@jmruthers/pace-core 0.6.2 → 0.6.3

package/src/rbac/hooks/permissions/useCan.ts

@@ -43,10 +43,18 @@ export function useCan(
   precomputedSuperAdmin: boolean | null = null,
   appName?: string,
 ) {
-  const [can, setCan] = useState<boolean>(false);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState<Error | null>(null);
+  // CRITICAL FIX: Initialize isSuperAdmin from precomputed value immediately
+  // This prevents permission checks from running when we already know the user is a super admin
+  // If precomputedSuperAdmin is true, we can immediately set can=true and isLoading=false
   const [isSuperAdmin, setIsSuperAdmin] = useState<boolean | null>(precomputedSuperAdmin ?? null);
+  
+  // For super admins, immediately grant permissions without waiting
+  const initialCan = precomputedSuperAdmin === true ? true : false;
+  const initialIsLoading = precomputedSuperAdmin === true ? false : true;
+  
+  const [can, setCan] = useState<boolean>(initialCan);
+  const [isLoading, setIsLoading] = useState<boolean>(initialIsLoading);
+  const [error, setError] = useState<Error | null>(null);
 
   // Validate scope parameter - handle undefined/null scope gracefully
   const isValidScope = scope && typeof scope === 'object';
@@ -54,6 +62,19 @@ export function useCan(
   const eventId = isValidScope ? scope.eventId : undefined;
   const appId = isValidScope ? scope.appId : undefined;
 
+  // CRITICAL FIX: Immediately update state when precomputedSuperAdmin changes to true
+  // This ensures super admins get immediate access without waiting for permission checks
+  useEffect(() => {
+    if (precomputedSuperAdmin === true && isSuperAdmin !== true) {
+      setIsSuperAdmin(true);
+      setCan(true);
+      setIsLoading(false);
+      setError(null);
+    } else if (precomputedSuperAdmin === false && isSuperAdmin !== false) {
+      setIsSuperAdmin(false);
+    }
+  }, [precomputedSuperAdmin, isSuperAdmin]);
+
   // Check super-admin status - super admins bypass organisation context requirements
   // PERFORMANCE OPTIMIZATION: Use precomputed value directly - no duplicate checks
   // Callers must check super admin once and pass the result (null if not checked yet)
@@ -93,6 +114,12 @@ export function useCan(
               });
             }
             setIsSuperAdmin(isSuper);
+            // If super admin, immediately grant permissions
+            if (isSuper) {
+              setCan(true);
+              setIsLoading(false);
+              setError(null);
+            }
           }
         } catch (err) {
           if (!cancelled) {
@@ -111,9 +138,6 @@ export function useCan(
       return () => {
         cancelled = true;
       };
-    } else {
-      // Precomputed value provided (true/false) - use it directly, no check needed
-      setIsSuperAdmin(precomputedSuperAdmin);
     }
   }, [userId, precomputedSuperAdmin]);
 
@@ -150,6 +174,7 @@ export function useCan(
   const lastPermissionRef = useRef<Permission | null>(null);
   const lastPageIdRef = useRef<UUID | undefined | null>(null);
   const lastUseCacheRef = useRef<boolean | null>(null);
+  const lastIsSuperAdminRef = useRef<boolean | null>(null);
 
   // Create a stable scope object for comparison
   const stableScope = useMemo(() => {
@@ -171,13 +196,18 @@ export function useCan(
     const scopeChanged = !scopeEqual(prevScopeRef.current, stableScope);
 
     // Only run if something has actually changed
+    // CRITICAL: Also check if isSuperAdmin changed - super admins bypass all checks
+    const isSuperAdminChanged = lastIsSuperAdminRef.current !== isSuperAdmin;
+    
     if (
       lastUserIdRef.current !== userId ||
       scopeChanged ||
       lastPermissionRef.current !== permission ||
       lastPageIdRef.current !== pageId ||
-      lastUseCacheRef.current !== useCache
+      lastUseCacheRef.current !== useCache ||
+      isSuperAdminChanged
     ) {
+      lastIsSuperAdminRef.current = isSuperAdmin;
       lastUserIdRef.current = userId;
       prevScopeRef.current = stableScope;
       lastPermissionRef.current = permission;
@@ -265,8 +295,8 @@ export function useCan(
           // Note: isPermittedCached doesn't support precomputedSuperAdmin, but the check will be cached
           // If we know user is NOT super admin (isSuperAdmin === false), pass false to skip the check
           const result = useCache
-            ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, undefined, appName)
-            : await isPermitted({ userId, scope: validScope, permission, pageId }, undefined, appName, isSuperAdmin === false ? false : null);
+            ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, appName)
+            : await isPermitted({ userId, scope: validScope, permission, pageId }, appName, isSuperAdmin === false ? false : null);
 
