@jmruthers/pace-core 0.6.5 → 0.6.7

package/src/rbac/components/NavigationProvider.tsx

@@ -1,345 +0,0 @@
-/**
- * @file Navigation Provider Component
- * @package @jmruthers/pace-core
- * @module RBAC/Components/NavigationProvider
- * @since 2.0.0
- *
- * A context provider that manages navigation permissions across the entire application.
- * This component ensures that all navigation items are properly protected and provides
- * centralized navigation permission management.
- *
- * Features:
- * - App-wide navigation permission management
- * - Strict mode to prevent bypassing
- * - Automatic audit logging
- * - Integration with existing RBAC system
- * - Navigation permission tracking
- * - Error handling and recovery
- *
- * @example
- * ```tsx
- * // Basic app setup with navigation permissions
- * <NavigationProvider strictMode={true} auditLog={true}>
- *   <App />
- * </NavigationProvider>
- * 
- * // With custom configuration
- * <NavigationProvider
- *   strictMode={true}
- *   auditLog={true}
- *   onNavigationAccess={(item, allowed) => {
- *     console.log(`Navigation access: ${item} - ${allowed ? 'allowed' : 'denied'}`);
- *   }}
- * >
- *   <App />
- * </NavigationProvider>
- * ```
- *
- * @security
- * - Enforces navigation-level permissions across the app
- * - Prevents apps from bypassing navigation permission checks
- * - Automatic audit logging for all navigation access attempts
- * - Integration with existing RBAC system
- * - Navigation permission tracking and monitoring
- *
- * @performance
- * - Optimized with useMemo and useCallback
- * - Efficient context updates
- * - Minimal re-renders
- * - Cached permission checks
- *
- * @dependencies
- * - React 19+ - Context and hooks
- * - useUnifiedAuth - Authentication context
- * - RBAC types - Type definitions
- */
-
-import React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';
-import { useUnifiedAuth } from '../../providers/services/UnifiedAuthProvider';
-import { useCan } from '../hooks';
-import { useResolvedScope } from '../hooks/useResolvedScope';
-import { UUID, Scope, Permission } from '../types';
-import { getRBACLogger } from '../config';
-import { logger } from '../../utils/core/logger';
-
-export interface NavigationItem {
-  /** Unique identifier for the navigation item */
-  id: string;
-  
-  /** Display label for the navigation item */
-  label: string;
-  
-  /** Navigation path/URL */
-  path: string;
-  
-  /** Permissions required for this navigation item */
-  permissions: Permission[];
-  
-  /** Roles that can access this navigation item */
-  roles?: string[];
-  
-  /** Minimum access level required */
-  accessLevel?: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';
-  
-  /** Page ID for permission checking */
-  pageId?: string;
-  
-  /** Enable strict mode for this navigation item */
-  strictMode?: boolean;
-  
-  /** Navigation item metadata */
-  meta?: {
-    icon?: string;
-    description?: string;
-    hidden?: boolean;
-    order?: number;
-  };
-}
-
-export interface NavigationAccessRecord {
-  navigationItem: string;
-  permissions: Permission[];
-  userId: UUID;
-  scope: Scope;
-  allowed: boolean;
-  timestamp: string;
-  pageId?: string;
-  roles?: string[];
-  accessLevel?: string;
-}
-
-export interface NavigationContextType {
-  /** Check if user has permission for a navigation item */
-  hasNavigationPermission: (item: NavigationItem) => boolean;
-  
-  /** Get all navigation permissions for current user */
-  getNavigationPermissions: () => Record<string, string[]>;
-  
-  /** Get filtered navigation items based on permissions */
-  getFilteredNavigationItems: (items: NavigationItem[]) => NavigationItem[];
-  
-  /** Check if navigation permission checking is enabled */
-  isEnabled: boolean;
-  
-  /** Check if strict mode is enabled */
-  isStrictMode: boolean;
-  
-  /** Check if audit logging is enabled */
-  isAuditLogEnabled: boolean;
-  
-  /** Get navigation access history */
-  getNavigationAccessHistory: () => NavigationAccessRecord[];
-  
-  /** Clear navigation access history */
-  clearNavigationAccessHistory: () => void;
-}
-
-export interface NavigationProviderProps {
-  /** Child components */
-  children: React.ReactNode;
-  
-  /** Enable strict mode to prevent bypassing (default: true) */
-  strictMode?: boolean;
-  
-  /** Enable audit logging (default: true) */
-  auditLog?: boolean;
-  
-  /** Callback when navigation access is attempted */
-  onNavigationAccess?: (item: NavigationItem, allowed: boolean, record: NavigationAccessRecord) => void;
-  
-  /** Callback when strict mode violation occurs */
-  onStrictModeViolation?: (item: NavigationItem, record: NavigationAccessRecord) => void;
-  
-  /** Maximum number of access records to keep in history */
-  maxHistorySize?: number;
-}
-
-const NavigationContext = createContext<NavigationContextType | null>(null);
-
-/**
- * NavigationProvider - Manages navigation-level permissions across the app
- * 
- * This provider ensures that all navigation items are properly protected and provides
- * centralized navigation permission management with strict enforcement.
