@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/services/AuthService.test.ts

@@ -0,0 +1,1362 @@
+/**
+ * @file AuthService Unit Tests
+ * @package @jmruthers/pace-core
+ * @module Services
+ * @since 0.1.0
+ *
+ * Unit tests for AuthService class.
+ * Tests authentication operations, state management, and error handling.
+ */
+
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { AuthService } from './AuthService';
+import { AuthError } from '@supabase/supabase-js';
+
+// Don't mock the logger - it now works in test mode
+// We'll spy on the Logger class methods in beforeEach to verify calls
+import { Logger } from '../utils/core/logger';
+
+let mockLoggerFunctions: {
+  debug: ReturnType<typeof vi.spyOn>;
+  error: ReturnType<typeof vi.spyOn>;
+  warn: ReturnType<typeof vi.spyOn>;
+  info: ReturnType<typeof vi.spyOn>;
+};
+
+// Mock Supabase client
+const createMockSupabaseClient = () => ({
+  auth: {
+    signInWithPassword: vi.fn(),
+    signUp: vi.fn(),
+    signOut: vi.fn(),
+    resetPasswordForEmail: vi.fn(),
+    updateUser: vi.fn(),
+    refreshSession: vi.fn(),
+    getSession: vi.fn(),
+    getUser: vi.fn(),
+    onAuthStateChange: vi.fn(),
+  },
+});
+
+describe('AuthService', () => {
+  let mockSupabase: ReturnType<typeof createMockSupabaseClient>;
+  let authService: AuthService;
+
+  beforeEach(() => {
+    // Spy on Logger methods to verify calls (logger now works in test mode)
+    mockLoggerFunctions = {
+      debug: vi.spyOn(Logger, 'debug'),
+      error: vi.spyOn(Logger, 'error'),
+      warn: vi.spyOn(Logger, 'warn'),
+      info: vi.spyOn(Logger, 'info'),
+    };
+    
+    mockSupabase = createMockSupabaseClient();
+    authService = new AuthService(mockSupabase as any);
+  });
+
+  afterEach(() => {
+    authService.cleanup();
+    // Restore spies
+    mockLoggerFunctions.debug.mockRestore();
+    mockLoggerFunctions.error.mockRestore();
+    mockLoggerFunctions.warn.mockRestore();
+    mockLoggerFunctions.info.mockRestore();
+    vi.clearAllMocks();
+  });
+
+  describe('Initialization', () => {
+    it('should initialize with default state', () => {
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+      expect(authService.isAuthenticated()).toBe(false);
+      expect(authService.isLoading()).toBe(false);
+      expect(authService.getError()).toBeNull();
+    });
+
+    it('should initialize service when created', async () => {
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.getUser.mockResolvedValue({
+        data: { user: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
+      expect(mockSupabase.auth.onAuthStateChange).toHaveBeenCalled();
+    });
+  });
+
+  describe('Sign In', () => {
+    it('should sign in user successfully', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      const result = await authService.signIn('test@example.com', 'password');
+
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toEqual(mockUser);
+      expect(result.data?.session).toEqual(mockSession);
+      expect(authService.getUser()).toEqual(mockUser);
+      expect(authService.getSession()).toEqual(mockSession);
+      expect(authService.isAuthenticated()).toBe(true);
+    });
+
+    it('should handle sign in errors', async () => {
+      const mockError = new AuthError('Invalid credentials');
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: null, session: null },
+        error: mockError
+      });
+
+      const result = await authService.signIn('test@example.com', 'wrongpassword');
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getError()).toEqual(mockError);
+      expect(authService.isAuthenticated()).toBe(false);
+    });
+
+    it('should handle missing Supabase client', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.signIn('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+  });
+
+  describe('Sign Up', () => {
+    it('should sign up user successfully', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signUp.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      const result = await authService.signUp('test@example.com', 'password');
+
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toEqual(mockUser);
+      expect(result.data?.session).toEqual(mockSession);
+      expect(authService.getUser()).toEqual(mockUser);
+      expect(authService.getSession()).toEqual(mockSession);
+      expect(authService.isAuthenticated()).toBe(true);
+    });
+
+    it('should handle sign up errors', async () => {
+      const mockError = new AuthError('Email already registered');
+
+      mockSupabase.auth.signUp.mockResolvedValue({
+        data: { user: null, session: null },
+        error: mockError
+      });
+
+      const result = await authService.signUp('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getError()).toEqual(mockError);
+    });
+  });
+
+  describe('Sign Out', () => {
+    it('should sign out user successfully', async () => {
+      // First sign in a user
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      await authService.signIn('test@example.com', 'password');
+      expect(authService.isAuthenticated()).toBe(true);
+
+      // Then sign out
+      mockSupabase.auth.signOut.mockResolvedValue({
+        error: null
+      });
+
+      const result = await authService.signOut();
+
+      expect(result.ok).toBe(true);
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+      expect(authService.isAuthenticated()).toBe(false);
+    });
+
+    it('should handle sign out errors', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+      await authService.signIn('test@example.com', 'password');
+      expect(authService.getUser()).not.toBeNull();
+
+      const mockError = new AuthError('Sign out failed');
+      mockSupabase.auth.signOut
+        .mockResolvedValueOnce({ error: mockError })
+        .mockResolvedValueOnce({ error: null });
+
+      const result = await authService.signOut();
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+    });
+
+    it('should clear user and session when signOut throws', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+      await authService.signIn('test@example.com', 'password');
+      expect(authService.getUser()).not.toBeNull();
+
+      const exceptionError = new Error('Network error');
+      mockSupabase.auth.signOut
+        .mockRejectedValueOnce(exceptionError)
+        .mockResolvedValueOnce({ error: null });
+
+      const result = await authService.signOut();
+
+      expect(result.ok).toBe(false);
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+    });
+  });
+
+  describe('Password Reset', () => {
+    it('should reset password successfully', async () => {
+      mockSupabase.auth.resetPasswordForEmail.mockResolvedValue({
+        error: null
+      });
+
+      const result = await authService.resetPassword('test@example.com');
