@jmruthers/pace-core 0.6.5 → 0.6.7

package/src/rbac/adapters.tsx

@@ -4,254 +4,17 @@
  * @module RBAC/Adapters
  * @since 1.0.0
  * 
- * This module provides adapters for different frameworks and server runtimes.
- */
-
-import React, { ReactNode } from 'react';
-import { UUID, Permission } from './types';
-import { useCan } from './hooks';
-import { rbacCache, RBACCache } from './cache';
-import { getRBACLogger } from './config';
-import { useUnifiedAuth } from '../providers/services/UnifiedAuthProvider';
-
-// ============================================================================
-// REACT COMPONENTS
-// ============================================================================
-
-/**
- * Permission Guard Component
- * 
- * A React component that conditionally renders children based on permissions.
- * Can auto-infer userId from context if not provided.
+ * This module provides server-side adapters for different frameworks and server runtimes.
  * 
- * @example
- * ```tsx
- * // With explicit userId and scope
- * <PermissionGuard
- *   userId="user-123"
- *   scope={{ organisationId: 'org-456' }}
- *   permission="update:events"
- *   pageId="page-789"
- *   fallback={<AccessDenied />}
- * >
- *   <AdminPanel />
- * </PermissionGuard>
+ * NOTE: React components (PermissionGuard, AccessLevelGuard) have been removed.
+ * Use PagePermissionGuard from @jmruthers/pace-core/rbac for all client-side permission enforcement.
+ * Use useAccessLevel hook + conditional rendering for access level checks.
  * 
- * // With context inference (requires auth context)
- * <PermissionGuard
- *   permission="update:events"
- *   scope={{ organisationId: 'org-456' }}
- *   fallback={<AccessDenied />}
- * >
- *   <AdminPanel />
- * </PermissionGuard>
- * ```
+ * Server adapters are provided for server-side route protection (Next.js, Express, etc.).
+ * These are optional utilities for server-side applications.
  */
-export function PermissionGuard({
-  userId,
-  scope,
-  permission,
-  pageId,
-  children,
-  fallback = null,
-  onDenied,
-  loading = null,
-  // NEW: Phase 1 - Enhanced Security Features
-  strictMode = true,
-  auditLog = true,
-  enforceAudit = true,
-}: {
-  userId?: UUID;
-  scope: { organisationId: UUID; eventId?: string; appId?: UUID };
-  permission: Permission;
-  pageId?: UUID;
-  children: ReactNode;
-  fallback?: ReactNode;
-  onDenied?: () => void;
-  loading?: ReactNode;
-  // NEW: Phase 1 - Enhanced Security Features
-  strictMode?: boolean;
-  auditLog?: boolean;
-  enforceAudit?: boolean;
-}): React.ReactNode {
-  const logger = getRBACLogger();
-
-  let authContext: ReturnType<typeof useUnifiedAuth> | null = null;
-  try {
-    authContext = useUnifiedAuth();
-  } catch (error) {
-    if (error instanceof Error && error.message.includes('must be used within')) {
-      authContext = null;
-    } else {
-      throw error;
-    }
-  }
-
-  const effectiveUserId = userId ?? authContext?.user?.id ?? null;
-
-  // Always call useCan hook, but handle the case where userId might be undefined
-  // Pass null for super admin status (not checked yet - hook will check if needed)
-  const { can, isLoading, error } = useCan(
-    effectiveUserId || '', 
-    scope, 
-    permission, 
-    pageId,
-    true, // useCache
-    null, // precomputedSuperAdmin - not checked yet
-    undefined // appName
-  );
-
-  // If still no userId, show helpful error
-  if (!effectiveUserId) {
-    logger.error('PermissionGuard: No userId provided and could not infer from context');
-    return fallback ?? null;
-  }
-
-  // Handle loading state
-  if (isLoading) {
-    return loading || (
-      <div className="rbac-loading" role="status" aria-live="polite">
-        <span className="sr-only">Checking permissions...</span>
-      </div>
-    );
-  }
-
-  // Handle error state
-  if (error) {
-    logger.error('Permission check failed:', error);
-    // NEW: Phase 1 - Record failed permission check for audit
-    if (auditLog) {
-      // Permission check failed logged
-    }
-    return fallback;
-  }
-
-  // Handle permission denied
-  if (!can) {
-    // NEW: Phase 1 - Record denied permission check for audit
-    if (auditLog) {
-      // Permission denied logged
-    }
-    
-    // NEW: Phase 1 - Handle strict mode violations
-    if (strictMode) {
-      logger.error(`[PermissionGuard] STRICT MODE VIOLATION: User attempted to access protected resource without permission`, {
-        userId: effectiveUserId,
-        scope,
-        permission,
-        pageId,
-        timestamp: new Date().toISOString()
-      });
-    }
-    
-    if (onDenied) {
-      onDenied();
-    }
-    return <>{fallback}</>;
-  }
-
-  // NEW: Phase 1 - Record successful permission check for audit
-  if (auditLog) {
-    // Permission granted logged
-  }
 
