@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/secureClient.test.ts

@@ -13,8 +13,7 @@ import {
   createSecureClient, 
   fromSupabaseClient 
 } from './secureClient';
-import { UUID } from './types';
-import { Database } from '../types/database';
+import { UUID, OrganisationContextRequiredError } from './types';
 
 // Mock the Supabase createClient function
 vi.mock('@supabase/supabase-js', () => ({
@@ -25,22 +24,34 @@ import { createClient } from '@supabase/supabase-js';
 const mockCreateClient = vi.mocked(createClient);
 
 // Mock Supabase client
-const createMockSupabaseClient = () => ({
-  from: vi.fn(() => ({
-    select: vi.fn().mockReturnThis(),
-    insert: vi.fn().mockReturnThis(),
-    update: vi.fn().mockReturnThis(),
-    delete: vi.fn().mockReturnThis(),
-    eq: vi.fn().mockReturnThis(),
-    single: vi.fn().mockResolvedValue({ data: null, error: null }),
-    maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null })
-  })),
-  rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
-  auth: {
-    getUser: vi.fn().mockResolvedValue({ data: { user: null }, error: null }),
-    getSession: vi.fn().mockResolvedValue({ data: { session: null }, error: null })
-  }
-});
+const createMockSupabaseClient = () => {
+  const createQueryBuilder = () => {
+    const promise = Promise.resolve({ data: null, error: null });
+    const builder = Object.assign(promise, {
+      select: vi.fn().mockReturnThis(),
+      insert: vi.fn().mockReturnThis(),
+      update: vi.fn().mockReturnThis(),
+      delete: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      or: vi.fn().mockReturnThis(),
+      single: vi.fn().mockResolvedValue({ data: null, error: null }),
+      maybeSingle: vi.fn().mockResolvedValue({ data: null, error: null })
+    });
+    return builder;
+  };
+  
+  return {
+    from: vi.fn(() => createQueryBuilder()),
+    rpc: vi.fn().mockResolvedValue({ data: null, error: null }),
+    functions: {
+      invoke: vi.fn().mockResolvedValue({ data: null, error: null })
+    },
+    auth: {
+      getUser: vi.fn().mockResolvedValue({ data: { user: null }, error: null }),
+      getSession: vi.fn().mockResolvedValue({ data: { session: null }, error: null })
+    }
+  };
+};
 
 describe('SecureSupabaseClient', () => {
   let mockSupabase: any;
@@ -71,21 +82,9 @@ describe('SecureSupabaseClient', () => {
   describe('Client Creation', () => {
     it('creates client with organisation context', () => {
       expect(secureClient).toBeInstanceOf(SecureSupabaseClient);
-    });
-
-    it('sets organisation context in headers', () => {
-      // Access private properties for testing
-      const client = secureClient as any;
-      expect(client.organisationId).toBe(mockOrgId);
-      expect(client.eventId).toBe(mockEventId);
-      expect(client.appId).toBe(mockAppId);
-    });
-
-    it('creates base Supabase client with correct configuration', () => {
-      const client = secureClient as any;
-      expect(client.supabase).toBeDefined();
-      expect(client.supabaseUrl).toBe('https://test.supabase.co');
-      expect(client.supabaseKey).toBe('test-key');
+      expect(secureClient.getOrganisationId()).toBe(mockOrgId);
+      expect(secureClient.getEventId()).toBe(mockEventId);
+      expect(secureClient.getAppId()).toBe(mockAppId);
     });
   });
 
@@ -168,40 +167,24 @@ describe('SecureSupabaseClient', () => {
   });
 
   describe('Context Validation', () => {
-    it('validates organisation ID format', () => {
-      // The constructor doesn't validate UUID format, it just sets the value
-      // Validation happens when queries are executed
+    it('accepts and stores organisation context values', () => {
       const client = new SecureSupabaseClient(
         'https://test.supabase.co',
         'test-key',
-        'invalid-uuid' as UUID
+        'org-123' as UUID
       );
-      expect(client.getOrganisationId()).toBe('invalid-uuid');
+      expect(client.getOrganisationId()).toBe('org-123');
     });
 
