@jmruthers/pace-core 0.6.10 → 0.6.12

package/src/services/__tests__/AuthService.test.ts

@@ -1,1328 +0,0 @@
-/**
- * @file AuthService Unit Tests
- * @package @jmruthers/pace-core
- * @module Services/__tests__
- * @since 0.1.0
- *
- * Unit tests for AuthService class.
- * Tests authentication operations, state management, and error handling.
- */
-
-import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
-import { AuthService } from '../AuthService';
-import { AuthError } from '@supabase/supabase-js';
-
-// Don't mock the logger - it now works in test mode
-// We'll spy on the Logger class methods in beforeEach to verify calls
-import { Logger } from '../../utils/core/logger';
-
-let mockLoggerFunctions: {
-  debug: ReturnType<typeof vi.spyOn>;
-  error: ReturnType<typeof vi.spyOn>;
-  warn: ReturnType<typeof vi.spyOn>;
-  info: ReturnType<typeof vi.spyOn>;
-};
-
-// Mock Supabase client
-const createMockSupabaseClient = () => ({
-  auth: {
-    signInWithPassword: vi.fn(),
-    signUp: vi.fn(),
-    signOut: vi.fn(),
-    resetPasswordForEmail: vi.fn(),
-    updateUser: vi.fn(),
-    refreshSession: vi.fn(),
-    getSession: vi.fn(),
-    getUser: vi.fn(),
-    onAuthStateChange: vi.fn(),
-  },
-});
-
-describe('AuthService', () => {
-  let mockSupabase: ReturnType<typeof createMockSupabaseClient>;
-  let authService: AuthService;
-
-  beforeEach(() => {
-    // Spy on Logger methods to verify calls (logger now works in test mode)
-    mockLoggerFunctions = {
-      debug: vi.spyOn(Logger, 'debug'),
-      error: vi.spyOn(Logger, 'error'),
-      warn: vi.spyOn(Logger, 'warn'),
-      info: vi.spyOn(Logger, 'info'),
-    };
-    
-    mockSupabase = createMockSupabaseClient();
-    authService = new AuthService(mockSupabase as any);
-  });
-
-  afterEach(() => {
-    authService.cleanup();
-    // Restore spies
-    mockLoggerFunctions.debug.mockRestore();
-    mockLoggerFunctions.error.mockRestore();
-    mockLoggerFunctions.warn.mockRestore();
-    mockLoggerFunctions.info.mockRestore();
-    vi.clearAllMocks();
-  });
-
-  describe('Initialization', () => {
-    it('should initialize with default state', () => {
-      expect(authService.getUser()).toBeNull();
-      expect(authService.getSession()).toBeNull();
-      expect(authService.isAuthenticated()).toBe(false);
-      expect(authService.isLoading()).toBe(false);
-      expect(authService.getError()).toBeNull();
-    });
-
-    it('should initialize service when created', async () => {
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.getUser.mockResolvedValue({
-        data: { user: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
-      expect(mockSupabase.auth.onAuthStateChange).toHaveBeenCalled();
-    });
-  });
-
-  describe('Sign In', () => {
-    it('should sign in user successfully', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      const result = await authService.signIn('test@example.com', 'password');
-
-      expect(result.user).toEqual(mockUser);
-      expect(result.session).toEqual(mockSession);
-      expect(result.error).toBeNull();
-      expect(authService.getUser()).toEqual(mockUser);
-      expect(authService.getSession()).toEqual(mockSession);
-      expect(authService.isAuthenticated()).toBe(true);
-    });
-
-    it('should handle sign in errors', async () => {
-      const mockError = new AuthError('Invalid credentials');
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: null, session: null },
-        error: mockError
-      });
-
-      const result = await authService.signIn('test@example.com', 'wrongpassword');
-
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-      expect(authService.isAuthenticated()).toBe(false);
-    });
-
-    it('should handle missing Supabase client', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.signIn('test@example.com', 'password');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-  });
-
-  describe('Sign Up', () => {
-    it('should sign up user successfully', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signUp.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      const result = await authService.signUp('test@example.com', 'password');
-
-      expect(result.user).toEqual(mockUser);
-      expect(result.session).toEqual(mockSession);
-      expect(result.error).toBeNull();
-      expect(authService.getUser()).toEqual(mockUser);
-      expect(authService.getSession()).toEqual(mockSession);
-      expect(authService.isAuthenticated()).toBe(true);
-    });
-
-    it('should handle sign up errors', async () => {
-      const mockError = new AuthError('Email already registered');
-
