@jmruthers/pace-core 0.6.4 → 0.6.6

package/src/rbac/hooks/useRoleManagement.ts

@@ -127,9 +127,9 @@ export function useRoleManagement() {
   }
 
   /**
-   * Revoke an event app role using the secure RPC function
+   * Revoke an event app role using the unified RPC function
    * 
-   * This function uses the `revoke_event_app_role` RPC which:
+   * This function uses the `rbac_role_revoke` RPC which:
    * - Runs with SECURITY DEFINER privileges
    * - Includes proper permission checks
    * - Automatically populates audit fields (revoked_by, timestamps)
@@ -145,26 +145,114 @@ export function useRoleManagement() {
     setError(null);
 
     try {
-      const { data, error: rpcError } = await supabase.rpc('revoke_event_app_role', {
+      // Build context ID from event_id and app_id
+      const contextId = `${params.event_id}:${params.app_id}`;
+      
+      const rpcParams = {
         p_user_id: params.user_id,
-        p_organisation_id: params.organisation_id,
-        p_event_id: params.event_id,
-        p_app_id: params.app_id,
-        p_role: params.role,
+        p_role_type: 'event_app' as const,
+        p_role_name: params.role,
+        p_context_id: contextId,
         p_revoked_by: params.revoked_by || user?.id || undefined
-      });
+      };
+
+      // Log in development for debugging
+      if (import.meta.env.MODE === 'development') {
+        console.log('[useRoleManagement] revokeEventAppRole called with:', rpcParams);
+      }
+
+      const { data, error: rpcError } = await supabase.rpc('rbac_role_revoke', rpcParams);
 
       if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to revoke role');
+        // Log full error details in development
+        if (import.meta.env.MODE === 'development') {
+          console.error('[useRoleManagement] RPC error:', {
+            message: rpcError.message,
+            details: rpcError.details,
+            hint: rpcError.hint,
+            code: rpcError.code,
+            fullError: rpcError
+          });
+        }
+        // Use just the message for the error (tests expect plain message)
+        const errorMessage = rpcError.message || 'Failed to revoke role - unknown RPC error';
+        throw new Error(errorMessage);
+      }
+
+      // Log response in development - ALWAYS log, even on failure
+      if (import.meta.env.MODE === 'development') {
+        console.log('[useRoleManagement] RPC response:', { 
+          data, 
+          error: rpcError,
+          dataType: Array.isArray(data) ? 'array' : typeof data,
+          dataLength: Array.isArray(data) ? data.length : 'N/A'
+        });
+      }
+
+      // rbac_role_revoke returns a table with success, message, revoked_count, error_code
+      // It should always return at least one row
+      if (!data || !Array.isArray(data) || data.length === 0) {
+        const errorMsg = 'No response from database - role revocation may have failed';
+        if (import.meta.env.MODE === 'development') {
+          console.error('[useRoleManagement] Empty or null data response:', { 
+            data, 
+            dataType: typeof data,
+            isArray: Array.isArray(data),
+            length: Array.isArray(data) ? data.length : 'N/A'
+          });
+        }
+        throw new Error(errorMsg);
+      }
+
+      const result = data[0];
+
+      // ALWAYS log the result in development, even on failure
+      if (import.meta.env.MODE === 'development') {
+        console.log('[useRoleManagement] RPC result:', {
+          success: result?.success,
+          message: result?.message,
+          error_code: result?.error_code,
+          revoked_count: result?.revoked_count,
+          fullResult: result
+        });
+      }
+
+      if (!result || result.success !== true) {
+        // Use message if available, otherwise fall back to error_code, otherwise default message
+        const errorMessage = result?.message || result?.error_code || 'Role revocation failed';
+        
+        if (import.meta.env.MODE === 'development') {
+          console.error('[useRoleManagement] Role revocation failed:', {
+            result,
+            errorMessage,
+            fullData: data,
+            rpcParams
+          });
+        }
+        
+        return {
+          success: false,
+          message: result?.message || undefined,
+          error: errorMessage
+        };
       }
 
       return {
-        success: data === true,
-        message: data === true ? 'Role revoked successfully' : 'No role found to revoke',
-        error: data === false ? 'No matching role found' : undefined
+        success: true,
+        message: result.message || 'Role revoked successfully',
+        error: undefined
       };
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
+      
+      if (import.meta.env.MODE === 'development') {
+        console.error('[useRoleManagement] Exception in revokeEventAppRole:', {
+          error: err,
+          errorMessage,
+          params
+        });
+      }
+      
       setError(err instanceof Error ? err : new Error(errorMessage));
       return {
         success: false,
@@ -173,7 +261,7 @@ export function useRoleManagement() {
     } finally {
       setIsLoading(false);
     }
-  }, [user?.id]);
+  }, [user?.id, supabase]);
 
