@jmruthers/pace-core 0.6.5 → 0.6.7

package/src/rbac/components/__tests__/PermissionEnforcer.test.tsx

@@ -1,881 +0,0 @@
-/**
- * @file PermissionEnforcer Component Tests
- * @package @jmruthers/pace-core
- * @module RBAC/Components/PermissionEnforcer
- * @since 2.0.0
- * 
- * Comprehensive tests for the PermissionEnforcer component covering all critical functionality.
- */
-
-import { render, screen, waitFor } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { ReactNode } from 'react';
-import { PermissionEnforcer } from '../PermissionEnforcer';
-import { useMultiplePermissions } from '../../hooks/usePermissions';
-import { useUnifiedAuth } from '../../../providers/services/UnifiedAuthProvider';
-
-// Mock the RBAC hooks
-vi.mock('../../hooks/usePermissions', () => ({
-  useMultiplePermissions: vi.fn()
-}));
-
-// Mock the auth provider
-const mockUseUnifiedAuthFn = vi.fn();
-vi.mock('../../../providers/services/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: () => mockUseUnifiedAuthFn(),
-  UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
-}));
-
-// Mock the event context utility
-vi.mock('../../utils/eventContext', () => ({
-  createScopeFromEvent: vi.fn()
-}));
-
-// Mock useResolvedScope hook
-vi.mock('../../hooks/useResolvedScope', () => ({
-  useResolvedScope: vi.fn()
-}));
-
-// Mock the Logger module
-vi.mock('../../../utils/core/logger', () => {
-  const mockLoggerInstance = {
-    debug: vi.fn(),
-    warn: vi.fn(),
-    error: vi.fn(),
-  };
-  return {
-    createLogger: vi.fn(() => mockLoggerInstance),
-  };
-});
-
-// Get the mock instance after mock is set up
-import { createLogger } from '../../../utils/core/logger';
-const getMockLogger = () => createLogger('test');
-
-import { createScopeFromEvent } from '../../utils/eventContext';
-import { useResolvedScope } from '../../hooks/useResolvedScope';
-
-// Mock data
-const mockUser = {
-  id: 'user-123',
-  email: 'test@example.com'
-};
-
-const mockScope = {
-  organisationId: 'org-123',
-  eventId: 'event-123',
-  appId: 'app-123'
-};
-
-const mockPermissions = ['read:events', 'update:events'] as const;
-const mockOperation = 'event-management';
-
-// Test component
-const TestComponent = ({ children }: { children: ReactNode }) => (
-  <div data-testid="test-component">{children}</div>
-);
-
-const TestFallback = () => (
-  <div data-testid="test-fallback">Access Denied</div>
-);
-
-const TestLoading = () => (
-  <div data-testid="test-loading">Loading...</div>
-);
-
-describe('PermissionEnforcer Component', () => {
-  const mockUseMultiplePermissions = vi.mocked(useMultiplePermissions);
-  const mockCreateScopeFromEvent = vi.mocked(createScopeFromEvent);
-  const mockUseResolvedScope = vi.mocked(useResolvedScope);
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    
-    // Default mock implementations
-    mockUseUnifiedAuthFn.mockReturnValue({
-      user: mockUser,
-      selectedOrganisation: { id: 'org-123' },
-      selectedEvent: { event_id: 'event-123' },
-      supabase: {} as any
-    });
-    
-    // Mock useResolvedScope to return resolved scope immediately
-    mockUseResolvedScope.mockReturnValue({
-      resolvedScope: {
-        organisationId: 'org-123',
-        eventId: 'event-123',
-        appId: 'app-123'
-      },
-      isLoading: false,
-      error: null
-    });
-    
-    mockUseMultiplePermissions.mockReturnValue({
-      results: {
-        'read:events': true,
-        'update:events': true
-      } as Record<string, boolean>,
-      isLoading: false,
-      error: null,
-      refetch: vi.fn()
-    });
-  });
-
-    describe('Rendering', () => {
-    it('renders children when permission is granted', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true, 'update:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-        expect(screen.getByText('Protected Content')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('renders fallback when permission is denied', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-        expect(screen.queryByTestId('test-component')).not.toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('shows loading state during permission check', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: true,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          loading={<TestLoading />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      expect(screen.getByTestId('test-loading')).toBeInTheDocument();
-      expect(screen.queryByTestId('test-component')).not.toBeInTheDocument();
-    });
-
-    it('uses default fallback when none provided', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByText('Access Denied')).toBeInTheDocument();
-        expect(screen.getByText('You don\'t have permission to perform this operation.')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('uses default loading when none provided', () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: true,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
-    });
-  });
-
-  describe('Permission Checking', () => {
-    it('enforces single permission correctly', async () => {
-      const singlePermission = ['read:events'] as const;
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={singlePermission}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:events'], // singlePermission only includes read:events
-        true
-      );
-    });
-
-    it('enforces multiple permissions with AND logic (requireAll=true)', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true, 'update:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          requireAll={true}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Should check all permissions when requireAll=true
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:events', 'update:events'],
-        true
-      );
-    });
-
-    it('handles permission checking errors gracefully', async () => {
-      const error = new Error('Permission check failed');
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: false,
-        error,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('handles empty permissions array', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={[]}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-  });
-
-  describe('Scope Resolution', () => {
-    it('uses provided scope when available', async () => {
-      const customScope = {
-        organisationId: 'custom-org',
-        eventId: 'custom-event',
-        appId: 'custom-app'
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          scope={customScope}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        customScope,
