@jmruthers/pace-core 0.6.2 → 0.6.3

package/src/providers/services/UnifiedAuthProvider.tsx

@@ -25,6 +25,7 @@ import type { Event } from '../../types/event';
 import type { AuthError } from '@supabase/supabase-js';
 import type { SessionRestorationState } from '../../types/auth';
 import { logger } from '../../utils/core/logger';
+import { setupRBAC, isRBACInitialized } from '../../rbac/api';
 
 // Re-export UserEventAccess type
 /**
@@ -117,7 +118,6 @@ export interface UnifiedAuthContextType {
   handleSignOutNow: () => Promise<void>;
 
   // Additional unified properties
-  appConfig: { requires_event: boolean } | null;
   isLoading: boolean;
   hasErrors: boolean;
   sessionRestoration: SessionRestorationState;
@@ -159,8 +159,6 @@ export interface UnifiedAuthProviderProps {
   enablePersistence?: boolean;
   requireOrganisationContext?: boolean;
   
-  // App configuration
-  appConfig?: { requires_event: boolean } | null;
   
   // Inactivity auto-logout configuration - MANDATORY for security
   idleTimeoutMs: number; // REQUIRED: Inactivity timeout in milliseconds
@@ -178,7 +176,6 @@ export interface UnifiedAuthProviderProps {
 function UnifiedAuthContextProvider({ 
   children, 
   appName,
-  appConfig: appConfigProp,
   supabaseClient: supabaseClientProp,
   ...props 
 }: UnifiedAuthProviderProps) {
@@ -199,17 +196,7 @@ function UnifiedAuthContextProvider({
     restorationError,
   }), [isRestoring, restorationComplete, restorationError]);
   
-  // Load appConfig from database if not provided as prop
-  // Memoize appConfig to prevent object reference changes that cause re-renders
-  const [appConfigState, setAppConfigState] = useState<{ requires_event: boolean } | null>(appConfigProp || null);
-  const isResolvingAppConfigRef = useRef(false);
-  const resolvedAppConfigRef = useRef<{ requires_event: boolean } | null>(null);
-  
-  // Memoize appConfig to ensure stable reference - only recreate if requires_event changes
-  const appConfig = useMemo(() => {
-    if (!appConfigState) return null;
-    return { requires_event: appConfigState.requires_event };
-  }, [appConfigState?.requires_event]);
+  // App config removed - scope is now page-level only (rbac_app_pages.scope_type)
 
   // Try to get event service, but provide fallback if not available
   let eventService;
@@ -244,6 +231,16 @@ function UnifiedAuthContextProvider({
   // Resolve appId immediately when user logs in (don't wait for organisation/event)
   // This makes appId available early for navigation menu filtering
   const [appId, setAppId] = useState<string | undefined>(undefined);
+  
+  useEffect(() => {
+    logger.debug('UnifiedAuthContextProvider', `Rendering [AuthService ID:${authService.getInstanceId?.() || 'unknown'}]`, {
+      hasUser: !!currentUser,
+      userId: currentUser?.id,
+      hasSession: !!currentSession,
+      isAuth
+    });
+  }, [currentUser?.id, currentSession?.access_token, isAuth, authService]);
+
   const isResolvingAppIdRef = useRef(false);
   const resolvedAppIdRef = useRef<string | undefined>(undefined);
   const resolvedUserIdRef = useRef<string | undefined>(undefined);
@@ -326,75 +323,6 @@ function UnifiedAuthContextProvider({
     }
   }, [isAuth, currentUser?.id, supabase, appName]); // Removed appId from deps - it's the output, not an input. currentUser?.id is stable primitive.
 
