@jmruthers/pace-core 0.6.8 → 0.6.10

package/dist/{chunk-LX6U42O3.js → chunk-LNHFAF4X.js}

@@ -1,5 +1,5 @@
-import { emitAuditEvent, createAuditManager, setGlobalAuditManager } from './chunk-AHU7G2R5.js';
-import { createLogger } from './chunk-TTRFSOKR.js';
+import { emitAuditEvent, createAuditManager, setGlobalAuditManager } from './chunk-NIU6DPQV.js';
+import { createLogger } from './chunk-BTHN5MKC.js';
 
 // src/rbac/types.ts
 var RBACError = class extends Error {
@@ -462,12 +462,13 @@ var RBACCacheInvalidationManager = class {
       schema: "public",
       table: "rbac_organisation_roles"
     }, (payload) => {
-      const { organisation_id, user_id } = payload.new || payload.old || {};
+      const payloadData = payload;
+      const { organisation_id, user_id } = payloadData.new || payloadData.old || {};
       if (organisation_id) {
-        this.invalidateOrganisation(organisation_id, `organisation_role_${payload.eventType}`);
+        this.invalidateOrganisation(organisation_id, `organisation_role_${payloadData.eventType || "unknown"}`);
       }
       if (user_id) {
-        this.invalidateUser(user_id, `organisation_role_${payload.eventType}`);
+        this.invalidateUser(user_id, `organisation_role_${payloadData.eventType || "unknown"}`);
       }
     });
     const orgRolesSubscription = orgRolesChannel.subscribe();
@@ -477,18 +478,19 @@ var RBACCacheInvalidationManager = class {
       schema: "public",
       table: "rbac_event_app_roles"
     }, (payload) => {
-      const { organisation_id, user_id, event_id, app_id } = payload.new || payload.old || {};
+      const payloadData = payload;
+      const { organisation_id, user_id, event_id, app_id } = payloadData.new || payloadData.old || {};
       if (organisation_id) {
-        this.invalidateOrganisation(organisation_id, `event_app_role_${payload.eventType}`);
+        this.invalidateOrganisation(organisation_id, `event_app_role_${payloadData.eventType || "unknown"}`);
       }
       if (user_id) {
-        this.invalidateUser(user_id, `event_app_role_${payload.eventType}`);
+        this.invalidateUser(user_id, `event_app_role_${payloadData.eventType || "unknown"}`);
       }
       if (event_id) {
-        this.invalidateEvent(event_id, `event_app_role_${payload.eventType}`);
+        this.invalidateEvent(event_id, `event_app_role_${payloadData.eventType || "unknown"}`);
       }
       if (app_id) {
-        this.invalidateApp(app_id, `event_app_role_${payload.eventType}`);
+        this.invalidateApp(app_id, `event_app_role_${payloadData.eventType || "unknown"}`);
       }
     });
     const eventAppRolesSubscription = eventAppRolesChannel.subscribe();
@@ -498,9 +500,10 @@ var RBACCacheInvalidationManager = class {
       schema: "public",
       table: "rbac_global_roles"
     }, (payload) => {
-      const { user_id } = payload.new || payload.old || {};
+      const payloadData = payload;
+      const { user_id } = payloadData.new || payloadData.old || {};
       if (user_id) {
-        this.invalidateUser(user_id, `global_role_${payload.eventType}`);
+        this.invalidateUser(user_id, `global_role_${payloadData.eventType || "unknown"}`);
       }
     });
     const globalRolesSubscription = globalRolesChannel.subscribe();
@@ -510,7 +513,7 @@ var RBACCacheInvalidationManager = class {
       schema: "public",
       table: "rbac_page_permissions"
     }, (payload) => {
-      const { organisation_id, app_page_id, role_id } = payload.new || payload.old || {};
+      const { organisation_id, app_page_id } = payload.new || payload.old || {};
       if (organisation_id) {
         this.invalidateOrganisation(organisation_id, `page_permission_${payload.eventType}`);
       }
@@ -789,7 +792,7 @@ var RBACSecurityValidator = class {
    * @param operation - Operation being performed
    * @returns True if within rate limit, false otherwise
    */
-  static async checkRateLimit(userId, operation) {
+  static async checkRateLimit(_userId, _operation) {
     return true;