-  // Render children if permission granted
-  return <>{children}</>;
-}
-
-/**
- * Access Level Guard Component
- * 
- * A React component that conditionally renders children based on access level.
- * Can auto-infer userId from context if not provided.
- * 
- * @example
- * ```tsx
- * // With explicit userId and scope
- * <AccessLevelGuard
- *   userId="user-123"
- *   scope={{ organisationId: 'org-456' }}
- *   minLevel="admin"
- *   fallback={<AccessDenied />}
- * >
- *   <AdminPanel />
- * </AccessLevelGuard>
- * 
- * // With context inference (requires auth context)
- * <AccessLevelGuard
- *   minLevel="admin"
- *   scope={{ organisationId: 'org-456' }}
- *   fallback={<AccessDenied />}
- * >
- *   <AdminPanel />
- * </AccessLevelGuard>
- * ```
- */
-export function AccessLevelGuard({
-  userId,
-  scope,
-  minLevel,
-  children,
-  fallback = null,
-  loading = null,
-}: {
-  userId?: UUID;
-  scope: { organisationId: UUID; eventId?: string; appId?: UUID };
-  minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';
-  children: ReactNode;
-  fallback?: ReactNode;
-  loading?: ReactNode;
-}): React.ReactNode {
-  const logger = getRBACLogger();
-
-  let authContext: ReturnType<typeof useUnifiedAuth> | null = null;
-  try {
-    authContext = useUnifiedAuth();
-  } catch (error) {
-    if (error instanceof Error && error.message.includes('must be used within')) {
-      authContext = null;
-    } else {
-      throw error;
-    }
-  }
-
-  const effectiveUserId = userId ?? authContext?.user?.id ?? null;
-
-  // Always call useAccessLevel hook, but handle the case where userId might be undefined
-  const { accessLevel, isLoading, error } = useAccessLevel(effectiveUserId || '', scope);
-
-  // If still no userId, show helpful error
-  if (!effectiveUserId) {
-    logger.error('AccessLevelGuard: No userId provided and could not infer from context');
-    return fallback ?? null;
-  }
-
-  // Handle loading state
-  if (isLoading) {
-    return loading || (
-      <div className="rbac-loading" role="status" aria-live="polite">
-        <span className="sr-only">Checking access level...</span>
-      </div>
-    );
-  }
-
-  // Handle error state
-  if (error) {
-    logger.error('Access level check failed:', error);
-    return fallback;
-  }
-
-  // Check access level
-  const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];
-  const userLevelIndex = accessLevel ? levelHierarchy.indexOf(accessLevel) : -1;
-  const requiredLevelIndex = levelHierarchy.indexOf(minLevel);
-
-  if (userLevelIndex < requiredLevelIndex) {
-    return <>{fallback}</>;
-  }
-
-  return <>{children}</>;
-}
+import { UUID, Permission } from './types';
 
 // ============================================================================
 // SERVER ADAPTERS
@@ -620,54 +383,3 @@ export function createRBACExpressMiddleware(config: {
   };
 }
 
