@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/hooks/usePermissionCache.test.ts

@@ -1,191 +1,204 @@
 /**
- * @file Permission Cache Hook Tests
+ * @file usePermissionCache Hook Tests
  * @package @jmruthers/pace-core
- * @module Hooks/usePermissionCache
+ * @module Hooks
  * @since 0.3.0
- * 
- * Comprehensive tests for the usePermissionCache hook covering all critical functionality.
+ *
+ * Comprehensive tests for the usePermissionCache hook covering caching, permission checking,
+ * audit trails, debug information, and edge cases.
  */
 
 import { renderHook, act } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { usePermissionCache } from './usePermissionCache';
 
-// Mock the dependencies
+// Mock dependencies
 const mockUseUnifiedAuthFn = vi.fn();
 vi.mock('../providers/services/UnifiedAuthProvider', () => ({
   useUnifiedAuth: () => mockUseUnifiedAuthFn(),
 }));
 
+const mockUseOrganisations = vi.fn();
 vi.mock('./useOrganisations', () => ({
-  useOrganisations: vi.fn()
+  useOrganisations: () => mockUseOrganisations(),
 }));
 
+const mockUseEvents = vi.fn();
 vi.mock('./useEvents', () => ({
-  useEvents: vi.fn()
+  useEvents: () => mockUseEvents(),
 }));
 
+// Hoist so mock applies to same module usePermissionCache imports (../rbac/api from hooks/)
+const mockIsPermittedCached = vi.hoisted(() => vi.fn().mockResolvedValue({ ok: true, data: true }));
 vi.mock('../rbac/api', () => ({
-  isPermittedCached: vi.fn()
+  isPermittedCached: mockIsPermittedCached,
 }));
 
 const loggerSpy = vi.hoisted(() => ({
   warn: vi.fn(),
-  error: vi.fn()
+  error: vi.fn(),
 }));
 
 vi.mock('../utils/core/logger', () => ({
   logger: loggerSpy,
-  createLogger: () => loggerSpy
+  createLogger: () => loggerSpy,
 }));
 
-import { useUnifiedAuth } from '../providers/services/UnifiedAuthProvider';
-import { useOrganisations } from './useOrganisations';
-import { useEvents } from './useEvents';
-import { isPermittedCached } from '../rbac/api';
-
-const mockUseOrganisations = vi.mocked(useOrganisations);
-const mockUseEvents = vi.mocked(useEvents);
-const mockIsPermittedCached = vi.mocked(isPermittedCached);
-
 describe('usePermissionCache', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.setSystemTime(0);
 
-    // Setup default mocks
     mockUseUnifiedAuthFn.mockReturnValue({
       user: { id: 'user-123' },
       session: null,
       appName: 'test-app',
       selectedOrganisationId: 'org-123',
-      selectedEventId: undefined
+      selectedEventId: undefined,
     } as any);
 
     mockUseOrganisations.mockReturnValue({
-      selectedOrganisation: { id: 'org-123' }
+      selectedOrganisation: { id: 'org-123' },
     } as any);
 
     mockUseEvents.mockReturnValue({
-      selectedEvent: null
+      selectedEvent: null,
     } as any);
 
-    mockIsPermittedCached.mockResolvedValue(true);
+    mockIsPermittedCached.mockResolvedValue({ ok: true, data: true });
   });
 
-  describe('Hook Initialization', () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.clearAllMocks();
+  });
+
+  describe('Initialization', () => {
     it('initializes with default configuration', () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      expect(result.current).toBeDefined();
-      expect(result.current.checkPermission).toBeInstanceOf(Function);
-      expect(result.current.checkMultiplePermissions).toBeInstanceOf(Function);
-      expect(result.current.getCachedPermissions).toBeInstanceOf(Function);
-      expect(result.current.invalidateCache).toBeInstanceOf(Function);
-      expect(result.current.getDebugInfo).toBeDefined();
+      expect(result.current).toHaveProperty('checkPermission');
+      expect(result.current).toHaveProperty('checkMultiplePermissions');
+      expect(result.current).toHaveProperty('getCachedPermissions');
+      expect(result.current).toHaveProperty('invalidateCache');
+      expect(result.current).toHaveProperty('getDebugInfo');
+      expect(result.current).toHaveProperty('getAuditTrail');
     });
 
