@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/api.test.ts

@@ -246,23 +246,6 @@ describe('RBAC API', () => {
 
       expect(mockCreateRBACEngine).toHaveBeenCalledWith(mockSupabase, undefined);
     });
-
-    it('handles multiple initialization calls', () => {
-      const mockEngine = { id: 'test-engine' };
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue({} as any);
-      mockGetRBACLogger.mockReturnValue({
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      });
-
-      setupRBAC(mockSupabase as any);
-      setupRBAC(mockSupabase as any);
-
-      expect(mockCreateRBACEngine).toHaveBeenCalledTimes(2);
-    });
   });
 
   describe('Environment Detection', () => {
@@ -326,7 +309,7 @@ describe('RBAC API', () => {
   });
 
   describe('Error Handling', () => {
-    it('handles missing supabase client', () => {
+    it('handles missing supabase client gracefully', () => {
       const mockEngine = { id: 'test-engine' };
       const mockAuditManager = { id: 'test-audit' };
       const mockLogger = {
@@ -347,175 +330,10 @@ describe('RBAC API', () => {
         setupRBAC(null as any);
       }).not.toThrow();
     });
-
-    it('handles invalid supabase client', () => {
-      const invalidSupabase = { invalid: 'client' };
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      // Ensure mocks don't throw
-      mockCreateRBACConfig.mockImplementation((config) => config);
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-      
-      // The function doesn't throw, it just creates config with invalid client
-      expect(() => {
-        setupRBAC(invalidSupabase as any);
-      }).not.toThrow();
-    });
-  });
-
-  describe('Multiple Initialization', () => {
-    it('handles multiple setupRBAC calls gracefully', () => {
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-
-      // First call
-      setupRBAC(mockSupabase as any);
-      
-      // Second call should not throw
-      expect(() => {
-        setupRBAC(mockSupabase as any);
-      }).not.toThrow();
-
-      expect(mockCreateRBACEngine).toHaveBeenCalledTimes(2);
-    });
-  });
-
-  describe('Configuration Validation', () => {
-    it('validates required supabase client', () => {
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      // Ensure mocks don't throw
-      mockCreateRBACConfig.mockImplementation((config) => config);
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-      
-      // The function doesn't throw, it just creates config with undefined
-      expect(() => {
-        setupRBAC(undefined as any);
-      }).not.toThrow();
-    });
-
-    it('validates supabase client structure', () => {
-      const invalidSupabase = {
-        from: 'not-a-function',
-        auth: 'not-an-object'
-      };
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      // Ensure mocks don't throw
-      mockCreateRBACConfig.mockImplementation((config) => config);
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-
-      // The function doesn't throw, it just creates config with invalid client
-      expect(() => {
-        setupRBAC(invalidSupabase as any);
-      }).not.toThrow();
-    });
-  });
-
-  describe('Logging Integration', () => {
-    it('logs initialization success', () => {
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      mockCreateRBACEngine.mockReturnValue({} as any);
-      mockCreateAuditManager.mockReturnValue({} as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-
-      setupRBAC(mockSupabase as any);
-
-      // Note: setupRBAC doesn't log "RBAC system initialized successfully" - logging is handled by the logger setup
-    });
-
-    it('logs configuration details in development', () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = 'development';
-
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      mockCreateRBACEngine.mockReturnValue({} as any);
-      mockCreateAuditManager.mockReturnValue({} as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-
-      setupRBAC(mockSupabase as any, { debug: true });
-
-      // The function may or may not call debug, so we just check it was called
-      expect(mockGetRBACLogger).toHaveBeenCalled();
-
-      process.env.NODE_ENV = originalEnv;
-    });
   });
 
-  describe('Type Safety', () => {
-    it('accepts valid Supabase client types', () => {
-      const validSupabase = {
-        from: vi.fn(),
-        auth: { getUser: vi.fn() },
-        rpc: vi.fn()
-      };
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
 
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
 
-      expect(() => {
-        setupRBAC(validSupabase as any);
-      }).not.toThrow();
-    });
-  });
 
   describe('Cache Integration', () => {
     it('initializes cache correctly', () => {
@@ -539,37 +357,6 @@ describe('RBAC API', () => {
     });
   });
 