-// ============================================================================
-// UTILITY FUNCTIONS
-// ============================================================================
-
-/**
- * Check if a user has a permission (synchronous cache check only)
- * 
- * @param userId - User ID
- * @param scope - Permission scope
- * @param permission - Permission to check
- * @param pageId - Optional page ID
- * @returns True if permission is cached and granted
- */
-export function hasPermissionCached(
-  userId: UUID,
-  scope: { organisationId: UUID; eventId?: string; appId?: UUID },
-  _permission: Permission,
-  _pageId?: UUID
-): boolean {
-  const cacheKey = RBACCache.generatePermissionKey({
-    userId,
-    organisationId: scope.organisationId,
-    eventId: scope.eventId,
-    appId: scope.appId,
-  });
-  
-  return rbacCache.get<boolean>(cacheKey) || false;
-}
-
-/**
- * Check if a user has any of the specified permissions (synchronous cache check only)
- * 
- * @param userId - User ID
- * @param scope - Permission scope
- * @param permissions - Array of permissions to check
- * @param pageId - Optional page ID
- * @returns True if any permission is cached and granted
- */
-export function hasAnyPermissionCached(
-  userId: UUID,
-  scope: { organisationId: UUID; eventId?: string; appId?: UUID },
-  permissions: Permission[],
-  pageId?: UUID
-): boolean {
-  return permissions.some(permission => 
-    hasPermissionCached(userId, scope, permission, pageId)
-  );
-}
-
-// Import useAccessLevel for AccessLevelGuard
-import { useAccessLevel } from './hooks';

package/src/rbac/api.test.ts

@@ -471,38 +471,50 @@ describe('RBAC API', () => {
 
     beforeEach(() => {
       // Create a mock Supabase client that can handle getPageScopeType queries
-      const mockSupabaseForEngine = {
-        from: vi.fn((table: string) => {
-          if (table === 'rbac_apps') {
-            return {
-              select: vi.fn(() => ({
-                eq: vi.fn(() => ({
-                  eq: vi.fn(() => ({
-                    single: vi.fn().mockResolvedValue({ data: { id: 'app-123' }, error: null })
-                  }))
-                }))
-              }))
-            };
-          }
-          if (table === 'rbac_app_pages') {
-            return {
-              select: vi.fn(() => ({
-                eq: vi.fn(() => ({
-                  eq: vi.fn(() => ({
-                    maybeSingle: vi.fn().mockResolvedValue({ data: { id: '123e4567-e89b-12d3-a456-426614174000' }, error: null })
-                  }))
-                }))
-              }))
-            };
+      // This needs to handle multiple query patterns:
+      // 1. from('rbac_apps').select('name').eq('id', ...).eq('is_active', true).single()
+      // 2. from('rbac_apps').select('id').eq('name', ...).eq('is_active', true).single()
+      // 3. from('rbac_app_pages').select('id').eq('app_id', ...).eq('page_name', ...).maybeSingle()
+      // 4. from('rbac_app_pages').select('scope_type').eq('id', ...).single()
+      
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        // Handle different query patterns based on table and select field
+        if (table === 'rbac_apps') {
+          if (selectField === 'name') {
+            // Pattern: select('name').eq('id', ...).eq('is_active', true).single()
+            builder.single = vi.fn().mockResolvedValue({ data: { name: 'test-app' }, error: null });
+          } else if (selectField === 'id') {
+            // Pattern: select('id').eq('name', ...).eq('is_active', true).single()
+            builder.single = vi.fn().mockResolvedValue({ data: { id: 'app-123' }, error: null });
           }
-          return mockSupabase.from(table);
-        }),
-        rpc: vi.fn((fnName: string, params: any) => {
-          if (fnName === 'get_page_scope_type') {
-            return Promise.resolve({ data: 'organisation', error: null });
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'id') {
+            // Pattern: select('id').eq('app_id', ...).eq('page_name', ...).maybeSingle()
+            builder.maybeSingle = vi.fn().mockResolvedValue({ data: { id: '123e4567-e89b-12d3-a456-426614174000' }, error: null });
+          } else if (selectField === 'scope_type') {
+            // Pattern: select('scope_type').eq('id', ...).single()
+            builder.single = vi.fn().mockResolvedValue({ data: { scope_type: 'organisation' }, error: null });
           }
-          return Promise.resolve({ data: null, error: null });
-        }),
+        }
+        
+        // Make select() return builder with the selectField tracked
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((table: string) => createQueryBuilder(table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
         auth: mockSupabase.auth
       };
 