-  // Load appConfig from database if not provided as prop
-  useEffect(() => {
-    // If appConfig is provided as prop, use it and don't load from database
-    if (appConfigProp !== undefined) {
-      setAppConfigState(appConfigProp);
-      resolvedAppConfigRef.current = appConfigProp;
-      return;
-    }
-
-    // If we've already resolved, don't resolve again
-    if (resolvedAppConfigRef.current !== null || isResolvingAppConfigRef.current) {
-      return;
-    }
-
-    // Only load if we have supabase and appName
-    if (!supabase || !appName) {
-      return;
-    }
-
-    isResolvingAppConfigRef.current = true;
-
-    // Load app config from database
-    import('../../rbac/api').then(async ({ getAppConfigByName }) => {
-      try {
-        const config = await getAppConfigByName(appName);
-        // Default to requires_event: false if config is null (organisation-based apps)
-        const resolvedConfig = config || { requires_event: false };
-        
-        // Only update if the value actually changed to prevent unnecessary re-renders
-        if (resolvedAppConfigRef.current?.requires_event !== resolvedConfig.requires_event) {
-          resolvedAppConfigRef.current = resolvedConfig;
-          setAppConfigState(resolvedConfig);
-        }
-        
-        // Debug logging for pace-mint
-        if (import.meta.env.DEV && appName === 'MINT') {
-          logger.debug('UnifiedAuthProvider', 'App config loaded', {
-            appName,
-            config: resolvedConfig,
-            requiresEvent: resolvedConfig.requires_event
-          });
-        }
-      } catch (error) {
-        logger.warn('UnifiedAuthProvider', 'Failed to load app config, defaulting to organisation-based', {
-          error: error instanceof Error ? error.message : String(error),
-          appName
-        });
-        // Default to organisation-based (requires_event: false) on error
-        // Only update if not already set to avoid unnecessary re-renders
-        if (resolvedAppConfigRef.current?.requires_event !== false) {
-          const defaultConfig = { requires_event: false };
-          resolvedAppConfigRef.current = defaultConfig;
-          setAppConfigState(defaultConfig);
-        }
-      } finally {
-        isResolvingAppConfigRef.current = false;
-      }
-    }).catch((importError) => {
-      logger.error('UnifiedAuthProvider', 'Failed to import RBAC API for app config', importError);
-      isResolvingAppConfigRef.current = false;
-      // Default to organisation-based on import error
-      // Only update if not already set to avoid unnecessary re-renders
-      if (resolvedAppConfigRef.current?.requires_event !== false) {
-        const defaultConfig = { requires_event: false };
-        resolvedAppConfigRef.current = defaultConfig;
-        setAppConfigState(defaultConfig);
-      }
-    });
-  }, [supabase, appName, appConfigProp]);
 
   // Subscribe to service state changes to trigger re-renders
   // Use useReducer to force updates when services notify
@@ -465,30 +393,9 @@ function UnifiedAuthContextProvider({
   const rawSelectedOrganisation = organisationService.getSelectedOrganisation();
   const organisationError = organisationService.getError();
   
-  // For event-required apps, selectedOrganisation is not in context (org derived from event)
-  // For org-required apps, selectedOrganisation is available
-  // CRITICAL FIX: Only set to null if appConfig is loaded AND explicitly requires_event is true
-  // If appConfig is null (still loading) OR requires_event is false/undefined, allow selectedOrganisation
-  // This ensures organisation-based apps work correctly even if appConfig hasn't loaded yet or is misconfigured
-  // IMPORTANT: If rawSelectedOrganisation exists, prefer it over appConfig to avoid race conditions
-  const selectedOrganisation = (appConfig !== null && appConfig?.requires_event === true && !rawSelectedOrganisation) 
-    ? null 
-    : rawSelectedOrganisation;
-  
-  // Debug logging for pace-mint issue - use useEffect to avoid causing re-renders
-  useEffect(() => {
-    if (import.meta.env.DEV && appName === 'MINT') {
-      logger.debug('UnifiedAuthProvider', 'Organisation state check', {
-        rawSelectedOrganisation: rawSelectedOrganisation?.id || null,
-        rawSelectedOrganisationType: typeof rawSelectedOrganisation,
-        appConfig,
-        appConfigRequiresEvent: appConfig?.requires_event,
-        selectedOrganisation: selectedOrganisation?.id || null,
-        selectedOrganisationId: selectedOrganisation?.id || null,
-        checkResult: appConfig?.requires_event === true,
-      });
-    }
-  }, [appName, rawSelectedOrganisation?.id, appConfig?.requires_event, selectedOrganisation?.id]);
+  // Scope is now page-level only - use whatever organisation is selected
+  // No app-level scope determination needed
+  const selectedOrganisation = rawSelectedOrganisation;
   const hasValidOrganisationContext = organisationService.hasValidOrganisationContext();
   const isContextReady = organisationService.isContextReady();
   
