@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/components/PagePermissionGuard.verification.test.tsx

@@ -0,0 +1,185 @@
+/**
+ * @file PagePermissionGuard Verification Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Components/PagePermissionGuard
+ * @since 2.0.0
+ *
+ * Verification tests for PagePermissionGuard component functionality.
+ */
+
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+import { PagePermissionGuard } from './PagePermissionGuard';
+
+// Mock the hooks with simple implementations
+const mockUseUnifiedAuthFn = vi.fn(() => ({
+  user: { id: 'user-123', email: 'test@example.com' },
+  isAuthenticated: true,
+  isLoading: false,
+  selectedOrganisation: { id: 'org-123' },
+  selectedEvent: null,
+  selectedOrganisationId: 'org-123',
+  selectedEventId: undefined,
+  appId: 'app-123',
+  appName: 'test-app',
+  supabase: {
+    from: vi.fn(() => ({
+      select: vi.fn(() => ({
+        eq: vi.fn(() => ({
+          single: vi.fn(() => Promise.resolve({ data: { id: 'app-123', name: 'test-app', is_active: true }, error: null }))
+        }))
+      }))
+    }))
+  }
+}));
+vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
+  useUnifiedAuth: () => mockUseUnifiedAuthFn(),
+  UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+}));
+
+// Mock individual hook file since barrel was removed
+// CRITICAL: Use hoisted mock so vi.mocked() works correctly
+const mockUseCanFn = vi.hoisted(() => vi.fn());
+vi.mock('../hooks/usePermissions', () => ({
+  useCan: mockUseCanFn
+}));
+
+// Mock useResolvedScope hook (same path as component: rbac/hooks)
+vi.mock('../hooks/useResolvedScope', () => ({
+  useResolvedScope: vi.fn()
+}));
+
+// Mock the app name resolver
+vi.mock('../../utils/app/appNameResolver', () => ({
+  getCurrentAppName: () => 'test-app'
+}));
+
+// Mock isSuperAdmin to return false immediately
+vi.mock('../api', () => ({
+  isSuperAdmin: vi.fn().mockResolvedValue(false)
+}));
+
+import { useResolvedScope } from '../hooks/useResolvedScope';
+
+describe('PagePermissionGuard Verification', () => {
+  const mockUseResolvedScope = vi.mocked(useResolvedScope);
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    // Mock useResolvedScope to return resolved scope immediately
+    mockUseResolvedScope.mockReturnValue({
+      resolvedScope: {
+        organisationId: 'org-123',
+        eventId: undefined,
+        appId: 'app-123'
+      },
+      isLoading: false,
+      error: null
+    });
+    
+    // Set up default mock behavior
+    mockUseCanFn.mockReturnValue({
+      can: true,
+      isLoading: false,
+      error: null,
+    });
+  });
+
+  describe('Permission Verification', () => {
+    it('should render content when permission is granted without infinite loops', async () => {
+      mockUseCanFn.mockReturnValue({
+        can: true,
+        isLoading: false,
+        error: null,
+      });
+      
+      render(
+        <PagePermissionGuard 
+          pageName="users"
+          operation="read"
+          scope={{ organisationId: 'org-123' }}
+        >
+          <main data-testid="protected-content">Verified Content</main>
+        </PagePermissionGuard>
+      );
+
+      // Wait for super admin check to complete and permission check to finish
+      await screen.findByTestId('protected-content', {}, { timeout: 3000 });
+      expect(screen.getByText('Verified Content')).toBeInTheDocument();
+    });
+
+    it('should handle changing supabase reference without infinite loops', async () => {
+      mockUseCanFn.mockReturnValue({
+        can: true,
+        isLoading: false,
+        error: null,
+      });
+      
+      const { rerender } = render(
+        <PagePermissionGuard 
+          pageName="users"
+          operation="read"
+          scope={{ organisationId: 'org-123' }}
+        >
+          <main data-testid="protected-content">Stable Content</main>
+        </PagePermissionGuard>
+      );
+
+      // Wait for super admin check to complete and permission check to finish
+      await screen.findByTestId('protected-content', {}, { timeout: 3000 });
+
+      // Rerender with same props should not cause issues
+      rerender(
+        <PagePermissionGuard 
+          pageName="users"
+          operation="read"
+          scope={{ organisationId: 'org-123' }}
+        >
+          <main data-testid="protected-content">Stable Content</main>
+        </PagePermissionGuard>
+      );
+
+      expect(screen.getByTestId('protected-content')).toBeInTheDocument();
+    });
+  });
+
+  describe('State Management', () => {
+    it('maintains consistent state across renders', async () => {
+      mockUseCanFn.mockReturnValue({
+        can: true,
+        isLoading: false,
+        error: null,
+      });
+      
+      const { rerender } = render(
+        <PagePermissionGuard 
+          pageName="users"
+          operation="read"
+          scope={{ organisationId: 'org-123' }}
+        >
+          <main data-testid="protected-content">Consistent Content</main>
+        </PagePermissionGuard>
+      );
+
+      // Wait for super admin check to complete and permission check to finish
+      await screen.findByTestId('protected-content', {}, { timeout: 3000 });
+
+      // Multiple rerenders should maintain state
+      for (let i = 0; i < 3; i++) {
+        rerender(
+          <PagePermissionGuard 
+            pageName="users"
+            operation="read"
+            scope={{ organisationId: 'org-123' }}
+          >
+            <main data-testid="protected-content">Consistent Content {i}</main>
+          </PagePermissionGuard>
+        );
+        
+        expect(screen.getByTestId('protected-content')).toBeInTheDocument();
+      }
+    });
+  });
+});

