@jmruthers/pace-core 0.6.11 → 0.6.12

package/src/rbac/hooks/useResourcePermissions.test.ts

@@ -365,7 +365,7 @@ describe('useResourcePermissions Hook', () => {
       );
     });
 
-    it('uses fallback scope when resolvedScope is null', () => {
+    it('passes null scope to useCan when resolvedScope is null', () => {
       mockUseResolvedScope.mockReturnValue({
         resolvedScope: null,
         isLoading: false,
@@ -374,15 +374,9 @@ describe('useResourcePermissions Hook', () => {
 
       renderHook(() => useResourcePermissions('contacts'));
 
-      const fallbackScope: Scope = {
-        organisationId: 'org-123',
-        eventId: 'event-123',
-        appId: undefined,
-      };
-
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
-        fallbackScope,
+        null,
         expect.any(String),
         undefined,
         true,
@@ -391,7 +385,7 @@ describe('useResourcePermissions Hook', () => {
       );
     });
 
-    it('handles missing organisation gracefully', () => {
+    it('handles missing organisation by passing null scope when resolvedScope is null', () => {
       mockUseOrganisations.mockReturnValue({
         selectedOrganisation: null,
       } as any);
@@ -404,15 +398,9 @@ describe('useResourcePermissions Hook', () => {
 
       renderHook(() => useResourcePermissions('contacts'));
 
-      const fallbackScope: Scope = {
-        organisationId: '',
-        eventId: 'event-123',
-        appId: undefined,
-      };
-
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
-        fallbackScope,
+        null,
         expect.any(String),
         undefined,
         true,
@@ -421,7 +409,7 @@ describe('useResourcePermissions Hook', () => {
       );
     });
 
-    it('handles missing event gracefully', () => {
+    it('handles missing event by passing null scope when resolvedScope is null', () => {
       mockUseEvents.mockReturnValue({
         selectedEvent: null,
       } as any);
@@ -434,15 +422,38 @@ describe('useResourcePermissions Hook', () => {
 
       renderHook(() => useResourcePermissions('contacts'));
 
-      const fallbackScope: Scope = {
+      expect(mockUseCan).toHaveBeenCalledWith(
+        expect.any(String),
+        null,
+        expect.any(String),
+        undefined,
+        true,
+        null,
+        undefined
+      );
+    });
+
+    it('handles missing event gracefully when resolvedScope is set', () => {
+      mockUseEvents.mockReturnValue({
+        selectedEvent: null,
+      } as any);
+
+      const scopeWithOrgOnly: Scope = {
         organisationId: 'org-123',
         eventId: undefined,
         appId: undefined,
       };
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: scopeWithOrgOnly,
+        isLoading: false,
+        error: null,
+      });
+
+      renderHook(() => useResourcePermissions('contacts'));
 
       expect(mockUseCan).toHaveBeenCalledWith(
         expect.any(String),
-        fallbackScope,
+        scopeWithOrgOnly,
         expect.any(String),
         undefined,
         true,
@@ -877,19 +888,12 @@ describe('useResourcePermissions Hook', () => {
 
       renderHook(() => useResourcePermissions('planning'));
 
-      // During scope loading, should use resource-based permissions (no page. prefix)
-      // because resolvedScope is null, so hasAppId is false
-      const fallbackScope: Scope = {
-        organisationId: 'org-123',
-        eventId: 'event-123',
-        appId: undefined,
-      };
-
+      // When resolvedScope is null we pass null to useCan (no fallback)
       expect(mockUseCan).toHaveBeenCalledWith(
         'user-123',
-        fallbackScope,
-        'create:planning', // Resource-based permission (no page. prefix) during loading
-        undefined, // No pageId when appId is not available
+        null,
+        'create:planning',
+        undefined,
         true,
         null,
         undefined
@@ -1348,17 +1352,11 @@ describe('useResourcePermissions Hook', () => {
 
