@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/audit.test.ts

@@ -23,7 +23,6 @@ import {
   RLSDeniedAuditEvent
 } from './audit';
 import { UUID, AuditEventSource } from './types';
-import { Database } from '../types/database';
 import { Logger, LogLevel } from '../utils/core/logger';
 
 // Mock Supabase client
@@ -250,7 +249,7 @@ describe('RBACAuditManager', () => {
         organisationId: 'org-456' as UUID,
         eventId: 'event-789',
         appId: 'app-101' as UUID,
-        tableName: 'users',
+        table: 'users',
         operation: 'SELECT',
         source: 'rls' as AuditEventSource,
         metadata: { query: 'SELECT * FROM users' }
@@ -303,7 +302,6 @@ describe('RBACAuditManager', () => {
       }
 
       expect(mockSupabase.insert).toHaveBeenCalledTimes(2);
-      expect(mockSupabase.insert).toHaveBeenCalledTimes(2);
     });
 
     it('handles empty batch gracefully', async () => {
@@ -633,6 +631,230 @@ describe('RBACAuditManager', () => {
       expect(events).toEqual(mockEvents);
     });
   });
+
+  describe('Cache Hit Skipping', () => {
+    it('skips audit logging for cache hits', async () => {
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+        cache_hit: true, // Cache hit - should skip logging
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).not.toHaveBeenCalled();
+    });
+
+    it('logs audit events when cache_hit is false', async () => {
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+        cache_hit: false, // Cache miss - should log
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).toHaveBeenCalled();
+    });
+  });
+
+  describe('Audit Manager State', () => {
+    it('can disable audit logging', async () => {
+      auditManager.setEnabled(false);
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).not.toHaveBeenCalled();
+    });
+
+    it('can re-enable audit logging', async () => {
+      auditManager.setEnabled(false);
+      auditManager.setEnabled(true);
+
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).toHaveBeenCalled();
+    });
+
+    it('checks if audit logging is enabled', () => {
+      expect(auditManager.isEnabled()).toBe(true);
+      auditManager.setEnabled(false);
+      expect(auditManager.isEnabled()).toBe(false);
+      auditManager.setEnabled(true);
+      expect(auditManager.isEnabled()).toBe(true);
+    });
+  });
+
+  describe('Missing Context Handling', () => {
+    it('handles missing userId gracefully', async () => {
+      const event = {
+        type: 'permission_check' as const,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+        // Missing userId
+      } as any;
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Should not throw, but should not insert either
+      expect(mockSupabase.insert).not.toHaveBeenCalled();
+    });
+
+    it('handles missing organisationId with warning', async () => {
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: undefined as any, // Missing organisationId
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+      };
+
+      // Mock console.warn to verify warning is logged
+      const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+      await auditManager.emitPermissionCheck(event);
+
+      // Should still insert, but with null organisationId
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
+          organisation_id: null,
+          metadata: expect.objectContaining({
+            no_organisation_context: true,
+          }),
+        }),
+      ]);
+
+      consoleWarnSpy.mockRestore();
+    });
+  });
+
+  describe('PageId Validation', () => {
+    it('stores valid UUID pageId in page_id column', async () => {
+      const validPageId = '01234567-89ab-cdef-0123-456789abcdef' as UUID;
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+        pageId: validPageId,
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
+          page_id: validPageId,
+        }),
+      ]);
+    });
+
+    it('stores non-UUID pageId in metadata', async () => {
+      const pageName = 'meals-page';
+      const event: PermissionCheckAuditEvent = {
+        type: 'permission_check',
+        userId: 'user-123' as UUID,
+        organisationId: 'org-456' as UUID,
+        permission: 'read:users',
+        decision: true,
+        source: 'api' as AuditEventSource,
+        duration_ms: 100,
+        pageId: pageName as UUID, // Not a valid UUID
+      };
+
+      await auditManager.emitPermissionCheck(event);
+
+      expect(mockSupabase.insert).toHaveBeenCalledWith([
+        expect.objectContaining({
+          page_id: undefined, // Not stored in page_id column
+          metadata: expect.objectContaining({
+            page_name: pageName, // Stored in metadata instead
+          }),
+        }),
+      ]);
+    });
+  });
+
+  describe('CORS Error Handling', () => {
+    it('detects and handles CORS errors in getUserAuditEvents', async () => {
+      const corsError = {
+        message: 'CORS error',
+        code: null,
+      };
+
+      const mockLimit = vi.fn().mockResolvedValue({
+        data: null,
+        error: corsError,
+      });
+      const mockOrder = vi.fn().mockReturnValue({ limit: mockLimit });
+      const mockEq = vi.fn().mockReturnValue({ order: mockOrder });
+      const mockSelect = vi.fn().mockReturnValue({ eq: mockEq });
+      
+      mockSupabase.from.mockReturnValue({ select: mockSelect });
+
+      await expect(
+        auditManager.getUserAuditEvents('user-123' as UUID, 10)
+      ).rejects.toThrow('CORS error');
+    });
+
+    it('detects and handles CORS errors in getOrganisationAuditEvents', async () => {
+      const corsError = {
+        message: 'CORS error',
+        code: null,
+      };
+
+      const mockLimit = vi.fn().mockResolvedValue({
+        data: null,
+        error: corsError,
+      });
+      const mockOrder = vi.fn().mockReturnValue({ limit: mockLimit });
+      const mockEq = vi.fn().mockReturnValue({ order: mockOrder });
+      const mockSelect = vi.fn().mockReturnValue({ eq: mockEq });
+      
+      mockSupabase.from.mockReturnValue({ select: mockSelect });
+
+      await expect(
+        auditManager.getOrganisationAuditEvents('org-456' as UUID, 10)
+      ).rejects.toThrow('CORS error');
+    });
+  });
 });
 