-  describe('Type Safety', () => {
-    it('accepts valid Supabase client types', () => {
-      const validSupabase = {
-        from: vi.fn(),
-        auth: {
-          getUser: vi.fn()
-        },
-        rpc: vi.fn()
-      };
-
-      const mockEngine = { id: 'test-engine' };
-      const mockAuditManager = { id: 'test-audit' };
-      const mockLogger = {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        debug: vi.fn()
-      };
-
-      // Ensure mocks don't throw
-      mockCreateRBACConfig.mockImplementation((config) => config);
-      mockCreateRBACEngine.mockReturnValue(mockEngine as any);
-      mockCreateAuditManager.mockReturnValue(mockAuditManager as any);
-      mockGetRBACLogger.mockReturnValue(mockLogger);
-
-      expect(() => {
-        setupRBAC(validSupabase as any);
-      }).not.toThrow();
-    });
-  });
-
   describe('Permission Functions', () => {
     let mockEngine: any;
 
@@ -599,12 +386,21 @@ describe('RBAC API', () => {
             builder.single = vi.fn().mockResolvedValue({ data: { id: 'app-123' }, error: null });
           }
         } else if (table === 'rbac_app_pages') {
-          if (selectField === 'id') {
+          if (selectField === 'id' || selectField === 'id, page_name, app_id') {
             // Pattern: select('id').eq('app_id', ...).eq('page_name', ...).maybeSingle()
+            // or select('id, page_name, app_id').eq('app_id', ...).eq('page_name', ...).maybeSingle()
             builder.maybeSingle = vi.fn().mockResolvedValue({ data: { id: '123e4567-e89b-12d3-a456-426614174000' }, error: null });
-          } else if (selectField === 'scope_type') {
+          } else if (selectField === 'scope_type' || (selectField && selectField.includes('scope_type'))) {
             // Pattern: select('scope_type').eq('id', ...).single()
-            builder.single = vi.fn().mockResolvedValue({ data: { scope_type: 'organisation' }, error: null });
+            // or select('scope_type, page_name, app_id').eq('id', ...).single()
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { 
+                scope_type: 'organisation',
+                page_name: 'test-page',
+                app_id: 'app-123'
+              }, 
+              error: null 
+            });
           }
         }
         
@@ -617,7 +413,7 @@ describe('RBAC API', () => {
       };
       
       const mockSupabaseForEngine = {
-        from: vi.fn((table: string) => createQueryBuilder(table)),
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
         rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
         auth: mockSupabase.auth
       };
@@ -656,7 +452,8 @@ describe('RBAC API', () => {
           scope: { organisationId: 'org-456' }
         });
 
-        expect(result).toBe(mockAccessLevel);
+        expect(result.ok).toBe(true);
+        expect(result.ok && result.data).toBe(mockAccessLevel);
         expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
           userId: 'user-123',
           scope: { organisationId: 'org-456' }
@@ -669,10 +466,12 @@ describe('RBAC API', () => {
         const error = new Error('Engine error');
         mockEngine.getAccessLevel.mockRejectedValue(error);
 
-        await expect(getAccessLevel({
+        const result = await getAccessLevel({
           userId: 'user-123',
           scope: { organisationId: 'org-456' }
-        })).rejects.toThrow('Engine error');
+        });
+        expect(result.ok).toBe(false);
+        expect(result.ok === false && result.error.message).toContain('Engine error');
       });
     });
 
@@ -691,7 +490,8 @@ describe('RBAC API', () => {
           scope: { organisationId: 'org-456' }
         });
 
-        expect(result).toEqual(mockPermissionMap);
+        expect(result.ok).toBe(true);
+        expect(result.ok && result.data).toEqual(mockPermissionMap);
         expect(mockEngine.getPermissionMap).toHaveBeenCalledWith({
           userId: 'user-123',
           scope: { organisationId: 'org-456' }
@@ -704,10 +504,11 @@ describe('RBAC API', () => {
         const error = new Error('Engine error');
         mockEngine.getPermissionMap.mockRejectedValue(error);
 