   }
   // Only warn once per 5 seconds per user
@@ -898,7 +901,8 @@ var RBACSecurityMiddleware = class {
     if (!RBACSecurityValidator.validateUserId(context.userId)) {
       errors.push("Invalid user ID format");
     }
-    const isPagePermission = input.permission?.includes(":page.") || !!input.pageId;
+    const permission = typeof input.permission === "string" ? input.permission : "";
+    const isPagePermission = permission.includes(":page.") || !!input.pageId;
     const requiresOrgId = !isPagePermission;
     if (requiresOrgId) {
       if (!context.organisationId) {
@@ -911,7 +915,7 @@ var RBACSecurityMiddleware = class {
         errors.push("Invalid organisation ID format");
       }
     }
-    if (input.permission && !RBACSecurityValidator.validatePermission(input.permission)) {
+    if (permission && !RBACSecurityValidator.validatePermission(permission)) {
       errors.push("Invalid permission format");
     }
     if (input.scope && !RBACSecurityValidator.validateScope(input.scope)) {
@@ -1000,6 +1004,7 @@ var RBACSecurityMiddleware = class {
 };
 
 // src/rbac/config.ts
+var logger = createLogger("RBAC");
 var RBACConfigManager = class {
   constructor() {
     this.config = null;
@@ -1023,31 +1028,31 @@ var RBACConfigManager = class {
     const { debug = false, logLevel = "warn" } = this.config;
     this.logger = {
       error: (message, ...args) => {
-        console.error(`[RBAC ERROR] ${message}`, ...args);
+        logger.error(message, ...args);
       },
       warn: (message, ...args) => {
         if (logLevel === "warn" || logLevel === "info" || logLevel === "debug") {
-          console.warn(`[RBAC WARN] ${message}`, ...args);
+          logger.warn(message, ...args);
         }
       },
       info: (message, ...args) => {
         if (logLevel === "info" || logLevel === "debug") {
-          console.info(`[RBAC INFO] ${message}`, ...args);
+          logger.info(message, ...args);
         }
       },
       debug: (message, ...args) => {
         if (debug && logLevel === "debug") {
-          console.debug(`[RBAC DEBUG] ${message}`, ...args);
+          logger.debug(message, ...args);
         }
       }
     };
   }
   createDefaultLogger() {
     return {
-      error: (message, ...args) => console.error(`[RBAC ERROR] ${message}`, ...args),
-      warn: (message, ...args) => console.warn(`[RBAC WARN] ${message}`, ...args),
-      info: (message, ...args) => console.info(`[RBAC INFO] ${message}`, ...args),
-      debug: (message, ...args) => console.debug(`[RBAC DEBUG] ${message}`, ...args)
+      error: (message, ...args) => logger.error(message, ...args),
+      warn: (message, ...args) => logger.warn(message, ...args),
+      info: (message, ...args) => logger.info(message, ...args),
+      debug: (message, ...args) => logger.debug(message, ...args)
     };
   }
   isDebugMode() {
@@ -1169,8 +1174,8 @@ var RBACEngine = class {
         p_page_id: pageId || void 0
       });
       if (error) {
-        const logger = getRBACLogger();
-        logger.error("RPC error:", error);
+        const logger2 = getRBACLogger();
+        logger2.error("RPC error:", error);
         const category = categorizeError(error);
         const eventType = mapErrorCategoryToSecurityEventType(category);
         const errorDetails = error;
@@ -1224,8 +1229,8 @@ var RBACEngine = class {
           category
         }
       });
-      const logger = getRBACLogger();
-      logger.error("Permission check failed:", error);
+      const logger2 = getRBACLogger();
+      logger2.error("Permission check failed:", error);
       return false;
     }
   }
@@ -1354,11 +1359,11 @@ var RBACEngine = class {
         p_app_name: appName
       });
       if (error) {
-        const logger = getRBACLogger();
-        logger.error("Failed to resolve app context:", error);
+        const logger2 = getRBACLogger();
+        logger2.error("Failed to resolve app context:", error);
         return null;
       }
