@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/engine.test.ts

@@ -4,19 +4,62 @@
  * @module RBAC/Engine
  * @since 0.1.0
  * 
- * Basic tests for the RBACEngine class focusing on essential functionality.
+ * Comprehensive tests for the RBACEngine class focusing on essential functionality.
  */
 
-import { vi, describe, it, expect, beforeEach } from 'vitest';
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { RBACEngine } from './engine';
 import type { PermissionCheck, Permission, UUID, Scope } from './types';
+import { rbacCache } from './cache';
+import { emitAuditEvent } from './audit';
+import { SecurityContext } from './security';
+
+// Mock dependencies
+vi.mock('./cache', () => ({
+  rbacCache: {
+    get: vi.fn(),
+    set: vi.fn(),
+    delete: vi.fn(),
+  },
+  RBACCache: {
+    generateKey: vi.fn((userId, permission, orgId, eventId, appId, pageId) => 
+      `cache:${userId}:${permission}:${orgId}:${eventId}:${appId}:${pageId || ''}`
+    ),
+    generateAccessLevelKey: vi.fn((userId, orgId, eventId, appId) => 
+      `access:${userId}:${orgId}:${eventId}:${appId || ''}`
+    ),
+    generatePermissionMapKey: vi.fn((userId, orgId, eventId, appId) => 
+      `permmap:${userId}:${orgId}:${eventId}:${appId || ''}`
+    ),
+  },
+}));
+
+vi.mock('./audit', () => ({
+  emitAuditEvent: vi.fn(),
+}));
+
+vi.mock('./cache-invalidation', () => ({
+  initializeCacheInvalidation: vi.fn(),
+}));
+
+vi.mock('./config', () => ({
+  getRBACLogger: vi.fn(() => ({
+    error: vi.fn(),
+    warn: vi.fn(),
+  })),
+}));
+
+vi.mock('./errors', () => ({
+  categorizeError: vi.fn((_error) => 'database_error'),
+  mapErrorCategoryToSecurityEventType: vi.fn((_category) => 'database_error'),
+}));
 
 // Mock Supabase client
-const createMockSupabaseClient = () => ({
-  from: vi.fn(() => ({
+const createMockSupabaseClient = () => {
+  const mockFrom = vi.fn(() => ({
     select: vi.fn().mockReturnThis(),
     eq: vi.fn().mockReturnThis(),
-    is: vi.fn().mockReturnThis(), // Fixed: use 'is' not 'is_'
+    is: vi.fn().mockReturnThis(),
     lte: vi.fn().mockReturnThis(),
     or: vi.fn().mockReturnThis(),
     limit: vi.fn().mockResolvedValue({ 
@@ -24,215 +67,1016 @@ const createMockSupabaseClient = () => ({
       error: null 
     }),
     single: vi.fn().mockResolvedValue({ data: null, error: null }),
-    data: null,
-    error: null
-  })),
-  rpc: vi.fn().mockResolvedValue({ data: false, error: null })
-});
+    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null }),
+  }));
+  
+  return {
+    from: mockFrom,
+    rpc: vi.fn().mockResolvedValue({ data: false, error: null }),
+  };
+};
 
 describe('RBACEngine', () => {
   let engine: RBACEngine;
   let mockSupabase: any;
-  const mockUserId = 'user-123' as UUID;
-  const mockOrgId = 'org-456' as UUID;
-  const baseScope: Scope = { organisationId: mockOrgId, appId: 'app-1' as UUID };
+  const mockUserId = '123e4567-e89b-12d3-a456-426614174000' as UUID;
+  const mockOrgId = '123e4567-e89b-12d3-a456-426614174001' as UUID;
+  const baseScope: Scope = { organisationId: mockOrgId, appId: '123e4567-e89b-12d3-a456-426614174002' as UUID };
+  const validSecurityContext: SecurityContext = {
+    userId: mockUserId,
+    organisationId: mockOrgId,
+    ipAddress: '192.168.1.1',
+    userAgent: 'Mozilla/5.0',
+    timestamp: new Date(),
+  };
 
   beforeEach(() => {
     vi.clearAllMocks();
     mockSupabase = createMockSupabaseClient();
     engine = new RBACEngine(mockSupabase);
+    vi.mocked(rbacCache.get).mockReturnValue(null);
   });
 