-        ['read:events', 'update:events'], // mockPermissions includes both
-        true
-      );
-    });
-
-    it('resolves scope from organisation and event context', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:events', 'update:events'], // mockPermissions includes both
-        true
-      );
-    });
-
-    it('resolves scope from organisation only (org-required app)', async () => {
-      // For org-required apps, organisation is primary context, event is optional
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: { id: 'org-123' },
-        selectedEvent: null,
-        supabase: {} as any
-      });
-
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: 'app-123'
-        },
-        isLoading: false,
-        error: null
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: 'app-123'
-        },
-        ['read:events', 'update:events'], // mockPermissions includes both
-        true
-      );
-    });
-
-    it('resolves scope from event context when organisation not available (event-required app)', async () => {
-      // For event-required apps, selectedOrganisation is null, org is derived from event
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null, // Not available for event-required apps
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: {
-          organisationId: 'resolved-org',
-          eventId: 'event-123',
-          appId: 'resolved-app'
-        },
-        isLoading: false,
-        error: null
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'resolved-org',
-          eventId: 'event-123',
-          appId: 'resolved-app'
-        },
-        ['read:events', 'update:events'], // mockPermissions includes both
-        true
-      );
-    });
-
-    it('handles scope resolution errors', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null,
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      const error = new Error('Could not resolve organisation from event');
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: null,
-        isLoading: false,
-        error
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('handles missing context gracefully', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null,
-        selectedEvent: null,
-        supabase: null
-      });
-
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: null,
-        isLoading: true,
-        error: null
-      });
-
-      render(
-        <PermissionEnforcer 
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      expect(screen.getByText('Checking permissions...')).toBeInTheDocument();
-    });
-  });
-
-  describe('Security Features', () => {
-    it('prevents bypassing in strict mode', async () => {
-      const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          strictMode={true}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('STRICT MODE VIOLATION'),
-        expect.objectContaining({
-          permissions: mockPermissions,
-          operation: mockOperation,
-          userId: 'user-123'
-        })
-      );
-
-      consoleSpy.mockRestore();
-    });
-
-    it('logs security violations for audit', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          auditLog={true}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      const logger = getMockLogger();
-      expect(vi.mocked(logger.debug)).toHaveBeenCalledWith(
-        'Permission check attempt:',
-        expect.objectContaining({
-          permissions: mockPermissions,
-          operation: mockOperation,
-          userId: 'user-123',
-          allowed: false
-        })
-      );
-    });
-
-    it('calls onDenied callback when access is denied', async () => {
-      const onDeniedSpy = vi.fn();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          onDenied={onDeniedSpy}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(onDeniedSpy).toHaveBeenCalledWith(mockPermissions, mockOperation);
-    });
-
-    it('does not call onDenied when access is granted', async () => {
-      const onDeniedSpy = vi.fn();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          onDenied={onDeniedSpy}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(onDeniedSpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Configuration Options', () => {
-    it('respects strictMode setting', async () => {
-      const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          strictMode={false}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(consoleSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining('STRICT MODE VIOLATION')
-      );
-
-      consoleSpy.mockRestore();
-    });
-
-    it('respects auditLog setting', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          auditLog={false}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(consoleSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining('Permission check attempt')
-      );
-
-      consoleSpy.mockRestore();
-    });
-
-    it('respects requireAll=false (any permission granted)', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': true, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          requireAll={false}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Should check all permissions and allow access if any is granted
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        expect.objectContaining({
-          organisationId: 'org-123',
-          eventId: 'event-123'
-        }),
-        ['read:events', 'update:events'],
-        true
-      );
-    });
-  });
-
-  describe('Error Handling', () => {
-    it('handles missing user gracefully', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: null,
-        selectedOrganisation: { id: 'org-123' },
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:events': false, 'update:events': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        '',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:events', 'update:events'], // mockPermissions includes both
-        true
-      );
-    });
-
-    it('handles permission check errors', async () => {
-      const error = new Error('Database connection failed');
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: false,
-        error,
-        refetch: vi.fn()
-      });
-
-      render(
-        <PermissionEnforcer
-          permissions={mockPermissions}
-          operation={mockOperation}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Protected Content</TestComponent>
-        </PermissionEnforcer>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-  });
-});