@jmruthers/pace-core 0.6.9 → 0.6.11

package/dist/chunk-PCSHBLPB.js

@@ -0,0 +1,811 @@
+import { Card, CardHeader, CardTitle, CardDescription, CardFooter, Button, useResolvedScope } from './chunk-V7FTM2LU.js';
+import { useEvents, useOrganisationSecurity } from './chunk-WY6Y7KC3.js';
+import { useUnifiedAuth, useOrganisations } from './chunk-4R3T5ENU.js';
+import { OrganisationContextRequiredError, getRBACLogger, resolveAppContext, getPageScopeType, ContextValidator, getPermissionMap, getRoleContext, getAccessLevel } from './chunk-7A6IMHH2.js';
+import { Logger, logger } from './chunk-BTHN5MKC.js';
+import { createClient } from '@supabase/supabase-js';
+import { ShieldX } from 'lucide-react';
+import { jsxs, jsx } from 'react/jsx-runtime';
+import { useState, useCallback, useMemo, useEffect, useRef } from 'react';
+
+// src/rbac/utils/clientSecurity.ts
+var SECURE_CLIENT_SYMBOL = Symbol("pace-core-secure-client");
+function isSecureClient(client) {
+  if (!client) return false;
+  return client[SECURE_CLIENT_SYMBOL] === true;
+}
+function warnIfInsecureClient(client, context) {
+  if (typeof process !== "undefined" && true) {
+    return;
+  }
+  if (!client) return;
+  if (!isSecureClient(client)) {
+    const contextMsg = context ? ` in ${context}` : "";
+    Logger.warn(
+      "ClientSecurity",
+      `Non-secure Supabase client detected${contextMsg}.
+You are using a Supabase client created with createClient() instead of useSecureSupabase().
+This bypasses organisation context enforcement and RLS policies, which can lead to:
+- Cross-organisation data access
+- Security vulnerabilities
+- Data leakage between organisations
+
+Fix: Replace with:
+  import { useSecureSupabase } from '@jmruthers/pace-core/rbac';
+  const supabase = useSecureSupabase();
+
+See: https://github.com/jmruthers/pace-core/blob/main/packages/core/docs/rbac/getting-started.md`
+    );
+  }
+}
+function markClientAsSecure(client) {
+  client[SECURE_CLIENT_SYMBOL] = true;
+}
+var _SecureSupabaseClient = class _SecureSupabaseClient {
+  constructor(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin = false, existingClient) {
+    this.edgeFunctionClient = null;
+    this.usesExistingClient = false;
+    this.supabaseUrl = supabaseUrl;
+    this.supabaseKey = supabaseKey;
+    this.organisationId = organisationId;
+    this.eventId = eventId;
+    this.appId = appId;
+    this.isSuperAdmin = isSuperAdmin;
+    if (existingClient) {
+      this.supabase = existingClient;
+      this.usesExistingClient = true;
+    } else {
+      this.supabase = createClient(supabaseUrl, supabaseKey, {
+        global: {
+          headers: {
+            "x-organisation-id": organisationId || "",
+            "x-event-id": eventId || "",
+            "x-app-id": appId || ""
+          }
+        }
+      });
+    }
+    this.setupContextInjection();
+    this.setupEdgeFunctionHandling();
+    markClientAsSecure(this.supabase);
+  }
+  /**
+   * Setup context injection for all database operations
+   */
+  setupContextInjection() {
+    const originalFrom = this.supabase.from.bind(this.supabase);
+    this.supabase.from = (table) => {
+      this.validateContextForTable(table);
+      const query = originalFrom(table);
+      query._tableName = table;
+      return this.injectContext(query, table);
+    };
+    const originalRpc = this.supabase.rpc.bind(this.supabase);
+    this.supabase.rpc = (fn, args, options) => {
+      this.validateContextForRpc(fn);
+      const acceptedParams = this.getRpcAcceptedParams(fn);
+      const safeArgs = args ?? {};
+      const contextArgs = { ...safeArgs };
+      if (acceptedParams.has("p_organisation_id") && this.organisationId && safeArgs.p_organisation_id === void 0) {
+        contextArgs.p_organisation_id = this.organisationId;
+      }
+      if (acceptedParams.has("p_event_id") && this.eventId && safeArgs.p_event_id === void 0) {
+        contextArgs.p_event_id = this.eventId;
+      }
+      if (acceptedParams.has("p_app_id") && this.appId && safeArgs.p_app_id === void 0) {
+        contextArgs.p_app_id = this.appId;
+      }
+      return originalRpc(fn, contextArgs, options);
+    };
+  }
+  /**
+   * Setup Edge Function handling to bypass custom headers
+   * Edge Functions may not have CORS configured to accept custom headers,
+   * so we create a separate client without custom headers for Edge Function calls
+   * 
+   * NOTE: We store the edge function client but don't override functions here.