-  describe('Permission Resolution', () => {
-    it('resolves super admin permissions correctly', async () => {
-      // Simplified test - just verify the engine doesn't crash and returns a boolean
-      const permissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: baseScope,
-        permission: 'read:users' as Permission
-      };
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('isPermitted', () => {
+    describe('Security Context Validation', () => {
+      it('requires security context parameter', async () => {
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        // TypeScript will catch this, but we test runtime behavior
+        await expect(
+          engine.isPermitted(permissionCheck, validSecurityContext)
+        ).resolves.toBeDefined();
+      });
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(typeof result).toBe('boolean');
+      it('validates security context userId format', async () => {
+        const invalidContext: SecurityContext = {
+          ...validSecurityContext,
+          userId: 'invalid-uuid' as UUID,
+        };
+
+        const permissionCheck: PermissionCheck = {
+          userId: 'invalid-uuid' as UUID,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, invalidContext);
+        expect(result).toBe(false);
+      });
+
+      it('validates permission format in security context', async () => {
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'invalid-permission' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(result).toBe(false);
+      });
+
+      it('validates scope format in security context', async () => {
+        const invalidScopeCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: {} as Scope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(invalidScopeCheck, validSecurityContext);
+        expect(result).toBe(false);
+      });
     });
 
-    it('resolves organisation admin permissions correctly', async () => {
-      // Simplified test - just verify the engine doesn't crash and returns a boolean
-      const permissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: baseScope,
-        permission: 'read:users' as Permission
+    describe('Rate Limiting', () => {
+      it('respects rate limits from security middleware', async () => {
+        // Mock rate limit exceeded
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        // The middleware will reject if rate limit is exceeded
+        // We can't easily test this without mocking the middleware, but we verify it's called
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(typeof result).toBe('boolean');
+      });
+    });
+
+    describe('Cache Behavior', () => {
+      it('returns cached result when cache hit', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(true);
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(result).toBe(true);
+        expect(mockSupabase.rpc).not.toHaveBeenCalled();
+        expect(emitAuditEvent).not.toHaveBeenCalled();
+      });
+
+      it('calls RPC when cache miss', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(result).toBe(true);
+        expect(mockSupabase.rpc).toHaveBeenCalledWith(
+          'rbac_check_permission_simplified',
+          expect.objectContaining({
+            p_user_id: mockUserId,
+            p_permission: 'read:users',
+          })
+        );
+      });
+
+      it('caches RPC result', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(rbacCache.set).toHaveBeenCalled();
+      });
+    });
+
+    describe('RPC Integration', () => {
+      it('calls RPC with correct parameters', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: { organisationId: mockOrgId, eventId: 'event-1', appId: baseScope.appId },
+          permission: 'read:users' as Permission,
+          pageId: 'page-123' as UUID,
+        };
+
+        await engine.isPermitted(permissionCheck, validSecurityContext);
+
+        expect(mockSupabase.rpc).toHaveBeenCalledWith(
+          'rbac_check_permission_simplified',
+          {
+            p_user_id: mockUserId,
+            p_permission: 'read:users',
+            p_organisation_id: mockOrgId,
+            p_event_id: 'event-1',
+            p_app_id: baseScope.appId,
+            p_page_id: 'page-123',
+          }
+        );
+      });
+
+      it('handles RPC errors gracefully', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({
+          data: null,
+          error: { message: 'Database error', code: 'PGRST116' },
+        });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(result).toBe(false);
+      });
+
+      it('handles RPC exceptions gracefully', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockRejectedValue(new Error('Network error'));
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        const result = await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('Audit Logging', () => {
+      it('emits audit event when permission granted', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        await engine.isPermitted(permissionCheck, validSecurityContext);
+
+        expect(emitAuditEvent).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: 'permission_check',
+            userId: mockUserId,
+            organisationId: mockOrgId,
+            permission: 'read:users',
+            decision: true,
+            source: 'api',
+          })
+        );
+      });
+
+      it('emits audit event when permission denied', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: false, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        await engine.isPermitted(permissionCheck, validSecurityContext);
+
+        expect(emitAuditEvent).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: 'permission_denied',
+            userId: mockUserId,
+            organisationId: mockOrgId,
+            permission: 'read:users',
+            decision: false,
+            source: 'api',
+          })
+        );
+      });
+
+      it('skips audit logging for cache hits', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(true);
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: baseScope,
+          permission: 'read:users' as Permission,
+        };
+
+        await engine.isPermitted(permissionCheck, validSecurityContext);
+        expect(emitAuditEvent).not.toHaveBeenCalled();
+      });
+
+      it('skips audit logging when no organisation context', async () => {
+        vi.mocked(rbacCache.get).mockReturnValue(null);
+        mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+        const permissionCheck: PermissionCheck = {
+          userId: mockUserId,
+          scope: { appId: baseScope.appId }, // No organisationId
+          permission: 'read:users' as Permission,
+        };
+
+        const contextWithoutOrg: SecurityContext = {
+          ...validSecurityContext,
+          organisationId: null,
+        };
+
+        await engine.isPermitted(permissionCheck, contextWithoutOrg);
+        expect(emitAuditEvent).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('getAccessLevel', () => {
+    it('returns cached access level when available', async () => {
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return false; // Not super admin (cached)
+        }
+        if (key.startsWith('access:')) {
+          return 'admin'; // Cached access level
+        }
+        return null;
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('admin');
+      expect(mockSupabase.from).not.toHaveBeenCalled();
+    });
+
+    it('checks super admin status first', async () => {
+      // Mock cache to return null for super admin check, then mock DB query
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return null; // Not cached
+        }
+        return null; // Not cached for access level either
+      });
+
+      // Mock the super admin database query
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [{ role: 'super_admin' }],
+          error: null,
+        }),
       };
+      mockSupabase.from.mockReturnValue(mockQuery);
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(typeof result).toBe('boolean');
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('super');
     });
 