@@ -668,7 +575,6 @@ function UnifiedAuthContextProvider({
     // Additional unified properties
     appName,
     appId, // Resolved immediately on login
-    appConfig: appConfig,
     isLoading: totalLoading,
     hasErrors: hasErrors,
     sessionRestoration: sessionRestoration,
@@ -700,7 +606,6 @@ function UnifiedAuthContextProvider({
     hasErrors,
     appName,
     appId,
-    appConfig,
     sessionRestoration,
     sessionRestorationTimedOut,
     sessionRestorationTimeoutMs,
@@ -741,28 +646,19 @@ function EventServiceProviderWrapper({
   supabaseClient,
   user,
   session,
-  appName,
-  appConfig
+  appName
 }: {
   children: React.ReactNode;
   supabaseClient: SupabaseClient;
   user: User | null;
   session: Session | null;
   appName: string;
-  appConfig?: { requires_event: boolean } | null;
 }) {
   // Use useOrganisations() hook for better reactivity - it subscribes to service changes
   // This ensures EventServiceProvider re-renders when selectedOrganisation changes
-  const { selectedOrganisation: rawSelectedOrganisation } = useOrganisations();
-
-  // FIX: For event-required apps, don't pass selectedOrganisation to EventService
-  // Organisation will be derived from the selected event instead
-  // This prevents EventService from filtering events by the wrong organisation
-  // CRITICAL FIX: Only set to null if appConfig is loaded AND explicitly requires_event is true AND no org selected
-  // If rawSelectedOrganisation exists, prefer it over appConfig to avoid race conditions
-  const selectedOrganisation = (appConfig !== null && appConfig?.requires_event === true && !rawSelectedOrganisation) 
-    ? null 
-    : rawSelectedOrganisation;
+  const { selectedOrganisation } = useOrganisations();
+  
+  // Scope is now page-level only - use whatever organisation is selected
 
   // Always render EventServiceProvider - it handles null user/session gracefully
   // This ensures EventServiceContext is always available for components calling useEvents()
@@ -771,6 +667,15 @@ function EventServiceProviderWrapper({
     // Event selection is now handled at the application level
   }, []);
 
+  useEffect(() => {
+    logger.debug('EventServiceProviderWrapper', 'Rendering with props', {
+      hasUser: !!user,
+      userId: user?.id,
+      hasSession: !!session,
+      selectedOrganisationId: selectedOrganisation?.id
+    });
+  }, [user?.id, session?.access_token, selectedOrganisation?.id]);
+
   return (
     <EventServiceProvider
       supabaseClient={supabaseClient}
@@ -790,7 +695,6 @@ function ServiceAwareProviders({
   children, 
   supabaseClient,
   appName,
-  appConfig,
   persistState,
   enablePersistence,
   requireOrganisationContext,
@@ -800,32 +704,71 @@ function ServiceAwareProviders({
   renderInactivityWarning,
   dangerouslyDisableInactivity
 }: UnifiedAuthProviderProps) {
+  // useAuthService already handles subscription and re-rendering with debouncing
+  // This ensures we get fresh user/session values on every render
   const authService = useAuthService();
 
+  // CRITICAL: Track user/session in state to force re-renders when they change
+  // This ensures ServiceAwareProviders re-renders immediately when user logs in
+  const [userState, setUserState] = useState(() => authService.getUser());
+  const [sessionState, setSessionState] = useState(() => authService.getSession());
+  
+  // Subscribe directly to auth service changes and update state immediately
+  useEffect(() => {
+    const unsubscribe = authService.subscribe(() => {
+      // Update state immediately when auth service notifies (bypasses debounce)
+      const newUser = authService.getUser();
+      const newSession = authService.getSession();
+      
+      logger.debug('ServiceAwareProviders', 'Auth service notified, updating state', {
+        hasUser: !!newUser,
+        userId: newUser?.id,
+        hasSession: !!newSession
+      });
+      
+      setUserState(newUser);
+      setSessionState(newSession);
+    });
+    return unsubscribe;
+  }, [authService]);
+
+  // Use state values instead of reading directly from service
+  // This ensures React re-renders when these values change
+  const user = userState;
+  const session = sessionState;
+  
+  // Log when user/session changes for debugging
+  useEffect(() => {
+    logger.debug('ServiceAwareProviders', `User/session state [AuthService ID:${authService.getInstanceId?.() || 'unknown'}]`, {
+      hasUser: !!user,
+      userId: user?.id,
+      hasSession: !!session,
+      sessionToken: session?.access_token ? 'present' : 'missing'
+    });
+  }, [user?.id, session?.access_token, authService]);
+
   return (
     <OrganisationServiceProvider
       supabaseClient={supabaseClient}
-      user={authService.getUser()}
-      session={authService.getSession()}
+      user={user}
+      session={session}
     >
       <EventServiceProviderWrapper
         supabaseClient={supabaseClient}
-        user={authService.getUser()}
-        session={authService.getSession()}
+        user={user}
+        session={session}
         appName={appName}
-        appConfig={appConfig}
       >
         <InactivityServiceProvider
           supabaseClient={supabaseClient}
-          user={authService.getUser()}
-          session={authService.getSession()}
+          user={user}
+          session={session}
           idleTimeoutMs={idleTimeoutMs}
           warnBeforeMs={warnBeforeMs}
           onIdleLogout={onIdleLogout}
         >
           <UnifiedAuthContextProvider
             appName={appName}
-            appConfig={appConfig}
             supabaseClient={supabaseClient}
             persistState={persistState}
             enablePersistence={enablePersistence}
@@ -855,7 +798,6 @@ export function UnifiedAuthProvider({
   children,
   supabaseClient,
   appName,
-  appConfig = { requires_event: true }, // Default to requiring events
   persistState = true,
   enablePersistence,
   requireOrganisationContext = true,
@@ -882,15 +824,29 @@ export function UnifiedAuthProvider({
         note: 'Ensure you create the Supabase client once and reuse it. Creating multiple clients can cause performance issues and the "Multiple GoTrueClient instances" warning.'
       });
       clientRef.current = supabaseClient;
+    } else {
+      logger.debug('UnifiedAuthProvider', 'Supabase client reference is stable');
     }
   }, [supabaseClient]);
 