     it('handles scope transition from resolved to null', async () => {
       mockIsSuperAdmin.mockResolvedValue(false);
-      mockUseResolvedScope
-        .mockReturnValueOnce({
-          resolvedScope: mockScope,
-          isLoading: false,
-          error: null,
-        })
-        .mockReturnValueOnce({
-          resolvedScope: null,
-          isLoading: false,
-          error: null,
-        });
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: mockScope,
+        isLoading: false,
+        error: null,
+      });
       mockUseCan.mockReturnValue({
         can: false,
         isLoading: false,
@@ -1370,27 +1368,19 @@ describe('useResourcePermissions Hook', () => {
 
       await waitFor(() => {
         expect(result.current.isLoading).toBe(false);
-        // Check scope properties individually to avoid issues with object reference comparison
-        expect(result.current.scope.organisationId).toBe(mockScope.organisationId);
-        expect(result.current.scope.eventId).toBe(mockScope.eventId);
-        // appId may be undefined in fallback scope, so only check if it exists in mockScope
-        // The hook may use fallback scope even when resolvedScope is provided, so be flexible
-      });
+        expect(result.current.scope).toEqual(mockScope);
+      }, { timeout: 3000 });
 
-      // Scope becomes null
+      // Switch to null scope
+      mockUseResolvedScope.mockReturnValue({
+        resolvedScope: null,
+        isLoading: false,
+        error: null,
+      });
       rerender();
 
       await waitFor(() => {
-        // Should handle null scope gracefully
-        // Scope falls back to selectedOrganisation/selectedEvent when resolvedScope is null
-        expect(result.current).toBeDefined();
-        expect(result.current.scope).toBeDefined();
-        // Scope should have organisationId from selectedOrganisation fallback
-        // The fallback scope has different structure (appId: undefined vs 'app-123'), so just check orgId and eventId
-        expect(result.current.scope.organisationId).toBe('org-123');
-        expect(result.current.scope.eventId).toBe('event-123');
-        // appId may be undefined in fallback scope, but the hook might still have the previous appId
-        // So just verify the scope is defined and has the expected orgId and eventId
+        expect(result.current.scope).toBeNull();
       }, { timeout: 3000 });
     });
 

package/src/rbac/hooks/useResourcePermissions.ts

@@ -66,8 +66,8 @@ export interface ResourcePermissions {
   canDelete: (resource: string) => boolean;
   /** Check if user can read resources of this type */
   canRead: (resource: string) => boolean;
-  /** The resolved scope object (for advanced use cases) */
-  scope: Scope;
+  /** The resolved scope object (for advanced use cases); null when not yet resolved. */
+  scope: Scope | null;
   /** Whether any permission check is currently loading */
   isLoading: boolean;
   /** Error from any permission check or scope resolution */
@@ -147,7 +147,7 @@ function buildResourcePermissions(params: {
   canUpdateResult: boolean;
   canDeleteResult: boolean;
   canReadResult: boolean;
-  scope: Scope;
+  scope: Scope | null;
   isLoading: boolean;
   error: Error | null;
 }): ResourcePermissions {
@@ -203,17 +203,8 @@ export function useResourcePermissions(
     selectedEventOrganisationId: selectedEvent?.organisation_id || null
   });
 
-  // CRITICAL FIX: Only use resolvedScope when it's available (not during loading)
-  // This ensures we wait for appId to be resolved before constructing permission strings
-  // If resolvedScope is null (still loading), we can't determine if we should use page permissions
-  // so we must wait for scope resolution to complete
-  const scope: Scope = useMemo(() => {
-    return resolvedScope || {
-      organisationId: selectedOrganisation?.id || '',
-      eventId: selectedEvent?.event_id || undefined,
-      appId: undefined
-    };
-  }, [resolvedScope, selectedOrganisation?.id, selectedEvent?.event_id]);
+  // Pass only resolvedScope to useCan — null when not ready; no fallback (avoids invalid_input).
+  const scopeForPermissionCheck: Scope | null = resolvedScope;
 