-      if (!data || data.length === 0) {
+      if (!data || !Array.isArray(data) || data.length === 0) {
         return null;
       }
       const appData = data[0];
@@ -1370,8 +1375,8 @@ var RBACEngine = class {
         hasAccess: appData.has_access !== false
       };
     } catch (error) {
-      const logger = getRBACLogger();
-      logger.error("Unexpected error resolving app context:", error);
+      const logger2 = getRBACLogger();
+      logger2.error("Unexpected error resolving app context:", error);
       return null;
     }
   }
@@ -1392,28 +1397,59 @@ var RBACEngine = class {
         // Optional: can filter to specific page if needed
       });
       if (error) {
-        const logger = getRBACLogger();
-        logger.error("Failed to load role context:", error);
+        const logger2 = getRBACLogger();
+        logger2.error("Failed to load role context:", error);
         return result;
       }
       if (!Array.isArray(data)) {
         return result;
       }
+      const mapToOrganisationRole = (level) => {
+        switch (level) {
+          case "supporter":
+            return "supporter";
+          case "member":
+            return "member";
+          case "leader":
+            return "leader";
+          case "org_admin":
+          case "admin":
+          case "super":
+            return "org_admin";
+          default:
+            return null;
+        }
+      };
+      const mapToEventAppRole = (level) => {
+        switch (level) {
+          case "viewer":
+            return "viewer";
+          case "participant":
+            return "participant";
+          case "planner":
+            return "planner";
+          case "admin":
+          case "super":
+            return "event_admin";
+          default:
+            return null;
+        }
+      };
       for (const permission of data) {
         if (permission.permission_type === "all_permissions") {
           result.globalRole = "super_admin";
         }
         if (permission.permission_type === "organisation_access") {
-          result.organisationRole = permission.role_name;
+          result.organisationRole = mapToOrganisationRole(permission.role_name);
         }
         if (permission.permission_type === "event_app_access") {
-          result.eventAppRole = permission.role_name;
+          result.eventAppRole = mapToEventAppRole(permission.role_name);
         }
       }
       return result;
     } catch (error) {
-      const logger = getRBACLogger();
-      logger.error("Unexpected error loading role context:", error);
+      const logger2 = getRBACLogger();
+      logger2.error("Unexpected error loading role context:", error);
       return result;
     }
   }
@@ -1435,10 +1471,12 @@ var RBACEngine = class {
       const { data, error } = await this.supabase.from("rbac_global_roles").select("role").eq("user_id", userId).eq("role", "super_admin").lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`).limit(1);
       const elapsed = Date.now() - startTime;
       if (elapsed > 2e3) {
-        console.warn("[RBACEngine] Super admin check took longer than expected", {
+        const logger2 = getRBACLogger();
+        const errorMessage = error && typeof error === "object" && "message" in error ? String(error.message) : void 0;
+        logger2.warn("[RBACEngine] Super admin check took longer than expected", {
           userId,
           elapsedMs: elapsed,
-          error: error?.message
+          error: errorMessage
         });
       }
       const isSuperAdmin2 = !error && data && data.length > 0;
@@ -1446,7 +1484,8 @@ var RBACEngine = class {
       return Boolean(isSuperAdmin2);
     } catch (err) {
       const elapsed = Date.now() - startTime;
-      console.error("[RBACEngine] Error checking super admin", {
+      const logger2 = getRBACLogger();
+      logger2.error("[RBACEngine] Error checking super admin", {
         userId,
         error: err,
         elapsedMs: elapsed
@@ -1475,16 +1514,16 @@ var RBACEngine = class {