-    it('validates app ID format when provided', () => {
-      // The constructor doesn't validate UUID format, it just sets the value
-      // Validation happens when queries are executed
+    it('accepts and stores app context values', () => {
       const client = new SecureSupabaseClient(
         'https://test.supabase.co',
         'test-key',
         mockOrgId,
         'event-123',
-        'invalid-uuid' as UUID
+        'app-456' as UUID
       );
-      expect(client.getAppId()).toBe('invalid-uuid');
-    });
-
-    it('accepts valid UUIDs', () => {
-      expect(() => {
-        new SecureSupabaseClient(
-          'https://test.supabase.co',
-          'test-key',
-          '123e4567-e89b-12d3-a456-426614174000' as UUID,
-          'event-123',
-          '123e4567-e89b-12d3-a456-426614174001' as UUID
-        );
-      }).not.toThrow();
+      expect(client.getAppId()).toBe('app-456');
     });
   });
 
@@ -246,68 +229,65 @@ describe('SecureSupabaseClient', () => {
   });
 
   describe('Context Switching', () => {
-    it('allows switching organisation context', () => {
+    it('creates new client with updated organisation context', () => {
       const newOrgId = 'org-456' as UUID;
       const newClient = secureClient.withContext({ organisationId: newOrgId });
       
       expect(newClient.getOrganisationId()).toBe(newOrgId);
-      expect(secureClient.getOrganisationId()).toBe(mockOrgId); // Original unchanged
-    });
-
-    it('validates new organisation context', () => {
-      // The withContext method doesn't validate UUID format, it just sets the value
-      const newClient = secureClient.withContext({ organisationId: 'invalid-uuid' as UUID });
-      expect(newClient.getOrganisationId()).toBe('invalid-uuid');
+      expect(newClient).toBeInstanceOf(SecureSupabaseClient);
+      // Original client unchanged
+      expect(secureClient.getOrganisationId()).toBe(mockOrgId);
     });
 
-    it('allows switching event context', () => {
+    it('creates new client with updated event context', () => {
       const newEventId = 'event-789';
       const newClient = secureClient.withContext({ eventId: newEventId });
       
       expect(newClient.getEventId()).toBe(newEventId);
-      expect(secureClient.getEventId()).toBe(mockEventId); // Original unchanged
+      expect(newClient).toBeInstanceOf(SecureSupabaseClient);
+      // Original client unchanged
+      expect(secureClient.getEventId()).toBe(mockEventId);
     });
 
-    it('allows switching app context', () => {
+    it('creates new client with updated app context', () => {
       const newAppId = 'app-101' as UUID;
       const newClient = secureClient.withContext({ appId: newAppId });
       
       expect(newClient.getAppId()).toBe(newAppId);
-      expect(secureClient.getAppId()).toBe(mockAppId); // Original unchanged
+      expect(newClient).toBeInstanceOf(SecureSupabaseClient);
+      // Original client unchanged
+      expect(secureClient.getAppId()).toBe(mockAppId);
     });
-  });
 
-  describe('Security Features', () => {
-    it('prevents direct database access without context', () => {
-      // The SecureSupabaseClient doesn't prevent access to the underlying client
-      // It just injects context when queries are made
-      const client = secureClient.getClient();
-      expect(() => {
-        client.from('users').select('*');
-      }).not.toThrow();
-    });
-
-    it('enforces RLS policies through context', async () => {
-      // Set up spy on the from method
-      const fromSpy = vi.spyOn(mockSupabase, 'from');
-      
-      await secureClient.getClient().from('users').select('*');
+    it('preserves existing context when only updating one field', () => {
+      const newOrgId = 'org-456' as UUID;
+      const newClient = secureClient.withContext({ organisationId: newOrgId });
       
-      // Verify that the query includes organisation context
-      expect(fromSpy).toHaveBeenCalledWith('users');
+      expect(newClient.getOrganisationId()).toBe(newOrgId);
+      expect(newClient.getEventId()).toBe(mockEventId);
+      expect(newClient.getAppId()).toBe(mockAppId);
     });
+  });
 
-    it('logs security violations', () => {
-      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-      
-      // The SecureSupabaseClient doesn't log security violations
-      // It just injects context when queries are made
-      const client = secureClient.getClient();
-      client.from('users').select('*');
+  describe('Security Features', () => {
+    it('enforces organisation context for queries', () => {
+      const clientWithoutContext = new SecureSupabaseClient(
+        'https://test.supabase.co',
+        'test-key',
+        '' as UUID // Empty organisation ID
+      );
 
-      expect(consoleSpy).not.toHaveBeenCalled();
+      // Queries should throw when organisation context is missing
+      expect(() => {
+        clientWithoutContext.getClient().from('users').select('*');
+      }).toThrow('Organisation context is required for this operation');
+    });
 