-      mockSupabase.auth.signUp.mockResolvedValue({
-        data: { user: null, session: null },
-        error: mockError
-      });
-
-      const result = await authService.signUp('test@example.com', 'password');
-
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-    });
-  });
-
-  describe('Sign Out', () => {
-    it('should sign out user successfully', async () => {
-      // First sign in a user
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      await authService.signIn('test@example.com', 'password');
-      expect(authService.isAuthenticated()).toBe(true);
-
-      // Then sign out
-      mockSupabase.auth.signOut.mockResolvedValue({
-        error: null
-      });
-
-      const result = await authService.signOut();
-
-      expect(result.error).toBeNull();
-      expect(authService.getUser()).toBeNull();
-      expect(authService.getSession()).toBeNull();
-      expect(authService.isAuthenticated()).toBe(false);
-    });
-
-    it('should handle sign out errors', async () => {
-      const mockError = new AuthError('Sign out failed');
-
-      mockSupabase.auth.signOut.mockResolvedValue({
-        error: mockError
-      });
-
-      const result = await authService.signOut();
-
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-    });
-  });
-
-  describe('Password Reset', () => {
-    it('should reset password successfully', async () => {
-      mockSupabase.auth.resetPasswordForEmail.mockResolvedValue({
-        error: null
-      });
-
-      const result = await authService.resetPassword('test@example.com');
-
-      expect(result.error).toBeNull();
-      expect(mockSupabase.auth.resetPasswordForEmail).toHaveBeenCalledWith('test@example.com');
-    });
-
-    it('should handle password reset errors', async () => {
-      const mockError = new AuthError('Email not found');
-
-      mockSupabase.auth.resetPasswordForEmail.mockResolvedValue({
-        error: mockError
-      });
-
-      const result = await authService.resetPassword('test@example.com');
-
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-    });
-  });
-
-  describe('Update Password', () => {
-    it('should update password successfully', async () => {
-      mockSupabase.auth.updateUser.mockResolvedValue({
-        error: null
-      });
-
-      const result = await authService.updatePassword('newpassword');
-
-      expect(result.error).toBeNull();
-      expect(mockSupabase.auth.updateUser).toHaveBeenCalledWith({
-        password: 'newpassword'
-      });
-    });
-
-    it('should handle update password errors', async () => {
-      const mockError = new AuthError('Password too weak');
-
-      mockSupabase.auth.updateUser.mockResolvedValue({
-        error: mockError
-      });
-
-      const result = await authService.updatePassword('weak');
-
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-    });
-  });
-
-  describe('Refresh Session', () => {
-    it('should refresh session successfully', async () => {
-      mockSupabase.auth.refreshSession.mockResolvedValue({
-        error: null
-      });
-
-      const result = await authService.refreshSession();
-
-      expect(result.error).toBeNull();
-      expect(mockSupabase.auth.refreshSession).toHaveBeenCalled();
-    });
-
-    it('should handle refresh session errors', async () => {
-      const mockError = new AuthError('Session expired');
-
-      mockSupabase.auth.refreshSession.mockResolvedValue({
-        error: mockError
-      });
-
-      const result = await authService.refreshSession();
-
-      expect(result.error).toEqual(mockError);
-      expect(authService.getError()).toEqual(mockError);
-    });
-  });
-
-  describe('State Management', () => {
-    it('should notify subscribers when state changes', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      const subscriber = vi.fn();
-      const unsubscribe = authService.subscribe(subscriber);
-
-      await authService.signIn('test@example.com', 'password');
-
-      expect(subscriber).toHaveBeenCalled();
-
-      unsubscribe();
-    });
-
-    it('should cleanup subscriptions on cleanup', () => {
-      const subscriber = vi.fn();
-      authService.subscribe(subscriber);
-
-      authService.cleanup();
-
-      // After cleanup, new state changes shouldn't notify subscribers
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      authService.signIn('test@example.com', 'password');
-
-      // Subscriber should not be called after cleanup
-      expect(subscriber).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Error Handling', () => {
-    it('should handle network errors', async () => {