-    it('resolves event admin permissions correctly', async () => {
-      // Simplified test - just verify the engine doesn't crash and returns a boolean
-      const permissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: { organisationId: mockOrgId, eventId: 'event-1', appId: 'app-1' as UUID },
-        permission: 'read:events' as Permission
+    it('defaults to viewer when no roles found', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      // Mock the super admin database query to return empty
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
       };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(typeof result).toBe('boolean');
+      expect(accessLevel).toBe('viewer');
     });
+  });
 
-    it('denies permissions for insufficient roles', async () => {
-      const permissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: baseScope,
-        permission: 'delete:users' as Permission
+  describe('getPermissionMap', () => {
+    it('returns cached permission map when available', async () => {
+      const cachedMap = { 'read:page.meals': true };
+      vi.mocked(rbacCache.get)
+        .mockReturnValueOnce(null) // For super admin cache check
+        .mockReturnValueOnce(cachedMap); // For permission map cache
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual(cachedMap);
+    });
+
+    it('returns wildcard map for super admins', async () => {
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return null; // Not cached
+        }
+        return null; // Not cached for permission map either
+      });
+
+      // Mock the super admin database query
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [{ role: 'super_admin' }],
+          error: null,
+        }),
       };
+      mockSupabase.from.mockReturnValue(mockQuery);
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(result).toBe(false);
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({ '*': true });
     });
 
-    it('handles database errors gracefully', async () => {
-      mockSupabase.rpc.mockRejectedValue(new Error('Database connection failed'));
+    it('returns empty map when no organisation context', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
 
-      const permissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: baseScope,
-        permission: 'read:users' as Permission
+      // Mock the super admin database query to return empty
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
       };
+      mockSupabase.from.mockReturnValue(mockQuery);
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(result).toBe(false);
+      const scope: Scope = { appId: baseScope.appId }; // No organisationId
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({});
     });
   });
 
