@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/types.test.ts

@@ -380,3 +380,239 @@ describe('Type Compatibility', () => {
     }
   });
 });
+
+describe('Error Class Edge Cases', () => {
+  describe('RBACError', () => {
+    it('handles empty message', () => {
+      const error = new RBACError('', 'TEST_ERROR');
+      expect(error.message).toBe('');
+      expect(error.code).toBe('TEST_ERROR');
+    });
+
+    it('handles very long messages', () => {
+      const longMessage = 'a'.repeat(10000);
+      const error = new RBACError(longMessage, 'TEST_ERROR');
+      expect(error.message).toBe(longMessage);
+    });
+
+    it('handles null context', () => {
+      const error = new RBACError('Test', 'TEST_ERROR', null as any);
+      expect(error.context).toBeNull();
+    });
+
+    it('handles complex context objects', () => {
+      const complexContext = {
+        userId: 'user-123',
+        nested: {
+          deep: {
+            value: 'test'
+          }
+        },
+        array: [1, 2, 3],
+        nullValue: null,
+        undefinedValue: undefined
+      };
+      const error = new RBACError('Test', 'TEST_ERROR', complexContext);
+      expect(error.context).toEqual(complexContext);
+    });
+
+    it('maintains error stack trace', () => {
+      const error = new RBACError('Test', 'TEST_ERROR');
+      expect(error.stack).toBeDefined();
+      expect(error.stack).toContain('RBACError');
+    });
+
+    it('can be serialized to JSON with custom properties', () => {
+      const error = new RBACError('Test error', 'TEST_ERROR', { userId: 'user-123' });
+      // JSON.stringify on Error objects doesn't include message/code by default
+      // So we need to manually serialize the properties we care about
+      const serialized = JSON.stringify({
+        message: error.message,
+        code: error.code,
+        name: error.name,
+        context: error.context
+      });
+      const parsed = JSON.parse(serialized);
+      expect(parsed.message).toBe('Test error');
+      expect(parsed.code).toBe('TEST_ERROR');
+      expect(parsed.name).toBe('RBACError');
+      expect(parsed.context).toEqual({ userId: 'user-123' });
+    });
+  });
+
+  describe('PermissionDeniedError', () => {
+    it('handles empty permission string', () => {
+      const error = new PermissionDeniedError('');
+      expect(error.message).toBe('Permission denied: ');
+      expect(error.context?.permission).toBe('');
+    });
+
+    it('handles very long permission strings', () => {
+      const longPermission = 'read:' + 'a'.repeat(1000);
+      const error = new PermissionDeniedError(longPermission);
+      expect(error.message).toContain(longPermission);
+    });
+
+    it('handles permission with special characters', () => {
+      const specialPermission = 'read:user.settings';
+      const error = new PermissionDeniedError(specialPermission);
+      expect(error.context?.permission).toBe(specialPermission);
+    });
+  });
+
+  describe('InvalidScopeError', () => {
+    it('handles empty scope', () => {
+      const error = new InvalidScopeError({}, 'Empty scope');
+      expect(error.context?.scope).toEqual({});
+    });
+
+    it('handles scope with all fields', () => {
+      const scope = {
+        organisationId: 'org-123',
+        eventId: 'event-456',
+        appId: 'app-789'
+      };
+      const error = new InvalidScopeError(scope, 'Invalid');
+      expect(error.context?.scope).toEqual(scope);
+    });
+
+    it('handles very long reason strings', () => {
+      const longReason = 'a'.repeat(10000);
+      const error = new InvalidScopeError({}, longReason);
+      expect(error.message).toContain(longReason);
+    });
+
+    it('handles empty reason string', () => {
+      const error = new InvalidScopeError({}, '');
+      expect(error.context?.reason).toBe('');
+    });
+  });
+
+  describe('Error Inheritance Chain', () => {
+    it('maintains proper inheritance for all error types', () => {
+      const errors = [
+        new RBACError('Test', 'TEST'),
+        new PermissionDeniedError('read:users'),
+        new OrganisationContextRequiredError(),
+        new RBACNotInitializedError(),
+        new InvalidScopeError({}, 'test'),
+        new MissingUserContextError()
+      ];
+
+      errors.forEach(error => {
+        expect(error).toBeInstanceOf(Error);
+        expect(error).toBeInstanceOf(RBACError);
+      });
