@jmruthers/pace-core 0.6.9 → 0.6.10

package/dist/{chunk-5W2A3DRC.js → chunk-JJEYZ3DX.js}

@@ -1,4 +1,4 @@
-import { createLogger } from './chunk-TTRFSOKR.js';
+import { createLogger } from './chunk-BTHN5MKC.js';
 
 // src/theming/parseEventColours.ts
 function parseAndNormalizeEventColours(input) {
@@ -23,8 +23,9 @@ function parseAndNormalizeEventColours(input) {
     const fill = (p) => {
       if (!p || typeof p !== "object") return {};
       const out = {};
-      for (const key in p) {
-        const value = p[key];
+      const paletteObj = p;
+      for (const key in paletteObj) {
+        const value = paletteObj[key];
         if (value !== null && value !== void 0 && value !== "") {
           const normalizedKey = typeof key === "string" && key.startsWith("ev-") ? key.substring(3) : key;
           out[normalizedKey] = value;
@@ -37,7 +38,7 @@ function parseAndNormalizeEventColours(input) {
       sec: fill(sec),
       acc: fill(acc)
     };
-  } catch (error) {
+  } catch (_error) {
     return null;
   }
 }

package/dist/chunk-KPYQWGFQ.js

@@ -0,0 +1,183 @@
+import { useUnifiedAuth, useOrganisations } from './chunk-Y4PF6HIM.js';
+import { logger } from './chunk-BTHN5MKC.js';
+import { useState, useEffect, useMemo, useCallback } from 'react';
+
+var useOrganisationSecurity = () => {
+  const { user, session, supabase } = useUnifiedAuth();
+  const { selectedOrganisation, getUserRole } = useOrganisations();
+  const [isSuperAdmin, setIsSuperAdmin] = useState(false);
+  const [_isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState(false);
+  useEffect(() => {
+    if (!user || !session || !supabase) {
+      setIsSuperAdmin(false);
+      return;
+    }
+    const checkSuperAdmin = async () => {
+      setIsCheckingSuperAdmin(true);
+      try {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const { data, error } = await supabase.from("rbac_global_roles").select("role").eq("user_id", user.id).eq("role", "super_admin").lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`).limit(1);
+        setIsSuperAdmin(!error && data && data.length > 0);
+      } catch (error) {
+        logger.error("useOrganisationSecurity", "Error checking super admin status:", error);
+        setIsSuperAdmin(false);
+      } finally {
+        setIsCheckingSuperAdmin(false);
+      }
+    };
+    checkSuperAdmin();
+  }, [user, session, supabase]);
+  const superAdminContext = useMemo(() => {
+    return {
+      isSuperAdmin,
+      hasGlobalAccess: isSuperAdmin,
+      canManageAllOrganisations: isSuperAdmin
+    };
+  }, [isSuperAdmin]);
+  const validateOrganisationAccess = useCallback(async (orgId) => {
+    if (!user || !session || !supabase) return false;
+    try {
+      if (superAdminContext.isSuperAdmin) {
+        return true;
+      }
+      const { data, error } = await supabase.from("rbac_organisation_roles").select("id").eq("user_id", user.id).eq("organisation_id", orgId).eq("status", "active").is("revoked_at", null).in("role", ["org_admin", "leader", "member"]).single();
+      if (error) {
+        logger.error("useOrganisationSecurity", "Error validating organisation access:", error);
+        return false;
+      }
+      return !!data;
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception validating organisation access:", error);
+      return false;
+    }
+  }, [user, session, supabase, superAdminContext.isSuperAdmin]);
+  const hasMinimumRole = useCallback((minRole, orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId) return false;
+    const userRole = getUserRole(targetOrgId);
+    const roleHierarchy = ["supporter", "member", "leader", "org_admin"];
+    const userRoleIndex = roleHierarchy.indexOf(userRole);
+    const minRoleIndex = roleHierarchy.indexOf(minRole);
+    return userRoleIndex >= minRoleIndex;
+  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);
+  const canAccessChildOrganisations = useCallback((orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId) return false;
+    const userRole = getUserRole(targetOrgId);
+    return userRole === "org_admin";
+  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);
+  const hasPermission = useCallback(async (permission, orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId || !user) return false;
+    try {
+      const { isPermittedCached } = await import('./api-F47QJ7FX.js');
+      const scope = {
+        organisationId: targetOrgId,
+        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,