-    it('initializes with custom configuration', () => {
+    it('merges custom configuration with defaults', () => {
       const customConfig = {
         defaultTTL: 10000,
         maxCacheSize: 500,
         enableLogging: true,
-        enableAuditTrail: false
+        enableAuditTrail: false,
       };
 
       const { result } = renderHook(() => usePermissionCache(customConfig));
 
-      expect(result.current).toBeDefined();
+      expect(result.current).toHaveProperty('checkPermission');
       expect(result.current.getDebugInfo).toBeDefined();
     });
-
-    it('depends on auth and organisation hooks', () => {
-      renderHook(() => usePermissionCache());
-      expect(mockUseUnifiedAuthFn).toHaveBeenCalled();
-      expect(mockUseOrganisations).toHaveBeenCalled();
-    });
   });
 
-  describe('Permission Checking', () => {
-    it('checks single permission and caches result', async () => {
+  describe('Single Permission Checking', () => {
+    it('checks permission and caches result', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      const hasPermission = await result.current.checkPermission('read', 'users');
+      const hasPermission = await result.current.checkPermission('read', 'dashboard');
+
       expect(hasPermission).toBe(true);
       expect(mockIsPermittedCached).toHaveBeenCalledWith(
         expect.objectContaining({
           userId: 'user-123',
           scope: expect.objectContaining({ organisationId: 'org-123' }),
-          permission: 'read:page.users',
-          pageId: 'users'
+          permission: 'read:page.dashboard',
+          pageId: 'dashboard',
         })
       );
-
-      // Check that result is cached
-      const cachedResult = await result.current.checkPermission('read', 'users');
-      expect(cachedResult).toBe(true);
     });
 
-    it('checks multiple permissions in batch', async () => {
+    it('returns cached result for subsequent calls', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      const permissions = [
-        ['read', 'users'],
-        ['create', 'users'],
-        ['update', 'users'],
-        ['delete', 'users']
-      ];
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('read', 'dashboard');
 
-      const results = await result.current.checkMultiplePermissions(permissions);
-      expect(results).toHaveLength(4);
-      expect(results.every(r => r.hasPermission)).toBe(true);
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(1);
     });
 
-    it('handles empty permission arrays gracefully', async () => {
-      const { result } = renderHook(() => usePermissionCache());
+    it('respects custom TTL', async () => {
+      const { result } = renderHook(() => usePermissionCache({ defaultTTL: 1000 }));
 
-      const results = await result.current.checkMultiplePermissions([]);
+      await result.current.checkPermission('read', 'dashboard', 2000);
 
-      expect(results).toEqual([]);
-      expect(mockIsPermittedCached).not.toHaveBeenCalled();
-      expect(loggerSpy.warn).toHaveBeenCalled();
+      expect(mockIsPermittedCached).toHaveBeenCalled();
     });
 
     it('handles permission check errors gracefully', async () => {
-      mockIsPermittedCached.mockRejectedValueOnce(new Error('Permission check failed'));
+      mockIsPermittedCached.mockRejectedValueOnce(new Error('Database error'));
 
       const { result } = renderHook(() => usePermissionCache());
 
-      const hasPermission = await result.current.checkPermission('read', 'users');
-      expect(hasPermission).toBe(false);
+      const permission = await result.current.checkPermission('read', 'dashboard');
+
+      expect(permission).toBe(false);
       expect(loggerSpy.error).toHaveBeenCalled();
     });
 
-    it('handles missing user context gracefully', () => {
+    it('handles missing user context', async () => {
       mockUseUnifiedAuthFn.mockReturnValueOnce({
         user: null,
         session: null,
-        appName: 'test-app',
-        selectedOrganisationId: undefined,
-        selectedEventId: undefined
       } as any);
 
       const { result } = renderHook(() => usePermissionCache());
 