           setCan(result);
         } catch (err) {
@@ -325,8 +355,8 @@ export function useCan(
       };
 
       const result = useCache
-        ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, undefined, appName)
-        : await isPermitted({ userId, scope: validScope, permission, pageId }, undefined, appName, null);
+        ? await isPermittedCached({ userId, scope: validScope, permission, pageId }, appName)
+        : await isPermitted({ userId, scope: validScope, permission, pageId }, appName, null);
 
       setCan(result);
     } catch (err) {

package/src/rbac/hooks/permissions/useHasAllPermissions.ts

@@ -59,7 +59,7 @@ export function useHasAllPermissions(
       for (const permission of permissions) {
         const result = useCache
           ? await isPermittedCached({ userId, scope, permission })
-          : await isPermitted({ userId, scope, permission }, null, undefined, null);
+          : await isPermitted({ userId, scope, permission });
 
         if (!result) {
           hasAllPermissions = false;

package/src/rbac/hooks/permissions/useHasAnyPermission.ts

@@ -59,7 +59,7 @@ export function useHasAnyPermission(
       for (const permission of permissions) {
         const result = useCache
           ? await isPermittedCached({ userId, scope, permission })
-          : await isPermitted({ userId, scope, permission }, null, undefined, null);
+          : await isPermitted({ userId, scope, permission });
 
         if (result) {
           hasAnyPermission = true;

package/src/rbac/hooks/permissions/useMultiplePermissions.ts

@@ -66,7 +66,7 @@ export function useMultiplePermissions(
       for (const permission of permissions) {
         const result = useCache
           ? await isPermittedCached({ userId, scope, permission })
-          : await isPermitted({ userId, scope, permission }, null, undefined, null);
+          : await isPermitted({ userId, scope, permission });
         permissionResults[permission] = result;
       }
 

package/src/rbac/hooks/useCan.test.ts

@@ -126,7 +126,6 @@ describe('useCan Hook', () => {
             permission: mockPermission,
             pageId: mockPageId
           },
-          undefined,
           undefined
         );
         expect(mockIsPermitted).not.toHaveBeenCalled();
@@ -151,7 +150,6 @@ describe('useCan Hook', () => {
             pageId: mockPageId
           },
           undefined,
-          undefined,
           false
         );
         expect(mockIsPermittedCached).not.toHaveBeenCalled();
@@ -191,7 +189,6 @@ describe('useCan Hook', () => {
             pageId: 'custom-page'
           },
           undefined,
-          undefined,
           false
         );
       });
@@ -214,7 +211,6 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined,
           false
         );
       });
@@ -257,7 +253,6 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined,
           false
         );
       });
@@ -299,7 +294,6 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined,
           false
         );
       });
@@ -340,7 +334,6 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined,
           false
         );
       });
@@ -548,7 +541,6 @@ describe('useCan Hook', () => {
         permission: mockPermission,
         pageId: mockPageId
       },
-      undefined,
       undefined
     );
     });
@@ -637,7 +629,6 @@ describe('useCan Hook', () => {
             pageId: undefined
           },
           undefined,
-          undefined,
           false
         );
       });

package/src/rbac/hooks/useRBAC.test.ts

@@ -115,11 +115,7 @@ describe('useRBAC', () => {
           eventId: undefined,
           appId: 'app-123'
         }
-      },
-      {
-        requires_event: false,
-      },
-      'test-app'
+      }
     );
   });
 

package/src/rbac/hooks/useRBAC.ts

@@ -19,6 +19,7 @@ import {
   getAccessLevel,
   resolveAppContext,
   getRoleContext,
+  getPageScopeType,
 } from '../api';
 import { getRBACLogger } from '../config';
 import { ContextValidator } from '../utils/contextValidator';
@@ -58,7 +59,6 @@ export function useRBAC(pageId?: string): UserRBACContext {
     session, 
     supabase,
     appName, 
-    appConfig,
     appId: contextAppId,
     selectedOrganisation,
     isContextReady: orgContextReady,
@@ -94,30 +94,21 @@ export function useRBAC(pageId?: string): UserRBACContext {
     }
 