+        appId: user.user_metadata?.appId || user.app_metadata?.appId
+      };
+      return await isPermittedCached({
+        userId: user.id,
+        scope,
+        permission
+      });
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception checking permission:", error);
+      return false;
+    }
+  }, [selectedOrganisation, user, superAdminContext.isSuperAdmin]);
+  const getUserPermissions = useCallback(async (orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return ["*"];
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId || !user) return [];
+    try {
+      const { getPermissionMap } = await import('./api-F47QJ7FX.js');
+      const scope = {
+        organisationId: targetOrgId,
+        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,
+        appId: user.user_metadata?.appId || user.app_metadata?.appId
+      };
+      const permissionMap = await getPermissionMap({
+        userId: user.id,
+        scope
+      });
+      const allPermissions = Object.entries(permissionMap).filter(([, allowed]) => allowed).map(([permission]) => permission);
+      return [...new Set(allPermissions)];
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception getting user permissions:", error);
+      return [];
+    }
+  }, [selectedOrganisation, user, superAdminContext.isSuperAdmin]);
+  const logOrganisationAccess = useCallback(async (action, details) => {
+    if (!user || !selectedOrganisation) return;
+    try {
+      if (selectedOrganisation.id) {
+        const { emitAuditEvent } = await import('./audit-Z6ZZBWLU.js');
+        await emitAuditEvent({
+          type: "permission_check",
+          userId: user.id,
+          organisationId: selectedOrganisation.id,
+          permission: action,
+          decision: true,
+          // Assume access was granted if we're logging it
+          source: "api",
+          duration_ms: 0,
+          // No actual permission check performed here
+          metadata: details || {}
+        });
+      }
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Error logging organisation access:", error);
+    }
+  }, [user, selectedOrganisation]);
+  const ensureOrganisationAccess = useCallback(async (orgId) => {
+    const hasAccess = await validateOrganisationAccess(orgId);
+    if (!hasAccess) {
+      const error = new Error(`User does not have access to organisation ${orgId}`);
+      error.name = "OrganisationSecurityError";
+      error.code = "ACCESS_DENIED";
+      error.organisationId = orgId;
+      error.userId = user?.id;
+      throw error;
+    }
+  }, [validateOrganisationAccess, user]);
+  const validateUserAccess = useCallback(async (userId, orgId) => {
+    if (!supabase) return false;
+    try {
+      if (superAdminContext.isSuperAdmin) {
+        return true;
+      }
+      if (userId !== user?.id) {
+        return false;
+      }
+      return await validateOrganisationAccess(orgId);
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception validating user access:", error);
+      return false;
+    }
+  }, [supabase, superAdminContext.isSuperAdmin, user, validateOrganisationAccess]);
+  return {
+    superAdminContext,
+    validateOrganisationAccess,
+    hasMinimumRole,
+    canAccessChildOrganisations,
+    hasPermission,
+    getUserPermissions,
+    logOrganisationAccess,
+    ensureOrganisationAccess,
+    validateUserAccess
+  };
+};
+
+export { useOrganisationSecurity };

package/dist/{chunk-C7ZQ5O4C.js → chunk-KSNLMI7N.js}

@@ -1,5 +1,5 @@
-import { formatInTimeZone, getTimezoneAbbreviation } from './chunk-FEJLJNWA.js';
-import { createLogger } from './chunk-TTRFSOKR.js';
+import { formatInTimeZone, getTimezoneAbbreviation } from './chunk-FN52B75D.js';
+import { createLogger, Logger } from './chunk-BTHN5MKC.js';
 import { z } from 'zod';
 import { createClient } from '@supabase/supabase-js';
 import { parseISO, isValid } from 'date-fns';
@@ -313,7 +313,7 @@ function createBaseClient(supabaseUrl, supabaseKey) {
     const error = new Error(
       "createBaseClient() can only be called from main.tsx, App.tsx, or lib/supabase.ts.\nThis is a security requirement to ensure the base client is only created once and passed to UnifiedAuthProvider.\nSee: https://github.com/jmruthers/pace-core/blob/main/packages/core/docs/standards/00-pace-core-compliance.md"
     );
-    console.error("[pace-core Security Error]", error);
+    Logger.error("createBaseClient", "Security Error", error);
     throw error;
   }
   return createClient(supabaseUrl, supabaseKey, {