package/src/rbac/config.test.ts

@@ -13,10 +13,11 @@ import {
   getRBACConfig, 
   getRBACLogger, 
   isDebugMode, 
-  isDevelopmentMode 
+  isDevelopmentMode,
+  getMockPermissions,
 } from './config';
 import { RBACConfig, LogLevel } from './config';
-import { Database } from '../types/database';
+import { Logger } from '../utils/core/logger';
 
 // Mock Supabase client
 const createMockSupabaseClient = () => ({
@@ -193,8 +194,22 @@ describe('RBAC Configuration', () => {
 
   describe('Logger Functionality', () => {
     let consoleSpy: any;
+    let originalEnvMode: string | undefined;
 
     beforeEach(() => {
+      // Store original mode and set to 'development' for logger to work
+      // This matches the pattern used in other logger tests
+      originalEnvMode = import.meta.env.MODE;
+      (import.meta.env as any).MODE = 'development';
+      
+      // Configure logger for test mode
+      Logger.configure({
+        level: 0, // LogLevel.DEBUG - allow all log levels
+        includeComponent: true,
+        includeTimestamp: false,
+      });
+      
+      // Create spies on console methods
       consoleSpy = {
         debug: vi.spyOn(console, 'debug').mockImplementation(() => {}),
         info: vi.spyOn(console, 'info').mockImplementation(() => {}),
@@ -204,7 +219,16 @@ describe('RBAC Configuration', () => {
     });
 
     afterEach(() => {
-      Object.values(consoleSpy).forEach(spy => spy.mockRestore());
+      // Restore original env mode
+      if (originalEnvMode !== undefined) {
+        (import.meta.env as any).MODE = originalEnvMode;
+      }
+      
+      Object.values(consoleSpy).forEach(spy => {
+        if (spy && typeof spy.mockRestore === 'function') {
+          spy.mockRestore();
+        }
+      });
     });
 
     it('logs debug messages when debug mode is enabled', () => {
@@ -219,7 +243,9 @@ describe('RBAC Configuration', () => {
       const logger = getRBACLogger();
 
       logger.debug('Test debug message');
-      expect(consoleSpy.debug).toHaveBeenCalledWith('[RBAC DEBUG] Test debug message');
+      expect(consoleSpy.debug).toHaveBeenCalledWith(
+        expect.stringMatching(/\[DEBUG\].*\[RBAC\].*Test debug message/)
+      );
     });
 
     it('does not log debug messages when debug mode is disabled', () => {
@@ -249,7 +275,9 @@ describe('RBAC Configuration', () => {
       const logger = getRBACLogger();
 
       logger.info('Test info message');
-      expect(consoleSpy.info).toHaveBeenCalledWith('[RBAC INFO] Test info message');
+      expect(consoleSpy.info).toHaveBeenCalledWith(
+        expect.stringMatching(/\[INFO\].*\[RBAC\].*Test info message/)
+      );
     });
 