-      const networkError = new Error('Network error');
-
-      mockSupabase.auth.signInWithPassword.mockRejectedValue(networkError);
-
-      const result = await authService.signIn('test@example.com', 'password');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Network error');
-    });
-
-    it('should clear errors on successful operations', async () => {
-      // First cause an error
-      const mockError = new AuthError('Invalid credentials');
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: null, session: null },
-        error: mockError
-      });
-
-      await authService.signIn('test@example.com', 'wrongpassword');
-      expect(authService.getError()).toEqual(mockError);
-
-      // Then succeed
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.signInWithPassword.mockResolvedValue({
-        data: { user: mockUser, session: mockSession },
-        error: null
-      });
-
-      await authService.signIn('test@example.com', 'password');
-      expect(authService.getError()).toBeNull();
-    });
-
-    it('should handle exceptions during sign in', async () => {
-      const exceptionError = new Error('Unexpected exception');
-      mockSupabase.auth.signInWithPassword.mockRejectedValue(exceptionError);
-
-      const result = await authService.signIn('test@example.com', 'password');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Unexpected exception');
-    });
-
-    it('should handle exceptions during sign up', async () => {
-      const exceptionError = new Error('Unexpected exception');
-      mockSupabase.auth.signUp.mockRejectedValue(exceptionError);
-
-      const result = await authService.signUp('test@example.com', 'password');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Unexpected exception');
-    });
-
-    it('should handle exceptions during sign out', async () => {
-      const exceptionError = new Error('Unexpected exception');
-      mockSupabase.auth.signOut.mockRejectedValue(exceptionError);
-
-      const result = await authService.signOut();
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Unexpected exception');
-    });
-
-    it('should handle exceptions during password reset', async () => {
-      const exceptionError = new Error('Unexpected exception');
-      mockSupabase.auth.resetPasswordForEmail.mockRejectedValue(exceptionError);
-
-      const result = await authService.resetPassword('test@example.com');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-    });
-
-    it('should handle missing Supabase client on sign up', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.signUp('test@example.com', 'password');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-
-    it('should handle missing Supabase client on sign out', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.signOut();
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-
-    it('should handle missing Supabase client on password reset', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.resetPassword('test@example.com');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-
-    it('should handle missing Supabase client on update password', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.updatePassword('newpassword');
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-
-    it('should handle missing Supabase client on session refresh', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      
-      const result = await serviceWithoutClient.refreshSession();
-
-      expect(result.error).toBeInstanceOf(AuthError);
-      expect(result.error?.message).toBe('Supabase client not available');
-    });
-  });
-
-  describe('Session Management Edge Cases', () => {
-    it('should handle session refresh with null data', async () => {
-      mockSupabase.auth.refreshSession.mockResolvedValue({
-        data: { session: null, user: null },
-        error: null
-      });
-
-      const result = await authService.refreshSession();
-
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
-      expect(result.error).toBeNull();
-      expect(authService.getUser()).toBeNull();
-      expect(authService.getSession()).toBeNull();
-    });
-
-    it('should handle session refresh with user but no session by clearing both', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-
-      mockSupabase.auth.refreshSession.mockResolvedValue({
-        data: { session: null, user: mockUser },
-        error: null
-      });
-
-      const result = await authService.refreshSession();
-
-      // If there's no session, we should clear user state too
-      // This is intentional - without a valid session, we can't trust the user object