-        await expect(getPermissionMap({
+        const result = await getPermissionMap({
           userId: 'user-123',
           scope: { organisationId: 'org-456' }
-        })).rejects.toThrow('Engine error');
+        });
+        expect(result.ok).toBe(false);
       });
     });
 
@@ -719,7 +520,8 @@ describe('RBAC API', () => {
 
         const result = await resolveAppContext({ userId: 'user-1', appName: 'test-app' });
 
-        expect(result).toEqual(context);
+        expect(result.ok).toBe(true);
+        expect(result.ok && result.data).toEqual(context);
         expect(mockEngine.resolveAppContext).toHaveBeenCalledWith({ userId: 'user-1', appName: 'test-app' });
       });
 
@@ -729,7 +531,8 @@ describe('RBAC API', () => {
 
         const result = await resolveAppContext({ userId: 'user-1', appName: 'test-app' });
 
-        expect(result).toBeNull();
+        expect(result.ok).toBe(true);
+        expect(result.ok && result.data).toBeNull();
       });
     });
 
@@ -749,7 +552,8 @@ describe('RBAC API', () => {
           scope: { organisationId: 'org-456' },
         });
 
-        expect(result).toEqual(roleContext);
+        expect(result.ok).toBe(true);
+        expect(result.ok && result.data).toEqual(roleContext);
         expect(mockEngine.getRoleContext).toHaveBeenCalledWith({
           userId: 'user-123',
           scope: { organisationId: 'org-456' },
@@ -770,7 +574,7 @@ describe('RBAC API', () => {
           pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.isPermitted).toHaveBeenCalled();
       });
 
@@ -780,31 +584,35 @@ describe('RBAC API', () => {
         const error = new Error('Engine error');
         mockEngine.isPermitted.mockRejectedValue(error);
 
-        await expect(isPermitted({
+        const result = await isPermitted({
           userId: 'user-123',
           scope: { organisationId: 'org-456' },
           permission: 'read:users'
-        })).rejects.toThrow('Engine error');
+        });
+        expect(result.ok).toBe(false);
+        expect(result.ok === false && result.error.message).toContain('Engine error');
       });
 
       it('throws OrganisationContextRequiredError when organisationId is missing', async () => {
-        const { isPermitted, OrganisationContextRequiredError } = await import('./api');
+        const { isPermitted } = await import('./api');
         
-        await expect(isPermitted({
+        const result = await isPermitted({
           userId: 'user-123',
           scope: {}, // Missing organisationId
           permission: 'read:users'
-        })).rejects.toThrow(OrganisationContextRequiredError);
+        });
+        expect(result.ok).toBe(false);
       });
 
       it('throws OrganisationContextRequiredError when organisationId is undefined', async () => {
-        const { isPermitted, OrganisationContextRequiredError } = await import('./api');
+        const { isPermitted } = await import('./api');
         
-        await expect(isPermitted({
+        const result = await isPermitted({
           userId: 'user-123',
           scope: { organisationId: undefined },
           permission: 'read:users'
-        })).rejects.toThrow(OrganisationContextRequiredError);
+        });
+        expect(result.ok).toBe(false);
       });
     });
 
@@ -823,7 +631,7 @@ describe('RBAC API', () => {
           pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(rbacCache.get).toHaveBeenCalledWith(cacheKey, true);
         expect(mockEngine.isPermitted).not.toHaveBeenCalled();
       });
@@ -841,7 +649,7 @@ describe('RBAC API', () => {
           pageId: '123e4567-e89b-12d3-a456-426614174000' // Valid UUID format
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.isPermitted).toHaveBeenCalled();
         // Check that cache.set was called - pageId presence makes it a page-level check
         expect(rbacCache.set).toHaveBeenCalled();
@@ -869,7 +677,7 @@ describe('RBAC API', () => {
           permissions: ['read:users', 'write:users']
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
       });
 
@@ -884,7 +692,7 @@ describe('RBAC API', () => {
           permissions: ['read:users', 'write:users']
         });
 