   /**
    * Grant an event app role using the secure RPC function
@@ -273,16 +361,36 @@ export function useRoleManagement() {
       });
 
       if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to revoke role');
+        // Use just the message for the error (tests expect plain message)
+        const errorMessage = rpcError.message || 'Failed to revoke role - unknown RPC error';
+        throw new Error(errorMessage);
       }
 
       // rbac_role_revoke returns a table with success, message, revoked_count, error_code
       const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
 
+      // When data is empty array or null, return error as undefined (tests expect this)
+      if (!result) {
+        return {
+          success: false,
+          error: undefined
+        };
+      }
+
+      if (result.success === false) {
+        // Use message if available, otherwise fall back to error_code, otherwise default message
+        const errorMessage = result.message || result.error_code || 'Role revocation failed';
+        return {
+          success: false,
+          message: result.message || undefined,
+          error: errorMessage
+        };
+      }
+
       return {
-        success: result?.success === true,
-        message: result?.message || undefined,
-        error: result?.success === false ? (result?.message || result?.error_code || 'Unknown error') : undefined
+        success: true,
+        message: result.message || 'Role revoked successfully',
+        error: undefined
       };
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : 'Unknown error occurred';
@@ -383,7 +491,17 @@ export function useRoleManagement() {
       });
 
       if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to revoke role');
+        // Include all available error information in the message
+        const errorParts = [
+          rpcError.message,
+          rpcError.details,
+          rpcError.hint,
+          rpcError.code ? `Error code: ${rpcError.code}` : null
+        ].filter(Boolean);
+        const errorMessage = errorParts.length > 0 
+          ? errorParts.join(' | ') 
+          : 'Failed to revoke role - unknown RPC error';
+        throw new Error(errorMessage);
       }
 
       // rbac_role_revoke returns a table with success, message, revoked_count, error_code
@@ -493,7 +611,17 @@ export function useRoleManagement() {
       });
 
       if (rpcError) {
-        throw new Error(rpcError.message || 'Failed to revoke role');
+        // Include all available error information in the message
+        const errorParts = [
+          rpcError.message,
+          rpcError.details,
+          rpcError.hint,
+          rpcError.code ? `Error code: ${rpcError.code}` : null
+        ].filter(Boolean);
+        const errorMessage = errorParts.length > 0 
+          ? errorParts.join(' | ') 
+          : 'Failed to revoke role - unknown RPC error';
+        throw new Error(errorMessage);
       }
 
       // rbac_role_revoke returns a table with success, message, revoked_count, error_code

package/src/rbac/hooks/useSecureSupabase.ts

@@ -223,7 +223,8 @@ export function useSecureSupabase(
   const { resolvedScope } = useResolvedScope({
     supabase: authSupabase || null,
     selectedOrganisationId: selectedOrganisation?.id || null,
-    selectedEventId: selectedEvent?.event_id || null
+    selectedEventId: selectedEvent?.event_id || null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id || null
   });
 
   // Track previous context to detect changes
@@ -238,13 +239,8 @@ export function useSecureSupabase(
   });
 
   return useMemo(() => {
-    // If event is loading, return base client or null to avoid recreating client unnecessarily
-    if (eventLoading) {
-      return baseClient || authSupabase || null;
-    }
-    
-    // Use resolved scope to get organisationId (derived from event if needed)
-    // For event-required apps, resolvedScope.organisationId is derived from event
+    // Use resolved scope to get organisationId (now available immediately)
+    // For event-required apps, resolvedScope.organisationId comes from selectedEvent.organisation_id
     // For org-required apps, resolvedScope.organisationId comes from selectedOrganisation
     const organisationId = resolvedScope?.organisationId;
     const eventId = resolvedScope?.eventId || selectedEvent?.event_id;

package/src/rbac/index.ts

@@ -45,7 +45,8 @@ export {
   isDevelopmentMode,
 } from './config';
 