+   * Instead, we provide a method to get the edge function client for direct use.
+   * This avoids interfering with the main client's operations.
+   */
+  setupEdgeFunctionHandling() {
+    if (this.usesExistingClient) {
+      this.edgeFunctionClient = null;
+      return;
+    }
+    this.edgeFunctionClient = createClient(this.supabaseUrl, this.supabaseKey);
+  }
+  /**
+   * Get a client for Edge Function calls without custom headers
+   * Edge Functions may not have CORS configured to accept custom headers
+   * @returns Supabase client without custom headers for Edge Function calls
+   */
+  getEdgeFunctionClient() {
+    return this.edgeFunctionClient || this.supabase;
+  }
+  /**
+   * Inject organisation context into a query
+   */
+  injectContext(query, tableName) {
+    const queryBuilder = query;
+    const originalSelect = queryBuilder.select.bind(queryBuilder);
+    const originalInsert = queryBuilder.insert.bind(queryBuilder);
+    const originalUpdate = queryBuilder.update.bind(queryBuilder);
+    const originalDelete = queryBuilder.delete.bind(queryBuilder);
+    queryBuilder.select = (columns) => {
+      const result = originalSelect(columns);
+      result._tableName = tableName;
+      return this.addOrganisationFilter(result, tableName);
+    };
+    queryBuilder.insert = (values) => {
+      const tablesWithoutOrganisationId = [
+        "core_organisations",
+        // Organisation table itself - uses 'id' as primary key
+        "rbac_apps",
+        // App configuration table - no organisation scope
+        "rbac_app_pages",
+        // Page configuration table - scoped by app_id, not organisation_id
+        "rbac_global_roles"
+        // Global roles - no organisation scope
+      ];
+      if (tablesWithoutOrganisationId.includes(tableName)) {
+        return originalInsert(values);
+      }
+      if (tableName === "rbac_user_profiles") {
+        if (this.isSuperAdmin) {
+          return originalInsert(values);
+        }
+        if (!this.organisationId) {
+          throw new OrganisationContextRequiredError();
+        }
+        const contextValues2 = Array.isArray(values) ? values.map((v) => ({ ...v, organisation_id: this.organisationId })) : { ...values, organisation_id: this.organisationId };
+        return originalInsert(contextValues2);
+      }
+      if (this.isSuperAdmin && !this.organisationId) {
+        return originalInsert(values);
+      }
+      if (!this.organisationId) {
+        throw new OrganisationContextRequiredError();
+      }
+      const contextValues = Array.isArray(values) ? values.map((v) => ({ ...v, organisation_id: this.organisationId })) : { ...values, organisation_id: this.organisationId };
+      return originalInsert(contextValues);
+    };
+    queryBuilder.update = (values) => {
+      const result = originalUpdate(values);
+      return this.addOrganisationFilter(result, tableName);
+    };
+    queryBuilder.delete = () => {
+      const result = originalDelete();
+      return this.addOrganisationFilter(result, tableName);
+    };
+    return query;
+  }
+  /**
+   * Add organisation filter to a query
+   * 
+   * Defense in depth strategy:
+   * - RLS policies are the primary security layer (cannot be bypassed)
+   * - Application-level filtering adds an additional layer of protection
+   * 
+   * For rbac_user_profiles:
+   * - Super admins: No org filter (see all users) - RLS will allow access
+   * - Non-super-admins: Apply org filter as defense in depth - RLS will also filter
+   * 
+   * For system-wide tables (like core_organisations):
+   * - Super admins: No org filter (see all records) - RLS will allow access