 describe('Global Audit Manager', () => {
@@ -692,28 +914,3 @@ describe('Global Audit Manager', () => {
     await expect(emitAuditEvent(event)).resolves.not.toThrow();
   });
 });
-
-describe('Audit Event Types', () => {
-  it('defines correct event type values', () => {
-    const eventTypes = [
-      'permission_check',
-      'permission_denied',
-      'role_granted',
-      'role_denied',
-      'rls_denied'
-    ];
-
-    eventTypes.forEach(type => {
-      expect(typeof type).toBe('string');
-      expect(type.length).toBeGreaterThan(0);
-    });
-  });
-
-  it('defines correct source values', () => {
-    const sources: AuditEventSource[] = ['api', 'ui', 'middleware', 'rls'];
-
-    sources.forEach(source => {
-      expect(['api', 'ui', 'middleware', 'rls']).toContain(source);
-    });
-  });
-});

package/src/rbac/audit.ts

@@ -17,6 +17,7 @@ import {
 import type { AuditEventType } from './types/functions';
 import { logger } from '../utils/core/logger';
 import { BatchedAuditManager } from './audit-batched';
+import { ok, type ApiResult } from '../types/api-result';
 
 /**
  * Audit event payload for permission checks
@@ -35,7 +36,7 @@ export interface PermissionCheckAuditEvent {
   duration_ms: number;
   cache_hit?: boolean;
   cache_source?: 'memory' | 'database' | 'rpc';
-  metadata?: Record<string, any>;
+  metadata?: Record<string, unknown>;
 }
 
 /**
@@ -50,7 +51,7 @@ export interface PermissionDeniedAuditEvent {
   pageId?: UUID;
   permission: string;
   source: AuditEventSource;
-  metadata?: Record<string, any>;
+  metadata?: Record<string, unknown>;
 }
 
 /**
@@ -64,7 +65,7 @@ export interface RoleGrantedAuditEvent {
   appId?: UUID;
   role: string;
   grantedBy: UUID;
-  metadata?: Record<string, any>;
+  metadata?: Record<string, unknown>;
 }
 
 /**
@@ -78,7 +79,7 @@ export interface RoleRevokedAuditEvent {
   appId?: UUID;
   role: string;
   revokedBy: UUID;
-  metadata?: Record<string, any>;
+  metadata?: Record<string, unknown>;
 }
 