-        expect(result).toBe(false);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(false);
         expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
       });
     });
@@ -901,7 +709,7 @@ describe('RBAC API', () => {
           permissions: ['read:users', 'write:users']
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
       });
 
@@ -918,7 +726,7 @@ describe('RBAC API', () => {
           permissions: ['read:users', 'write:users']
         });
 
-        expect(result).toBe(false);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(false);
         expect(mockEngine.isPermitted).toHaveBeenCalledTimes(2);
       });
     });
@@ -931,7 +739,7 @@ describe('RBAC API', () => {
 
         const result = await isSuperAdmin('user-123');
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.checkSuperAdmin).toHaveBeenCalledWith('user-123');
       });
 
@@ -941,7 +749,9 @@ describe('RBAC API', () => {
         const error = new Error('Engine error');
         mockEngine.checkSuperAdmin.mockRejectedValue(error);
 
-        await expect(isSuperAdmin('user-123')).rejects.toThrow('Engine error');
+        const result = await isSuperAdmin('user-123');
+        expect(result.ok).toBe(false);
+        expect(result.ok === false && result.error.message).toContain('Engine error');
       });
     });
 
@@ -956,7 +766,7 @@ describe('RBAC API', () => {
 
         const result = await isOrganisationAdmin('user-123', 'org-456');
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
           userId: 'user-123',
           scope: { organisationId: 'org-456' }
@@ -970,7 +780,7 @@ describe('RBAC API', () => {
 
         const result = await isOrganisationAdmin('user-123', 'org-456');
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
       });
 
       it('returns false for other access levels', async () => {
@@ -980,7 +790,7 @@ describe('RBAC API', () => {
 
         const result = await isOrganisationAdmin('user-123', 'org-456');
 
-        expect(result).toBe(false);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(false);
       });
     });
 
@@ -996,7 +806,7 @@ describe('RBAC API', () => {
           appId: 'app-101'
         });
 
-        expect(result).toBe(true);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
         expect(mockEngine.getAccessLevel).toHaveBeenCalledWith({
           userId: 'user-123',
           scope: {
@@ -1016,7 +826,7 @@ describe('RBAC API', () => {
           appId: 'app-101'
         });
 
-        expect(result).toBe(false);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(false);
         expect(mockEngine.getAccessLevel).not.toHaveBeenCalled();
       });
 
@@ -1029,7 +839,7 @@ describe('RBAC API', () => {
           appId: undefined
         });
 
-        expect(result).toBe(false);
+        expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(false);
         expect(mockEngine.getAccessLevel).not.toHaveBeenCalled();
       });
     });
@@ -1130,17 +940,934 @@ describe('RBAC API', () => {
     });
   });
 
-  describe('Error Handling', () => {
-    it('throws RBACNotInitializedError when engine not available', async () => {
-      // Reset global engine by clearing the module cache
-      vi.resetModules();
+  describe('getPageScopeType', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          if (selectField === 'id, name, is_active') {
+            builder.maybeSingle = vi.fn().mockResolvedValue({ 
+              data: { id: 'app-123', name: 'test-app', is_active: true }, 
+              error: null 
+            });
+          }
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'id, page_name, app_id') {
+            builder.maybeSingle = vi.fn().mockResolvedValue({ 
+              data: { id: '123e4567-e89b-12d3-a456-426614174000', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          } else if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { scope_type: 'organisation', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
       
-      const { getAccessLevel } = await import('./api');
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('returns scope type for UUID pageId', async () => {
+      // Update mockEngine.supabase before importing (globalEngine references mockEngine)
+      const mockSupabaseForQuery = {
+        from: vi.fn((table: string) => {
+          if (table === 'rbac_app_pages') {
+            return {
+              select: vi.fn().mockReturnThis(),
+              eq: vi.fn().mockReturnThis(),
+              single: vi.fn().mockResolvedValue({
+                data: { scope_type: 'organisation', page_name: 'test-page', app_id: 'app-123' },
+                error: null
+              })
+            };
+          }
+          return {
+            select: vi.fn().mockReturnThis(),
+            eq: vi.fn().mockReturnThis(),
+            maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+            single: vi.fn().mockResolvedValue({ data: null, error: null })
+          };
+        }),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
       