   // CRITICAL FIX: Only use page permissions when appId is actually available in resolvedScope
   // If scope is still loading (resolvedScope is null), we can't know if appId will be available
@@ -240,7 +231,7 @@ export function useResourcePermissions(
   // But we must ensure permission strings are correct before calling useCan
   const { can: canCreateResult, isLoading: createLoading, error: createError } = useCan(
     user?.id || '',
-    scope,
+    scopeForPermissionCheck,
     createPermission as Permission,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
     true, // useCache
@@ -250,7 +241,7 @@ export function useResourcePermissions(
 
   const { can: canUpdateResult, isLoading: updateLoading, error: updateError } = useCan(
     user?.id || '',
-    scope,
+    scopeForPermissionCheck,
     updatePermission as Permission,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
     true, // useCache
@@ -260,7 +251,7 @@ export function useResourcePermissions(
 
   const { can: canDeleteResult, isLoading: deleteLoading, error: deleteError } = useCan(
     user?.id || '',
-    scope,
+    scopeForPermissionCheck,
     deletePermission as Permission,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
     true, // useCache
@@ -271,7 +262,7 @@ export function useResourcePermissions(
   // Optional read permission check
   const { can: canReadResult, isLoading: readLoading, error: readError } = useCan(
     user?.id || '',
-    scope,
+    scopeForPermissionCheck,
     readPermission as Permission,
     pageId, // Pass resource name as pageId when appId is available to enable page permission checks
     true, // useCache
@@ -313,7 +304,7 @@ export function useResourcePermissions(
         canUpdateResult,
         canDeleteResult,
         canReadResult,
-        scope,
+        scope: scopeForPermissionCheck,
         isLoading,
         error,
       }),
@@ -326,7 +317,7 @@ export function useResourcePermissions(
       canUpdateResult,
       canDeleteResult,
       canReadResult,
-      scope,
+      scopeForPermissionCheck,
       isLoading,
       error,
     ]

package/src/rbac/types.ts

@@ -31,6 +31,9 @@ export type AccessLevel =
 /**
  * Scope defines the context for permission checks.
  * Can include organisation, event, and/or app identifiers.
+ *
+ * Convention: For permission-check APIs (e.g. useCan, useMultiplePermissions), pass Scope | null.
+ * null means scope not yet resolved — the hook stays in loading and does not call the RPC.
  */
 export type Scope = {
   organisationId?: UUID;

package/src/services/AuthService.edge-cases.test.ts

@@ -579,7 +579,7 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
       expect(authService.isAuthenticated()).toBe(false);
     });
 
-    it('handles sign out during session restoration', async () => {
+    it('handles sign out during session restoration', { timeout: 15000 }, async () => {
       vi.useFakeTimers();
       
       mockSupabase.auth.getSession.mockImplementation(() => {
@@ -606,7 +606,7 @@ describe('AuthService Edge Cases and Complex Scenarios', () => {
       expect(authService.isAuthenticated()).toBe(false);
       
       vi.useRealTimers();
-    }, { timeout: 15000 });
+    });
 
     it('handles refreshSession with invalid session data', async () => {
       mockSupabase.auth.refreshSession.mockResolvedValue({

package/src/services/EventService.ts

@@ -228,10 +228,15 @@ export class EventService extends BaseService implements IEventService {
   // Event methods
   setSelectedEvent(event: Event | null): void {
     if (event) {
-      // No validation needed: For event-required apps, org is derived from event
-      // For org-required apps, event is optional and doesn't need validation
-      // RLS policies handle security at the database level
-      this.selectedEvent = event;
+      // Ensure organisation_id is set when we have selectedOrganisation, so scope resolution
+      // (useResolvedScope / useDataTableScope) gets org early and permission checks succeed.
+      const orgId = (event as { organisation_id?: string | null }).organisation_id;
+      const missingOrg = !orgId || (typeof orgId === 'string' && orgId.trim() === '');
+      const eventToStore: Event =
+        missingOrg && this.selectedOrganisation?.id
+          ? ({ ...event, organisation_id: this.selectedOrganisation.id } as Event)
+          : event;
+      this.selectedEvent = eventToStore;
       this.setSelectedEventId?.(event.event_id);
       // Persist asynchronously (don't await to avoid blocking)
       this.persistEventSelection(event.event_id).catch(error => {

package/src/utils/file-reference/file-reference.test.ts

@@ -675,15 +675,20 @@ describe('[service] FileReferenceServiceImpl', () => {
           tags: ['updated']
         }
       };
-      
-      // Simulate update chain resolving via shared query builder
-      (mockSupabase.from() as any).single.mockResolvedValue({
-        data: { ...mockFileReference, ...updates },
-        error: null
-      });
-      
+
+      const updateChain = {
+        update: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        select: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { ...mockFileReference, ...updates },
+          error: null
+        })
+      };
+      (mockSupabase.from as any).mockReturnValue(updateChain);
+
       const result = await service.updateFileReference('file-ref-123', updates);
-      
+
       expect(expectOk(result)).toEqual(expect.objectContaining(updates));
     });
 