+    });
+
+    it('preserves error name correctly', () => {
+      expect(new RBACError('Test', 'TEST').name).toBe('RBACError');
+      expect(new PermissionDeniedError('read:users').name).toBe('PermissionDeniedError');
+      expect(new OrganisationContextRequiredError().name).toBe('OrganisationContextRequiredError');
+      expect(new RBACNotInitializedError().name).toBe('RBACNotInitializedError');
+      expect(new InvalidScopeError({}, 'test').name).toBe('InvalidScopeError');
+      expect(new MissingUserContextError().name).toBe('MissingUserContextError');
+    });
+  });
+
+  describe('Error Message Formatting', () => {
+    it('formats PermissionDeniedError message correctly', () => {
+      const error = new PermissionDeniedError('read:users');
+      expect(error.message).toBe('Permission denied: read:users');
+    });
+
+    it('formats InvalidScopeError message with scope details', () => {
+      const scope = { organisationId: 'org-123' };
+      const error = new InvalidScopeError(scope, 'Invalid UUID');
+      expect(error.message).toContain('Invalid scope provided');
+      expect(error.message).toContain('Invalid UUID');
+    });
+
+    it('formats RBACNotInitializedError with setup instructions', () => {
+      const error = new RBACNotInitializedError();
+      expect(error.message).toContain('RBAC system not initialized');
+      expect(error.message).toContain('setupRBAC');
+    });
+  });
+});
+
+describe('Type Edge Cases', () => {
+  describe('Scope Type', () => {
+    it('handles scope with only organisationId', () => {
+      const scope: Scope = { organisationId: '123e4567-e89b-12d3-a456-426614174000' as UUID };
+      expect(scope.organisationId).toBeDefined();
+      expect(scope.eventId).toBeUndefined();
+      expect(scope.appId).toBeUndefined();
+    });
+
+    it('handles scope with only eventId', () => {
+      const scope: Scope = { eventId: 'event-123' };
+      expect(scope.eventId).toBeDefined();
+      expect(scope.organisationId).toBeUndefined();
+    });
+
+    it('handles scope with only appId', () => {
+      const scope: Scope = { appId: '123e4567-e89b-12d3-a456-426614174000' as UUID };
+      expect(scope.appId).toBeDefined();
+      expect(scope.organisationId).toBeUndefined();
+    });
+
+    it('handles empty scope object', () => {
+      const scope: Scope = {};
+      expect(scope.organisationId).toBeUndefined();
+      expect(scope.eventId).toBeUndefined();
+      expect(scope.appId).toBeUndefined();
+    });
+  });
+
+  describe('PermissionCheck Type', () => {
+    it('handles permission check without pageId', () => {
+      const check: PermissionCheck = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        scope: { organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID },
+        permission: 'read:users' as Permission
+      };
+      expect(check.pageId).toBeUndefined();
+    });
+
+    it('handles permission check with all optional fields', () => {
+      const check: PermissionCheck = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        scope: {
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          eventId: 'event-123',
+          appId: '123e4567-e89b-12d3-a456-426614174002' as UUID
+        },
+        permission: 'read:users' as Permission,
+        pageId: '123e4567-e89b-12d3-a456-426614174003' as UUID
+      };
+      expect(check.scope.eventId).toBeDefined();
+      expect(check.scope.appId).toBeDefined();
+      expect(check.pageId).toBeDefined();
+    });
+  });
+
+  describe('AccessLevel Type', () => {
+    it('validates all access level values', () => {
+      const levels: AccessLevel[] = ['viewer', 'participant', 'planner', 'admin', 'super'];
+      levels.forEach(level => {
+        expect(['viewer', 'participant', 'planner', 'admin', 'super']).toContain(level);
+      });
+    });
+
+    it('maintains hierarchy order', () => {
+      const hierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];
+      const levels: AccessLevel[] = ['viewer', 'participant', 'planner', 'admin', 'super'];
+      expect(levels).toEqual(hierarchy);
+    });
+  });
+
+  describe('Operation Type', () => {
+    it('validates all operation values', () => {
+      const operations: Operation[] = ['read', 'create', 'update', 'delete'];
+      operations.forEach(op => {
+        expect(['read', 'create', 'update', 'delete']).toContain(op);
+      });
+    });
+  });
+});

