@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/secureClient.ts

@@ -10,8 +10,7 @@
 
 import { createClient, SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../types/database';
-import { UUID } from './types';
-import { OrganisationContextRequiredError } from './types';
+import { UUID, OrganisationContextRequiredError } from './types';
 import { markClientAsSecure } from './utils/clientSecurity';
 
 /**
@@ -49,6 +48,10 @@ export class SecureSupabaseClient {
    *
    * This allowlist enables compliant consuming apps to use `secureSupabase.rpc(...)`
    * even before an organisation is selected (common during initial page load/refresh).
+   *
+   * IMPORTANT: Do NOT add `data_rbac_roles_list` here. Only super admins may call
+   * that RPC without org context (e.g. "All Organizations" / event roles). The
+   * org check is skipped in validateContextForRpc when isSuperAdmin is true.
    */
   private static readonly GLOBAL_RPC_ALLOWLIST = new Set<string>([
     'data_rbac_apps_list',
@@ -107,17 +110,17 @@ export class SecureSupabaseClient {
   private setupContextInjection() {
     const originalFrom = this.supabase.from.bind(this.supabase);
     
-    (this.supabase as any).from = (table: string): any => {
+    (this.supabase as unknown as { from: (table: string) => unknown }).from = (table: string): unknown => {
       // Validate context before allowing database operations.
       // Some tables are not organisation-scoped (e.g. rbac_apps) and must be queryable
       // without organisation context for initial bootstrapping.
       this.validateContextForTable(table);
       
       // Type assertion needed because table is a string but Supabase expects specific table names
-      const query = originalFrom(table as any);
+      const query = originalFrom(table as keyof Database['public']['Tables']);
       
       // Store table name on query object so we can access it in filter methods
-      (query as any)._tableName = table;
+      (query as { _tableName?: string })._tableName = table;
       
       // Inject organisation context into all queries
       return this.injectContext(query, table);
@@ -128,7 +131,7 @@ export class SecureSupabaseClient {
     // Override rpc method to inject context
     // Type assertion needed because we're wrapping the generic rpc method
     // The fn parameter is typed as string to match Supabase's rpc signature
-    (this.supabase as any).rpc = (fn: string, args?: any, options?: any): any => {
+    (this.supabase as unknown as { rpc: (fn: string, args?: Record<string, unknown>, options?: { count?: 'exact' | 'planned' | 'estimated' }) => unknown }).rpc = (fn: string, args?: Record<string, unknown>, options?: { count?: 'exact' | 'planned' | 'estimated' }): unknown => {
       // Validate context before allowing RPC calls.
       // Some RPCs are global (not organisation-scoped) but still require auth.uid() from JWT.
       // Allow these even without organisation context.
@@ -170,7 +173,7 @@ export class SecureSupabaseClient {
         contextArgs.p_app_id = this.appId;
       }
       
-      return originalRpc(fn as any, contextArgs, options);
+      return originalRpc(fn as never, contextArgs as never, options);
     };
   }
 
@@ -212,22 +215,29 @@ export class SecureSupabaseClient {
   /**
    * Inject organisation context into a query
    */
-  private injectContext(query: any, tableName: string) {
-    const originalSelect = query.select.bind(query);
-    const originalInsert = query.insert.bind(query);
-    const originalUpdate = query.update.bind(query);
-    const originalDelete = query.delete.bind(query);
+  private injectContext(query: unknown, tableName: string): unknown {
+    // Type query as a query builder object with the methods we need
+    const queryBuilder = query as {
+      select: (columns?: string) => unknown;
+      insert: (values: unknown) => unknown;
+      update: (values: unknown) => unknown;
+      delete: () => unknown;
+    };
+    const originalSelect = queryBuilder.select.bind(queryBuilder);
+    const originalInsert = queryBuilder.insert.bind(queryBuilder);
+    const originalUpdate = queryBuilder.update.bind(queryBuilder);
+    const originalDelete = queryBuilder.delete.bind(queryBuilder);
 
     // Override select to add organisation filter
-    query.select = (columns?: string) => {
+    queryBuilder.select = (columns?: string) => {
       const result = originalSelect(columns);
       // Store table name on query object so we can access it in filter methods
-      (result as any)._tableName = tableName;
+      (result as { _tableName?: string })._tableName = tableName;
       return this.addOrganisationFilter(result, tableName);
     };
 
     // Override insert to add organisation context
-    query.insert = (values: any) => {
+    queryBuilder.insert = (values: unknown) => {
       // Tables that don't have organisation_id column
       const tablesWithoutOrganisationId = [
         'core_organisations', // Organisation table itself - uses 'id' as primary key
@@ -254,8 +264,8 @@ export class SecureSupabaseClient {
           throw new OrganisationContextRequiredError();
         }
         const contextValues = Array.isArray(values) 
-          ? values.map(v => ({ ...v, organisation_id: this.organisationId }))
-          : { ...values, organisation_id: this.organisationId };
+          ? values.map(v => ({ ...(v as Record<string, unknown>), organisation_id: this.organisationId }))
+          : { ...(values as Record<string, unknown>), organisation_id: this.organisationId };
         return originalInsert(contextValues);
       }
       