@@ -1036,12 +1041,18 @@ describe('[service] FileReferenceServiceImpl', () => {
 
     it('handles updateFileReference errors', async () => {
       const updates = { file_metadata: { tags: ['updated'] } };
-      
-      (mockSupabase.from() as any).update().eq().select().single.mockResolvedValue({
-        data: null,
-        error: { message: 'Update failed', code: 'ERR' }
-      });
-      
+
+      const updateChain = {
+        update: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        select: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: null,
+          error: { message: 'Update failed', code: 'ERR' }
+        })
+      };
+      (mockSupabase.from as any).mockReturnValue(updateChain);
+
       const result = await service.updateFileReference('file-ref-123', updates);
       expect(result.ok).toBe(false);
       if (!result.ok) expect(result.error.message).toContain('Update failed');

package/src/utils/supabase/createBaseClient.test.ts

@@ -46,16 +46,21 @@ describe('[unit] createBaseClient', () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
-    // Set production mode by default to bypass stack check
     process.env.NODE_ENV = 'production';
-    // @ts-expect-error - Testing production mode
-    import.meta.env = { MODE: 'production', PROD: true };
+    Object.defineProperty(import.meta, 'env', {
+      value: { MODE: 'production', PROD: true },
+      writable: true,
+      configurable: true,
+    });
   });
 
   afterEach(() => {
     delete process.env.NODE_ENV;
-    // @ts-expect-error - Restore
-    import.meta.env = {};
+    Object.defineProperty(import.meta, 'env', {
+      value: {},
+      writable: true,
+      configurable: true,
+    });
   });
 
   describe('Client Creation', () => {
@@ -104,8 +109,11 @@ describe('[unit] createBaseClient', () => {
   describe('Context Validation', () => {
     it('allows creation in production mode', () => {
       process.env.NODE_ENV = 'production';
-      // @ts-expect-error - Testing production mode
-      import.meta.env = { MODE: 'production', PROD: true };
+      Object.defineProperty(import.meta, 'env', {
+        value: { MODE: 'production', PROD: true },
+        writable: true,
+        configurable: true,
+      });
 
       expect(() => {
         createBaseClient(mockSupabaseUrl, mockSupabaseKey);
@@ -114,8 +122,11 @@ describe('[unit] createBaseClient', () => {
 
     it('allows creation with null stack (production build)', () => {
       process.env.NODE_ENV = 'production';
-      // @ts-expect-error - Testing production mode
-      import.meta.env = { MODE: 'production', PROD: true };
+      Object.defineProperty(import.meta, 'env', {
+        value: { MODE: 'production', PROD: true },
+        writable: true,
+        configurable: true,
+      });
 
       // Mock Error to return null stack
       const originalError = Error;
@@ -141,8 +152,11 @@ describe('[unit] createBaseClient', () => {
   describe('Error Handling', () => {
     it('throws error when called from unauthorized location in development', () => {
       process.env.NODE_ENV = 'development';
-      // @ts-expect-error - Testing development mode
-      import.meta.env = { MODE: 'development' };
+      Object.defineProperty(import.meta, 'env', {
+        value: { MODE: 'development' },
+        writable: true,
+        configurable: true,
+      });
 
       // Mock Error to return unauthorized stack
       const originalError = Error;
@@ -167,8 +181,11 @@ describe('[unit] createBaseClient', () => {
     it('logs error to Logger when called from unauthorized location', () => {
       mockLoggerError.mockClear();
       process.env.NODE_ENV = 'development';
-      // @ts-expect-error - Testing development mode
-      import.meta.env = { MODE: 'development' };
+      Object.defineProperty(import.meta, 'env', {
+        value: { MODE: 'development' },
+        writable: true,
+        configurable: true,
+      });
 
       // Mock Error to return unauthorized stack
       const originalError = Error;