-      await expect(getAccessLevel({
-        userId: 'user-123',
-        scope: { organisationId: 'org-456' }
-      })).rejects.toThrow('RBAC system not initialized');
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('123e4567-e89b-12d3-a456-426614174000', 'app-123');
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe('organisation');
+    });
+
+    it('resolves page name to UUID and returns scope type', async () => {
+      // Update mockEngine.supabase before importing (globalEngine references mockEngine)
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_app_pages') {
+          if (selectField === 'id, page_name, app_id') {
+            builder.maybeSingle = vi.fn().mockResolvedValue({
+              data: { id: '123e4567-e89b-12d3-a456-426614174000', page_name: 'test-page', app_id: 'app-123' },
+              error: null
+            });
+          } else if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({
+              data: { scope_type: 'organisation', page_name: 'test-page', app_id: 'app-123' },
+              error: null
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForQuery = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+      
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('test-page', 'app-123');
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe('organisation');
+    });
+
+    it('resolves appId from appName', async () => {
+      // Update mockEngine.supabase before importing (globalEngine references mockEngine)
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          if (selectField === 'id, name, is_active') {
+            builder.maybeSingle = vi.fn().mockResolvedValue({ 
+              data: { id: 'app-123', name: 'test-app', is_active: true }, 
+              error: null 
+            });
+          }
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'id, page_name, app_id') {
+            builder.maybeSingle = vi.fn().mockResolvedValue({ 
+              data: { id: '123e4567-e89b-12d3-a456-426614174000', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          } else if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { scope_type: 'event', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForQuery = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('test-page', undefined, 'test-app');
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe('event');
+    });
+
+    it('handles errors when app not found', async () => {
+      const createQueryBuilder = (table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          builder.maybeSingle = vi.fn().mockResolvedValue({ 
+            data: null, 
+            error: null 
+          });
+        }
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the existing mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForEngine as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('test-page', undefined, 'nonexistent-app');
+      expect(result.ok).toBe(false);
+    });
+
+    it('handles errors when page not found', async () => {
+      const createQueryBuilder = (table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_app_pages') {
+          builder.single = vi.fn().mockResolvedValue({ 
+            data: null, 
+            error: { message: 'Page not found' } 
+          });
+        }
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the existing mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForEngine as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('nonexistent-page', 'app-123');
+      expect(result.ok).toBe(false);
+    });
+
+    it('handles database errors gracefully', async () => {
+      // Update mockEngine.supabase before importing (globalEngine references mockEngine)
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ 
+            data: null, 
+            error: { message: 'Database error', code: 'PGRST116' } 
+          })
+        };
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForQuery = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('123e4567-e89b-12d3-a456-426614174000', 'app-123');
+      expect(result.ok).toBe(false);
+    });
+
+    it('returns "both" scope type when page has both scope', async () => {
+      // Update mockEngine.supabase before importing (globalEngine references mockEngine)
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_app_pages' && selectField === 'scope_type, page_name, app_id') {
+          builder.single = vi.fn().mockResolvedValue({ 
+            data: { scope_type: 'both', page_name: 'test-page', app_id: 'app-123' }, 
+            error: null 
+          });
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForQuery = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      
+      const { getPageScopeType } = await import('./api');
+      
+      const result = await getPageScopeType('123e4567-e89b-12d3-a456-426614174000', 'app-123');
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe('both');
+    });
+  });
+
+  describe('isPermitted - Advanced Cases', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          if (selectField === 'name') {
+            builder.single = vi.fn().mockResolvedValue({ data: { name: 'test-app' }, error: null });
+          }
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { scope_type: 'organisation', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('uses precomputed super admin status when provided as true', async () => {