-      expect(result.current).toBeDefined();
-      expect(result.current.checkPermission).toBeInstanceOf(Function);
+      const permission = await result.current.checkPermission('read', 'dashboard');
+
+      expect(permission).toBe(false);
+      expect(loggerSpy.warn).toHaveBeenCalled();
+    });
+
+    it('handles missing organisation context', async () => {
+      mockUseOrganisations.mockReturnValueOnce({
+        selectedOrganisation: null,
+      } as any);
+
+      const { result } = renderHook(() => usePermissionCache());
+
+      const permission = await result.current.checkPermission('read', 'dashboard');
+
+      expect(permission).toBe(false);
+      expect(loggerSpy.warn).toHaveBeenCalled();
+    });
+
+    it('handles invalid parameters', async () => {
+      const { result } = renderHook(() => usePermissionCache());
+
+      const permission1 = await result.current.checkPermission('' as any, 'dashboard');
+      const permission2 = await result.current.checkPermission('read', '');
+
+      expect(permission1).toBe(false);
+      expect(permission2).toBe(false);
+      expect(loggerSpy.warn).toHaveBeenCalled();
     });
 
     it('deduplicates concurrent permission checks', async () => {
-      mockIsPermittedCached.mockImplementation(
-        () => new Promise(resolve => setTimeout(() => resolve(true), 50))
-      );
+      let resolveFn: (value: { ok: true; data: boolean }) => void;
+      const promise = new Promise<{ ok: true; data: boolean }>((resolve) => {
+        resolveFn = resolve;
+      });
+      mockIsPermittedCached.mockImplementation(() => promise);
 
       const { result } = renderHook(() => usePermissionCache());
 
-      const [first, second] = await Promise.all([
-        result.current.checkPermission('read', 'users'),
-        result.current.checkPermission('read', 'users')
-      ]);
+      const promise1 = result.current.checkPermission('read', 'dashboard');
+      const promise2 = result.current.checkPermission('read', 'dashboard');
+
+      resolveFn!({ ok: true, data: true });
+
+      const [first, second] = await Promise.all([promise1, promise2]);
 
       expect(first).toBe(true);
       expect(second).toBe(true);
@@ -193,344 +206,300 @@ describe('usePermissionCache', () => {
     });
   });
 
-  describe('Cache Management', () => {
-    it('caches permission results with TTL', async () => {
+  describe('Multiple Permission Checking', () => {
+    it('checks multiple permissions efficiently', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false })
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false });
+
       const { result } = renderHook(() => usePermissionCache());
 
-      // First check
-      await result.current.checkPermission('read', 'users');
-      
-      // Second check should use cache
-      await result.current.checkPermission('read', 'users');
-      
-      expect(mockIsPermittedCached).toHaveBeenCalledTimes(1);
+      const permissions = await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+        ['update', 'dashboard'],
+        ['delete', 'dashboard'],
+      ]);
+
+      expect(permissions).toHaveLength(4);
+      expect(permissions[0]).toEqual({
+        operation: 'read',
+        pageId: 'dashboard',
+        hasPermission: true,
+        cached: false,
+        timestamp: expect.any(Number),
+      });
+      expect(permissions[1]).toEqual({
+        operation: 'create',
+        pageId: 'dashboard',
+        hasPermission: false,
+        cached: false,
+        timestamp: expect.any(Number),
+      });
     });
 
-    it('expires cached results after TTL', async () => {
-      const { result } = renderHook(() => usePermissionCache({
-        defaultTTL: 100 // 100ms TTL
-      }));
+    it('uses cached results for multiple permission checks', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false });
+
+      const { result } = renderHook(() => usePermissionCache());
+
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+      ]);
+
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+      ]);
 
-      // First check
-      await result.current.checkPermission('read', 'users');
-      
-      // Wait for TTL to expire
-      await new Promise(resolve => setTimeout(resolve, 150));
-      
-      // Second check should not use cache
-      await result.current.checkPermission('read', 'users');
-      
       expect(mockIsPermittedCached).toHaveBeenCalledTimes(2);
     });
 