package/src/rbac/types.ts

@@ -168,7 +168,7 @@ export interface RBACAuditEvent {
   source?: AuditEventSource;
   bypass?: boolean;
   duration_ms?: number;
-  metadata: Record<string, any>;
+  metadata: Record<string, unknown>;
   created_at: string;
 }
 
@@ -255,8 +255,10 @@ export interface WithPermissionGuardOptions {
 // HOOK RETURN TYPES
 // ============================================================================
 
+import type { User } from '@supabase/supabase-js';
+
 export interface UserRBACContext {
-  user: any; // User from auth context
+  user: User | null; // User from auth context
   globalRole: GlobalRole | null;
   organisationRole: OrganisationRole | null;
   eventAppRole: EventAppRole | null;
@@ -273,7 +275,7 @@ export interface UserRBACContext {
 export interface RBACPermission {
   permission_type: string;
   role_name: string;
-  [key: string]: any;
+  [key: string]: unknown;
 }
 
 // ============================================================================
@@ -303,7 +305,7 @@ export class RBACError extends Error {
   constructor(
     message: string,
     public code: string,
-    public context?: Record<string, any>
+    public context?: Record<string, unknown>
   ) {
     super(message);
     this.name = 'RBACError';
@@ -311,7 +313,7 @@ export class RBACError extends Error {
 }
 
 export class PermissionDeniedError extends RBACError {
-  constructor(permission: Permission, context?: Record<string, any>) {
+  constructor(permission: Permission, context?: Record<string, unknown>) {
     super(
       `Permission denied: ${permission}`,
       'PERMISSION_DENIED',