+      const { isPermitted } = await import('./api');
+      
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermitted({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      }, undefined, true);
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+      expect(mockEngine.checkSuperAdmin).not.toHaveBeenCalled();
+    });
+
+    it('checks super admin when precomputed is null', async () => {
+      const { isPermitted } = await import('./api');
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermitted({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      }, undefined, null);
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+      expect(mockEngine.checkSuperAdmin).toHaveBeenCalled();
+    });
+
+    it('handles "both" scope type pages correctly', async () => {
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          if (selectField === 'name') {
+            builder.single = vi.fn().mockResolvedValue({ data: { name: 'test-app' }, error: null });
+          }
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { scope_type: 'both', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForEngine as any;
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted
+        .mockResolvedValueOnce(true) // Event scope check
+        .mockResolvedValueOnce(false); // Org scope check
+      
+      const { isPermitted } = await import('./api');
+      
+      const result = await isPermitted({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', eventId: 'event-789', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true); // Union: true || false = true
+    });
+
+    it('resolves appName from appId when not provided', async () => {
+      const { isPermitted } = await import('./api');
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermitted({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+    });
+
+    it('handles errors in getPageScopeType gracefully', async () => {
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          single: vi.fn().mockResolvedValue({ 
+            data: null, 
+            error: { message: 'Database error' } 
+          })
+        };
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForEngine as any;
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      
+      const { isPermitted } = await import('./api');
+      
+      const result = await isPermitted({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      });
+      expect(result.ok).toBe(false);
+    });
+  });
+
+  describe('isPermittedCached - Edge Cases', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (table: string, selectField?: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        if (table === 'rbac_apps') {
+          if (selectField === 'name') {
+            builder.single = vi.fn().mockResolvedValue({ data: { name: 'test-app' }, error: null });
+          }
+        } else if (table === 'rbac_app_pages') {
+          if (selectField === 'scope_type, page_name, app_id') {
+            builder.single = vi.fn().mockResolvedValue({ 
+              data: { scope_type: 'organisation', page_name: 'test-page', app_id: 'app-123' }, 
+              error: null 
+            });
+          }
+        }
+        
+        builder.select = vi.fn((fields: string) => {
+          return createQueryBuilder(table, fields);
+        });
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('uses session cache for page-level checks', async () => {
+      const { isPermittedCached } = await import('./api');
+      
+      rbacCache.get.mockReturnValue(null);
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermittedCached({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users',
+        pageId: '123e4567-e89b-12d3-a456-426614174000'
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+      expect(rbacCache.set).toHaveBeenCalledWith(
+        expect.any(String),
+        true,
+        undefined,
+        true // useSessionCache = true for page-level checks
+      );
+    });
+
+    it('uses regular cache for non-page-level checks', async () => {
+      const { isPermittedCached } = await import('./api');
+      
+      rbacCache.get.mockReturnValue(null);
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermittedCached({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:users'
+        // No pageId
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+      expect(rbacCache.set).toHaveBeenCalledWith(
+        expect.any(String),
+        true,
+        undefined,
+        false // useSessionCache = false for non-page-level checks
+      );
+    });
+
+    it('detects page-level check by permission pattern', async () => {
+      const { isPermittedCached } = await import('./api');
+      
+      rbacCache.get.mockReturnValue(null);
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.isPermitted.mockResolvedValue(true);
+      
+      const result = await isPermittedCached({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456', appId: 'app-123' },
+        permission: 'read:page.meals'
+        // No pageId, but permission contains 'page.'
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe(true);
+      expect(rbacCache.set).toHaveBeenCalledWith(
+        expect.any(String),
+        true,