-    it('invalidates cache correctly', async () => {
+    it('handles mixed cached and uncached permissions', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false)
+        .mockResolvedValueOnce(true)
+        .mockResolvedValueOnce(false);
+
       const { result } = renderHook(() => usePermissionCache());
 
-      // Check permission
-      await result.current.checkPermission('read', 'users');
-      
-      // Invalidate cache
-      result.current.invalidateCache();
-      
-      // Check again - should not use cache
-      await result.current.checkPermission('read', 'users');
+      await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+      ]);
 
-      expect(mockIsPermittedCached).toHaveBeenCalledTimes(2);
+      const permissions = await result.current.checkMultiplePermissions([
+        ['read', 'dashboard'],
+        ['create', 'dashboard'],
+        ['update', 'dashboard'],
+        ['delete', 'dashboard'],
+      ]);
+
+      expect(permissions[0].cached).toBe(true);
+      expect(permissions[1].cached).toBe(true);
+      expect(permissions[2].cached).toBe(false);
+      expect(permissions[3].cached).toBe(false);
     });
 
-    it('invalidates cache entries by pattern', async () => {
+    it('handles empty permission arrays', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      await result.current.checkPermission('read', 'dashboard');
-      await result.current.checkPermission('read', 'admin');
+      const permissions = await result.current.checkMultiplePermissions([]);
 
-      result.current.invalidateCache('dashboard');
+      expect(permissions).toHaveLength(0);
+      expect(mockIsPermittedCached).not.toHaveBeenCalled();
+      expect(loggerSpy.warn).toHaveBeenCalled();
+    });
 
-      await result.current.checkPermission('read', 'dashboard');
+    it('handles invalid permission arrays', async () => {
+      const { result } = renderHook(() => usePermissionCache());
 
-      expect(mockIsPermittedCached).toHaveBeenCalledTimes(3);
+      const permissions1 = await result.current.checkMultiplePermissions(null as any);
+      const permissions2 = await result.current.checkMultiplePermissions('invalid' as any);
+
+      expect(permissions1).toEqual([]);
+      expect(permissions2).toEqual([]);
+      expect(loggerSpy.warn).toHaveBeenCalled();
     });
+  });
 
-    it('respects max cache size', async () => {
-      const { result } = renderHook(() => usePermissionCache({
-        maxCacheSize: 2
-      }));
+  describe('Cache Management', () => {
+    it('enforces maximum cache size', async () => {
+      const { result } = renderHook(() => usePermissionCache({ maxCacheSize: 3 }));
+
+      await result.current.checkPermission('read', 'page1');
+      await result.current.checkPermission('read', 'page2');
+      await result.current.checkPermission('read', 'page3');
+      await result.current.checkPermission('read', 'page4');
+      await result.current.checkPermission('read', 'page5');
 
-      // Fill cache beyond max size
-      await result.current.checkPermission('read', 'users');
-      await result.current.checkPermission('create', 'users');
-      await result.current.checkPermission('update', 'users');
-      await result.current.checkPermission('delete', 'users');
-      
-      // Check that cache size is respected
       const debugInfo = result.current.getDebugInfo();
-      expect(debugInfo.cacheSize).toBeLessThanOrEqual(2);
+      expect(debugInfo.cacheSize).toBeLessThanOrEqual(3);
     });
-  });
 
-  describe('Debug Information', () => {
-    it('provides debug information', () => {
+    it('invalidates all cache entries', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      const debugInfo = result.current.getDebugInfo();
-      expect(debugInfo).toBeDefined();
-      expect(debugInfo.cacheSize).toBe(0);
-      expect(debugInfo.cacheHits).toBe(0);
-      expect(debugInfo.cacheMisses).toBe(0);
-      expect(debugInfo.totalChecks).toBe(0);
-      expect(debugInfo.averageResponseTime).toBe(0);
-      expect(debugInfo.lastInvalidation).toBe(0);
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+
+      result.current.invalidateCache();
+
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(4);
     });
 