+   * - Non-super-admins: Apply org filter as defense in depth - RLS will also filter
+   * 
+   * For other tables:
+   * - Always apply org filter unless super admin bypasses it
+   */
+  addOrganisationFilter(query, tableName) {
+    const tablesWithoutOrganisationId = [
+      "core_organisations",
+      // Organisation table itself - uses 'id' as primary key
+      "rbac_apps",
+      // App configuration table - no organisation scope
+      "rbac_app_pages",
+      // Page configuration table - scoped by app_id, not organisation_id
+      "rbac_global_roles",
+      // Global roles - no organisation scope
+      // Person-scoped tables (organisation_id was removed in person-scoped profiles migration)
+      "core_person",
+      // Person records - person-scoped, no organisation_id
+      "core_member",
+      // Member profiles - person-scoped, no organisation_id
+      "core_contact",
+      // Contact profiles - person-scoped, no organisation_id
+      "core_consent",
+      // Consent records - person-scoped, no organisation_id
+      "core_identification",
+      // Identification records - person-scoped, no organisation_id
+      "core_qualification",
+      // Qualification records - person-scoped, no organisation_id
+      "medi_profile",
+      // Medical profiles - person-scoped, no organisation_id
+      "medi_condition",
+      // Medical conditions - person-scoped via medi_profile, no organisation_id
+      "medi_diet",
+      // Medical diets - person-scoped via medi_profile, no organisation_id
+      "medi_action_plan",
+      // Medical action plans - person-scoped via medi_profile, no organisation_id
+      "medi_profile_versions"
+      // Medical profile versions - person-scoped via medi_profile, no organisation_id
+    ];
+    if (tablesWithoutOrganisationId.includes(tableName)) {
+      return query;
+    }
+    if (!this.organisationId) {
+      return query;
+    }
+    const systemWideTablesForSuperAdmins = [
+      "core_organisations"
+      // Super-admins need to see all organisations
+    ];
+    if (systemWideTablesForSuperAdmins.includes(tableName) && this.isSuperAdmin) {
+      return query;
+    }
+    if (tableName === "rbac_user_profiles") {
+      if (this.isSuperAdmin) {
+        return query;
+      }
+      const queryBuilder2 = query;
+      return queryBuilder2.or(`organisation_id.eq.${this.organisationId},organisation_id.is.null`);
+    }
+    const queryBuilder = query;
+    if (this.isSuperAdmin) {
+      return queryBuilder.eq("organisation_id", this.organisationId);
+    }
+    return queryBuilder.eq("organisation_id", this.organisationId);
+  }
+  /**
+   * Validate that required context is present
+   * Super-admins can operate without organisation context
+   */
+  validateContext() {
+    if (this.isSuperAdmin) {
+      return;
+    }
+    if (!this.organisationId) {
+      throw new OrganisationContextRequiredError();
+    }
+  }
+  /**
+   * Determine whether a table requires organisation context.
+   * Tables without an organisation_id column (or global configuration tables) are safe without org context.
+   */
+  tableRequiresOrganisationContext(tableName) {
+    const tablesWithoutOrganisationId = /* @__PURE__ */ new Set([
+      "core_organisations",
+      "rbac_apps",
+      "rbac_app_pages",
+      "rbac_global_roles",
+      "core_person",
+      "core_member",
+      "core_contact",
+      "core_consent",
+      "core_identification",
+      "core_qualification",
+      "medi_profile",
+      "medi_condition",
+      "medi_diet",
+      "medi_action_plan",
+      "medi_profile_versions"
+    ]);
+    return !tablesWithoutOrganisationId.has(tableName);
+  }
+  /**
+   * Validate context for a specific table operation.