package/src/rbac/utils/clientSecurity.test.ts

@@ -0,0 +1,192 @@
+/**
+ * @file Client Security Tests
+ * @package @jmruthers/pace-core
+ * @module RBAC/Utils
+ * @since 1.0.0
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+// Mock Logger - use vi.hoisted() pattern that works in other tests
+const mockLoggerWarn = vi.hoisted(() => vi.fn());
+vi.mock('../../utils/core/logger', () => ({
+  Logger: {
+    warn: mockLoggerWarn,
+  },
+  LogLevel: {
+    DEBUG: 0,
+    INFO: 1,
+    WARN: 2,
+    ERROR: 3,
+  },
+}));
+
+import {
+  isSecureClient,
+  warnIfInsecureClient,
+  markClientAsSecure,
+  SECURE_CLIENT_SYMBOL,
+} from './clientSecurity';
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '../../types/database';
+
+describe('Client Security', () => {
+  let mockClient: SupabaseClient<Database>;
+
+  beforeEach(() => {
+    // Create a mock Supabase client
+    mockClient = {} as SupabaseClient<Database>;
+    mockLoggerWarn.mockClear();
+    vi.clearAllMocks();
+  });
+
+  describe('isSecureClient', () => {
+    it('returns true for client marked as secure', () => {
+      markClientAsSecure(mockClient);
+      expect(isSecureClient(mockClient)).toBe(true);
+    });
+
+    it('returns false for unmarked client', () => {
+      expect(isSecureClient(mockClient)).toBe(false);
+    });
+
+    it('returns false for null client', () => {
+      expect(isSecureClient(null)).toBe(false);
+    });
+
+    it('returns false for undefined client', () => {
+      expect(isSecureClient(undefined)).toBe(false);
+    });
+
+    it('returns false for client with symbol set to false', () => {
+      (mockClient as any)[SECURE_CLIENT_SYMBOL] = false;
+      expect(isSecureClient(mockClient)).toBe(false);
+    });
+
+    it('returns false for client with symbol set to undefined', () => {
+      (mockClient as any)[SECURE_CLIENT_SYMBOL] = undefined;
+      expect(isSecureClient(mockClient)).toBe(false);
+    });
+  });
+
+  describe('markClientAsSecure', () => {
+    it('marks client with secure symbol', () => {
+      markClientAsSecure(mockClient);
+      expect((mockClient as any)[SECURE_CLIENT_SYMBOL]).toBe(true);
+    });
+
+    it('allows isSecureClient to detect marked client', () => {
+      markClientAsSecure(mockClient);
+      expect(isSecureClient(mockClient)).toBe(true);
+    });
+
+    it('can mark multiple clients independently', () => {
+      const client1 = {} as SupabaseClient<Database>;
+      const client2 = {} as SupabaseClient<Database>;
+
+      markClientAsSecure(client1);
+      expect(isSecureClient(client1)).toBe(true);
+      expect(isSecureClient(client2)).toBe(false);
+
+      markClientAsSecure(client2);
+      expect(isSecureClient(client1)).toBe(true);
+      expect(isSecureClient(client2)).toBe(true);
+    });
+  });
+
+  describe('warnIfInsecureClient', () => {
+    const originalEnv = process.env.NODE_ENV;
+
+    beforeEach(() => {
+      // Reset NODE_ENV - default to 'development' for tests that need warnings
+      process.env.NODE_ENV = 'development';
+      mockLoggerWarn.mockClear();
+    });
+
+    afterEach(() => {
+      process.env.NODE_ENV = originalEnv;
+    });
+
+    it('does not warn for secure client', () => {
+      markClientAsSecure(mockClient);
+      warnIfInsecureClient(mockClient);
+      expect(mockLoggerWarn).not.toHaveBeenCalled();
+    });
+
+    it('warns for insecure client in development', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(mockClient);
+      
+      expect(mockLoggerWarn).toHaveBeenCalledTimes(1);
+      const [context, ...messageParts] = mockLoggerWarn.mock.calls[0];
+      const warningMessage = messageParts.join(' ');
+      expect(context).toBe('ClientSecurity');
+      expect(warningMessage).toContain('Non-secure Supabase client detected');
+      expect(warningMessage).toContain('createClient()');
+      expect(warningMessage).toContain('useSecureSupabase()');
+    });
+
+    it('includes context in warning message when provided', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(mockClient, 'MyComponent');
+      
+      expect(mockLoggerWarn).toHaveBeenCalledTimes(1);
+      const [...messageParts] = mockLoggerWarn.mock.calls[0];
+      const warningMessage = messageParts.join(' ');
+      expect(warningMessage).toContain('in MyComponent');
+    });
+
+    it('does not warn in production', () => {
+      process.env.NODE_ENV = 'production';
+      warnIfInsecureClient(mockClient);
+      expect(mockLoggerWarn).not.toHaveBeenCalled();
+    });
+
+    it('does not warn for null client', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(null);
+      expect(mockLoggerWarn).not.toHaveBeenCalled();
+    });
+
+    it('does not warn for undefined client', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(undefined);
+      expect(mockLoggerWarn).not.toHaveBeenCalled();
+    });
+
+    it('warns with correct security implications', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(mockClient);
+      
+      expect(mockLoggerWarn).toHaveBeenCalledTimes(1);
+      const [...messageParts] = mockLoggerWarn.mock.calls[0];
+      const warningMessage = messageParts.join(' ');
+      expect(warningMessage).toContain('Cross-organisation data access');
+      expect(warningMessage).toContain('Security vulnerabilities');
+      expect(warningMessage).toContain('Data leakage between organisations');
+    });
+
+    it('warns with fix instructions', () => {
+      process.env.NODE_ENV = 'development';
+      warnIfInsecureClient(mockClient);
+      
+      expect(mockLoggerWarn).toHaveBeenCalledTimes(1);
+      const [...messageParts] = mockLoggerWarn.mock.calls[0];
+      const warningMessage = messageParts.join(' ');
+      expect(warningMessage).toContain('useSecureSupabase');
+      expect(warningMessage).toContain('@jmruthers/pace-core/rbac');
+    });
+  });
+
+  describe('SECURE_CLIENT_SYMBOL', () => {
+    it('is a unique symbol', () => {
+      expect(typeof SECURE_CLIENT_SYMBOL).toBe('symbol');
+    });
+
+    it('can be used to check client security directly', () => {
+      const client = {} as SupabaseClient<Database>;
+      (client as any)[SECURE_CLIENT_SYMBOL] = true;
+      expect((client as any)[SECURE_CLIENT_SYMBOL]).toBe(true);
+    });
+  });
+});