-      consoleSpy.mockRestore();
+    it('allows queries with valid organisation context', async () => {
+      // Should execute without throwing an error
+      await expect(async () => {
+        await secureClient.getClient().from('users').select('*');
+      }).not.toThrow();
     });
   });
 });
@@ -326,6 +306,7 @@ describe('createSecureClient', () => {
     );
 
     expect(client).toBeInstanceOf(SecureSupabaseClient);
+    expect(client.getOrganisationId()).toBe('org-123');
   });
 
   it('creates secure client with all parameters', () => {
@@ -338,22 +319,9 @@ describe('createSecureClient', () => {
     );
 
     expect(client).toBeInstanceOf(SecureSupabaseClient);
-  });
-
-  it('validates required parameters', () => {
-    // The createSecureClient function doesn't validate parameters, it just passes them through
-    // It relies on the underlying Supabase client to handle URL/key validation
-    expect(() => {
-      createSecureClient('', 'test-key', 'org-123' as UUID);
-    }).not.toThrow();
-
-    expect(() => {
-      createSecureClient('https://test.supabase.co', '', 'org-123' as UUID);
-    }).not.toThrow();
-
-    // Empty organisation ID is allowed (validation happens at query time)
-    const client = createSecureClient('https://test.supabase.co', 'test-key', '' as UUID);
-    expect(client.getOrganisationId()).toBe('');
+    expect(client.getOrganisationId()).toBe('org-123');
+    expect(client.getEventId()).toBe('event-456');
+    expect(client.getAppId()).toBe('app-789');
   });
 });
 
@@ -426,7 +394,7 @@ describe('Integration with RBAC', () => {
     rpcSpy.mockRestore();
   });
 
-  it('enforces organisation isolation', async () => {
+  it('maintains separate organisation contexts for different clients', () => {
     const client1 = createSecureClient(
       'https://test.supabase.co',
       'test-key',
@@ -439,10 +407,426 @@ describe('Integration with RBAC', () => {
       'org-456' as UUID
     );
 
