@jmruthers/pace-core 0.6.10 → 0.6.12

package/src/utils/__tests__/secureDataAccess.unit.test.ts

@@ -1,334 +0,0 @@
-/**
- * @file Secure Data Access Unit Tests
- * @package @jmruthers/pace-core
- * @module Utils/SecureDataAccess
- * @since 0.4.0
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { createSecureDataAccess } from '../security/secureDataAccess';
-import { testDataGenerators } from '../../__tests__/helpers/test-utils';
-
-// Create a proper mock for Supabase query chain
-const createMockQuery = (returnData: any = null, returnError: any = null) => {
-  const mockQuery = {
-    select: vi.fn(() => mockQuery),
-    eq: vi.fn(() => mockQuery),
-    ne: vi.fn(() => mockQuery),
-    gt: vi.fn(() => mockQuery),
-    gte: vi.fn(() => mockQuery),
-    lt: vi.fn(() => mockQuery),
-    lte: vi.fn(() => mockQuery),
-    like: vi.fn(() => mockQuery),
-    ilike: vi.fn(() => mockQuery),
-    in: vi.fn(() => mockQuery),
-    not: vi.fn(() => mockQuery),
-    or: vi.fn(() => mockQuery),
-    and: vi.fn(() => mockQuery),
-    order: vi.fn(() => mockQuery),
-    limit: vi.fn(() => mockQuery),
-    offset: vi.fn(() => mockQuery),
-    single: vi.fn(() => mockQuery),
-    maybeSingle: vi.fn(() => mockQuery),
-    insert: vi.fn(() => mockQuery),
-    update: vi.fn(() => mockQuery),
-    delete: vi.fn(() => mockQuery),
-    then: vi.fn((callback: any) => Promise.resolve(callback({ data: returnData, error: returnError })))
-  };
-  return mockQuery;
-};
-
-// Mock Supabase client
-const mockSupabaseClient = {
-  from: vi.fn(() => createMockQuery())
-} as any;
-
-describe('Secure Data Access', () => {
-  let secureDataAccess: ReturnType<typeof createSecureDataAccess>;
-  const organisationId = 'org-123';
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    secureDataAccess = createSecureDataAccess(mockSupabaseClient, organisationId);
-  });
-
-  describe('createSecureDataAccess', () => {
-    it('should create secure data access instance', () => {
-      expect(secureDataAccess).toBeDefined();
-      expect(secureDataAccess.secureQuery).toBeDefined();
-      expect(secureDataAccess.secureSingleQuery).toBeDefined();
-      expect(secureDataAccess.secureInsert).toBeDefined();
-      expect(secureDataAccess.secureUpdate).toBeDefined();
-      expect(secureDataAccess.secureDelete).toBeDefined();
-    });
-
-    it('should create instance with super admin privileges', () => {
-      const superAdminAccess = createSecureDataAccess(mockSupabaseClient, organisationId, true);
-      expect(superAdminAccess).toBeDefined();
-    });
-  });
-
-  describe('validateOrganisationContext', () => {
-    it('should throw error for empty organisation ID', () => {
-      expect(() => {
-        secureDataAccess.validateOrganisationContext('');
-      }).toThrow('Organisation context is required for secure data access');
-    });
-
-    it('should throw error for null organisation ID', () => {
-      expect(() => {
-        secureDataAccess.validateOrganisationContext(null as any);
-      }).toThrow('Organisation context is required for secure data access');
-    });
-
-    it('should not throw error for valid organisation ID', () => {
-      expect(() => {
-        secureDataAccess.validateOrganisationContext('valid-org-id');
-      }).not.toThrow();
-    });
-
-    it('should throw error for non-super admin without organisation context', () => {
-      const nonSuperAdminAccess = createSecureDataAccess(mockSupabaseClient, '', false);
-      expect(() => {
-        nonSuperAdminAccess.validateOrganisationContext('');
-      }).toThrow('Organisation context is required for secure data access');
-    });
-  });
-
-  describe('secureQuery', () => {
-    it('should execute secure query with organisation filter', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'core_events', // Use a table that has organisation_id
-        select: '*',
-        organisationId: organisationId,
-        filters: { name: 'Test' }
-      };
-
-      const result = await secureDataAccess.secureQuery(options);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('core_events');
-      expect(mockQuery.select).toHaveBeenCalledWith('*');
-      // Organisation filter should be applied first
-      expect(mockQuery.eq).toHaveBeenCalledWith('organisation_id', organisationId);
-      expect(mockQuery.eq).toHaveBeenCalledWith('name', 'Test');
-    });
-
-    it('should handle query errors gracefully', async () => {
-      const mockError = { message: 'Database error' };
-      const mockQuery = createMockQuery(null, mockError);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'users',
-        select: '*',
-        organisationId: organisationId
-      };
-
-      await expect(secureDataAccess.secureQuery(options)).rejects.toThrow();
-    });
-  });
-
-  describe('secureSingleQuery', () => {
-    it('should execute single secure query', async () => {
-      const mockData = { id: 1, name: 'Test', organisation_id: organisationId };
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'event', // Use a table that has organisation_id
-        select: '*',
-        organisationId: organisationId,
-        filters: { id: 1 }
-      };
-
-      const result = await secureDataAccess.secureSingleQuery(options);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('event');
-      expect(mockQuery.single).toHaveBeenCalled();
-    });
-
-    it('should return null for no results', async () => {
-      const mockQuery = createMockQuery(null);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'users',