+   */
+  validateContextForTable(tableName) {
+    if (this.isSuperAdmin) return;
+    if (!this.organisationId && this.tableRequiresOrganisationContext(tableName)) {
+      throw new OrganisationContextRequiredError();
+    }
+  }
+  /**
+   * Validate context for a specific RPC call.
+   */
+  validateContextForRpc(fn) {
+    if (this.isSuperAdmin) return;
+    if (_SecureSupabaseClient.GLOBAL_RPC_ALLOWLIST.has(fn)) return;
+    this.validateContext();
+  }
+  /**
+   * Get the current organisation ID
+   */
+  getOrganisationId() {
+    return this.organisationId;
+  }
+  /**
+   * Get the current event ID
+   */
+  getEventId() {
+    return this.eventId;
+  }
+  /**
+   * Get the current app ID
+   */
+  getAppId() {
+    return this.appId;
+  }
+  /**
+   * Create a new client with updated context
+   */
+  withContext(updates) {
+    return new _SecureSupabaseClient(
+      this.supabaseUrl,
+      this.supabaseKey,
+      updates.organisationId !== void 0 ? updates.organisationId : this.organisationId,
+      updates.eventId !== void 0 ? updates.eventId : this.eventId,
+      updates.appId !== void 0 ? updates.appId : this.appId,
+      updates.isSuperAdmin !== void 0 ? updates.isSuperAdmin : this.isSuperAdmin
+    );
+  }
+  /**
+   * Get the underlying Supabase client (for internal use only)
+   * @internal
+   */
+  getClient() {
+    const proxiedClient = new Proxy(this.supabase, {
+      get: (target, prop) => {
+        if (prop === "functions" && this.edgeFunctionClient) {
+          return this.edgeFunctionClient.functions;
+        }
+        if (typeof prop === "string") {
+          return target[prop];
+        }
+        return Reflect.get(target, prop);
+      }
+    });
+    markClientAsSecure(proxiedClient);
+    return proxiedClient;
+  }
+  /**
+   * Get the set of parameter names that an RPC function accepts.
+   * Uses a static whitelist of RPCs that we know accept context parameters.
+   * 
+   * This is an opt-in approach: by default, we don't inject context unless
+   * the function is explicitly whitelisted. This prevents PGRST202 errors from
+   * injecting unexpected parameters.
+   * 
+   * @param fn - The RPC function name
+   * @returns Set of parameter names the function accepts
+   */
+  getRpcAcceptedParams(fn) {
+    if (_SecureSupabaseClient.rpcSignatureCache.has(fn)) {
+      return _SecureSupabaseClient.rpcSignatureCache.get(fn);
+    }
+    const rpcContextWhitelist = {
+      // Only inject p_organisation_id for data_rbac_roles_list. Do NOT inject p_event_id/p_app_id:
+      // when editing a user we need all event-app roles for that user; injecting current event/app
+      // would filter to a single event-app and show only one role instead of all (e.g. 3).
+      "data_rbac_roles_list": /* @__PURE__ */ new Set(["p_organisation_id"]),
+      // RPCs that accept only p_organisation_id (not p_app_id or p_event_id)
+      "data_file_reference_by_category_list": /* @__PURE__ */ new Set(["p_organisation_id"])
+      // Add more RPCs here as we discover them
+      // Format: 'function_name': new Set(['p_organisation_id', 'p_event_id', 'p_app_id']),
+    };
+    const acceptedParams = rpcContextWhitelist[fn] || /* @__PURE__ */ new Set();
+    _SecureSupabaseClient.rpcSignatureCache.set(fn, acceptedParams);
+    return acceptedParams;
+  }
+};
+// Cache for RPC function signatures to avoid repeated database queries
+// Maps function name -> Set of parameter names it accepts
+_SecureSupabaseClient.rpcSignatureCache = /* @__PURE__ */ new Map();
+/**
+ * RPC functions that are safe to call without organisation context.