-    it('tracks cache hits and misses', async () => {
+    it('invalidates cache entries by pattern', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      // First check - cache miss
-      await result.current.checkPermission('read', 'users');
-      
-      // Second check - cache hit
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('read', 'admin');
       await result.current.checkPermission('read', 'users');
-      
+
+      result.current.invalidateCache('dashboard');
+
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('read', 'admin');
+
+      expect(mockIsPermittedCached).toHaveBeenCalledTimes(4);
+    });
+
+    it('cleans up expired cache entries', async () => {
+      const { result } = renderHook(() => usePermissionCache({ defaultTTL: 1000 }));
+
+      await result.current.checkPermission('read', 'dashboard');
+
+      vi.setSystemTime(2000);
+
+      await result.current.checkPermission('read', 'admin');
+
       const debugInfo = result.current.getDebugInfo();
-      expect(debugInfo.cacheMisses).toBe(1);
-      expect(debugInfo.cacheHits).toBe(1);
-      expect(debugInfo.totalChecks).toBe(2);
+      expect(debugInfo.cacheSize).toBe(1);
     });
+  });
 
+  describe('Cached Permissions', () => {
     it('returns cached permissions for a page', async () => {
       mockIsPermittedCached
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(false)
-        .mockResolvedValueOnce(true)
-        .mockResolvedValueOnce(false);
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false })
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false });
 
       const { result } = renderHook(() => usePermissionCache());
 
-      await result.current.checkMultiplePermissions([
-        ['read', 'dashboard'],
-        ['create', 'dashboard'],
-        ['update', 'dashboard'],
-        ['delete', 'dashboard']
-      ]);
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+      await result.current.checkPermission('update', 'dashboard');
+      await result.current.checkPermission('delete', 'dashboard');
 
       const cachedPermissions = result.current.getCachedPermissions('dashboard');
 
+      expect(cachedPermissions).toHaveLength(4);
       expect(cachedPermissions).toEqual([
         { operation: 'read', hasPermission: true },
         { operation: 'create', hasPermission: false },
         { operation: 'update', hasPermission: true },
-        { operation: 'delete', hasPermission: false }
+        { operation: 'delete', hasPermission: false },
       ]);
     });
 
-    it('tracks average response time', async () => {
+    it('returns empty array for uncached page', () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      // Mock slow permission check
-      mockIsPermittedCached.mockImplementation(() => 
-        new Promise(resolve => setTimeout(() => resolve(true), 100))
-      );
+      const cachedPermissions = result.current.getCachedPermissions('uncached-page');
 
-      await result.current.checkPermission('read', 'users');
-      
-      const debugInfo = result.current.getDebugInfo();
-      expect(debugInfo.averageResponseTime).toBeGreaterThan(0);
+      expect(cachedPermissions).toHaveLength(0);
     });
   });
 
-  describe('Audit Trail', () => {
-    it('logs permission checks when audit trail is enabled', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-      const { result } = renderHook(() => usePermissionCache({
-        enableAuditTrail: true,
-        enableLogging: true
-      }));
-
-      // Verify the actual behavior: permission check returns correct result
-      const hasPermission = await result.current.checkPermission('read', 'users');
-      
-      // Test the actual functionality: permission check works correctly
-      expect(hasPermission).toBe(true);
-      // Verify audit trail is working (if enabled)
-      const auditTrail = result.current.getAuditTrail();
-      expect(auditTrail.length).toBeGreaterThan(0);
-      expect(auditTrail[0]).toMatchObject({
-        operation: 'read',
-        pageId: 'users',
-        result: true
-      });
-
-      consoleSpy.mockRestore();
-    });
+  describe('Debug Information', () => {
+    it('provides accurate debug information', async () => {
+      mockIsPermittedCached
+        .mockResolvedValueOnce({ ok: true, data: true })
+        .mockResolvedValueOnce({ ok: true, data: false });
 
-    it('does not log when audit trail is disabled', async () => {
-      const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const { result } = renderHook(() => usePermissionCache());
 
-      const { result } = renderHook(() => usePermissionCache({
-        enableAuditTrail: false,
-        enableLogging: false
-      }));
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'dashboard');
+      await result.current.checkPermission('read', 'dashboard');
 