@@ -272,20 +282,20 @@ export class SecureSupabaseClient {
         throw new OrganisationContextRequiredError();
       }
       const contextValues = Array.isArray(values) 
-        ? values.map(v => ({ ...v, organisation_id: this.organisationId }))
-        : { ...values, organisation_id: this.organisationId };
+        ? values.map(v => ({ ...(v as Record<string, unknown>), organisation_id: this.organisationId }))
+        : { ...(values as Record<string, unknown>), organisation_id: this.organisationId };
       
       return originalInsert(contextValues);
     };
 
     // Override update to add organisation filter
-    query.update = (values: any) => {
+    queryBuilder.update = (values: unknown) => {
       const result = originalUpdate(values);
       return this.addOrganisationFilter(result, tableName);
     };
 
     // Override delete to add organisation filter
-    query.delete = () => {
+    queryBuilder.delete = () => {
       const result = originalDelete();
       return this.addOrganisationFilter(result, tableName);
     };
@@ -311,7 +321,7 @@ export class SecureSupabaseClient {
    * For other tables:
    * - Always apply org filter unless super admin bypasses it
    */
-  private addOrganisationFilter(query: any, tableName: string) {
+  private addOrganisationFilter(query: unknown, tableName: string): unknown {
     // Tables that don't have organisation_id column - RLS policies handle access control
     const tablesWithoutOrganisationId = [
       'core_organisations', // Organisation table itself - uses 'id' as primary key
@@ -360,24 +370,33 @@ export class SecureSupabaseClient {
         return query; // No filter - RLS handles access control
       }
       
+      // Type assertion: query builder has eq and or methods
+      const queryBuilder = query as { 
+        eq: (column: string, value: unknown) => unknown;
+        or: (filter: string) => unknown;
+      };
+      
       // For non-super-admins: Apply org filter, but allow NULL organisation_id
       // User profiles can have organisation_id = NULL (users not yet assigned to an org)
       // We use .or() to allow either matching organisation_id OR NULL
       // RLS policies will still enforce access control
-      return query.or(`organisation_id.eq.${this.organisationId},organisation_id.is.null`);
+      return queryBuilder.or(`organisation_id.eq.${this.organisationId},organisation_id.is.null`);
     }
     
+    // Type assertion: query builder has eq method
+    const queryBuilder = query as { eq: (column: string, value: unknown) => unknown };
+    
     // For all other tables, apply organisation filter
     // Super admins can still bypass via RLS if needed, but we filter at app level too
     if (this.isSuperAdmin) {
       // Super admins might want to see cross-org data, but for most tables
       // we still apply the filter as a safety measure (they can override if needed)
       // For now, we'll apply it - super admins can use direct queries if they need cross-org access
-      return query.eq('organisation_id', this.organisationId);
+      return queryBuilder.eq('organisation_id', this.organisationId);
     }
     
     // Non-super-admins: Always apply org filter
-    return query.eq('organisation_id', this.organisationId);
+    return queryBuilder.eq('organisation_id', this.organisationId);
   }
 
   /**
@@ -496,7 +515,12 @@ export class SecureSupabaseClient {
           return this.edgeFunctionClient.functions;
         }
         // For all other properties, return the original
-        return (target as any)[prop];
+        // Handle both string and symbol keys
+        if (typeof prop === 'string') {
+          return (target as unknown as Record<string, unknown>)[prop];
+        }
+        // For symbol keys, use Reflect.get
+        return Reflect.get(target, prop);
       }
     }) as SupabaseClient<Database>;
     
@@ -535,8 +559,10 @@ export class SecureSupabaseClient {
     //    SELECT pg_get_function_identity_arguments(oid) FROM pg_proc WHERE proname = 'function_name';
     // 2. Add it here with the parameters it accepts
     const rpcContextWhitelist: Record<string, Set<string>> = {
-      // RPCs that accept all three context parameters
-      'data_rbac_roles_list': new Set(['p_organisation_id', 'p_event_id', 'p_app_id']),
+      // Only inject p_organisation_id for data_rbac_roles_list. Do NOT inject p_event_id/p_app_id:
+      // when editing a user we need all event-app roles for that user; injecting current event/app
+      // would filter to a single event-app and show only one role instead of all (e.g. 3).
+      'data_rbac_roles_list': new Set(['p_organisation_id']),
       
       // RPCs that accept only p_organisation_id (not p_app_id or p_event_id)
       'data_file_reference_by_category_list': new Set(['p_organisation_id']),