {
           error: appError,
           errorMessage: appError instanceof Error ? appError.message : String(appError)
         });
-        throw new Error(`Failed to resolve appId from appName "${appName}": ${appError instanceof Error ? appError.message : String(appError)}`);
+        return err({ code: "APP_RESOLVE_FAILED", message: `Failed to resolve appId from appName "${appName}": ${appError instanceof Error ? appError.message : String(appError)}` });
       }
       if (!app) {
         log4.error("App not found or inactive", { appName, pageId });
-        throw new Error(`Could not resolve appId for appName "${appName}" - app not found or not active`);
+        return err({ code: "APP_NOT_FOUND", message: `Could not resolve appId for appName "${appName}" - app not found or not active` });
       }
       resolvedAppId = app.id;
     }
     if (!resolvedAppId) {
       log4.error("No appId resolved", { pageId, appId, appName });
-      throw new Error(`Could not resolve appId for page ${pageId} - appId and appName both missing or invalid`);
+      return err({ code: "APP_ID_REQUIRED", message: `Could not resolve appId for page ${pageId} - appId and appName both missing or invalid` });
     }
     let resolvedPageId = pageId;
     const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     if (!uuidRegex.test(pageId)) {
       const { data: page, error: pageError } = await engine["supabase"].from("rbac_app_pages").select("id, page_name, app_id").eq("app_id", resolvedAppId).eq("page_name", pageId).maybeSingle();
       if (pageError) {
-        log4.error("Error resolving pageId from page_name", {
-          pageId,
-          appId: resolvedAppId,
-          appName,
-          error: pageError,
-          errorMessage: pageError instanceof Error ? pageError.message : String(pageError),
-          errorCode: pageError?.code
-        });
-        throw new Error(`Failed to resolve pageId "${pageId}" for appId ${resolvedAppId}: ${pageError instanceof Error ? pageError.message : String(pageError)}`);
+        log4.error("Error resolving pageId from page_name", { pageId, appId: resolvedAppId, appName, error: pageError });
+        return err({ code: "PAGE_RESOLVE_FAILED", message: `Failed to resolve pageId "${pageId}" for appId ${resolvedAppId}: ${pageError instanceof Error ? pageError.message : String(pageError)}` });
       }
       if (!page) {
-        log4.error("Page not found in database", {
-          pageId,
-          appId: resolvedAppId,
-          appName,
-          note: "Page may not exist in rbac_app_pages table or may be for a different app"
-        });
-        throw new Error(`Could not resolve pageId "${pageId}" to a valid UUID - page not found for appId ${resolvedAppId}`);
+        log4.error("Page not found in database", { pageId, appId: resolvedAppId, appName });
+        return err({ code: "PAGE_NOT_FOUND", message: `Could not resolve pageId "${pageId}" to a valid UUID - page not found for appId ${resolvedAppId}` });
       }
       resolvedPageId = page.id;
     }
     if (!uuidRegex.test(resolvedPageId)) {
-      log4.error("PageId resolution failed - not a valid UUID", {
-        originalPageId: pageId,
-        resolvedPageId,
-        appId: resolvedAppId,
-        appName
-      });
-      throw new Error(`Could not resolve pageId ${pageId} to a valid UUID`);
+      log4.error("PageId resolution failed - not a valid UUID", { originalPageId: pageId, resolvedPageId, appId: resolvedAppId, appName });
+      return err({ code: "PAGE_ID_INVALID", message: `Could not resolve pageId ${pageId} to a valid UUID` });
     }
     const { data: pageData, error } = await engine["supabase"].from("rbac_app_pages").select("scope_type, page_name, app_id").eq("id", resolvedPageId).single();
     if (error) {
-      log4.error("Error fetching page scope type from database", {
-        pageId: resolvedPageId,
-        originalPageId: pageId,
-        appId: resolvedAppId,
-        appName,
-        error,
-        errorMessage: error instanceof Error ? error.message : String(error),
-        errorCode: error?.code,
-        errorDetails: error?.details,
-        errorHint: error?.hint
-      });
-      throw new Error(`Failed to get page scope type: ${error instanceof Error ? error.message : String(error)}`);
+      log4.error("Error fetching page scope type from database", { pageId: resolvedPageId, originalPageId: pageId, appId: resolvedAppId, appName, error });
+      return err({ code: "PAGE_SCOPE_FETCH_FAILED", message: `Failed to get page scope type: ${error instanceof Error ? error.message : String(error)}` });
     }
     if (!pageData || !pageData.scope_type) {
-      log4.error("Page found but scope_type is missing", {
-        pageId: resolvedPageId,
-        originalPageId: pageId,
-        appId: resolvedAppId,
-        appName,
-        pageData
-      });
-      throw new Error(`Page ${resolvedPageId} does not have scope_type set`);
+      log4.error("Page found but scope_type is missing", { pageId: resolvedPageId, originalPageId: pageId, appId: resolvedAppId, appName, pageData });
+      return err({ code: "PAGE_SCOPE_TYPE_MISSING", message: `Page ${resolvedPageId} does not have scope_type set` });
     }
-    return pageData.scope_type;
-  } catch (err) {
-    log4.error("Error fetching page scope type (catch block)", {
-      pageId,
-      appId,
-      appName,
-      error: err,
-      errorMessage: err instanceof Error ? err.message : String(err),
-      errorStack: err instanceof Error ? err.stack : void 0
-    });
-    throw err instanceof Error ? err : new Error(`Failed to get page scope type: ${String(err)}`);
+    return ok(pageData.scope_type);
+  } catch (error) {
+    log4.error("Error fetching page scope type (catch block)", { pageId, appId, appName, error });
+    return err(toApiError(error));
   }
 }
 async function isOrganisationAdmin(userId, organisationId) {
-  const accessLevel = await getAccessLevel({
+  const result = await getAccessLevel({
     userId,
     scope: { organisationId }
   });
-  return accessLevel === "admin" || accessLevel === "super";
+  if (!result.ok) {
+    return result;
+  }
+  return ok(result.data === "admin" || result.data === "super");
 }
 async function isEventAdmin(userId, scope) {
   if (!scope.eventId || !scope.appId) {
-    return false;
+    return ok(false);
+  }
+  const result = await getAccessLevel({ userId, scope });
+  if (!result.ok) {
+    return result;
   }
-  const accessLevel = await getAccessLevel({ userId, scope });
-  return accessLevel === "admin" || accessLevel === "super";
+  return ok(result.data === "admin" || result.data === "super");
 }
 function invalidateUserCache(userId, organisationId) {
   const patterns = organisationId ? [