     it('logs warn messages when log level allows', () => {
@@ -264,7 +292,9 @@ describe('RBAC Configuration', () => {
       const logger = getRBACLogger();
 
       logger.warn('Test warn message');
-      expect(consoleSpy.warn).toHaveBeenCalledWith('[RBAC WARN] Test warn message');
+      expect(consoleSpy.warn).toHaveBeenCalledWith(
+        expect.stringMatching(/\[WARN\].*\[RBAC\].*Test warn message/)
+      );
     });
 
     it('logs error messages regardless of log level', () => {
@@ -279,7 +309,9 @@ describe('RBAC Configuration', () => {
       const logger = getRBACLogger();
 
       logger.error('Test error message');
-      expect(consoleSpy.error).toHaveBeenCalledWith('[RBAC ERROR] Test error message');
+      expect(consoleSpy.error).toHaveBeenCalledWith(
+        expect.stringMatching(/\[ERROR\].*\[RBAC\].*Test error message/)
+      );
     });
 
     it('respects log level hierarchy', () => {
@@ -301,7 +333,9 @@ describe('RBAC Configuration', () => {
       expect(consoleSpy.debug).not.toHaveBeenCalled();
       expect(consoleSpy.info).not.toHaveBeenCalled();
       expect(consoleSpy.warn).not.toHaveBeenCalled();
-      expect(consoleSpy.error).toHaveBeenCalledWith('[RBAC ERROR] Error message');
+      expect(consoleSpy.error).toHaveBeenCalledWith(
+        expect.stringMatching(/\[ERROR\].*\[RBAC\].*Error message/)
+      );
     });
 
     it('handles multiple arguments in log messages', () => {
@@ -317,10 +351,27 @@ describe('RBAC Configuration', () => {
 
       logger.info('User action', { userId: '123', action: 'login' });
       expect(consoleSpy.info).toHaveBeenCalledWith(
-        '[RBAC INFO] User action', 
+        expect.stringMatching(/\[INFO\].*\[RBAC\].*User action/),
         { userId: '123', action: 'login' }
       );
     });
+
+    it('provides default logger when config not set', () => {
+      // Reset config
+      createRBACConfig({
+        supabase: mockSupabase as any,
+        debug: false,
+        logLevel: 'warn',
+        developmentMode: false
+      });
+      
+      const logger = getRBACLogger();
+      expect(logger).toBeDefined();
+      expect(typeof logger.error).toBe('function');
+      expect(typeof logger.warn).toBe('function');
+      expect(typeof logger.info).toBe('function');
+      expect(typeof logger.debug).toBe('function');
+    });
   });
 
   describe('Log Level Validation', () => {
@@ -340,67 +391,99 @@ describe('RBAC Configuration', () => {
     });
   });
 
-  describe('Environment Detection', () => {
-    it('detects development environment', () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = 'development';
 
+  describe('Mock Permissions', () => {
+    it('retrieves mock permissions when configured', () => {
       const config: RBACConfig = {
         supabase: mockSupabase as any,
-        debug: false,
-        logLevel: 'warn',
-        developmentMode: false
+        mockPermissions: {
+          'read:users': true,
+          'create:users': false,
+        },
       };
 
       createRBACConfig(config);
-      expect(isDevelopmentMode()).toBe(false); // Should use explicit config
-
-      process.env.NODE_ENV = originalEnv;
+      const mockPerms = getMockPermissions();
+      
+      expect(mockPerms).toEqual({
+        'read:users': true,
+        'create:users': false,
+      });
     });
 
-    it('detects production environment', () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = 'production';
-
+    it('returns null when mock permissions not configured', () => {
       const config: RBACConfig = {
         supabase: mockSupabase as any,
-        debug: false,
-        logLevel: 'warn',
-        developmentMode: false
       };
 
       createRBACConfig(config);
-      expect(isDevelopmentMode()).toBe(false);
+      const mockPerms = getMockPermissions();
+      
+      expect(mockPerms).toBeNull();
+    });
+  });
+
+  describe('Cache Configuration', () => {
+    it('stores cache configuration correctly', () => {
+      const config: RBACConfig = {
+        supabase: mockSupabase as any,
+        cache: {
+          ttl: 60000,
+          enabled: true,
+          sessionTtl: 300000,
+        },
+      };
 