+  // Initialize RBAC synchronously when supabaseClient is available
+  // This ensures RBAC engine is ready BEFORE any child services (EventService, OrganisationService, etc.)
+  // are initialized, preventing race conditions where services try to use RBAC before it's ready
+  // CRITICAL: This must be synchronous, not in useEffect, to ensure RBAC is ready before children render
+  if (supabaseClient && !isRBACInitialized()) {
+    try {
+      setupRBAC(supabaseClient);
+      logger.debug('UnifiedAuthProvider', 'RBAC initialized synchronously');
+    } catch (err) {
+      logger.error('UnifiedAuthProvider', 'Failed to initialize RBAC', err);
+    }
+  }
+
   return (
     <AuthServiceProvider supabaseClient={supabaseClient} appName={appName}>
       <ServiceAwareProviders
         supabaseClient={supabaseClient}
         appName={appName}
-        appConfig={appConfig}
         persistState={persistState}
         enablePersistence={enablePersistence}
         requireOrganisationContext={requireOrganisationContext}

package/src/rbac/__tests__/adapters.comprehensive.test.tsx

@@ -499,7 +499,7 @@ describe('RBAC Adapters - Comprehensive Tests', () => {
           scope: { organisationId: 'org-123', eventId: 'event-123', appId: 'app-123' },
           permission: 'read:users',
           pageId: undefined,
-        }, null, undefined, null);
+        });
         expect(handler).toHaveBeenCalledWith(req);
         expect(result).toEqual({ success: true });
       });

package/src/rbac/adapters.tsx

@@ -303,7 +303,7 @@ export function withPermissionGuard<T extends any[]>(
       scope: { organisationId, eventId, appId },
       permission: config.permission,
       pageId: config.pageId,
-    }, null, undefined, null);
+    });
 
     if (!hasPermission) {
       throw new Error(`Permission denied: ${config.permission}`);
@@ -548,7 +548,7 @@ export function createRBACMiddleware(config: {
           scope: { organisationId },
           permission: protectedRoute.permission,
           pageId: protectedRoute.pageId,
-        }, null, undefined, null);
+        });
 
         if (!hasPermission) {
           return res.redirect(config.fallbackUrl || '/access-denied');

package/src/rbac/api.test.ts

@@ -61,6 +61,16 @@ vi.mock('./config', () => ({
   }))
 }));
 
+// Mock getPageScopeType RPC call
+vi.mock('../utils/core/logger', () => ({
+  createLogger: vi.fn(() => ({
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn()
+  }))
+}));
+
 // Mock Supabase client
 const mockSupabase = {
   from: vi.fn(() => ({
@@ -460,6 +470,42 @@ describe('RBAC API', () => {
     let mockEngine: any;
 