-      expect(result.user).toBeNull();
-      expect(result.session).toBeNull();
-      expect(authService.getUser()).toBeNull();
-      expect(authService.getSession()).toBeNull();
-    });
-
-    it('should handle refresh session errors by clearing state', async () => {
-      const mockError = new AuthError('Session expired');
-
-      mockSupabase.auth.refreshSession.mockResolvedValue({
-        data: { session: null, user: null },
-        error: mockError
-      });
-
-      const result = await authService.refreshSession();
-
-      expect(result.error).toEqual(mockError);
-      expect(authService.getUser()).toBeNull();
-      expect(authService.getSession()).toBeNull();
-      expect(authService.isAuthenticated()).toBe(false);
-    });
-  });
-
-  describe('Initialization Edge Cases', () => {
-    it('should handle initialization without Supabase client', async () => {
-      const serviceWithoutClient = new AuthService(null as any);
-      await serviceWithoutClient.initialize();
-
-      expect(mockSupabase.auth.getSession).not.toHaveBeenCalled();
-      expect(mockSupabase.auth.onAuthStateChange).not.toHaveBeenCalled();
-    });
-
-    it('should handle initialization with getSession error', async () => {
-      const sessionError = new AuthError('Session error');
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: sessionError
-      });
-      mockSupabase.auth.getUser.mockResolvedValue({
-        data: { user: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
-      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
-    });
-
-    it('should not call getUser when getSession succeeds with no session (prevents AuthSessionMissingError)', async () => {
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // When getSession succeeds with no session, getUser is NOT called to prevent
-      // AuthSessionMissingError from being raised on public pages (e.g., login page)
-      // This is intentional behavior to avoid noisy error banners for benign unauthenticated states
-      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
-      expect(mockSupabase.auth.getUser).not.toHaveBeenCalled();
-    });
-
-    it('should restore session from storage during initialization', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: mockSession },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      expect(authService.getUser()).toEqual(mockUser);
-      expect(authService.getSession()).toEqual(mockSession);
-      expect(authService.isAuthenticated()).toBe(true);
-    });
-
-    it('should handle auth state change unsubscribe gracefully', () => {
-      const unsubscribeFn = vi.fn();
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: unsubscribeFn } }
-      });
-
-      authService.cleanup();
-
-      // Should not throw error
-      expect(unsubscribeFn).not.toHaveBeenCalled();
-    });
-
-    it('should handle auth state change events correctly', async () => {
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      await authService.initialize();
-
-      // Simulate SIGNED_IN event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-        expect(authService.getUser()).toEqual(mockUser);
-        expect(authService.getSession()).toEqual(mockSession);
-      }
-
-      // Simulate SIGNED_OUT event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_OUT', null);
-        expect(authService.getUser()).toBeNull();
-        expect(authService.getSession()).toBeNull();
-      }
-
-      // Simulate TOKEN_REFRESHED event
-      const refreshedSession = { ...mockSession, access_token: 'new_token' };
-      if (authStateCallback) {
-        authStateCallback('TOKEN_REFRESHED', refreshedSession);
-        expect(authService.getSession()).toEqual(refreshedSession);
-      }
-
-      // Simulate INITIAL_SESSION event
-      const initialSession = { access_token: 'initial_token', user: mockUser };
-      if (authStateCallback) {
-        authStateCallback('INITIAL_SESSION', initialSession);
-        expect(authService.getSession()).toEqual(initialSession);
-      }
-    });
-
-    it('should handle errors in auth state change callback', async () => {
-      const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-      
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        // Simulate error in callback
-        try {
-          callback('INITIAL_SESSION', null);
-        } catch (_error) {
-          // Error is expected to be caught and logged
-        }
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      await authService.initialize();
-
-      expect(consoleWarnSpy).not.toHaveBeenCalled();
-      consoleWarnSpy.mockRestore();