-  describe('Role Hierarchy', () => {
-    it('respects global role hierarchy', async () => {
-      // Simplified test - just verify the engine doesn't crash and returns a boolean
-      const superAdminCheck: PermissionCheck = {
+  describe('resolveAppContext', () => {
+    it('resolves app context successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [{ app_id: baseScope.appId, has_access: true }],
+        error: null,
+      });
+
+      const context = await engine.resolveAppContext({
         userId: mockUserId,
-        scope: baseScope,
-        permission: 'read:users' as Permission
-      };
+        appName: 'test-app',
+      });
 
-      const result = await engine.isPermitted(superAdminCheck);
-      expect(typeof result).toBe('boolean');
+      expect(context).toEqual({
+        appId: baseScope.appId,
+        hasAccess: true,
+      });
     });
 
-    it('respects organisation role hierarchy', async () => {
-      // Simplified test - just verify the engine doesn't crash and returns a boolean
-      const orgAdminCheck: PermissionCheck = {
+    it('returns null when app not found', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [],
+        error: null,
+      });
+
+      const context = await engine.resolveAppContext({
         userId: mockUserId,
-        scope: baseScope,
-        permission: 'read:users' as Permission
-      };
+        appName: 'nonexistent-app',
+      });
 
-      const result = await engine.isPermitted(orgAdminCheck);
-      expect(typeof result).toBe('boolean');
+      expect(context).toBeNull();
+    });
+
+    it('handles RPC errors gracefully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: null,
+        error: { message: 'Database error' },
+      });
+
+      const context = await engine.resolveAppContext({
+        userId: mockUserId,
+        appName: 'test-app',
+      });
+
+      expect(context).toBeNull();
     });
   });
 
-  describe('Access Level Resolution', () => {
-    it('resolves super admin access level', async () => {
-      const scope: Scope = { organisationId: mockOrgId, appId: 'app-1' as UUID };
-      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
-      
-      expect(typeof accessLevel).toBe('string');
+  describe('getRoleContext', () => {
+    it('returns role context successfully', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          { permission_type: 'all_permissions', role_name: 'super_admin' },
+          { permission_type: 'organisation_access', role_name: 'org_admin' },
+        ],
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: 'super_admin',
+        organisationRole: 'org_admin',
+        eventAppRole: null,
+      });
     });
 
-    it('resolves organisation admin access level', async () => {
-      const scope: Scope = { organisationId: mockOrgId, appId: 'app-1' as UUID };
+    it('returns empty context on error', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: null,
+        error: { message: 'Database error' },
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      });
+    });
+
+    it('handles non-array data', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: null,
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      });
+    });
+
+    it('maps event app roles correctly', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          { permission_type: 'event_app_access', role_name: 'viewer' },
+          { permission_type: 'event_app_access', role_name: 'participant' },
+          { permission_type: 'event_app_access', role_name: 'planner' },
+          { permission_type: 'event_app_access', role_name: 'admin' },
+        ],
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      // Should use the last one (admin maps to event_admin)
+      expect(roleContext.eventAppRole).toBe('event_admin');
+    });
+
+    it('maps organisation roles correctly', async () => {
+      mockSupabase.rpc.mockResolvedValue({
+        data: [
+          { permission_type: 'organisation_access', role_name: 'supporter' },
+          { permission_type: 'organisation_access', role_name: 'member' },
+          { permission_type: 'organisation_access', role_name: 'leader' },
+          { permission_type: 'organisation_access', role_name: 'org_admin' },
+        ],
+        error: null,
+      });
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      // Should use the last one
+      expect(roleContext.organisationRole).toBe('org_admin');
+    });
+
+    it('handles exceptions in getRoleContext', async () => {
+      mockSupabase.rpc.mockRejectedValue(new Error('Network error'));
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const roleContext = await engine.getRoleContext({ userId: mockUserId, scope });
+
+      expect(roleContext).toEqual({
+        globalRole: null,
+        organisationRole: null,
+        eventAppRole: null,
+      });
+    });
+  });
+
+  describe('getAccessLevel - Organisation Roles', () => {
+    it('returns admin for org_admin role', async () => {
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return false; // Not super admin (cached) - this means checkSuperAdmin won't call from()
+        }
+        return null;
+      });
+
+      // Create a query builder that chains properly
+      // The engine uses .limit(1) which returns { data: Array, error }
+      // The engine calls: from('rbac_organisation_roles').select('role').eq(...).limit(1)
+      // which returns { data: [{ role: 'org_admin' }], error: null }
+      const createOrgQueryBuilder = () => {
+        const builder: any = {
+          select: vi.fn().mockReturnThis(),
+          eq: vi.fn().mockReturnThis(),
+          is: vi.fn().mockReturnThis(),
+          lte: vi.fn().mockReturnThis(),
+          or: vi.fn().mockReturnThis(),
+          limit: vi.fn().mockResolvedValue({
+            data: [{ role: 'org_admin' }],
+            error: null,
+          }),
+        };
+        return builder;
+      };
+
+      // Since checkSuperAdmin returns false from cache, it won't call from()
+      // So we only need to mock the org role query
+      mockSupabase.from.mockReturnValueOnce(createOrgQueryBuilder());
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
       const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
-      
-      expect(typeof accessLevel).toBe('string');
+
+      expect(accessLevel).toBe('admin');
     });
 