     // Build initial scope from available context
-    // For event-required apps: use organisation_id from selectedEvent if available (faster than deriving)
-    // For org-required apps: use selectedOrganisation.id
+    // Scope is now page-level only - use whatever context is available
     const initialScope: Scope = {
-      organisationId: appConfig?.requires_event 
-        ? (selectedEvent?.organisation_id || selectedOrganisation?.id) 
-        : selectedOrganisation?.id,
+      organisationId: selectedEvent?.organisation_id || selectedOrganisation?.id || undefined,
       eventId: selectedEvent?.event_id || undefined,
       appId: undefined
     };
 
-    // Check if context is ready using ContextValidator
-    const contextReady = ContextValidator.isContextReady(
-      initialScope,
-      appConfig,
-      appName,
-      !!selectedEvent,
-      !!selectedOrganisation
-    );
-
     // PORTAL/ADMIN special case: context is always ready
-    if (appName !== 'PORTAL' && appName !== 'ADMIN' && !contextReady) {
-      // Wait for appropriate context based on app config
-      setIsLoading(true);
-      return;
+    // For other apps, we need at least one context (org or event) for page-level scope validation
+    if (appName !== 'PORTAL' && appName !== 'ADMIN') {
+      if (!selectedOrganisation && !selectedEvent) {
+        // Wait for context to be available
+        setIsLoading(true);
+        return;
+      }
     }
 
     setIsLoading(true);
@@ -135,14 +126,8 @@ export function useRBAC(pageId?: string): UserRBACContext {
           // For PORTAL/ADMIN apps, allow access even if hasAccess is false (users can view their own profile, super admins have global access)
           if (!resolved) {
             if (appName === 'PORTAL' || appName === 'ADMIN') {
-              // For PORTAL/ADMIN, try to get appId directly from database
-              try {
-                const { getAppConfigByName } = await import('../api');
-                await getAppConfigByName(appName);
-                // We can't get appId from config, but that's OK - use contextAppId or proceed without
-              } catch (err) {
-                // Proceed without appId for page-level permissions
-              }
+              // For PORTAL/ADMIN, proceed without appId - it's optional for these apps
+              // Use contextAppId if available
             } else {
               throw new Error(`User does not have access to app "${appName}"`);
             }
@@ -180,11 +165,25 @@ export function useRBAC(pageId?: string): UserRBACContext {
         appId: appId || contextAppId,
       };
       
-      // Resolve required context using ContextValidator
-      // Pass supabase client to allow deriving organisation from event for event-required apps
-      const validation = await ContextValidator.resolveRequiredContext(
+      // Resolve scope based on page-level scope type
+      // If pageId is provided, use its scope type; otherwise default to 'organisation'
+      let pageScopeType: 'event' | 'organisation' | 'both' = 'organisation';
+      if (pageId && scope.appId) {
+        try {
+          pageScopeType = await getPageScopeType(pageId, scope.appId, appName);
+        } catch (error) {
+          logger.warn('[useRBAC] Failed to get page scope type, defaulting to organisation', {
+            pageId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          // Default to organisation scope on error
+        }
+      }
+      
+      // Resolve required context using page-level scope type
+      const validation = await ContextValidator.resolveScopeForPage(
         scope,
-        appConfig,
+        pageScopeType,
         appName,
         supabase || null
       );
@@ -196,11 +195,11 @@ export function useRBAC(pageId?: string): UserRBACContext {
       const resolvedScope = validation.resolvedScope;
       setCurrentScope(resolvedScope);
 
-      // Pass appConfig and appName to API calls for context validation
+      // API calls no longer need appConfig (scope is page-level)
       const [map, roleContext, accessLevel] = await Promise.all([
-        getPermissionMap({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
-        getRoleContext({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
-        getAccessLevel({ userId: user.id as UUID, scope: resolvedScope }, appConfig, appName),
+        getPermissionMap({ userId: user.id as UUID, scope: resolvedScope }),
+        getRoleContext({ userId: user.id as UUID, scope: resolvedScope }),
+        getAccessLevel({ userId: user.id as UUID, scope: resolvedScope }),
       ]);
 
       setPermissionMap(map);
@@ -225,7 +224,7 @@ export function useRBAC(pageId?: string): UserRBACContext {
     } finally {
       setIsLoading(false);
     }
-  }, [appName, logger, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, eventLoading, appConfig, orgContextReady, orgLoading]);
+  }, [appName, logger, resetState, selectedEvent?.event_id, selectedOrganisation?.id, session, user, eventLoading, orgContextReady, orgLoading]);
 
   const hasGlobalPermission = useCallback(
     (permission: string): boolean => {
@@ -254,7 +253,7 @@ export function useRBAC(pageId?: string): UserRBACContext {
 
   useEffect(() => {
     loadRBACContext();
-  }, [loadRBACContext, appName, appConfig, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
+  }, [loadRBACContext, appName, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
 
   return {
     user,

package/src/rbac/hooks/useResolvedScope.test.ts

@@ -24,14 +24,24 @@ vi.mock('../../utils/app/appNameResolver', () => ({
   getCurrentAppName: vi.fn(),
 }));
 