+ *
+ * These functions must:
+ * - rely on JWT context (auth.uid()) for authentication
+ * - not read or write organisation-scoped data
+ *
+ * This allowlist enables compliant consuming apps to use `secureSupabase.rpc(...)`
+ * even before an organisation is selected (common during initial page load/refresh).
+ *
+ * IMPORTANT: Do NOT add `data_rbac_roles_list` here. Only super admins may call
+ * that RPC without org context (e.g. "All Organizations" / event roles). The
+ * org check is skipped in validateContextForRpc when isSuperAdmin is true.
+ */
+_SecureSupabaseClient.GLOBAL_RPC_ALLOWLIST = /* @__PURE__ */ new Set([
+  "data_rbac_apps_list"
+]);
+var SecureSupabaseClient = _SecureSupabaseClient;
+function createSecureClient(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin = false) {
+  return new SecureSupabaseClient(supabaseUrl, supabaseKey, organisationId, eventId, appId, isSuperAdmin);
+}
+function fromSupabaseClient(client, organisationId, eventId, appId, isSuperAdmin = false) {
+  return new SecureSupabaseClient("", "", organisationId, eventId, appId, isSuperAdmin, client);
+}
+function AccessDenied({
+  message,
+  resource,
+  operation,
+  onGoBack,
+  onSignOut,
+  className = "",
+  showSignOut = false
+}) {
+  const defaultMessage = message || (resource && operation ? `You don't have permission to ${operation} ${resource}.` : "You don't have permission to access this page.");
+  const handleGoBack = () => {
+    if (onGoBack) {
+      onGoBack();
+    } else {
+      window.history.back();
+    }
+  };
+  const handleSignOut = () => {
+    if (onSignOut) {
+      onSignOut();
+    }
+  };
+  return /* @__PURE__ */ jsxs(Card, { className: ` text-center ${className}`, children: [
+    /* @__PURE__ */ jsxs(CardHeader, { children: [
+      /* @__PURE__ */ jsx(ShieldX, { className: "size-16 text-acc-500", "aria-hidden": "true" }),
+      /* @__PURE__ */ jsx(CardTitle, { children: "Access Denied" })
+    ] }),
+    /* @__PURE__ */ jsx(CardDescription, { children: defaultMessage }),
+    /* @__PURE__ */ jsxs(CardFooter, { children: [
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          onClick: handleGoBack,
+          variant: "default",
+          "aria-label": "Go back to previous page",
+          className: "inline-block mr-2",
+          children: "Go Back"
+        }
+      ),
+      showSignOut && onSignOut && /* @__PURE__ */ jsx(
+        Button,
+        {
+          onClick: handleSignOut,
+          variant: "outline",
+          "aria-label": "Sign out of your account",
+          className: "inline-block mr-2",
+          children: "Sign Out"
+        }
+      )
+    ] })
+  ] });
+}
+function mapAccessLevelToEventRole(level) {
+  switch (level) {
+    case "viewer":
+      return "viewer";
+    case "participant":
+      return "participant";
+    case "planner":
+      return "planner";
+    case "admin":
+    case "super":
+      return "event_admin";
+    default:
+      return null;
+  }
+}
+async function resolveAppIdForRBAC(userId, appName, contextAppId, options) {
+  if (!appName || contextAppId) {
+    return { appId: contextAppId, shouldRetry: false };
+  }
+  try {
+    const resolvedResult = await resolveAppContext({ userId, appName });
+    if (!resolvedResult.ok) {
+      throw new Error(resolvedResult.error.message);
+    }
+    const resolved = resolvedResult.data;
+    if (!resolved) {
+      if (appName === "PORTAL" || appName === "ADMIN") {
+        return { appId: contextAppId, shouldRetry: false };
+      }
+      throw new Error(`User does not have access to app "${appName}"`);
+    }
+    if (!resolved.hasAccess && appName !== "PORTAL" && appName !== "ADMIN") {
+      throw new Error(`User does not have access to app "${appName}"`);
+    }