-    });
-  });
-
-  describe('Get Session with Null User', () => {
-    it('should handle session with null user object', () => {
-      const mockSessionWithNullUser = { access_token: 'token', user: null };
-      
-      // This would be set via internal state
-      (authService as any).session = mockSessionWithNullUser;
-      
-      expect(authService.getSession()).toEqual(mockSessionWithNullUser);
-      expect(authService.getUser()).toBeNull();
-      expect(authService.isAuthenticated()).toBe(false);
-    });
-  });
-
-  describe('Automatic Session Tracking', () => {
-    beforeEach(() => {
-      // Mock rpc function for session tracking
-      (mockSupabase as any).rpc = vi.fn();
-      // Mock from().select() chain for app ID resolution
-      (mockSupabase as any).from = vi.fn().mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-id-123' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-    });
-
-    it('should track login session automatically on SIGNED_IN event', async () => {
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-      
-      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      // Initialize with appName to test app ID resolution
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      // Simulate SIGNED_IN event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-        
-        // Wait a bit for async tracking to complete
-        await new Promise(resolve => setTimeout(resolve, 100));
-        
-        // Verify rbac_session_track was called with correct parameters
-        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
-          p_user_id: 'user-123',
-          p_session_type: 'login',
-          p_event_id: null,
-          p_app_id: 'app-id-123', // Should be resolved from appName
-          // p_user_agent, p_device_fingerprint, p_ip_address may be undefined in test environment
-        }));
-      }
-
-      authServiceWithApp.cleanup();
-    });
-
-    it('should track logout session automatically on SIGNED_OUT event', async () => {
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-      
-      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      // Simulate SIGNED_OUT event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_OUT', mockSession);
-        
-        // Wait a bit for async tracking to complete
-        await new Promise(resolve => setTimeout(resolve, 100));
-        
-        // Verify rbac_session_track was called with logout type
-        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
-          p_user_id: 'user-123',
-          p_session_type: 'logout',
-        }));
-      }
-
-      authServiceWithApp.cleanup();
-    });
-
-    it('should NOT track session on TOKEN_REFRESHED event (to avoid duplicate login records)', async () => {
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'new_token', user: mockUser };
-      
-      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      // Simulate TOKEN_REFRESHED event
-      if (authStateCallback) {
-        authStateCallback('TOKEN_REFRESHED', mockSession);
-        
-        // Wait a bit for any async operations
-        await new Promise(resolve => setTimeout(resolve, 100));
-        
-        // Verify rbac_session_track was NOT called
-        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
-      }
-
-      authServiceWithApp.cleanup();
-    });
-
-    it('should handle tracking errors gracefully without breaking authentication', async () => {
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-      
-      // Mock rpc to reject (this will trigger the catch block in trackSession)
-      (mockSupabase as any).rpc = vi.fn().mockRejectedValue(new Error('Tracking failed'));
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      // Simulate SIGNED_IN event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-        
-        // Wait for async tracking to complete (trackSession is async)
-        // The catch block in trackSession will log the error
-        // Note: The logger may be called in the .catch() handler with "Failed to track" 
-        // or in the catch block with "Error tracking"
-        await new Promise(resolve => setTimeout(resolve, 500));
-        
-        // Check for either error message pattern
-        const warnCalls = mockLoggerFunctions.warn.mock.calls;
-        const hasErrorTracking = warnCalls.some(call => 
-          call[0] === 'AuthService' && 
-          typeof call[1] === 'string' && 
-          call[1].includes('Error tracking')
-        );
-        const hasFailedToTrack = warnCalls.some(call => 
-          call[0] === 'AuthService' && 