-        select: '*',
-        organisationId: organisationId,
-        filters: { id: 999 }
-      };
-
-      const result = await secureDataAccess.secureSingleQuery(options);
-
-      expect(result).toBeNull();
-    });
-  });
-
-  describe('secureInsert', () => {
-    it('should insert data with organisation context', async () => {
-      const mockData = { id: 1, name: 'New User', organisation_id: organisationId };
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const insertData = { name: 'New User' };
-
-      const result = await secureDataAccess.secureInsert('users', insertData, organisationId);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('users');
-      expect(mockQuery.insert).toHaveBeenCalledWith({
-        ...insertData,
-        organisation_id: organisationId
-      });
-      expect(mockQuery.select).toHaveBeenCalled();
-      expect(mockQuery.single).toHaveBeenCalled();
-    });
-
-    it('should handle insert errors gracefully', async () => {
-      const mockError = { message: 'Insert failed' };
-      const mockQuery = createMockQuery(null, mockError);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const insertData = { name: 'New User' };
-
-      await expect(secureDataAccess.secureInsert('users', insertData, organisationId)).rejects.toThrow();
-    });
-  });
-
-  describe('secureUpdate', () => {
-    it('should update data with organisation context', async () => {
-      const mockData = { id: 1, name: 'Updated User', organisation_id: organisationId };
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const updateData = { name: 'Updated User' };
-      const filters = { id: 1 };
-
-      const result = await secureDataAccess.secureUpdate('users', updateData, filters, organisationId);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('users');
-      expect(mockQuery.update).toHaveBeenCalledWith(updateData);
-      expect(mockQuery.eq).toHaveBeenCalledWith('id', 1);
-    });
-
-    it('should handle update errors gracefully', async () => {
-      const mockError = { message: 'Update failed' };
-      const mockQuery = createMockQuery(null, mockError);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const updateData = { name: 'Updated User' };
-      const filters = { id: 1 };
-
-      await expect(secureDataAccess.secureUpdate('users', updateData, filters, organisationId)).rejects.toThrow();
-    });
-  });
-
-  describe('secureDelete', () => {
-    it('should delete data with organisation context', async () => {
-      const mockQuery = createMockQuery({ count: 1 });
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const filters = { id: 1 };
-
-      const result = await secureDataAccess.secureDelete('users', filters, organisationId);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('users');
-      expect(mockQuery.delete).toHaveBeenCalled();
-      expect(mockQuery.eq).toHaveBeenCalledWith('id', 1);
-    });
-
-    it('should return true for successful deletion', async () => {
-      const mockQuery = createMockQuery({ count: 1 });
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const filters = { id: 1 };
-
-      const result = await secureDataAccess.secureDelete('users', filters, organisationId);
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false for failed deletion', async () => {
-      const mockError = { message: 'Delete failed' };
-      const mockQuery = createMockQuery(null, mockError);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const filters = { id: 1 };
-
-      await expect(secureDataAccess.secureDelete('users', filters, organisationId)).rejects.toThrow();
-    });
-  });
-
-  describe('queryByOrganisation', () => {
-    it('should query data by organisation', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const result = await secureDataAccess.queryByOrganisation('users', '*', organisationId, { name: 'Test' });
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('users');
-      expect(mockQuery.eq).toHaveBeenCalledWith('name', 'Test');
-    });
-
-    it('should query without additional filters', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const result = await secureDataAccess.queryByOrganisation('users', '*', organisationId);
-
-      expect(mockSupabaseClient.from).toHaveBeenCalledWith('users');
-    });
-  });
-
-  describe('Edge Cases', () => {
-    it('should handle undefined filters gracefully', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'users',
-        select: '*',
-        organisationId: organisationId,
-        filters: undefined
-      };
-
-      await expect(secureDataAccess.secureQuery(options)).resolves.toBeDefined();
-    });
-
-    it('should handle null filters gracefully', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'users',
-        select: '*',
-        organisationId: organisationId,
-        filters: undefined
-      };
-
-      await expect(secureDataAccess.secureQuery(options)).resolves.toBeDefined();
-    });
-
-    it('should handle empty filters object', async () => {
-      const mockData = testDataGenerators.createUsers(1, { id: 1, name: 'Test', organisation_id: organisationId });
-      const mockQuery = createMockQuery(mockData);
-      mockSupabaseClient.from = vi.fn(() => mockQuery);
-
-      const options = {
-        table: 'users',
-        select: '*',
-        organisationId: organisationId,
-        filters: {}
-      };
-
-      await expect(secureDataAccess.secureQuery(options)).resolves.toBeDefined();
-    });
-  });
-});