package/src/rbac/utils/clientSecurity.ts

@@ -9,6 +9,7 @@
 
 import type { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../../types/database';
+import { Logger } from '../../utils/core/logger';
 
 /**
  * Symbol to mark secure clients
@@ -36,7 +37,7 @@ export function isSecureClient(client: SupabaseClient<Database> | null | undefin
   if (!client) return false;
   
   // Check for the secure client symbol
-  return (client as any)[SECURE_CLIENT_SYMBOL] === true;
+  return (client as unknown as Record<string | symbol, unknown>)[SECURE_CLIENT_SYMBOL] === true;
 }
 
 /**
@@ -66,8 +67,9 @@ export function warnIfInsecureClient(
   
   if (!isSecureClient(client)) {
     const contextMsg = context ? ` in ${context}` : '';
-    console.warn(
-      `[pace-core Security Warning] Non-secure Supabase client detected${contextMsg}.\n` +
+    Logger.warn(
+      'ClientSecurity',
+      `Non-secure Supabase client detected${contextMsg}.\n` +
       `You are using a Supabase client created with createClient() instead of useSecureSupabase().\n` +
       `This bypasses organisation context enforcement and RLS policies, which can lead to:\n` +
       `- Cross-organisation data access\n` +
@@ -88,6 +90,6 @@ export function warnIfInsecureClient(
  * @internal
  */
 export function markClientAsSecure(client: SupabaseClient<Database>): void {
-  (client as any)[SECURE_CLIENT_SYMBOL] = true;
+  (client as unknown as Record<string | symbol, unknown>)[SECURE_CLIENT_SYMBOL] = true;
 }
 