-          typeof call[1] === 'string' && 
-          call[1].includes('Failed to track')
-        );
-        
-        expect(hasErrorTracking || hasFailedToTrack).toBe(true);
-        expect(mockLoggerFunctions.warn).toHaveBeenCalled();
-        expect(authServiceWithApp.isAuthenticated()).toBe(true);
-      }
-      authServiceWithApp.cleanup();
-    });
-
-    it('should work without appName (app_id will be null)', async () => {
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-      
-      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
-      
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      // Initialize without appName
-      await authService.initialize();
-
-      // Simulate SIGNED_IN event
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-        
-        // Wait a bit for async tracking to complete
-        await new Promise(resolve => setTimeout(resolve, 100));
-        
-        // Verify rbac_session_track was called with null app_id
-        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
-          p_user_id: 'user-123',
-          p_session_type: 'login',
-          p_app_id: undefined, // Should be undefined when appName not provided
-        }));
-      }
-    });
-  });
-
-  describe('Session Restoration Edge Cases', () => {
-    it('should handle getSession throwing exception', async () => {
-      mockSupabase.auth.getSession.mockRejectedValue(new Error('getSession exception'));
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // Should handle exception gracefully
-      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
-    });
-
-    it('should handle getUser when getSession fails', async () => {
-      const sessionError = new AuthError('Session error');
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: sessionError
-      });
-      mockSupabase.auth.getUser.mockResolvedValue({
-        data: { user: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
-    });
-
-    it('should handle getUser also failing', async () => {
-      const sessionError = new AuthError('Session error');
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: sessionError
-      });
-      mockSupabase.auth.getUser.mockRejectedValue(new Error('getUser exception'));
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // Should handle both failures gracefully
-      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
-    });
-
-    it('should handle session restoration timeout', async () => {
-      // Mock getSession to hang (simulate timeout scenario)
-      mockSupabase.auth.getSession.mockImplementation(() => {
-        return new Promise(() => {
-          // Never resolves - will timeout after 5 seconds in real scenario
-        });
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      // Start initialization (will hang waiting for getSession)
-      const initPromise = authService.initialize();
-
-      // Use a timeout to simulate the service's internal timeout
-      const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => reject(new Error('Test timeout')), 100);
-      });
-
-      // Race between initialization and test timeout
-      try {
-        await Promise.race([initPromise, timeoutPromise]);
-      } catch (_error) {
-        // Expected to timeout in test
-      }
-
-      // Verify that restoration state is managed
-      const restorationState = authService.getSessionRestorationState();
-      expect(restorationState).toBeDefined();
-    }, 1000);
-
-    it('should finish restoration with timeout error', async () => {
-      // Mock getSession to hang (simulate timeout scenario)
-      mockSupabase.auth.getSession.mockImplementation(() => {
-        return new Promise(() => {
-          // Never resolves - will timeout after 5 seconds in real scenario
-        });
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      // Start initialization (will hang waiting for getSession)
-      const initPromise = authService.initialize();
-
-      // Use a timeout to simulate the service's internal timeout
-      const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => reject(new Error('Test timeout')), 100);
-      });
-
-      // Race between initialization and test timeout
-      try {
-        await Promise.race([initPromise, timeoutPromise]);
-      } catch (_error) {
-        // Expected to timeout in test
-      }
-
-      // Verify that restoration state is managed
-      const restorationState = authService.getSessionRestorationState();
-      expect(restorationState).toBeDefined();
-    }, 1000);
-
-    it('should handle restoration error during initialization', async () => {