-    it('defaults to viewer access level', async () => {
-      const scope: Scope = { organisationId: mockOrgId, appId: 'app-1' as UUID };
+    it('returns viewer when no org role found', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
       const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
-      
+
       expect(accessLevel).toBe('viewer');
     });
   });
 
-  describe('Security Validation', () => {
-    it('validates input parameters', async () => {
-      const invalidCheck: PermissionCheck = {
-        userId: '' as UUID,
-        scope: baseScope,
-        permission: 'read:users' as Permission
+  describe('getAccessLevel - Event App Roles', () => {
+    it('returns admin for event_admin role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
       };
 
-      const result = await engine.isPermitted(invalidCheck);
-      expect(result).toBe(false);
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'event_admin' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery) // Super admin check
+        .mockReturnValueOnce(mockOrgQuery) // Org role check
+        .mockReturnValueOnce(mockEventQuery); // Event role check
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('admin');
     });
 
-    it('validates scope requirements', async () => {
-      const invalidScopeCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: {} as Scope,
-        permission: 'read:users' as Permission
+    it('returns planner for planner role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
       };
 
-      const result = await engine.isPermitted(invalidScopeCheck);
-      expect(result).toBe(false);
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'planner' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockOrgQuery)
+        .mockReturnValueOnce(mockEventQuery);
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('planner');
     });
 
-    it('validates permission format', async () => {
-      const invalidPermissionCheck: PermissionCheck = {
-        userId: mockUserId,
-        scope: baseScope,
-        permission: 'invalid-permission' as Permission
+    it('returns participant for participant role', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockOrgQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockEventQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        single: vi.fn().mockResolvedValue({
+          data: { role: 'participant' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockOrgQuery)
+        .mockReturnValueOnce(mockEventQuery);
+
+      const scope: Scope = { 
+        organisationId: mockOrgId, 
+        eventId: 'event-123',
+        appId: baseScope.appId 
+      };
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+
+      expect(accessLevel).toBe('participant');
+    });
+  });
+
+  describe('getPermissionMap - Edge Cases', () => {
+    it('handles empty pages array', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      const mockPagesQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockPagesQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({});
+    });
+
+    it('handles null pages data', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockSuperAdminQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
       };
 
-      const result = await engine.isPermitted(invalidPermissionCheck);
-      expect(result).toBe(false);
+      const mockPagesQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockResolvedValue({
+          data: null,
+          error: null,
+        }),
+      };
+
+      mockSupabase.from
+        .mockReturnValueOnce(mockSuperAdminQuery)
+        .mockReturnValueOnce(mockPagesQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      const permissionMap = await engine.getPermissionMap({ userId: mockUserId, scope });
+
+      expect(permissionMap).toEqual({});
     });
   });
 