@@ -736,32 +748,8 @@ describe('RBAC API', () => {
       });
     });
 
-    describe('hasPermission', () => {
-      it('calls isPermitted', async () => {
-        const { hasPermission } = await import('./api');
-        
-        mockEngine.isPermitted.mockResolvedValue(true);
-
-        const result = await hasPermission({
-          userId: 'user-123',
-          scope: { organisationId: 'org-456' },
-          permission: 'read:users'
-        });
-
-        expect(result).toBe(true);
-        expect(mockEngine.isPermitted).toHaveBeenCalledWith(
-          {
-            userId: 'user-123',
-            scope: { organisationId: 'org-456' },
-            permission: 'read:users'
-          },
-          expect.objectContaining({
-            userId: 'user-123',
-            organisationId: 'org-456'
-          })
-        );
-      });
-    });
+    // hasPermission was removed - use isPermitted directly
+    // Tests for isPermitted are covered in the isPermitted describe block above
 
     describe('hasAnyPermission', () => {
       it('returns true if user has any permission', async () => {

package/src/rbac/api.ts

@@ -490,16 +490,6 @@ export async function isPermittedCached(
   });
 }
 
-/**
- * Check if a user has a specific permission (alias for isPermitted)
- * 
- * @param input - Permission check parameters
- * @returns Promise<boolean> - True if user has permission
- */
-export async function hasPermission(input: PermissionCheck): Promise<boolean> {
-  return isPermitted(input);
-}
-
 /**
  * Check if user has any of the specified permissions
  * 
@@ -623,22 +613,25 @@ export async function getPageScopeType(
       throw new Error(`Could not resolve pageId ${pageId} to a valid UUID`);
     }
     
-    // Call the database function to get scope type (always returns a value)
-    const { data, error } = await engine['supabase']
-      .rpc('get_page_scope_type' as any, {
-        p_page_id: resolvedPageId
-      }) as { data: 'event' | 'organisation' | 'both' | null; error: any };
+    // Query scope type directly from rbac_app_pages (removed legacy RPC get_page_scope_type)
+    const { data: pageData, error } = await engine['supabase']
+      .from('rbac_app_pages')
+      .select('scope_type')
+      .eq('id', resolvedPageId)
+      .single();
     
     if (error) {
       log.error('Error fetching page scope type:', { pageId, appId, error });
       throw new Error(`Failed to get page scope type: ${error.message}`);
     }
     
-    if (!data) {
+    if (!pageData || !pageData.scope_type) {
       throw new Error(`Page ${resolvedPageId} does not have scope_type set`);
     }
     
-    return data;
+    // Type assertion to narrow string to the specific union type
+    // The database constraint ensures it's one of these values
+    return pageData.scope_type as 'event' | 'organisation' | 'both';
   } catch (err) {
     log.error('Error fetching page scope type:', err);
     throw err instanceof Error ? err : new Error(`Failed to get page scope type: ${String(err)}`);

package/src/rbac/cache-invalidation.ts

@@ -357,7 +357,6 @@ let globalCacheInvalidationManager: RBACCacheInvalidationManager | null = null;
 export function initializeCacheInvalidation(supabase: SupabaseClient<Database>): RBACCacheInvalidationManager {
   // Clean up existing manager if it exists (e.g., when switching Supabase clients)
   if (globalCacheInvalidationManager) {
-    log.debug('Cleaning up existing cache invalidation manager before creating new one');
     globalCacheInvalidationManager.cleanup();
   }
   

package/src/rbac/compliance/index.ts

@@ -36,3 +36,13 @@ export {
   type QuickFix,
 } from './quick-fix-suggestions';
 
+export {
+  detectDirectRpcCalls,
+  detectDirectTableQueries,
+  detectCustomAccessDeniedComponents,
+  detectPatternViolations,
+  logPatternViolations,
+  type PatternViolation,
+  type PatternDetectionResult,
+} from './pattern-detector';
+