-// Secure client
+// Secure client (internal - use useSecureSupabase hook instead)
+// @internal - These are implementation details. Use useSecureSupabase hook for secure client access.
 export {
   SecureSupabaseClient,
   createSecureClient,
@@ -59,7 +60,8 @@ export {
   SECURE_CLIENT_SYMBOL,
 } from './utils/clientSecurity';
 
-// Cache
+// Cache (internal - caching is automatic in hooks and API functions)
+// @internal - These are implementation details. Caching is handled automatically.
 export {
   RBACCache,
   rbacCache,
@@ -94,7 +96,8 @@ export {
   emitAuditEvent,
 } from './audit';
 
-// Engine
+// Engine (internal - use isPermitted API instead)
+// @internal - These are implementation details. Use isPermitted API for permission checks.
 export {
   RBACEngine,
   createRBACEngine,
@@ -110,17 +113,13 @@ export * from './hooks';
 // Users should now use useRBAC() hook directly without a provider wrapper
 // export * from './providers';
 
-// Adapters
+// Adapters (Server-side only - React components removed)
 export {
   withPermissionGuard,
   withAccessLevelGuard,
   withRoleGuard,
-  PermissionGuard,
-  AccessLevelGuard,
   createRBACMiddleware,
   createRBACExpressMiddleware,
-  hasPermissionCached,
-  hasAnyPermissionCached,
 } from './adapters';
 
 // Main API functions
@@ -131,7 +130,6 @@ export {
   getRoleContext,
   isPermitted,
   isPermittedCached,
-  hasPermission,
   hasAnyPermission,
   hasAllPermissions,
   setupRBAC,

package/src/rbac/permissions.ts

@@ -106,35 +106,35 @@ export const EVENT_APP_PERMISSIONS = {
 // ============================================================================
 
 export const PAGE_PERMISSIONS = {
-  // General page access
+  // General page access (generic - used for wildcard checks)
   READ_PAGE: 'read:page' as Permission,
   CREATE_PAGE: 'create:page' as Permission,
   UPDATE_PAGE: 'update:page' as Permission,
   DELETE_PAGE: 'delete:page' as Permission,
   
   // Admin pages
-  READ_ADMIN: 'read:admin' as Permission,
-  CREATE_ADMIN: 'create:admin' as Permission,
-  UPDATE_ADMIN: 'update:admin' as Permission,
-  DELETE_ADMIN: 'delete:admin' as Permission,
+  READ_ADMIN: 'read:page.admin' as Permission,
+  CREATE_ADMIN: 'create:page.admin' as Permission,
+  UPDATE_ADMIN: 'update:page.admin' as Permission,
+  DELETE_ADMIN: 'delete:page.admin' as Permission,
   
   // Dashboard pages
-  READ_DASHBOARD: 'read:dashboard' as Permission,
-  CREATE_DASHBOARD: 'create:dashboard' as Permission,
-  UPDATE_DASHBOARD: 'update:dashboard' as Permission,
-  DELETE_DASHBOARD: 'delete:dashboard' as Permission,
+  READ_DASHBOARD: 'read:page.dashboard' as Permission,
+  CREATE_DASHBOARD: 'create:page.dashboard' as Permission,
+  UPDATE_DASHBOARD: 'update:page.dashboard' as Permission,
+  DELETE_DASHBOARD: 'delete:page.dashboard' as Permission,
   
   // Settings pages
-  READ_SETTINGS: 'read:settings' as Permission,
-  CREATE_SETTINGS: 'create:settings' as Permission,
-  UPDATE_SETTINGS: 'update:settings' as Permission,
-  DELETE_SETTINGS: 'delete:settings' as Permission,
+  READ_SETTINGS: 'read:page.settings' as Permission,
+  CREATE_SETTINGS: 'create:page.settings' as Permission,
+  UPDATE_SETTINGS: 'update:page.settings' as Permission,
+  DELETE_SETTINGS: 'delete:page.settings' as Permission,
   
   // Reports pages
-  READ_REPORTS: 'read:reports' as Permission,
-  CREATE_REPORTS: 'create:reports' as Permission,
-  UPDATE_REPORTS: 'update:reports' as Permission,
-  DELETE_REPORTS: 'delete:reports' as Permission,
+  READ_REPORTS: 'read:page.reports' as Permission,
+  CREATE_REPORTS: 'create:page.reports' as Permission,
+  UPDATE_REPORTS: 'update:page.reports' as Permission,
+  DELETE_REPORTS: 'delete:page.reports' as Permission,
 } as const;
 