package/src/rbac/utils/contextValidator.test.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { ContextValidator } from './contextValidator';
+import { EventContextRequiredError, OrganisationContextRequiredError, type Scope } from '../types';
+import type { Database } from '../../types/database';
+
+describe('ContextValidator', () => {
+
+  const createSupabaseMock = () => ({}) as SupabaseClient<Database>;
+
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('deriveOrgFromEvent', () => {
+    it('derives organisation ID from event ID', async () => {
+      const supabase = createSupabaseMock();
+      // Mock the underlying function
+      vi.spyOn(await import('./eventContext'), 'getOrganisationFromEvent').mockResolvedValue({ ok: true, data: 'derived-org' as any });
+
+      const result = await ContextValidator.deriveOrgFromEvent(supabase, 'event-1');
+
+      expect(result).toBe('derived-org');
+    });
+  });
+
+  describe('resolveScopeForPage', () => {
+    it('handles event scope - requires event context', async () => {
+      const scope: Scope = { organisationId: 'org-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'event');
+
+      expect(result.isValid).toBe(false);
+      expect(result.error).toBeInstanceOf(EventContextRequiredError);
+    });
+
+    it('handles event scope - derives org from event when event provided', async () => {
+      const supabase = createSupabaseMock();
+      vi.spyOn(ContextValidator, 'deriveOrgFromEvent').mockResolvedValue('derived-org');
+
+      const scope: Scope = { eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'event', undefined, supabase);
+
+      expect(result.isValid).toBe(true);
+      expect(result.resolvedScope?.organisationId).toBe('derived-org');
+      expect(result.resolvedScope?.eventId).toBe('event-1');
+    });
+
+    it('handles organisation scope - requires organisation context', async () => {
+      const scope: Scope = { eventId: 'event-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'organisation');
+
+      expect(result.isValid).toBe(false);
+      expect(result.error).toBeInstanceOf(OrganisationContextRequiredError);
+    });
+
+    it('handles organisation scope - accepts organisation context', async () => {
+      const scope: Scope = { organisationId: 'org-1', eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'organisation');
+
+      expect(result.isValid).toBe(true);
+      expect(result.resolvedScope).toEqual(scope);
+    });
+
+    it('handles both scope - requires at least one context', async () => {
+      const scope: Scope = { appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'both');
+
+      expect(result.isValid).toBe(false);
+      expect(result.error?.message).toContain('either organisation or event context');
+    });
+
+    it('handles both scope - accepts organisation context', async () => {
+      const scope: Scope = { organisationId: 'org-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'both');
+
+      expect(result.isValid).toBe(true);
+      expect(result.resolvedScope?.organisationId).toBe('org-1');
+    });
+
+    it('handles both scope - accepts event context', async () => {
+      const scope: Scope = { eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'both');
+
+      expect(result.isValid).toBe(true);
+      expect(result.resolvedScope?.eventId).toBe('event-1');
+    });
+
+    it('handles both scope - derives org from event when event provided', async () => {
+      const supabase = createSupabaseMock();
+      vi.spyOn(ContextValidator, 'deriveOrgFromEvent').mockResolvedValue('derived-org');
+
+      const scope: Scope = { eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'both', undefined, supabase);
+
+      expect(result.isValid).toBe(true);
+      expect(result.resolvedScope?.organisationId).toBe('derived-org');
+      expect(result.resolvedScope?.eventId).toBe('event-1');
+    });
+
+    it('handles event scope - returns error when org derivation fails', async () => {
+      const supabase = createSupabaseMock();
+      vi.spyOn(ContextValidator, 'deriveOrgFromEvent').mockResolvedValue(null);
+
+      const scope: Scope = { eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'event', undefined, supabase);
+
+      expect(result.isValid).toBe(false);
+      expect(result.error?.message).toContain('Could not resolve organisation from event context');
+    });
+
+    it('handles event scope - returns error when org derivation throws', async () => {
+      const supabase = createSupabaseMock();
+      vi.spyOn(ContextValidator, 'deriveOrgFromEvent').mockRejectedValue(new Error('network error'));
+
+      const scope: Scope = { eventId: 'event-1', appId: 'app-1' };
+      const result = await ContextValidator.resolveScopeForPage(scope, 'event', undefined, supabase);
+
+      expect(result.isValid).toBe(false);
+      expect(result.error?.message).toContain('network error');
+    });
+  });
+});

package/src/rbac/utils/contextValidator.ts

@@ -15,8 +15,7 @@
 
 import { SupabaseClient } from '@supabase/supabase-js';
 import { Database } from '../../types/database';
-import { UUID, Scope } from '../types';
-import { EventContextRequiredError, OrganisationContextRequiredError } from '../types';
+import { UUID, Scope, EventContextRequiredError, OrganisationContextRequiredError } from '../types';
 import { getOrganisationFromEvent } from './eventContext';
 import { createLogger } from '../../utils/core/logger';
 
@@ -61,7 +60,11 @@ export class ContextValidator {
     supabase: SupabaseClient<Database>,
     eventId: string
   ): Promise<UUID | null> {
-    return getOrganisationFromEvent(supabase, eventId);
+    const result = await getOrganisationFromEvent(supabase, eventId);
+    if (!result.ok) {
+      return null;
+    }
+    return result.data;
   }
 
   /**