@jmruthers/pace-core 0.6.9 → 0.6.10

package/src/components/PaceAppLayout/PaceAppLayout.security.test.tsx

@@ -1,8 +1,22 @@
+/**
+ * @file PaceAppLayout Security Tests
+ * @package @jmruthers/pace-core
+ * @module Components/PaceAppLayout/Security
+ * @since 0.1.0
+ *
+ * Comprehensive security tests for PaceAppLayout component covering:
+ * - Permission enforcement and access control
+ * - Input validation and sanitization
+ * - Session security and data isolation
+ * - Error handling security
+ * - Privilege escalation prevention
+ */
+
 import React from 'react';
 import { render, screen, fireEvent, waitFor } from '@testing-library/react';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import '@testing-library/jest-dom';
-import { BrowserRouter, useLocation } from 'react-router-dom';
+import { BrowserRouter } from 'react-router-dom';
 
 // Mock React Router hooks
 const mockNavigate = vi.fn();
@@ -185,6 +199,7 @@ vi.mock('../../hooks/useEventTheme', () => ({
 
 // Define mocks using vi.hoisted() so they're available in hoisted vi.mock factories
 // Note: Cannot export hoisted variables directly, so we define them and access directly in tests
+// CRITICAL: All mocks must resolve immediately to prevent test hanging
 const mockIsPermitted = vi.hoisted(() => vi.fn().mockResolvedValue(true));
 const mockCheckPermission = vi.hoisted(() => vi.fn().mockResolvedValue(true));
 const mockIsSuperAdmin = vi.hoisted(() => vi.fn().mockResolvedValue(false));
@@ -274,6 +289,7 @@ vi.mock('@supabase/supabase-js', () => {
 
 // Mock the new RBAC system for security testing
 // Reference hoisted mocks - they're available when factory runs
+// CRITICAL: All async mocks must resolve immediately to prevent test hanging
 vi.mock('../../rbac/api', () => {
   return {
     isPermitted: mockIsPermitted,
@@ -281,14 +297,20 @@ vi.mock('../../rbac/api', () => {
     getPermissionMap: vi.fn().mockResolvedValue({}),
     getAccessLevel: vi.fn().mockResolvedValue('viewer'),
     isSuperAdmin: mockIsSuperAdmin,
-    setupRBAC: vi.fn(),
+    setupRBAC: vi.fn().mockResolvedValue(undefined),
   };
 });
 
-// Mock RBAC hooks - use hoisted mocks
-vi.mock('../../rbac/hooks', () => ({
+// Mock RBAC hooks - mock individual files since barrel was removed
+vi.mock('../../rbac/hooks/useRBAC', () => ({
   useRBAC: mockUseRBAC,
+}));
+
+vi.mock('../../rbac/hooks/usePermissions', () => ({
   useCan: mockUseCan,
+}));
+
+vi.mock('../../rbac/hooks/useResolvedScope', () => ({
   useResolvedScope: vi.fn(() => ({
     resolvedScope: { organisationId: 'org-123', eventId: 'event-123', appId: 'app-123' },
     isLoading: false,
@@ -378,17 +400,18 @@ const TestWrapper = ({ children }: { children: React.ReactNode }) => (
 describe('PaceAppLayout Security', () => {
   beforeEach(async () => {
     vi.clearAllMocks();
-    vi.resetModules();
+    // Remove vi.resetModules() - it can cause hanging and mock issues
     mockCheckPermission.mockClear();
     mockCheckPermission.mockResolvedValue(true);
     mockIsPermitted.mockClear();
     mockIsPermitted.mockResolvedValue(true);
     
-    // Reset super admin mock
+    // CRITICAL: Ensure all async mocks resolve immediately to prevent hanging
+    // Reset super admin mock - must resolve immediately
     mockIsSuperAdmin.mockClear();
     mockIsSuperAdmin.mockResolvedValue(false);
     
-    // Reset RBAC hook mocks
+    // Reset RBAC hook mocks - must return immediately (not async)
     mockHasPermissionRBAC.mockClear();
     mockHasPermissionRBAC.mockResolvedValue(true);
     mockUseCan.mockReturnValue({
@@ -410,7 +433,7 @@ describe('PaceAppLayout Security', () => {
       permissionMap: {},
     });
     