     try {
       const { data: page, error: pageError } = await this.supabase.from("rbac_app_pages").select("id").eq("app_id", appId).eq("page_name", pageId).maybeSingle();
       if (pageError) {
-        const logger = getRBACLogger();
+        const logger2 = getRBACLogger();
         if (pageError.code !== "PGRST116") {
-          logger.warn("Failed to resolve page name to UUID:", { pageId, appId, error: pageError });
+          logger2.warn("Failed to resolve page name to UUID:", { pageId, appId, error: pageError });
         }
         return pageId;
       }
       return page?.id || pageId;
     } catch (error) {
-      const logger = getRBACLogger();
-      logger.warn("Failed to resolve page name to UUID:", { pageId, appId, error });
+      const logger2 = getRBACLogger();
+      logger2.warn("Failed to resolve page name to UUID:", { pageId, appId, error });
       return pageId;
     }
   }
@@ -1842,7 +1881,6 @@ var ContextValidator = class {
 var log4 = createLogger("RBACAPI");
 var globalEngine = null;
 function setupRBAC(supabase, config) {
-  getRBACLogger();
   const isDevelopment = import.meta.env.MODE === "development";
   const fullConfig = {
     supabase,
@@ -1968,7 +2006,7 @@ async function isPermitted(input, appName, precomputedSuperAdmin = null) {
       if (data) {
         resolvedAppName = data.name;
       }
-    } catch (err) {
+    } catch (_err) {
     }
   }
   let pageScopeType;
@@ -2106,32 +2144,96 @@ async function getPageScopeType(pageId, appId, appName) {
   try {
     let resolvedAppId = appId;
     if (!resolvedAppId && appName) {
-      const { data: app } = await engine["supabase"].from("rbac_apps").select("id").eq("name", appName).eq("is_active", true).single();
-      resolvedAppId = app?.id;
+      const { data: app, error: appError } = await engine["supabase"].from("rbac_apps").select("id, name, is_active").eq("name", appName).eq("is_active", true).maybeSingle();
+      if (appError) {
+        log4.error("Error resolving appId from appName", {
+          appName,
+          pageId,
+          error: appError,
+          errorMessage: appError instanceof Error ? appError.message : String(appError)
+        });
+        throw new Error(`Failed to resolve appId from appName "${appName}": ${appError instanceof Error ? appError.message : String(appError)}`);
+      }
+      if (!app) {
+        log4.error("App not found or inactive", { appName, pageId });
+        throw new Error(`Could not resolve appId for appName "${appName}" - app not found or not active`);
+      }
+      resolvedAppId = app.id;
     }
     if (!resolvedAppId) {
-      throw new Error(`Could not resolve appId for page ${pageId}`);
+      log4.error("No appId resolved", { pageId, appId, appName });
+      throw new Error(`Could not resolve appId for page ${pageId} - appId and appName both missing or invalid`);
     }
     let resolvedPageId = pageId;
     const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     if (!uuidRegex.test(pageId)) {
-      const { data: page } = await engine["supabase"].from("rbac_app_pages").select("id").eq("app_id", resolvedAppId).eq("page_name", pageId).maybeSingle();
-      resolvedPageId = page?.id || pageId;
+      const { data: page, error: pageError } = await engine["supabase"].from("rbac_app_pages").select("id, page_name, app_id").eq("app_id", resolvedAppId).eq("page_name", pageId).maybeSingle();
+      if (pageError) {
+        log4.error("Error resolving pageId from page_name", {
+          pageId,
+          appId: resolvedAppId,
+          appName,
+          error: pageError,
+          errorMessage: pageError instanceof Error ? pageError.message : String(pageError),
+          errorCode: pageError?.code
+        });
+        throw new Error(`Failed to resolve pageId "${pageId}" for appId ${resolvedAppId}: ${pageError instanceof Error ? pageError.message : String(pageError)}`);
+      }
+      if (!page) {
+        log4.error("Page not found in database", {
+          pageId,