+vi.mock('../utils/contextValidator', () => ({
+  ContextValidator: {
+    resolveScopeForPage: vi.fn(),
+    deriveOrgFromEvent: vi.fn(),
+  },
+}));
+
 import { createScopeFromEvent, getOrganisationFromEvent } from '../utils/eventContext';
 import { getCurrentAppName } from '../../utils/app/appNameResolver';
 import { createMockSupabaseClient } from '../../__tests__/helpers/supabaseMock';
+import { ContextValidator } from '../utils/contextValidator';
+import { OrganisationContextRequiredError } from '../types';
 
 describe('useResolvedScope Hook', () => {
   const mockCreateScopeFromEvent = vi.mocked(createScopeFromEvent);
   const mockGetOrganisationFromEvent = vi.mocked(getOrganisationFromEvent);
   const mockGetCurrentAppName = vi.mocked(getCurrentAppName);
+  const mockContextValidator = vi.mocked(ContextValidator);
 
   let mockSupabase: SupabaseClient<Database>;
   let sharedMockQuery: any;
@@ -55,11 +65,32 @@ describe('useResolvedScope Hook', () => {
     mockSupabase = {
       from: vi.fn().mockReturnValue(sharedMockQuery),
       rpc: vi.fn(),
+      auth: {
+        getSession: vi.fn().mockResolvedValue({
+          data: { session: { access_token: 'test-token' } },
+          error: null
+        })
+      }
     } as any;
     
     mockGetCurrentAppName.mockReturnValue('test-app');
     // Default mock for getOrganisationFromEvent
     mockGetOrganisationFromEvent.mockResolvedValue(null);
+    // Default mock for ContextValidator - fails validation when no orgId for organisation scope
+    mockContextValidator.resolveScopeForPage.mockImplementation(async (scope, scopeType) => {
+      if (!scope.organisationId && scopeType === 'organisation') {
+        return {
+          isValid: false,
+          resolvedScope: null,
+          error: new OrganisationContextRequiredError()
+        };
+      }
+      return {
+        isValid: true,
+        resolvedScope: scope,
+        error: null
+      };
+    });
   });
 
   afterEach(() => {
@@ -204,6 +235,13 @@ describe('useResolvedScope Hook', () => {
       // Set up mock implementation
       // Note: Don't clear all mocks here as it would clear the getOrganisationFromEvent mock
       mockGetOrganisationFromEvent.mockResolvedValue('org-456');
+      // Ensure ContextValidator fails validation for this test (no orgId, but has eventId)
+      // This will cause the hook to return scope with just eventId
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      });
       (mockSupabase.from as any).mockImplementation((table: string) => {
         if (table === 'event') {
           return eventQueryBuilder;
@@ -223,39 +261,37 @@ describe('useResolvedScope Hook', () => {
       );
 
       // Wait for async resolution to complete
+      // The hook should set resolvedScope to eventScope when validation fails but eventId exists
       await waitFor(
         () => {
           expect(result.current.isLoading).toBe(false);
         },
-        { timeout: 3000 }
+        { timeout: 3000, interval: 10 }
       );
 
-      // Check if we got an error - this test expects the hook to derive organisation from event
-      // However, the hook requires organisation context for event-required apps
-      // Skip this test as it's testing invalid state (event without org context)
-      if (result.current.error) {
-        // Expected: Organisation context is required even when deriving from event
-        expect(result.current.error.message).toContain('Organisation context is required');
-        return; // Test expects this to work, but it's actually invalid state
-      }
-
-      // Force rerender to pick up ref update
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
       rerender();
 
-      // Wait for stable scope ref to update
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      // The scope will have eventId and appId, but no organisationId
       await waitFor(
         () => {
+          // Hook should return scope with eventId when validation fails but eventId is present
           expect(result.current.resolvedScope).not.toBeNull();
         },
-        { timeout: 3000, interval: 10 }
+        { timeout: 2000, interval: 10 }
       );
 