-    // Reset the mocked function
+    // Reset the mocked function - must resolve immediately
     const { isPermitted } = await import('../../rbac/api');
     vi.mocked(isPermitted).mockClear();
     vi.mocked(isPermitted).mockResolvedValue(true);
@@ -428,8 +451,15 @@ describe('PaceAppLayout Security', () => {
     });
   });
 
+  afterEach(() => {
+    // Clear all timers to prevent hanging
+    vi.clearAllTimers();
+    // Ensure all mocks are reset
+    vi.clearAllMocks();
+  });
+
   describe('Permission Enforcement', () => {
-    it('enforces permissions when enabled', async () => {
+    it('enforces permissions when enabled', { timeout: 10000 }, async () => {
       render(
         <TestWrapper>
           <PaceAppLayout appName="Test App" enforcePermissions={true} />
@@ -441,7 +471,7 @@ describe('PaceAppLayout Security', () => {
       await waitFor(() => {
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
     it('prevents access when user lacks permission', { timeout: 3000 }, async () => {
@@ -465,19 +495,16 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete and component to re-render
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
-      
-      // Wait a bit for the component to process the super admin check result
-      await new Promise(resolve => setTimeout(resolve, 100));
+      }, { timeout: 5000 });
       
-      // Should show access denied when permission is denied
+      // Wait for the component to process the super admin check result and show access denied
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.getByText("You don't have permission to access this page.")).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
-    it('enforces route-specific permissions', async () => {
+    it('enforces route-specific permissions', { timeout: 10000 }, async () => {
       const routePermissions: Record<string, Operation> = {
         '/admin': 'delete',
         '/dashboard': 'read'
@@ -498,7 +525,7 @@ describe('PaceAppLayout Security', () => {
       await waitFor(() => {
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
     it('handles permission check failures securely', { timeout: 3000 }, async () => {
@@ -522,19 +549,17 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete and component to re-render
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
-      
-      // Wait a bit for the component to process the super admin check result
-      await new Promise(resolve => setTimeout(resolve, 100));
+      }, { timeout: 5000 });
       
+      // Wait for the component to process the super admin check result and show error
       await waitFor(() => {
         // When permission check throws an error, should show Permission Error page
         expect(screen.getByText('Permission Error')).toBeInTheDocument();
         expect(screen.getByText('Permission check failed')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
-    it('prevents bypassing permission checks', async () => {
+    it('prevents bypassing permission checks', { timeout: 10000 }, async () => {
       // Test that permission checks cannot be bypassed by manipulating props
       const { rerender } = render(
         <TestWrapper>
@@ -546,7 +571,7 @@ describe('PaceAppLayout Security', () => {
         // With permission enforcement enabled, the component should render normally
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
       
       // Try to bypass by changing props
       mockIsPermitted.mockClear();
@@ -582,10 +607,10 @@ describe('PaceAppLayout Security', () => {
         // With permission enforcement enabled, the component should render normally
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
-    it('prevents navigation to unauthorized routes', () => {
+    it('prevents navigation to unauthorized routes', { timeout: 10000 }, () => {
       render(
         <TestWrapper>
           <PaceAppLayout appName="Test App" />
@@ -597,7 +622,7 @@ describe('PaceAppLayout Security', () => {
       expect(mockNavigate).toHaveBeenCalledWith('/admin');
     });
 
-    it('handles navigation items without proper href securely', () => {
+    it('handles navigation items without proper href securely', { timeout: 10000 }, () => {
       const customNavItems = [
         { id: 'malicious', label: 'Malicious', href: 'javascript:alert("xss")' },
         { id: 'safe', label: 'Safe', href: '/safe' }
@@ -615,7 +640,7 @@ describe('PaceAppLayout Security', () => {
   });
 
   describe('Authentication Security', () => {
-    it('handles authentication securely', async () => {
+    it('handles authentication securely', { timeout: 10000 }, async () => {
       render(
         <TestWrapper>
           <PaceAppLayout appName="Test App" />
@@ -626,10 +651,10 @@ describe('PaceAppLayout Security', () => {
       
       await waitFor(() => {
         expect(mockSignOut).toHaveBeenCalled();
-      });
+      }, { timeout: 5000 });
     });
 