-      await result.current.checkPermission('read', 'users');
-      
-      expect(consoleSpy).not.toHaveBeenCalled();
+      const debugInfo = result.current.getDebugInfo();
 
-      consoleSpy.mockRestore();
+      expect(debugInfo.cacheSize).toBe(2);
+      expect(debugInfo.cacheHits).toBe(1);
+      expect(debugInfo.cacheMisses).toBe(2);
+      expect(debugInfo.totalChecks).toBe(3);
+      expect(debugInfo.averageResponseTime).toBeGreaterThan(0);
+      expect(debugInfo.lastInvalidation).toBe(0);
     });
-  });
 
-  describe('Performance Optimization', () => {
-    it('batches multiple permission checks efficiently', async () => {
+    it('tracks response times accurately', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      const permissions = [
-        ['read', 'users'],
-        ['create', 'users'],
-        ['update', 'users'],
-        ['delete', 'users']
-      ];
-
-      const startTime = Date.now();
-      await result.current.checkMultiplePermissions(permissions);
-      const endTime = Date.now();
-
-      // Should complete quickly due to batching
-      expect(endTime - startTime).toBeLessThan(1000);
-    });
-
-    it('uses memoization to prevent unnecessary re-renders', () => {
-      let renderCount = 0;
-      
-      const TestComponent = () => {
-        renderCount++;
-        const cache = usePermissionCache();
-        // Test that the same functions are returned (memoized)
-        expect(cache.checkPermission).toBeInstanceOf(Function);
-        expect(cache.getDebugInfo).toBeInstanceOf(Function);
-        return null;
-      };
+      await result.current.checkPermission('read', 'dashboard');
 
-      const { rerender } = renderHook(() => TestComponent());
-      const initialRenderCount = renderCount;
-      
-      // Re-render with same props
-      rerender();
-      
-      // The hook will re-render, but the functions should be memoized
-      expect(renderCount).toBe(initialRenderCount + 1);
+      const debugInfo = result.current.getDebugInfo();
+      expect(debugInfo.averageResponseTime).toBeGreaterThan(0);
+      expect(debugInfo.totalChecks).toBe(1);
     });
   });
 
-  describe('Error Handling', () => {
-    it('handles permission API errors gracefully', async () => {
-      mockIsPermittedCached.mockRejectedValueOnce(new Error('RBAC error'));
-
-      const { result } = renderHook(() => usePermissionCache());
+  describe('Audit Trail', () => {
+    it('records audit trail when enabled', async () => {
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: true }));
 
-      const hasPermission = await result.current.checkPermission('read', 'users');
-      expect(hasPermission).toBe(false);
-    });
+      await result.current.checkPermission('read', 'dashboard');
+      await result.current.checkPermission('create', 'admin');
 
-    it('handles invalid permission formats gracefully', async () => {
-      const { result } = renderHook(() => usePermissionCache());
+      const auditTrail = result.current.getAuditTrail();
 
-      const hasPermission = await result.current.checkPermission('', '');
-      expect(hasPermission).toBe(false);
+      expect(auditTrail).toHaveLength(2);
+      expect(auditTrail[0]).toHaveProperty('timestamp');
+      expect(auditTrail[0]).toHaveProperty('operation', 'read');
+      expect(auditTrail[0]).toHaveProperty('pageId', 'dashboard');
+      expect(auditTrail[0]).toHaveProperty('result', true);
+      expect(auditTrail[0]).toHaveProperty('cached', false);
+      expect(auditTrail[0]).toHaveProperty('userId', 'user-123');
     });
 
-    it('handles null/undefined parameters gracefully', async () => {
-      const { result } = renderHook(() => usePermissionCache());
+    it('does not record audit trail when disabled', async () => {
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: false }));
 
-      const hasPermission = await result.current.checkPermission(null as any, null as any);
-      expect(hasPermission).toBe(false);
-    });
-  });
-
-  describe('Cache Configuration', () => {
-    it('uses custom TTL when provided', async () => {
-      const { result } = renderHook(() => usePermissionCache({
-        defaultTTL: 200
-      }));
+      await result.current.checkPermission('read', 'dashboard');
 