-    // Perform queries from each client and ensure no exceptions are thrown
-    expect(async () => {
-      await client1.getClient().from('users').select('*');
-      await client2.getClient().from('users').select('*');
+    expect(client1.getOrganisationId()).toBe('org-123');
+    expect(client2.getOrganisationId()).toBe('org-456');
+  });
+});
+
+describe('RPC Parameter Injection', () => {
+  const mockOrgId = 'org-123' as UUID;
+  const mockEventId = 'event-456';
+  const mockAppId = 'app-789' as UUID;
+  let mockSupabase: any;
+
+  beforeEach(() => {
+    mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+
+  it('injects context parameters for whitelisted RPCs', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('data_rbac_roles_list', {});
+    
+    // data_rbac_roles_list: only p_organisation_id is injected (not p_event_id/p_app_id)
+    // so that Edit User can load all event-app roles for a user
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({
+        p_organisation_id: mockOrgId,
+      }),
+      undefined
+    );
+  });
+
+  it('does not inject parameters for non-whitelisted RPCs', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('some_other_function', {});
+    
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'some_other_function',
+      {},
+      undefined
+    );
+  });
+
+  it('does not overwrite explicitly provided RPC parameters', async () => {
+    // Spy on the mock's rpc before creating the client
+    const rpcSpy = vi.spyOn(mockSupabase, 'rpc');
+    
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+    
+    await client.getClient().rpc('data_rbac_roles_list', {
+      p_organisation_id: 'different-org' as UUID,
+    });
+    
+    // data_rbac_roles_list: only p_organisation_id is injected (not p_event_id/p_app_id)
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({
+        p_organisation_id: 'different-org',
+      }),
+      undefined
+    );
+  });
+
+  it('allows global RPCs without organisation context', async () => {
+    const clientWithoutOrg = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      false
+    );
+
+    const rpcSpy = vi.spyOn(clientWithoutOrg.getClient() as any, 'rpc');
+    
+    await expect(
+      clientWithoutOrg.getClient().rpc('data_rbac_apps_list', {})
+    ).resolves.toBeDefined();
+    
+    expect(rpcSpy).toHaveBeenCalled();
+  });
+
+  it('rejects data_rbac_roles_list when organisationId is null and caller is not super admin', () => {
+    const clientWithoutOrg = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      false
+    );
+
+    expect(() => {
+      clientWithoutOrg.getClient().rpc('data_rbac_roles_list', { p_user_id: 'user-123' as UUID });
+    }).toThrow(OrganisationContextRequiredError);
+  });
+});
+
+describe('Super Admin Bypass', () => {
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('allows queries without organisation context for super admins', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    expect(() => {
+      superAdminClient.getClient().from('users').select('*');
+    }).not.toThrow();
+  });
+
+  it('allows inserts without organisation context for super admins', async () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    await expect(
+      superAdminClient.getClient().from('users').insert({ name: 'Test' })
+    ).resolves.toBeDefined();
+  });
+
+  it('allows queries to system-wide tables for super admins', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    expect(() => {
+      superAdminClient.getClient().from('core_organisations').select('*');
     }).not.toThrow();
   });
+
+  it('allows data_rbac_roles_list when organisationId is null and caller is super admin', async () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    const rpcSpy = vi.spyOn(superAdminClient.getClient() as any, 'rpc');
+
+    await expect(
+      superAdminClient.getClient().rpc('data_rbac_roles_list', { p_user_id: 'user-123' as UUID })
+    ).resolves.toBeDefined();
+
+    expect(rpcSpy).toHaveBeenCalledWith(
+      'data_rbac_roles_list',
+      expect.objectContaining({ p_user_id: 'user-123' })
+    );
+  });
+});
+
+describe('Table-Specific Logic', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('skips organisation filter for core_organisations table', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('core_organisations').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('skips organisation filter for rbac_apps table', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('rbac_apps').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('handles rbac_user_profiles with conditional filtering', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const query = client.getClient().from('rbac_user_profiles').select('*');
+    
+    expect(query).toBeDefined();
+  });
+
+  it('allows super admin to query rbac_user_profiles without filter', () => {
+    const superAdminClient = new SecureSupabaseClient(
+      'https://test.supabase.co',
+      'test-key',
+      null,
+      undefined,
+      undefined,
+      true
+    );
+
+    const query = superAdminClient.getClient().from('rbac_user_profiles').select('*');
+    
+    expect(query).toBeDefined();
+  });
+});
+
+describe('Edge Function Client', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('returns edge function client without custom headers', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const edgeClient = client.getEdgeFunctionClient();
+    
+    expect(edgeClient).toBeDefined();
+    expect(edgeClient).not.toBe(client.getClient());
+  });
+
+  it('uses existing client for edge functions when reusing client', () => {
+    const existingClient = createMockSupabaseClient();
+    const secureClient = fromSupabaseClient(
+      existingClient as any,
+      mockOrgId
+    );
+
+    const edgeClient = secureClient.getEdgeFunctionClient();
+    
+    expect(edgeClient).toBe(existingClient);
+  });
+
+  it('proxies functions.invoke to edge function client', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const proxiedClient = client.getClient();
+    
+    expect(proxiedClient.functions).toBeDefined();
+  });
+});
+
+describe('Insert Context Injection', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('injects organisation_id for regular tables', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').insert({ name: 'Test' })
+    ).resolves.toBeDefined();
+  });
+
+  it('does not inject organisation_id for tables without it', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('rbac_apps').insert({ name: 'Test App' })
+    ).resolves.toBeDefined();
+  });
+
+  it('handles array inserts with organisation context', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').insert([
+        { name: 'User 1' },
+        { name: 'User 2' }
+      ])
+    ).resolves.toBeDefined();
+  });
+});
+
+describe('Update and Delete Context Filtering', () => {
+  const mockOrgId = 'org-123' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('adds organisation filter to update queries', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').update({ name: 'Updated' }).eq('id', 'user-123')
+    ).resolves.toBeDefined();
+  });
+
+  it('adds organisation filter to delete queries', async () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    await expect(
+      client.getClient().from('users').delete().eq('id', 'user-123')
+    ).resolves.toBeDefined();
+  });
+});
+
+describe('withContext', () => {
+  const mockOrgId = 'org-123' as UUID;
+  const mockEventId = 'event-456';
+  const mockAppId = 'app-789' as UUID;
+  
+  beforeEach(() => {
+    const mockSupabase = createMockSupabaseClient();
+    mockCreateClient.mockReturnValue(mockSupabase as any);
+  });
+  
+  it('creates new client with updated super admin status', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId
+    );
+
+    const superAdminClient = client.withContext({ isSuperAdmin: true });
+    
+    expect(superAdminClient).toBeInstanceOf(SecureSupabaseClient);
+    expect(superAdminClient).not.toBe(client);
+  });
+
+  it('preserves all context when updating one field', () => {
+    const client = createSecureClient(
+      'https://test.supabase.co',
+      'test-key',
+      mockOrgId,
+      mockEventId,
+      mockAppId
+    );
+
+    const newClient = client.withContext({ organisationId: 'new-org' as UUID });
+    
+    expect(newClient.getOrganisationId()).toBe('new-org');
+    expect(newClient.getEventId()).toBe(mockEventId);
+    expect(newClient.getAppId()).toBe(mockAppId);
+  });
 });