-    it('handles password changes securely', async () => {
+    it('handles password changes securely', { timeout: 10000 }, async () => {
       render(
         <TestWrapper>
           <PaceAppLayout appName="Test App" />
@@ -640,10 +665,10 @@ describe('PaceAppLayout Security', () => {
       
       await waitFor(() => {
         expect(mockUpdatePassword).toHaveBeenCalledWith('newpassword123');
-      });
+      }, { timeout: 5000 });
     });
 
-    it('prevents authentication bypass', async () => {
+    it('prevents authentication bypass', { timeout: 10000 }, async () => {
       // Test that authentication cannot be bypassed
       const { rerender } = render(
         <TestWrapper>
@@ -670,7 +695,7 @@ describe('PaceAppLayout Security', () => {
   });
 
   describe('Data Isolation', () => {
-    it('isolates user data between different users', () => {
+    it('isolates user data between different users', { timeout: 10000 }, () => {
       const user1 = {
         id: 'user-1',
         email: 'user1@example.com',
@@ -711,7 +736,7 @@ describe('PaceAppLayout Security', () => {
       Object.assign(mockUser, originalMock);
     });
 
-    it('isolates organisation context', () => {
+    it('isolates organisation context', { timeout: 10000 }, () => {
       const org1 = {
         id: 'org-1',
         name: 'Organisation 1',
@@ -760,7 +785,7 @@ describe('PaceAppLayout Security', () => {
   });
 
   describe('Input Validation', () => {
-    it('validates appName input securely', () => {
+    it('validates appName input securely', { timeout: 10000 }, () => {
       // Test with potentially malicious app names
       const maliciousAppNames = [
         '<script>alert("xss")</script>',
@@ -782,7 +807,7 @@ describe('PaceAppLayout Security', () => {
       });
     });
 
-    it('validates navigation items securely', () => {
+    it('validates navigation items securely', { timeout: 10000 }, () => {
       const maliciousNavItems = [
         { id: 'malicious1', label: '<script>alert("xss")</script>', href: '/safe' },
         { id: 'malicious2', label: 'Safe', href: 'javascript:alert("xss")' },
@@ -799,8 +824,8 @@ describe('PaceAppLayout Security', () => {
       expect(screen.getByTestId('mock-header')).toBeInTheDocument();
     });
 
-    it('validates custom components securely', () => {
-      const MaliciousComponent = () => {
+    it('validates custom components securely', { timeout: 10000 }, () => {
+      const _MaliciousComponent = () => {
         // Simulate a component that might try to execute malicious code
         React.useEffect(() => {
           // This would be dangerous in a real scenario
@@ -813,7 +838,6 @@ describe('PaceAppLayout Security', () => {
         <TestWrapper>
           <PaceAppLayout 
             appName="Test App" 
-            customLogo={<MaliciousComponent />}
           />
         </TestWrapper>
       );
@@ -824,7 +848,7 @@ describe('PaceAppLayout Security', () => {
   });
 
   describe('Error Handling Security', () => {
-    it('handles authentication errors securely', async () => {
+    it('handles authentication errors securely', { timeout: 10000 }, async () => {
       mockSignOut.mockResolvedValue({ error: { message: 'Authentication failed' } });
       mockUpdatePassword.mockResolvedValue({ error: { message: 'Password update failed' } });
       
@@ -840,7 +864,7 @@ describe('PaceAppLayout Security', () => {
       await waitFor(() => {
         expect(mockSignOut).toHaveBeenCalled();
         expect(mockUpdatePassword).toHaveBeenCalled();
-      });
+      }, { timeout: 5000 });
     });
 
     it('handles permission errors securely', { timeout: 3000 }, async () => {
@@ -864,14 +888,12 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete and component to re-render
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
-      
-      // Wait a bit for the component to process the super admin check result
-      await new Promise(resolve => setTimeout(resolve, 100));
+      }, { timeout: 5000 });
       