+    return { appId: resolved.appId, shouldRetry: false };
+  } catch (rpcError) {
+    const errorMessage = rpcError instanceof Error ? rpcError.message : String(rpcError);
+    if (errorMessage.includes("NetworkError") || errorMessage.includes("fetch")) {
+      options.logger.warn("[useRBAC] NetworkError resolving app context - may be timing issue, will retry when context is ready", {
+        appName,
+        error: errorMessage,
+        eventLoading: options.eventLoading,
+        hasSelectedEvent: options.hasSelectedEvent
+      });
+      return { appId: void 0, shouldRetry: true };
+    }
+    if (appName === "PORTAL" || appName === "ADMIN") {
+      return { appId: contextAppId, shouldRetry: false };
+    }
+    throw rpcError;
+  }
+}
+async function resolveScopeForRBAC(params) {
+  const { initialScope, appId, contextAppId, pageId, appName, supabase, logger: logger2 } = params;
+  const scope = {
+    ...initialScope,
+    appId: appId || contextAppId
+  };
+  let pageScopeType = "organisation";
+  if (pageId && scope.appId) {
+    const scopeTypeResult = await getPageScopeType(pageId, scope.appId, appName);
+    if (scopeTypeResult.ok) {
+      pageScopeType = scopeTypeResult.data;
+    } else {
+      logger2.warn("[useRBAC] Failed to get page scope type, defaulting to organisation", {
+        pageId,
+        error: scopeTypeResult.error.message
+      });
+    }
+  }
+  const validation = await ContextValidator.resolveScopeForPage(
+    scope,
+    pageScopeType,
+    appName,
+    supabase ?? null
+  );
+  if (!validation.isValid || !validation.resolvedScope) {
+    throw validation.error || new Error("Context validation failed");
+  }
+  return validation.resolvedScope;
+}
+async function fetchRBACContextData(userId, resolvedScope, appName) {
+  const [mapResult, roleResult, accessResult] = await Promise.all([
+    getPermissionMap({ userId, scope: resolvedScope }, appName),
+    getRoleContext({ userId, scope: resolvedScope }, appName),
+    getAccessLevel({ userId, scope: resolvedScope }, appName)
+  ]);
+  if (!mapResult.ok) {
+    throw new Error(mapResult.error.message);
+  }
+  if (!roleResult.ok) {
+    throw new Error(roleResult.error.message);
+  }
+  if (!accessResult.ok) {
+    throw new Error(accessResult.error.message);
+  }
+  return {
+    map: mapResult.data,
+    roleContext: roleResult.data,
+    accessLevel: accessResult.data
+  };
+}
+function useRBAC(pageId) {
+  const logger2 = getRBACLogger();
+  const {
+    user,
+    session,
+    supabase,
+    appName,
+    appId: contextAppId,
+    selectedOrganisation,
+    isContextReady: orgContextReady,
+    organisationLoading: orgLoading,
+    selectedEvent,
+    eventLoading
+  } = useUnifiedAuth();
+  const [globalRole, setGlobalRole] = useState(null);
+  const [organisationRole, setOrganisationRole] = useState(null);
+  const [eventAppRole, setEventAppRole] = useState(null);
+  const [permissionMap, setPermissionMap] = useState({});
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState(null);
+  const resetState = useCallback(() => {
+    setGlobalRole(null);
+    setOrganisationRole(null);
+    setEventAppRole(null);
+    setPermissionMap({});
+  }, []);
+  const loadRBACContext = useCallback(async () => {
+    if (!user || !session) {
+      resetState();
+      setIsLoading(false);
+      return;
+    }
+    const initialScope = {
+      organisationId: selectedEvent?.organisation_id || selectedOrganisation?.id || void 0,
+      eventId: selectedEvent?.event_id || void 0,
+      appId: void 0
+    };
+    if (appName !== "PORTAL" && appName !== "ADMIN") {
+      if (!selectedOrganisation && !selectedEvent) {
+        setIsLoading(true);
+        return;
+      }
+    }
+    setIsLoading(true);
+    setError(null);
+    try {