+        undefined,
+        true // useSessionCache = true for page-level checks
+      );
+    });
+  });
+
+  describe('getAccessLevel - Super Admin Cases', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('returns super for super admin users', async () => {
+      const { getAccessLevel } = await import('./api');
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(true);
+      
+      const result = await getAccessLevel({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456' }
+      });
+      
+      expect(result.ok).toBe(true); expect(result.ok && result.data).toBe('super');
+      expect(mockEngine.getAccessLevel).not.toHaveBeenCalled();
+    });
+
+    it('handles context validation errors', async () => {
+      const { getAccessLevel } = await import('./api');
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.getAccessLevel.mockRejectedValue(new Error('Context validation failed'));
+      
+      const result = await getAccessLevel({
+        userId: 'user-123',
+        scope: {} // Invalid scope
+      });
+      expect(result.ok).toBe(false);
+    });
+  });
+
+  describe('getPermissionMap - Error Cases', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('handles context validation errors', async () => {
+      const { getPermissionMap } = await import('./api');
+      
+      mockEngine.checkSuperAdmin.mockResolvedValue(false);
+      mockEngine.getPermissionMap.mockRejectedValue(new Error('Context validation failed'));
+      
+      const result = await getPermissionMap({
+        userId: 'user-123',
+        scope: {} // Invalid scope
+      });
+      expect(result.ok).toBe(false);
+    });
+  });
+
+  describe('Error Handling', () => {
+    let mockEngine: any;
+
+    beforeEach(() => {
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        
+        builder.select = vi.fn(() => builder);
+        
+        return builder;
+      };
+      
+      const mockSupabaseForEngine = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+
+      mockEngine = {
+        getAccessLevel: vi.fn(),
+        getPermissionMap: vi.fn(),
+        isPermitted: vi.fn(),
+        resolveAppContext: vi.fn(),
+        getRoleContext: vi.fn(),
+        checkSuperAdmin: vi.fn(),
+        supabase: mockSupabaseForEngine as any
+      };
+
+      mockCreateRBACEngine.mockReturnValue(mockEngine);
+      mockCreateAuditManager.mockReturnValue({} as any);
+      mockGetRBACLogger.mockReturnValue({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn()
+      });
+
+      setupRBAC(mockSupabase as any);
+    });
+
+    it('throws RBACNotInitializedError when engine not available', async () => {
+      // Reset global engine by clearing the module cache
+      vi.resetModules();
+      
+      const { getAccessLevel } = await import('./api');
+      
+      const result = await getAccessLevel({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456' }
+      });
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.code).toBe('RBAC_NOT_INITIALIZED');
+    });
+
+    it('handles errors in resolveAppContext', async () => {
+      // Re-initialize RBAC after potential resetModules() in previous test
+      mockEngine.resolveAppContext.mockRejectedValue(new Error('Database error'));
+      
+      // Re-import setupRBAC to get fresh reference after potential resetModules()
+      const { setupRBAC: freshSetupRBAC } = await import('./api');
+      freshSetupRBAC(mockSupabase as any);
+      
+      // Dynamic import after setup
+      const { resolveAppContext } = await import('./api');
+      
+      const result = await resolveAppContext({
+        userId: 'user-123',
+        appName: 'test-app'
+      });
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.message).toContain('Database error');
+    });
+
+    it('handles errors in getRoleContext', async () => {
+      // Ensure engine is set up before importing
+      // getRoleContext calls ContextValidator.resolveScopeForPage which needs engine.supabase
+      const createQueryBuilder = (_table: string) => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+          single: vi.fn().mockResolvedValue({ data: null, error: null })
+        };
+        builder.select = vi.fn(() => builder);
+        return builder;
+      };
+      
+      const mockSupabaseForQuery = {
+        from: vi.fn((_table: string) => createQueryBuilder(_table)),
+        rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+        auth: mockSupabase.auth
+      };
+      
+      // Update the mockEngine's supabase property (globalEngine references the same object)
+      mockEngine.supabase = mockSupabaseForQuery as any;
+      mockEngine.getRoleContext.mockRejectedValue(new Error('Database error'));
+      
+      // Re-import setupRBAC to get fresh reference after potential resetModules()
+      const { setupRBAC: freshSetupRBAC } = await import('./api');
+      freshSetupRBAC(mockSupabase as any);
+      
+      // Dynamic import after setup
+      const { getRoleContext } = await import('./api');
+      
+      const result = await getRoleContext({
+        userId: 'user-123',
+        scope: { organisationId: 'org-456' }
+      });
+      expect(result.ok).toBe(false);
+      expect(result.ok === false && result.error.message).toContain('Database error');
     });
   });
 });