-  describe('Error Handling', () => {
-    it('handles database connection errors', async () => {
-      mockSupabase.rpc.mockRejectedValue(new Error('Connection failed'));
+  describe('isPermitted - resolvePageId', () => {
+    it('resolves page name to UUID for audit logging', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+      mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+      const mockPageQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        maybeSingle: vi.fn().mockResolvedValue({
+          data: { id: '123e4567-e89b-12d3-a456-426614174000' },
+          error: null,
+        }),
+      };
+
+      mockSupabase.from.mockReturnValue(mockPageQuery);
 
       const permissionCheck: PermissionCheck = {
         userId: mockUserId,
         scope: baseScope,
-        permission: 'read:users' as Permission
+        permission: 'read:users' as Permission,
+        pageId: 'test-page-name',
       };
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(result).toBe(false);
+      await engine.isPermitted(permissionCheck, validSecurityContext);
+
+      expect(emitAuditEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          pageId: '123e4567-e89b-12d3-a456-426614174000',
+        })
+      );
     });
 
-    it('handles timeout errors gracefully', async () => {
-      mockSupabase.rpc.mockRejectedValue(new Error('Timeout'));
+    it('handles page resolution errors gracefully', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+      mockSupabase.rpc.mockResolvedValue({ data: true, error: null });
+
+      const mockPageQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        maybeSingle: vi.fn().mockResolvedValue({
+          data: null,
+          error: { message: 'Page not found', code: 'PGRST116' },
+        }),
+      };
+
+      mockSupabase.from.mockReturnValue(mockPageQuery);
 
       const permissionCheck: PermissionCheck = {
         userId: mockUserId,
         scope: baseScope,
-        permission: 'read:users' as Permission
+        permission: 'read:users' as Permission,
+        pageId: 'nonexistent-page',
       };
 
-      const result = await engine.isPermitted(permissionCheck);
-      expect(result).toBe(false);
+      // Should not throw, should use original pageId
+      await engine.isPermitted(permissionCheck, validSecurityContext);
+
+      expect(emitAuditEvent).toHaveBeenCalled();
     });
   });
 
-  describe('Performance', () => {
-    it('handles concurrent permission checks', async () => {
-      const permissionChecks = Array.from({ length: 5 }, (_, i) => ({
-        userId: mockUserId,
-        scope: baseScope,
-        permission: `read:resource${i}` as Permission
-      }));
+  describe('checkSuperAdmin - Indirect Tests', () => {
+    it('caches super admin status', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
 
-      const results = await Promise.all(
-        permissionChecks.map(check => engine.isPermitted(check))
-      );
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [{ role: 'super_admin' }],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
 
-      expect(results).toHaveLength(5);
-      results.forEach(result => {
-        expect(typeof result).toBe('boolean');
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // First call
+      await engine.getAccessLevel({ userId: mockUserId, scope });
+      
+      // Second call should use cache
+      vi.mocked(rbacCache.get).mockImplementation((key: string) => {
+        if (key.startsWith('super_admin:')) {
+          return true;
+        }
+        return null;
       });
+
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+      expect(accessLevel).toBe('super');
+      expect(mockSupabase.from).toHaveBeenCalledTimes(1); // Only called once
+    });
+
+    it('handles super admin check errors', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockRejectedValue(new Error('Database error')),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // Should handle error gracefully and return viewer
+      await expect(engine.getAccessLevel({ userId: mockUserId, scope })).rejects.toThrow('Database error');
+    });
+
+    it('handles slow super admin checks without throwing', async () => {
+      vi.mocked(rbacCache.get).mockReturnValue(null);
+
+      const mockQuery = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        is: vi.fn().mockReturnThis(),
+        lte: vi.fn().mockReturnThis(),
+        or: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: [],
+          error: null,
+        }),
+      };
+      mockSupabase.from.mockReturnValue(mockQuery);
+
+      const scope: Scope = { organisationId: mockOrgId, appId: baseScope.appId };
+      
+      // Should complete without throwing
+      const accessLevel = await engine.getAccessLevel({ userId: mockUserId, scope });
+      expect(accessLevel).toBe('viewer');
     });
   });
 });