-      const restorationError = new Error('Restoration failed');
-      mockSupabase.auth.getSession.mockRejectedValue(restorationError);
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      const restorationState = authService.getSessionRestorationState();
-      expect(restorationState.restorationError).toBeDefined();
-    });
-
-    it('should reset restoration state when valid session arrives after timeout', async () => {
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      // Mock getSession to fail initially
-      mockSupabase.auth.getSession.mockRejectedValue(new Error('Timeout'));
-
-      await authService.initialize();
-
-      // Simulate INITIAL_SESSION arriving after timeout
-      const mockSession = { access_token: 'token', user: { id: '1', email: 'test@example.com' } };
-      if (authStateCallback) {
-        authStateCallback('INITIAL_SESSION', mockSession);
-      }
-
-      // Wait a bit for state to update
-      await new Promise(resolve => setTimeout(resolve, 10));
-
-      const restorationState = authService.getSessionRestorationState();
-      expect(restorationState.restorationComplete).toBe(true);
-    });
-  });
-
-  describe('Error Handlers', () => {
-    it('should setup error handlers on initialization', async () => {
-      const addEventListenerSpy = vi.spyOn(window, 'addEventListener');
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // Error handlers should be set up
-      expect(addEventListenerSpy).toHaveBeenCalledWith('error', expect.any(Function));
-      expect(addEventListenerSpy).toHaveBeenCalledWith('unhandledrejection', expect.any(Function));
-
-      addEventListenerSpy.mockRestore();
-    });
-
-    it('should suppress AuthSessionMissingError in error handler', async () => {
-      const preventDefaultSpy = vi.fn();
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // Trigger error handler
-      const errorEvent = new ErrorEvent('error', { error: { message: 'AuthSessionMissingError' } as any });
-      window.dispatchEvent(errorEvent);
-
-      // Error should be suppressed
-      expect(preventDefaultSpy).not.toHaveBeenCalled(); // In test environment, preventDefault may not work
-    });
-
-    it('should suppress AuthSessionMissingError in unhandled rejection', async () => {
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      await authService.initialize();
-
-      // Create a promise that will be rejected
-      const rejectedPromise = Promise.reject(new Error('AuthSessionMissingError'));
-      
-      // Catch the rejection to prevent it from being unhandled
-      rejectedPromise.catch(() => {
-        // The error handler should suppress this
-      });
-
-      // Trigger unhandled rejection using a custom event
-      const rejectionEvent = new Event('unhandledrejection') as any;
-      rejectionEvent.promise = rejectedPromise;
-      rejectionEvent.reason = { message: 'AuthSessionMissingError' };
-
-      // The handler should be set up and will suppress the error
-      window.dispatchEvent(rejectionEvent);
-
-      // Test passes if no error propagates
-      expect(true).toBe(true);
-    });
-
-    it('should handle window undefined environment', async () => {
-      const originalWindow = global.window;
-      // @ts-ignore - for testing
-      delete global.window;
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-      mockSupabase.auth.onAuthStateChange.mockReturnValue({
-        data: { subscription: { unsubscribe: vi.fn() } }
-      });
-
-      // Should not throw error
-      await expect(authService.initialize()).resolves.toBeUndefined();
-
-      global.window = originalWindow;
-    });
-  });
-
-  describe('Session Tracking Edge Cases', () => {
-    it('should handle tracking when app lookup fails', async () => {
-      (mockSupabase as any).rpc = vi.fn();
-      (mockSupabase as any).from = vi.fn().mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: null,
-                error: { message: 'App not found' }
-              })
-            })
-          })
-        })
-      });
-
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-
-        await new Promise(resolve => setTimeout(resolve, 100));
-
-        // Should still track with null app_id
-        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
-          p_app_id: undefined
-        }));
-      }
-
-      authServiceWithApp.cleanup();
-    });
-
-    it('should handle tracking when RPC fails', async () => {
-      vi.clearAllMocks();
-      (mockSupabase as any).rpc = vi.fn().mockResolvedValue({
-        error: { message: 'RPC failed' }
-      });