+          appId: resolvedAppId,
+          appName,
+          note: "Page may not exist in rbac_app_pages table or may be for a different app"
+        });
+        throw new Error(`Could not resolve pageId "${pageId}" to a valid UUID - page not found for appId ${resolvedAppId}`);
+      }
+      resolvedPageId = page.id;
     }
     if (!uuidRegex.test(resolvedPageId)) {
+      log4.error("PageId resolution failed - not a valid UUID", {
+        originalPageId: pageId,
+        resolvedPageId,
+        appId: resolvedAppId,
+        appName
+      });
       throw new Error(`Could not resolve pageId ${pageId} to a valid UUID`);
     }
-    const { data: pageData, error } = await engine["supabase"].from("rbac_app_pages").select("scope_type").eq("id", resolvedPageId).single();
+    const { data: pageData, error } = await engine["supabase"].from("rbac_app_pages").select("scope_type, page_name, app_id").eq("id", resolvedPageId).single();
     if (error) {
-      log4.error("Error fetching page scope type:", { pageId, appId, error });
-      throw new Error(`Failed to get page scope type: ${error.message}`);
+      log4.error("Error fetching page scope type from database", {
+        pageId: resolvedPageId,
+        originalPageId: pageId,
+        appId: resolvedAppId,
+        appName,
+        error,
+        errorMessage: error instanceof Error ? error.message : String(error),
+        errorCode: error?.code,
+        errorDetails: error?.details,
+        errorHint: error?.hint
+      });
+      throw new Error(`Failed to get page scope type: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (!pageData || !pageData.scope_type) {
+      log4.error("Page found but scope_type is missing", {
+        pageId: resolvedPageId,
+        originalPageId: pageId,
+        appId: resolvedAppId,
+        appName,
+        pageData
+      });
       throw new Error(`Page ${resolvedPageId} does not have scope_type set`);
     }
     return pageData.scope_type;
   } catch (err) {
-    log4.error("Error fetching page scope type:", err);
+    log4.error("Error fetching page scope type (catch block)", {
+      pageId,
+      appId,
+      appName,
+      error: err,
+      errorMessage: err instanceof Error ? err.message : String(err),
+      errorStack: err instanceof Error ? err.stack : void 0
+    });
     throw err instanceof Error ? err : new Error(`Failed to get page scope type: ${String(err)}`);
   }
 }
@@ -2174,4 +2276,4 @@ function clearCache() {
   rbacCache.clear();
 }
 
-export { CACHE_PATTERNS, ContextValidator, EventContextRequiredError, OrganisationContextRequiredError, RBACCache, RBACEngine, RBACNotInitializedError, clearCache, clearInFlightRequests, createRBACConfig, createRBACEngine, disablePerformanceMonitoring, enablePerformanceMonitoring, getAccessLevel, getInFlightRequestCount, getPageScopeType, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getRBACConfig, getRBACLogger, getRoleContext, hasAllPermissions, hasAnyPermission, invalidateAppCache, invalidateEventCache, invalidateOrganisationCache, invalidateUserCache, isDebugMode, isDevelopmentMode, isEventAdmin, isOrganisationAdmin, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, isSuperAdmin, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setupRBAC };
+export { CACHE_PATTERNS, ContextValidator, EventContextRequiredError, OrganisationContextRequiredError, RBACCache, RBACEngine, clearCache, clearInFlightRequests, createRBACConfig, createRBACEngine, disablePerformanceMonitoring, enablePerformanceMonitoring, getAccessLevel, getInFlightRequestCount, getPageScopeType, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getRBACConfig, getRBACLogger, getRoleContext, hasAllPermissions, hasAnyPermission, invalidateAppCache, invalidateEventCache, invalidateOrganisationCache, invalidateUserCache, isDebugMode, isDevelopmentMode, isEventAdmin, isOrganisationAdmin, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, isSuperAdmin, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setupRBAC };