+      const { appId, shouldRetry } = await resolveAppIdForRBAC(
+        user.id,
+        appName,
+        contextAppId,
+        { logger: logger2, eventLoading, hasSelectedEvent: !!selectedEvent }
+      );
+      if (shouldRetry) {
+        setIsLoading(false);
+        return;
+      }
+      const resolvedScope = await resolveScopeForRBAC({
+        initialScope,
+        appId,
+        contextAppId,
+        pageId,
+        appName,
+        supabase,
+        logger: logger2
+      });
+      const { map, roleContext, accessLevel } = await fetchRBACContextData(
+        user.id,
+        resolvedScope,
+        appName
+      );
+      setPermissionMap(map);
+      setGlobalRole(roleContext.globalRole);
+      setOrganisationRole(roleContext.organisationRole);
+      setEventAppRole(roleContext.eventAppRole || mapAccessLevelToEventRole(accessLevel));
+      const permissionCount = Object.keys(map).length;
+      if (permissionCount === 0) {
+        logger2.warn("[useRBAC] RBAC context loaded but returned 0 permissions", {
+          appName,
+          organisationId: resolvedScope.organisationId,
+          eventId: resolvedScope.eventId
+        });
+      }
+    } catch (err) {
+      const handledError = err instanceof Error ? err : new Error("Failed to load RBAC context");
+      logger2.error("[useRBAC] Error loading RBAC context:", handledError);
+      setError(handledError);
+      resetState();
+    } finally {
+      setIsLoading(false);
+    }
+  }, [appName, logger2, resetState, selectedEvent, selectedOrganisation, session, user, eventLoading, contextAppId, pageId, supabase]);
+  const hasGlobalPermission = useCallback(
+    (permission) => {
+      if (globalRole === "super_admin" || permissionMap["*"]) {
+        return true;
+      }
+      if (permission === "super_admin") {
+        return globalRole === "super_admin";
+      }
+      if (permission === "org_admin") {
+        return organisationRole === "org_admin";
+      }
+      return permissionMap[permission] === true;
+    },
+    [globalRole, organisationRole, permissionMap]
+  );
+  const isSuperAdmin = useMemo(() => globalRole === "super_admin" || permissionMap["*"] === true, [globalRole, permissionMap]);
+  const isOrgAdmin = useMemo(() => organisationRole === "org_admin" || isSuperAdmin, [organisationRole, isSuperAdmin]);
+  const isEventAdmin = useMemo(() => eventAppRole === "event_admin" || isSuperAdmin, [eventAppRole, isSuperAdmin]);
+  const canManageOrganisation = useMemo(() => isSuperAdmin || organisationRole === "org_admin", [isSuperAdmin, organisationRole]);
+  const canManageEvent = useMemo(() => isSuperAdmin || eventAppRole === "event_admin", [isSuperAdmin, eventAppRole]);
+  useEffect(() => {
+    loadRBACContext();
+  }, [loadRBACContext, appName, eventLoading, selectedEvent?.event_id, user, session, selectedOrganisation?.id, orgContextReady, orgLoading]);
+  return {
+    user,
+    globalRole,
+    organisationRole,
+    eventAppRole,
+    hasGlobalPermission,
+    isSuperAdmin,
+    isOrgAdmin,
+    isEventAdmin,
+    canManageOrganisation,
+    canManageEvent,
+    isLoading,
+    error
+  };
+}
+var secureClientCache = /* @__PURE__ */ new Map();
+var MAX_CACHE_SIZE = 5;
+function getCacheKey(organisationId, eventId, appId, isSuperAdmin) {
+  return `${organisationId || "no-org"}-${eventId || "no-event"}-${appId || "no-app"}-${isSuperAdmin ? "super" : "regular"}`;
+}
+function getSupabaseConfig() {
+  const getEnvVar = (key) => {
+    if (typeof import.meta !== "undefined" && import.meta.env) {
+      const env = import.meta.env;
+      return env[key];
+    }
+    if (typeof process !== "undefined" && process.env) {
+      return process.env[key];
+    }
+    return void 0;
+  };
+  const supabaseUrl = getEnvVar("VITE_SUPABASE_URL") || getEnvVar("NEXT_PUBLIC_SUPABASE_URL") || null;