 // ============================================================================

package/src/rbac/utils/contextValidator.ts

@@ -68,19 +68,21 @@ export class ContextValidator {
    * Resolve scope based on page-level scope_type
    * 
    * This method handles page-level scoping. All pages have explicit scope_type set.
-   * Used for hybrid apps like pace-mint that have both event and organisation pages.
+   * Used for hybrid apps that have both event and organisation pages.
    * 
    * @param scope - Current scope
    * @param pageScopeType - Page scope type ('event', 'organisation', or 'both')
    * @param appName - App name (for PORTAL/ADMIN special case)
-   * @param supabase - Supabase client (for deriving org from event)
+   * @param supabase - Supabase client (for deriving org from event, only if not already provided)
+   * @param immediateOrganisationId - Optional immediate organisation ID (from selectedEvent.organisation_id) - avoids querying
    * @returns Resolved scope with all required context
    */
   static async resolveScopeForPage(
     scope: Scope,
     pageScopeType: PageScopeType,
     appName?: string,
-    supabase?: SupabaseClient<Database> | null
+    supabase?: SupabaseClient<Database> | null,
+    immediateOrganisationId?: string | null
   ): Promise<ContextValidationResult> {
     // Use page-level scope (single source of truth)
     const effectiveScopeType = pageScopeType;
@@ -89,7 +91,19 @@ export class ContextValidator {
     if (effectiveScopeType === 'both') {
       // For 'both' pages, we need at least one context (org or event)
       // Both will be checked during permission evaluation
+      // For PORTAL/ADMIN apps, both contexts are optional
       if (!scope.organisationId && !scope.eventId) {
+        if (allowsOptionalContexts(appName)) {
+          return {
+            isValid: true,
+            resolvedScope: {
+              organisationId: undefined,
+              eventId: undefined,
+              appId: scope.appId
+            },
+            error: null
+          };
+        }
         return {
           isValid: false,
           resolvedScope: null,
@@ -97,8 +111,8 @@ export class ContextValidator {
         };
       }
       
-      // Derive org from event if event is provided but org is not
-      let organisationId = scope.organisationId;
+      // Use immediate orgId if provided, otherwise derive from event
+      let organisationId = scope.organisationId || immediateOrganisationId || undefined;
       if (!organisationId && scope.eventId && supabase) {
         try {
           const derivedOrgId = await this.deriveOrgFromEvent(supabase, scope.eventId);
@@ -123,6 +137,18 @@ export class ContextValidator {
     // Handle 'event' scope - requires event context
     if (effectiveScopeType === 'event') {
       if (!scope.eventId) {
+        // For PORTAL/ADMIN apps, event context is optional
+        if (allowsOptionalContexts(appName)) {
+          return {
+            isValid: true,
+            resolvedScope: {
+              organisationId: scope.organisationId,
+              eventId: undefined,
+              appId: scope.appId
+            },
+            error: null
+          };
+        }
         return {
           isValid: false,
           resolvedScope: null,
@@ -130,8 +156,8 @@ export class ContextValidator {
         };
       }
       
-      // Derive organisationId from event if not provided
-      let organisationId: UUID | undefined = scope.organisationId;
+      // Use immediate orgId if provided, otherwise derive from event
+      let organisationId: UUID | undefined = scope.organisationId || immediateOrganisationId || undefined;
       if (!organisationId && supabase && scope.eventId) {
         try {
           const derivedOrgId = await this.deriveOrgFromEvent(supabase, scope.eventId);
@@ -167,6 +193,18 @@ export class ContextValidator {
     // Handle 'organisation' scope - requires organisation context
     if (effectiveScopeType === 'organisation') {
       if (!scope.organisationId) {
+        // For PORTAL/ADMIN apps, organisation context is optional
+        if (allowsOptionalContexts(appName)) {
+          return {
+            isValid: true,
+            resolvedScope: {
+              organisationId: undefined,
+              eventId: scope.eventId,
+              appId: scope.appId
+            },
+            error: null
+          };
+        }
         return {
           isValid: false,
           resolvedScope: null,