-      (mockSupabase as any).from = vi.fn().mockReturnValue({
-        select: vi.fn().mockReturnValue({
-          eq: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              single: vi.fn().mockResolvedValue({
-                data: { id: 'app-id-123' },
-                error: null
-              })
-            })
-          })
-        })
-      });
-
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
-      await authServiceWithApp.initialize();
-
-      const mockUser = { id: 'user-123', email: 'test@example.com' };
-      const mockSession = { access_token: 'token', user: mockUser };
-
-      if (authStateCallback) {
-        authStateCallback('SIGNED_IN', mockSession);
-
-        // Wait for async tracking to complete
-        await new Promise(resolve => setTimeout(resolve, 200));
-        expect(mockLoggerFunctions.warn).toHaveBeenCalledWith(
-          'AuthService',
-          expect.stringContaining('Failed to track'),
-          expect.anything()
-        );
-      }
-      authServiceWithApp.cleanup();
-    });
-
-    it('should not track when session is null', async () => {
-      (mockSupabase as any).rpc = vi.fn();
-
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      await authService.initialize();
-
-      if (authStateCallback) {
-        authStateCallback('SIGNED_OUT', null);
-
-        await new Promise(resolve => setTimeout(resolve, 100));
-
-        // Should not track when session is null
-        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
-      }
-    });
-
-    it('should not track when user is null in session', async () => {
-      (mockSupabase as any).rpc = vi.fn();
-
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      await authService.initialize();
-
-      if (authStateCallback) {
-        const sessionWithoutUser = { access_token: 'token', user: null };
-        authStateCallback('SIGNED_IN', sessionWithoutUser);
-
-        await new Promise(resolve => setTimeout(resolve, 100));
-
-        // Should not track when user is null
-        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
-      }
-    });
-  });
-
-  describe('Auth State Change Events', () => {
-    it('should handle INITIAL_SESSION event with null session', async () => {
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-
-      await authService.initialize();
-
-      if (authStateCallback) {
-        authStateCallback('INITIAL_SESSION', null);
-
-        expect(authService.getUser()).toBeNull();
-        expect(authService.getSession()).toBeNull();
-      }
-    });
-
-    it('should handle TOKEN_REFRESHED event', async () => {
-      let authStateCallback: any;
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        authStateCallback = callback;
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-
-      await authService.initialize();
-
-      const mockUser = { id: '1', email: 'test@example.com' };
-      const refreshedSession = { access_token: 'new_token', user: mockUser };
-
-      if (authStateCallback) {
-        authStateCallback('TOKEN_REFRESHED', refreshedSession);
-
-        expect(authService.getSession()).toEqual(refreshedSession);
-        expect(authService.getUser()).toEqual(mockUser);
-      }
-    });
-
-    it('should handle errors in auth state change callback', async () => {
-      const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
-        try {
-          // Simulate error in callback
-          callback('INITIAL_SESSION', null);
-        } catch (_error) {
-          // Error should be caught
-        }
-        return { data: { subscription: { unsubscribe: vi.fn() } } };
-      });
-
-      mockSupabase.auth.getSession.mockResolvedValue({
-        data: { session: null },
-        error: null
-      });
-
-      await authService.initialize();
-
-      // Should handle error gracefully
-      expect(consoleWarnSpy).not.toHaveBeenCalled();
-
-      consoleWarnSpy.mockRestore();
-    });
-  });
-
-  describe('Session Restoration State', () => {
-    it('should return session restoration state', () => {
-      const state = authService.getSessionRestorationState();
-
-      expect(state).toHaveProperty('isRestoring');
-      expect(state).toHaveProperty('restorationComplete');
-      expect(state).toHaveProperty('restorationError');
-    });
-
-    it('should return copy of restoration state', () => {
-      const state1 = authService.getSessionRestorationState();
-      const state2 = authService.getSessionRestorationState();
-
-      // Should be different objects (copies)
-      expect(state1).not.toBe(state2);
-      expect(state1).toEqual(state2);
-    });
-  });
-});