+  const supabaseKey = getEnvVar("VITE_SUPABASE_PUBLISHABLE_KEY") || getEnvVar("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY") || null;
+  if (!supabaseUrl || !supabaseKey) {
+    return null;
+  }
+  return { url: supabaseUrl, key: supabaseKey };
+}
+function useSecureSupabase(baseClient) {
+  const { user, supabase: authSupabase } = useUnifiedAuth();
+  const { selectedOrganisation } = useOrganisations();
+  const eventsContext = useEvents();
+  const { selectedEvent } = eventsContext;
+  const organisationId = useMemo(
+    () => selectedOrganisation?.id ?? selectedEvent?.organisation_id ?? void 0,
+    [selectedOrganisation?.id, selectedEvent]
+  );
+  const { superAdminContext } = useOrganisationSecurity();
+  const isSuperAdmin = superAdminContext.isSuperAdmin;
+  const { resolvedScope } = useResolvedScope({
+    supabase: authSupabase || null,
+    selectedOrganisationId: organisationId ?? null,
+    selectedEventId: selectedEvent?.event_id || null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id || null
+  });
+  const prevContextRef = useRef({
+    organisationId: void 0,
+    eventId: void 0,
+    appId: void 0
+  });
+  return useMemo(() => {
+    const organisationId2 = resolvedScope?.organisationId;
+    const eventId = resolvedScope?.eventId || selectedEvent?.event_id;
+    const appId = resolvedScope?.appId;
+    const canCreateSecureClient = user?.id && (isSuperAdmin || organisationId2);
+    if (canCreateSecureClient) {
+      prevContextRef.current = { organisationId: organisationId2, eventId, appId };
+      const cacheKey = getCacheKey(organisationId2, eventId, appId, isSuperAdmin);
+      const cachedClient = secureClientCache.get(cacheKey);
+      if (cachedClient) {
+        return cachedClient.getClient();
+      }
+      const config = getSupabaseConfig();
+      if (!config || !config.url || !config.key) {
+        logger.warn("useSecureSupabase", "Missing Supabase environment variables. Falling back to base client.", {
+          note: "Ensure VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY are set in your environment."
+        });
+        return baseClient || authSupabase || null;
+      }
+      try {
+        const effectiveOrganisationId = isSuperAdmin ? organisationId2 || null : organisationId2;
+        const baseForSecureClient = baseClient || authSupabase || null;
+        const secureClient = baseForSecureClient ? fromSupabaseClient(
+          baseForSecureClient,
+          effectiveOrganisationId ?? null,
+          eventId,
+          appId,
+          isSuperAdmin
+        ) : createSecureClient(
+          config.url,
+          config.key,
+          effectiveOrganisationId ?? null,
+          eventId,
+          appId,
+          isSuperAdmin
+          // Pass super admin status for conditional filtering
+        );
+        secureClientCache.set(cacheKey, secureClient);
+        if (secureClientCache.size > MAX_CACHE_SIZE) {
+          const firstKey = secureClientCache.keys().next().value;
+          if (firstKey) {
+            secureClientCache.delete(firstKey);
+          }
+        }
+        return secureClient.getClient();
+      } catch (error) {
+        logger.error("useSecureSupabase", "Failed to create secure client", error);
+        return baseClient || authSupabase || null;
+      }
+    }
+    return baseClient || authSupabase || null;
+  }, [
+    resolvedScope?.organisationId,
+    resolvedScope?.eventId,
+    resolvedScope?.appId,
+    selectedEvent?.event_id,
+    user?.id,
+    isSuperAdmin,
+    baseClient,
+    authSupabase
+  ]);
+}
+
+export { AccessDenied, SECURE_CLIENT_SYMBOL, SecureSupabaseClient, createSecureClient, fromSupabaseClient, isSecureClient, useRBAC, useSecureSupabase, warnIfInsecureClient };