     beforeEach(() => {
+      // Create a mock Supabase client that can handle getPageScopeType queries
+      const mockSupabaseForEngine = {
+        from: vi.fn((table: string) => {
+          if (table === 'rbac_apps') {
+            return {
+              select: vi.fn(() => ({
+                eq: vi.fn(() => ({
+                  eq: vi.fn(() => ({
+                    single: vi.fn().mockResolvedValue({ data: { id: 'app-123' }, error: null })
+                  }))
+                }))
+              }))
+            };
+          }
+          if (table === 'rbac_app_pages') {
+            return {
+              select: vi.fn(() => ({
+                eq: vi.fn(() => ({
+                  eq: vi.fn(() => ({
+                    maybeSingle: vi.fn().mockResolvedValue({ data: { id: '123e4567-e89b-12d3-a456-426614174000' }, error: null })
+                  }))
+                }))
+              }))
+            };
+          }
+          return mockSupabase.from(table);
+        }),
+        rpc: vi.fn((fnName: string, params: any) => {
+          if (fnName === 'get_page_scope_type') {
+            return Promise.resolve({ data: 'organisation', error: null });
+          }
+          return Promise.resolve({ data: null, error: null });
+        }),
+        auth: mockSupabase.auth
+      };
+
       mockEngine = {
         getAccessLevel: vi.fn(),
         getPermissionMap: vi.fn(),
@@ -467,7 +513,7 @@ describe('RBAC API', () => {
         resolveAppContext: vi.fn(),
         getRoleContext: vi.fn(),
         checkSuperAdmin: vi.fn(),
-        getAppConfig: vi.fn()
+        supabase: mockSupabaseForEngine as any
       };
 
       mockCreateRBACEngine.mockReturnValue(mockEngine);
@@ -603,24 +649,13 @@ describe('RBAC API', () => {
 
         const result = await isPermitted({
           userId: 'user-123',
-          scope: { organisationId: 'org-456' },
+          scope: { organisationId: 'org-456', appId: 'app-123' },
           permission: 'read:users',
-          pageId: 'page-789'
+          pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
         expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
-          {
-            userId: 'user-123',
-            scope: { organisationId: 'org-456' },
-            permission: 'read:users',
-            pageId: 'page-789'
-          },
-          expect.objectContaining({
-            userId: 'user-123',
-            organisationId: 'org-456'
-          })
-        );
+        expect(mockEngine.isPermitted).toHaveBeenCalled();
       });
 
       it('handles engine errors', async () => {
@@ -661,14 +696,15 @@ describe('RBAC API', () => {
       it('returns cached result when available', async () => {
         const { isPermittedCached } = await import('./api');
         
-        const cacheKey = 'permission:user-123:org-456:null:null:read:users';
+        // Cache key now includes appId when provided
+        const cacheKey = 'permission:user-123:org-456:null:app-123:read:users';
         rbacCache.get.mockReturnValue(true);
 
         const result = await isPermittedCached({
           userId: 'user-123',
-          scope: { organisationId: 'org-456' },
+          scope: { organisationId: 'org-456', appId: 'app-123' },
           permission: 'read:users',
-          pageId: 'page-789'
+          pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
         expect(result).toBe(true);
@@ -684,24 +720,13 @@ describe('RBAC API', () => {
 
         const result = await isPermittedCached({
           userId: 'user-123',
-          scope: { organisationId: 'org-456' },
+          scope: { organisationId: 'org-456', appId: 'app-123' },
           permission: 'read:users',
-          pageId: 'page-789'
+          pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
         expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
-          {
-            userId: 'user-123',
-            scope: { organisationId: 'org-456' },
-            permission: 'read:users',
-            pageId: 'page-789'
-          },
-          expect.objectContaining({
-            userId: 'user-123',
-            organisationId: 'org-456'
-          })
-        );
+        expect(mockEngine.isPermitted).toHaveBeenCalled();
         // Check that cache.set was called - pageId presence makes it a page-level check
         expect(rbacCache.set).toHaveBeenCalled();
         const setCall = rbacCache.set.mock.calls[0];
@@ -828,25 +853,8 @@ describe('RBAC API', () => {
       });
     });
 
-    describe('getAppConfig', () => {
-      it('returns app configuration', async () => {
-        const { getAppConfig } = await import('./api');
-        
-        // getAppConfig now returns null (needs Supabase client)
-        const result = await getAppConfig('app-123');
-
-        expect(result).toBeNull();
-      });
-
-      it('handles missing Supabase client gracefully', async () => {
-        const { getAppConfig } = await import('./api');
-        
-        const result = await getAppConfig('app-123');
-        
-        // Should return null when no client is available
-        expect(result).toBeNull();
-      });
-    });
+    // getAppConfig has been removed - scope is now page-level only
+    // Tests removed as function no longer exists
 
     describe('isOrganisationAdmin', () => {
       it('returns true for admin access level', async () => {