-      await result.current.checkPermission('read', 'users');
-      
-      // Wait for custom TTL to expire
-      await new Promise(resolve => setTimeout(resolve, 250));
-      
-      // Should not use cache
-      await result.current.checkPermission('read', 'users');
-      
-      expect(mockIsPermittedCached).toHaveBeenCalledTimes(2);
+      const auditTrail = result.current.getAuditTrail();
+      expect(auditTrail).toHaveLength(0);
     });
 
-    it('respects max cache size configuration', async () => {
-      const { result } = renderHook(() => usePermissionCache({
-        maxCacheSize: 1
-      }));
+    it('limits audit trail size', async () => {
+      const { result } = renderHook(() => usePermissionCache({ enableAuditTrail: true }));
 
-      // Fill cache beyond max size
-      await result.current.checkPermission('read', 'users');
-      await result.current.checkPermission('create', 'users');
-      
-      const debugInfo = result.current.getDebugInfo();
-      expect(debugInfo.cacheSize).toBeLessThanOrEqual(1);
+      for (let i = 0; i < 600; i++) {
+        await result.current.checkPermission('read', `page${i}`);
+      }
+
+      const auditTrail = result.current.getAuditTrail();
+      expect(auditTrail.length).toBeLessThanOrEqual(500);
     });
   });
 
-  describe('Integration with RBAC API', () => {
-    it('integrates with auth and organisation hooks correctly', () => {
-      renderHook(() => usePermissionCache());
-      expect(mockUseUnifiedAuthFn).toHaveBeenCalled();
-      expect(mockUseOrganisations).toHaveBeenCalled();
-    });
+  describe('Edge Cases', () => {
+    it('handles event context when available', async () => {
+      mockUseEvents.mockReturnValueOnce({
+        selectedEvent: { event_id: 'event-123' },
+      } as any);
 
-    it('passes correct parameters to isPermittedCached', async () => {
       const { result } = renderHook(() => usePermissionCache());
 
-      await result.current.checkPermission('read', 'users');
-      
+      await result.current.checkPermission('read', 'dashboard');
+
       expect(mockIsPermittedCached).toHaveBeenCalledWith(
         expect.objectContaining({
-          userId: 'user-123',
-          scope: expect.objectContaining({ organisationId: 'org-123' }),
-          permission: 'read:page.users',
-          pageId: 'users'
+          scope: expect.objectContaining({ eventId: 'event-123' }),
         })
       );
     });
 
-    it('handles permission API state changes', async () => {
-      mockIsPermittedCached.mockResolvedValueOnce(true);
-      mockUseUnifiedAuthFn.mockReturnValueOnce({
-        user: { id: 'user-456' },
-        session: null,
-        appName: 'test-app',
-        selectedOrganisationId: undefined,
-        selectedEventId: undefined
-      } as any);
-      
-      // The hook uses useOrganisations() for organisationId, not useUnifiedAuth
-      // The mock for useOrganisations returns 'org-123' by default
-      mockUseOrganisations.mockReturnValueOnce({
-        selectedOrganisation: { id: 'org-123' },
-        organisations: [],
-        userMemberships: [],
-        isLoading: false,
-        error: null
-      } as any);
+    it('handles missing event context gracefully', async () => {
+      mockUseEvents.mockImplementation(() => {
+        throw new Error('Event provider not available');
+      });
 
       const { result } = renderHook(() => usePermissionCache());
 
-      await result.current.checkPermission('read', 'users');
-      expect(mockIsPermittedCached).toHaveBeenCalledWith(
-        expect.objectContaining({
-          userId: 'user-456',
-          scope: expect.objectContaining({ organisationId: 'org-123' }),
-          permission: 'read:page.users',
-          pageId: 'users'
-        })
-      );
+      await result.current.checkPermission('read', 'dashboard');
+
+      expect(mockIsPermittedCached).toHaveBeenCalled();
     });
   });
-});
+});