-      process.env.NODE_ENV = originalEnv;
+      createRBACConfig(config);
+      const retrievedConfig = getRBACConfig();
+      
+      expect(retrievedConfig?.cache?.ttl).toBe(60000);
+      expect(retrievedConfig?.cache?.enabled).toBe(true);
+      expect(retrievedConfig?.cache?.sessionTtl).toBe(300000);
     });
   });
 
-  describe('Configuration Validation', () => {
-    it('accepts null supabase client', () => {
-      // The function doesn't throw, it just sets the config
-      createRBACConfig({
-        supabase: null as any,
-        debug: false,
-        logLevel: 'warn',
-        developmentMode: false
-      });
+  describe('Audit Configuration', () => {
+    it('stores audit configuration with all options', () => {
+      const config: RBACConfig = {
+        supabase: mockSupabase as any,
+        audit: {
+          enabled: true,
+          logLevel: 'info',
+          batched: true,
+          batchWindow: 200,
+          batchSize: 20,
+        },
+      };
+
+      createRBACConfig(config);
+      const retrievedConfig = getRBACConfig();
       
-      const config = getRBACConfig();
-      expect(config?.supabase).toBeNull();
+      expect(retrievedConfig?.audit?.enabled).toBe(true);
+      expect(retrievedConfig?.audit?.logLevel).toBe('info');
+      expect(retrievedConfig?.audit?.batched).toBe(true);
+      expect(retrievedConfig?.audit?.batchWindow).toBe(200);
+      expect(retrievedConfig?.audit?.batchSize).toBe(20);
     });
+  });
 
-    it('accepts invalid log level values', () => {
-      // The function doesn't throw, it just sets the config
-      createRBACConfig({
+  describe('Performance Configuration', () => {
+    it('stores performance configuration options', () => {
+      const config: RBACConfig = {
         supabase: mockSupabase as any,
-        debug: false,
-        logLevel: 'invalid' as any,
-        developmentMode: false
-      });
+        performance: {
+          enableRequestDeduplication: false,
+          enableBatchedAuditLogging: false,
+          enablePerformanceTracking: true,
+        },
+      };
+
+      createRBACConfig(config);
+      const retrievedConfig = getRBACConfig();
       
-      const config = getRBACConfig();
-      expect(config?.logLevel).toBe('invalid');
+      expect(retrievedConfig?.performance?.enableRequestDeduplication).toBe(false);
+      expect(retrievedConfig?.performance?.enableBatchedAuditLogging).toBe(false);
+      expect(retrievedConfig?.performance?.enablePerformanceTracking).toBe(true);
     });
   });
 });

package/src/rbac/config.ts

@@ -10,35 +10,78 @@
 import { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../types/database';
 import { RBACSecurityConfig } from './security';
+import { createLogger } from '../utils/core/logger';
+
+const logger = createLogger('RBAC');
 
 export type LogLevel = 'error' | 'warn' | 'info' | 'debug';
 