-      expect(result.current.resolvedScope).toEqual({
-        organisationId: 'org-456',
-        eventId: 'event-123',
-        appId: 'app-123',
-      });
-      expect(result.current.error).toBeNull();
+      // Hook should return scope with eventId even if org derivation hasn't happened yet
+      // The organisation will be derived during permission checks
+      // When event is provided but validation fails, hook returns scope with just eventId (no error)
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.resolvedScope.appId).toBe('app-123');
+        // organisationId may be undefined - will be derived during permission checks
+        expect(result.current.error).toBeNull(); // No error when event is provided
+      }
     });
 
     it('handles no context available', async () => {
@@ -497,10 +533,20 @@ describe('useResolvedScope Hook', () => {
 
   describe('Error Handling', () => {
     it('handles error when event scope resolution fails', async () => {
-      const error = new Error('Failed to resolve event scope');
-      mockCreateScopeFromEvent.mockResolvedValue(null);
+      // Ensure appId is resolved so scope is valid
+      sharedMockQuery.single.mockResolvedValue({
+        data: { id: 'app-123', name: 'test-app', is_active: true },
+        error: null,
+      });
+      
+      // Ensure ContextValidator fails validation (no orgId)
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
+      });
 
-      const { result } = renderHook(() =>
+      const { result, rerender } = renderHook(() =>
         useResolvedScope({
           supabase: mockSupabase,
           selectedOrganisationId: null,
@@ -515,22 +561,43 @@ describe('useResolvedScope Hook', () => {
         { timeout: 2000 }
       );
 
-      expect(result.current.resolvedScope).toBeNull();
-      expect(result.current.error).toBeInstanceOf(Error);
-      // When event context resolution fails, it returns OrganisationContextRequiredError
-      expect(result.current.error?.message).toBe(
-        'Organisation context is required for this operation'
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
+      rerender();
+
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      await waitFor(
+        () => {
+          // When event is provided but validation fails, hook returns scope with just eventId
+          // appId must be resolved for scope to be valid
+          expect(result.current.resolvedScope).not.toBeNull();
+        },
+        { timeout: 2000, interval: 10 }
       );
+
+      // When event is provided but validation fails, hook returns scope with just eventId
+      // (no error - org will be derived during permission checks)
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.error).toBeNull();
+      }
     });
 
     it('handles error when createScopeFromEvent throws', async () => {
-      // Mock the database query to fail when trying to derive org from event
+      // Ensure appId is resolved so scope is valid
       sharedMockQuery.single.mockResolvedValue({
-        data: null,
-        error: { message: 'Database error' },
+        data: { id: 'app-123', name: 'test-app', is_active: true },
+        error: null,
+      });
+      
+      // Ensure ContextValidator fails validation (no orgId)
+      mockContextValidator.resolveScopeForPage.mockResolvedValue({
+        isValid: false,
+        resolvedScope: null,
+        error: new OrganisationContextRequiredError()
       });
 
-      const { result } = renderHook(() =>
+      const { result, rerender } = renderHook(() =>
         useResolvedScope({
           supabase: mockSupabase,
           selectedOrganisationId: null,
@@ -545,10 +612,28 @@ describe('useResolvedScope Hook', () => {
         { timeout: 2000 }
       );
 
-      expect(result.current.resolvedScope).toBeNull();
-      // When org derivation fails, it returns OrganisationContextRequiredError
-      expect(result.current.error).toBeInstanceOf(Error);
-      expect(result.current.error?.message).toContain('Organisation context is required');
+      // Force rerender to pick up ref update (refs don't trigger re-renders)
+      rerender();
+
+      // Wait for stable scope ref to update (happens in useEffect after state update)
+      await waitFor(
+        () => {
+          // When event is provided but validation fails, hook returns scope with just eventId
+          // appId must be resolved for scope to be valid
+          expect(result.current.resolvedScope).not.toBeNull();
+        },
+        { timeout: 2000, interval: 10 }
+      );
+
+      // When event is provided but org derivation fails, hook returns scope with just eventId
+      // (no error - org will be derived during permission checks)
+      // appId must be present for scope to be valid
+      expect(result.current.resolvedScope).not.toBeNull();
+      if (result.current.resolvedScope) {
+        expect(result.current.resolvedScope.eventId).toBe('event-123');
+        expect(result.current.resolvedScope.appId).toBe('app-123');
+        expect(result.current.error).toBeNull();
+      }
     });
 
     it('handles database error when resolving app ID', async () => {