- * 
- * @param props - Provider props
- * @returns React element with navigation permission context
- */
-export function NavigationProvider({
-  children,
-  strictMode = true,
-  auditLog = true,
-  onNavigationAccess,
-  onStrictModeViolation,
-  maxHistorySize = 1000
-}: NavigationProviderProps) {
-  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
-  const [navigationAccessHistory, setNavigationAccessHistory] = useState<NavigationAccessRecord[]>([]);
-  const [isEnabled, setIsEnabled] = useState(true);
-
-  // Use useResolvedScope to get proper scope (org derived from event if needed)
-  const { resolvedScope } = useResolvedScope({
-    supabase,
-    selectedOrganisationId: selectedOrganisation?.id || null,
-    selectedEventId: selectedEvent?.event_id || null
-  });
-
-  // Get current scope from resolved scope
-  // For event-required apps: org is derived from event
-  // For org-required apps: org comes from selectedOrganisation
-  const currentScope = resolvedScope;
-
-  // Check if user has permission for a navigation item
-  // NOTE: This is a synchronous check for basic validation only.
-  // Actual permission checking should be done by individual NavigationGuard components
-  // using the useCan hook for proper async RBAC integration.
-  const hasNavigationPermission = useCallback((
-    item: NavigationItem
-  ): boolean => {
-    if (!isEnabled) return true;
-    if (!user?.id) return false; // No user context - deny access for security
-    
-    if (!currentScope) return false; // No scope context - deny access for security
-    
-    // If no permissions are defined for the navigation item, deny access by default
-    if (!item.permissions || item.permissions.length === 0) {
-      logger.warn('NavigationProvider', `Navigation item "${item.id}" has no permissions defined - denying access`);
-      return false;
-    }
-    
-    // Use the first permission for checking (as per original implementation)
-    const permission = item.permissions[0];
-    
-    // Call useCan hook for actual permission checking
-    // Pass null for super admin status (not checked yet - hook will check if needed)
-    const { can, error } = useCan(
-      user.id,
-      currentScope,
-      permission,
-      item.pageId,
-      true, // useCache
-      null, // precomputedSuperAdmin - not checked yet
-      undefined // appName
-    );
-    
-    // Handle errors gracefully - allow access when there are permission check errors (graceful degradation)
-    // This ensures navigation doesn't break when the permission service has issues
-    if (error) {
-      logger.warn('NavigationProvider', `Permission check error for "${item.id}": ${error.message} - allowing access for graceful degradation`);
-      return true;
-    }
-    
-    return can;
-  }, [isEnabled, user?.id, currentScope]);
-
-  // Get all navigation permissions for current user
-  const getNavigationPermissions = useCallback((): Record<string, string[]> => {
-    if (!isEnabled || !user?.id) return {};
-    
-    // For now, return empty object - this will be enhanced with actual permission checking
-    // when we integrate with the existing RBAC system
-    return {};
-  }, [isEnabled, user?.id]);
-
-  // Get filtered navigation items based on permissions
-  const getFilteredNavigationItems = useCallback((items: NavigationItem[]): NavigationItem[] => {
-    if (!isEnabled) return items;
-    
-    return items.filter(item => hasNavigationPermission(item));
-  }, [isEnabled, hasNavigationPermission]);
-
-  // Get navigation access history
-  const getNavigationAccessHistory = useCallback((): NavigationAccessRecord[] => {
-    return [...navigationAccessHistory];
-  }, [navigationAccessHistory]);
-
-  // Clear navigation access history
-  const clearNavigationAccessHistory = useCallback(() => {
-    setNavigationAccessHistory([]);
-  }, []);
-
-  // Record navigation access attempt
-  const recordNavigationAccess = useCallback((
-    item: NavigationItem,
-    allowed: boolean
-  ) => {
-    if (!auditLog || !user?.id || !currentScope) return;
-    
-    const record: NavigationAccessRecord = {
-      navigationItem: item.id,
-      permissions: item.permissions,
-      userId: user.id,
-      scope: currentScope,
-      allowed,
-      timestamp: new Date().toISOString(),
-      pageId: item.pageId,
-      roles: item.roles,
-      accessLevel: item.accessLevel
-    };
-    
-    setNavigationAccessHistory(prev => {
-      const newHistory = [record, ...prev];
-      return newHistory.slice(0, maxHistorySize);
-    });
-    
-    if (onNavigationAccess) {
-      onNavigationAccess(item, allowed, record);
-    }
-    
-    if (strictMode && !allowed && onStrictModeViolation) {
-      onStrictModeViolation(item, record);
-    }
-  }, [auditLog, user?.id, currentScope, maxHistorySize, onNavigationAccess, onStrictModeViolation, strictMode]);
-
-  // Context value
-  const contextValue = useMemo((): NavigationContextType => ({
-    hasNavigationPermission,
-    getNavigationPermissions,
-    getFilteredNavigationItems,
-    isEnabled,
-    isStrictMode: strictMode,
-    isAuditLogEnabled: auditLog,
-    getNavigationAccessHistory,
-    clearNavigationAccessHistory
-  }), [
-    hasNavigationPermission,
-    getNavigationPermissions,
-    getFilteredNavigationItems,
-    isEnabled,
-    strictMode,
-    auditLog,
-    getNavigationAccessHistory,
-    clearNavigationAccessHistory
-  ]);
-
-  // Log strict mode violations
-  useEffect(() => {
-    if (strictMode && auditLog) {
-      const logger = getRBACLogger();
-    }
-  }, [strictMode, auditLog]);
-
-  return (
-    <NavigationContext.Provider value={contextValue}>
-      {children}
-    </NavigationContext.Provider>
-  );
-}
-
-/**
- * Hook to use navigation permission context
- * 
- * @returns Navigation permission context
- * @throws Error if used outside of NavigationProvider
- */
-export function useNavigationPermissions(): NavigationContextType {
-  const context = useContext(NavigationContext);
-  
-  if (!context) {
-    throw new Error('useNavigationPermissions must be used within a NavigationProvider');
-  }
-  
-  return context;
-}
-
-export default NavigationProvider;