-export interface RBACConfig {
+/** Cache configuration for RBAC (TTL, enabled, sessionTtl). */
+export interface RBACCacheConfig {
+  ttl?: number;
+  enabled?: boolean;
+  /** Session cache TTL in milliseconds (default: 5 minutes) */
+  sessionTtl?: number;
+}
+
+/** Audit configuration for RBAC (enabled, logLevel, batched, batchWindow, batchSize). */
+export interface RBACAuditConfig {
+  enabled?: boolean;
+  logLevel?: LogLevel;
+  /** Enable batched audit logging (default: true) */
+  batched?: boolean;
+  /** Time window in milliseconds (default: 100ms) */
+  batchWindow?: number;
+  /** Maximum batch size (default: 10) */
+  batchSize?: number;
+}
+
+/** Performance configuration for RBAC (deduplication, batched audit, tracking). */
+export interface RBACPerformanceConfig {
+  /** Enable request deduplication (default: true) */
+  enableRequestDeduplication?: boolean;
+  /** Enable batched audit logging (default: true) */
+  enableBatchedAuditLogging?: boolean;
+  /** Enable performance tracking (default: false in production) */
+  enablePerformanceTracking?: boolean;
+}
+
+/** Core RBAC config (supabase, debug, logLevel, etc.) (ISP). */
+export interface RBACConfigCore {
   supabase: SupabaseClient<Database>;
   debug?: boolean;
   logLevel?: LogLevel;
   developmentMode?: boolean;
   mockPermissions?: Record<string, boolean>;
-  cache?: {
-    ttl?: number;
-    enabled?: boolean;
-    sessionTtl?: number; // Session cache TTL in milliseconds (default: 5 minutes)
-  };
-  audit?: {
-    enabled?: boolean;
-    logLevel?: LogLevel;
-    batched?: boolean; // Enable batched audit logging (default: true)
-    batchWindow?: number; // Time window in milliseconds (default: 100ms)
-    batchSize?: number; // Maximum batch size (default: 10)
-  };
+}
+
+/** Cache config slice for RBAC (ISP). */
+export interface RBACConfigCache {
+  cache?: RBACCacheConfig;
+}
+
+/** Audit config slice for RBAC (ISP). */
+export interface RBACConfigAudit {
+  audit?: RBACAuditConfig;
+}
+
+/** Security config slice for RBAC (ISP). */
+export interface RBACConfigSecurity {
   security?: Partial<RBACSecurityConfig>;
-  performance?: {
-    enableRequestDeduplication?: boolean; // Enable request deduplication (default: true)
-    enableBatchedAuditLogging?: boolean; // Enable batched audit logging (default: true)
-    enablePerformanceTracking?: boolean; // Enable performance tracking (default: false in production)
-  };
 }
 
+/** Performance config slice for RBAC (ISP). */
+export interface RBACConfigPerformance {
+  performance?: RBACPerformanceConfig;
+}
+
+/** RBAC config (ISP: composed from focused interfaces). */
+export type RBACConfig = RBACConfigCore
+  & RBACConfigCache
+  & RBACConfigAudit
+  & RBACConfigSecurity
+  & RBACConfigPerformance;
+
 export interface RBACLogger {
   error: (message: string, ...args: unknown[]) => void;
   warn: (message: string, ...args: unknown[]) => void;
@@ -73,21 +116,21 @@ class RBACConfigManager {
     
     this.logger = {
       error: (message: string, ...args: unknown[]) => {
-        console.error(`[RBAC ERROR] ${message}`, ...args);
+        logger.error(message, ...args);
       },
       warn: (message: string, ...args: unknown[]) => {
         if (logLevel === 'warn' || logLevel === 'info' || logLevel === 'debug') {
-          console.warn(`[RBAC WARN] ${message}`, ...args);
+          logger.warn(message, ...args);
         }
       },
       info: (message: string, ...args: unknown[]) => {
         if (logLevel === 'info' || logLevel === 'debug') {
-          console.info(`[RBAC INFO] ${message}`, ...args);
+          logger.info(message, ...args);
         }
       },
       debug: (message: string, ...args: unknown[]) => {
         if (debug && logLevel === 'debug') {
-          console.debug(`[RBAC DEBUG] ${message}`, ...args);
+          logger.debug(message, ...args);
         }
       },
     };
@@ -95,10 +138,10 @@ class RBACConfigManager {
 
   private createDefaultLogger(): RBACLogger {
     return {
-      error: (message: string, ...args: unknown[]) => console.error(`[RBAC ERROR] ${message}`, ...args),
-      warn: (message: string, ...args: unknown[]) => console.warn(`[RBAC WARN] ${message}`, ...args),
-      info: (message: string, ...args: unknown[]) => console.info(`[RBAC INFO] ${message}`, ...args),
-      debug: (message: string, ...args: unknown[]) => console.debug(`[RBAC DEBUG] ${message}`, ...args),
+      error: (message: string, ...args: unknown[]) => logger.error(message, ...args),
+      warn: (message: string, ...args: unknown[]) => logger.warn(message, ...args),
+      info: (message: string, ...args: unknown[]) => logger.info(message, ...args),
+      debug: (message: string, ...args: unknown[]) => logger.debug(message, ...args),
     };
   }