 /**
@@ -90,7 +91,7 @@ export interface RLSDeniedAuditEvent {
   organisationId: UUID;
   table: string;
   operation: string;
-  metadata?: Record<string, any>;
+  metadata?: Record<string, unknown>;
 }
 
 /**
@@ -240,9 +241,9 @@ export class RBACAuditManager {
         },
       };
 
-      const { error } = await (this.supabase as any)
+      const { error } = await this.supabase
         .from('rbac_audit_events')
-        .insert([auditEvent]);
+        .insert([auditEvent as Database['public']['Tables']['rbac_audit_events']['Insert']]);
 
       if (error) {
         // Log the error for debugging
@@ -276,11 +277,14 @@ export class RBACAuditManager {
    * @param event - Audit event payload
    * @param error - The error that occurred
    */
-  private logFallbackEvent(event: AuditEventPayload, error: any): void {
+  private logFallbackEvent(event: AuditEventPayload, error: unknown): void {
+    const errorMessage = error && typeof error === 'object' && 'message' in error
+      ? String(error.message)
+      : String(error);
     logger.debug('RBAC Audit Fallback', 'Database audit logging failed, using console fallback', {
       timestamp: new Date().toISOString(),
       event,
-      error: error?.message || error
+      error: errorMessage
     });
   }
 
@@ -361,11 +365,12 @@ export class RBACAuditManager {
 
     if (error) {
       // Detect CORS errors (they typically have null status or specific error codes)
+      const errorWithStatus = error as unknown as { status?: number | null; [key: string]: unknown };
       const isCorsError = 
         error.message?.toLowerCase().includes('cors') ||
         error.message?.toLowerCase().includes('cross-origin') ||
         error.code === null ||
-        (error as any).status === null;
+        errorWithStatus.status === null;
       
       if (isCorsError) {
         const corsError = new Error(
@@ -373,9 +378,9 @@ export class RBACAuditManager {
           `Please configure CORS in your Supabase Dashboard: Settings → API → CORS. ` +
           `Add your app's origin (e.g., http://localhost:8087) to the allowed origins list. ` +
           `Original error: ${error.message || 'CORS request did not succeed'}`
-        );
-        (corsError as any).isCorsError = true;
-        (corsError as any).originalError = error;
+        ) as Error & { isCorsError: boolean; originalError: typeof error };
+        corsError.isCorsError = true;
+        corsError.originalError = error;
         throw corsError;
       }
       
@@ -405,11 +410,12 @@ export class RBACAuditManager {
 
     if (error) {
       // Detect CORS errors (they typically have null status or specific error codes)
+      const errorWithStatus = error as unknown as { status?: number | null; [key: string]: unknown };
       const isCorsError = 
         error.message?.toLowerCase().includes('cors') ||
         error.message?.toLowerCase().includes('cross-origin') ||
         error.code === null ||
-        (error as any).status === null;
+        errorWithStatus.status === null;
       
       if (isCorsError) {
         const corsError = new Error(
@@ -417,9 +423,9 @@ export class RBACAuditManager {
           `Please configure CORS in your Supabase Dashboard: Settings → API → CORS. ` +
           `Add your app's origin (e.g., http://localhost:8087) to the allowed origins list. ` +
           `Original error: ${error.message || 'CORS request did not succeed'}`
-        );
-        (corsError as any).isCorsError = true;
-        (corsError as any).originalError = error;
+        ) as Error & { isCorsError: boolean; originalError: typeof error };
+        corsError.isCorsError = true;
+        corsError.originalError = error;
         throw corsError;
       }
       
@@ -478,9 +484,11 @@ export function getGlobalAuditManager(): RBACAuditManager | null {
  * Emit an audit event using the global audit manager
  * 
  * @param event - Audit event payload
+ * @returns ApiResult for consistency with API error handling
  */
-export async function emitAuditEvent(event: AuditEventPayload): Promise<void> {
+export async function emitAuditEvent(event: AuditEventPayload): Promise<ApiResult<void>> {
   if (globalAuditManager) {
     await globalAuditManager.emitEvent(event);
   }
+  return ok(undefined);
 }