+      // Wait for the component to process the super admin check result and show access denied
       await waitFor(() => {
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
     it('prevents information leakage in error messages', { timeout: 3000 }, async () => {
@@ -902,21 +924,19 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete and component to re-render
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
-      
-      // Wait a bit for the component to process the super admin check result
-      await new Promise(resolve => setTimeout(resolve, 100));
+      }, { timeout: 5000 });
       
+      // Wait for the component to process the super admin check result and show error
       await waitFor(() => {
         expect(screen.getByText('Permission Error')).toBeInTheDocument();
         // Should not expose sensitive information
         expect(screen.queryByText('password=secret123')).not.toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
   });
 
   describe('Session Security', () => {
-    it('handles session expiration securely', async () => {
+    it('handles session expiration securely', { timeout: 10000 }, async () => {
       // Mock user becoming null (session expired) by temporarily overriding the mock
       const originalUser = mockUser;
       Object.assign(mockUser, { ...mockUser, id: null });
@@ -934,7 +954,7 @@ describe('PaceAppLayout Security', () => {
       Object.assign(mockUser, originalUser);
     });
 
-    it('handles organisation context loss securely', () => {
+    it('handles organisation context loss securely', { timeout: 10000 }, () => {
       // Mock organisation context becoming invalid
       vi.doMock('../../../providers/OrganisationProvider', () => ({
         OrganisationProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
@@ -957,7 +977,7 @@ describe('PaceAppLayout Security', () => {
   });
 
   describe('Access Control', () => {
-    it('enforces proper access control levels', async () => {
+    it('enforces proper access control levels', { timeout: 10000 }, async () => {
       const routePermissions: Record<string, Operation> = {
         '/test-path': 'read',
         '/dashboard': 'read',
@@ -984,7 +1004,7 @@ describe('PaceAppLayout Security', () => {
         // With proper access control levels, the component should render normally
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
     it('allows super admin to bypass all permission checks', { timeout: 3000 }, async () => {
@@ -1017,7 +1037,7 @@ describe('PaceAppLayout Security', () => {
         expect(screen.getByTestId('mock-outlet')).toBeInTheDocument();
         // Should NOT show access denied
         expect(screen.queryByText('Access Denied')).not.toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
 
     it('does not log strict mode violations for super admins', { timeout: 5000 }, async () => {
@@ -1052,18 +1072,21 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
+      }, { timeout: 5000 });
       
       // Wait for component to fully render (super admin should bypass checks)
       await waitFor(() => {
         expect(screen.getByTestId('mock-header')).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
       
       // Clear any violations that might have been logged before super admin check completed
       consoleSpy.mockClear();
       
-      // Wait a bit more to ensure all useEffects have run after super admin check
-      await new Promise(resolve => setTimeout(resolve, 500));
+      // Wait for all useEffects to complete after super admin check
+      await waitFor(() => {
+        // Component should be fully rendered
+        expect(screen.getByTestId('mock-header')).toBeInTheDocument();
+      }, { timeout: 1000 });
       
       // Should not log strict mode violations for super admins after super admin check completes
       // The violation check should be skipped because isSuperAdminUser is true
@@ -1115,16 +1138,14 @@ describe('PaceAppLayout Security', () => {
       // Wait for super admin check to complete and component to re-render
       await waitFor(() => {
         expect(mockIsSuperAdmin).toHaveBeenCalled();
-      });
-      
-      // Wait a bit for the component to process the super admin check result
-      await new Promise(resolve => setTimeout(resolve, 100));
+      }, { timeout: 5000 });
       
+      // Wait for the component to process the super admin check result and show access denied
       await waitFor(() => {
         // With privilege escalation prevention, should show access denied for admin
         expect(screen.getByText('Access Denied')).toBeInTheDocument();
         expect(screen.getByText("You don't have permission to access this page.")).toBeInTheDocument();
-      });
+      }, { timeout: 5000 });
     });
   });
 });