+
+      expect(result.ok).toBe(true);
+      expect(mockSupabase.auth.resetPasswordForEmail).toHaveBeenCalledWith('test@example.com');
+    });
+
+    it('should handle password reset errors', async () => {
+      const mockError = new AuthError('Email not found');
+
+      mockSupabase.auth.resetPasswordForEmail.mockResolvedValue({
+        error: mockError
+      });
+
+      const result = await authService.resetPassword('test@example.com');
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getError()).toEqual(mockError);
+    });
+  });
+
+  describe('Update Password', () => {
+    it('should update password successfully', async () => {
+      mockSupabase.auth.updateUser.mockResolvedValue({
+        error: null
+      });
+
+      const result = await authService.updatePassword('newpassword');
+
+      expect(result.ok).toBe(true);
+      expect(mockSupabase.auth.updateUser).toHaveBeenCalledWith({
+        password: 'newpassword'
+      });
+    });
+
+    it('should handle update password errors', async () => {
+      const mockError = new AuthError('Password too weak');
+
+      mockSupabase.auth.updateUser.mockResolvedValue({
+        error: mockError
+      });
+
+      const result = await authService.updatePassword('weak');
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getError()).toEqual(mockError);
+    });
+  });
+
+  describe('Refresh Session', () => {
+    it('should refresh session successfully', async () => {
+      mockSupabase.auth.refreshSession.mockResolvedValue({
+        error: null
+      });
+
+      const result = await authService.refreshSession();
+
+      expect(result.ok).toBe(true);
+      expect(mockSupabase.auth.refreshSession).toHaveBeenCalled();
+    });
+
+    it('should handle refresh session errors', async () => {
+      const mockError = new AuthError('Session expired');
+
+      mockSupabase.auth.refreshSession.mockResolvedValue({
+        error: mockError
+      });
+
+      const result = await authService.refreshSession();
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getError()).toEqual(mockError);
+    });
+  });
+
+  describe('State Management', () => {
+    it('should notify subscribers when state changes', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      const subscriber = vi.fn();
+      const unsubscribe = authService.subscribe(subscriber);
+
+      await authService.signIn('test@example.com', 'password');
+
+      expect(subscriber).toHaveBeenCalled();
+
+      unsubscribe();
+    });
+
+    it('should cleanup subscriptions on cleanup', () => {
+      const subscriber = vi.fn();
+      authService.subscribe(subscriber);
+
+      authService.cleanup();
+
+      // After cleanup, new state changes shouldn't notify subscribers
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      authService.signIn('test@example.com', 'password');
+
+      // Subscriber should not be called after cleanup
+      expect(subscriber).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should handle network errors', async () => {
+      const networkError = new Error('Network error');
+
+      mockSupabase.auth.signInWithPassword.mockRejectedValue(networkError);
+
+      const result = await authService.signIn('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Network error');
+    });
+
+    it('should clear errors on successful operations', async () => {
+      // First cause an error
+      const mockError = new AuthError('Invalid credentials');
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: null, session: null },
+        error: mockError
+      });
+
+      await authService.signIn('test@example.com', 'wrongpassword');
+      expect(authService.getError()).toEqual(mockError);
+
+      // Then succeed
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.signInWithPassword.mockResolvedValue({
+        data: { user: mockUser, session: mockSession },
+        error: null
+      });
+
+      await authService.signIn('test@example.com', 'password');
+      expect(authService.getError()).toBeNull();
+    });
+
+    it('should handle exceptions during sign in', async () => {
+      const exceptionError = new Error('Unexpected exception');
+      mockSupabase.auth.signInWithPassword.mockRejectedValue(exceptionError);
+
+      const result = await authService.signIn('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Unexpected exception');
+    });
+
+    it('should handle exceptions during sign up', async () => {
+      const exceptionError = new Error('Unexpected exception');
+      mockSupabase.auth.signUp.mockRejectedValue(exceptionError);
+
+      const result = await authService.signUp('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Unexpected exception');
+    });
+
+    it('should handle exceptions during sign out', async () => {
+      const exceptionError = new Error('Unexpected exception');
+      mockSupabase.auth.signOut.mockRejectedValue(exceptionError);
+
+      const result = await authService.signOut();
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Unexpected exception');
+    });
+
+    it('should handle exceptions during password reset', async () => {
+      const exceptionError = new Error('Unexpected exception');
+      mockSupabase.auth.resetPasswordForEmail.mockRejectedValue(exceptionError);
+
+      const result = await authService.resetPassword('test@example.com');
+
+      expect(result.ok).toBe(false);
+    });
+
+    it('should handle missing Supabase client on sign up', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.signUp('test@example.com', 'password');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+
+    it('should handle missing Supabase client on sign out', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.signOut();
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+
+    it('should handle missing Supabase client on password reset', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.resetPassword('test@example.com');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+
+    it('should handle missing Supabase client on update password', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.updatePassword('newpassword');
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+
+    it('should handle missing Supabase client on session refresh', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      
+      const result = await serviceWithoutClient.refreshSession();
+
+      expect(result.ok).toBe(false);
+      expect(result.error.message).toBe('Supabase client not available');
+    });
+  });
+
+  describe('Session Management Edge Cases', () => {
+    it('should handle session refresh with null data', async () => {
+      mockSupabase.auth.refreshSession.mockResolvedValue({
+        data: { session: null, user: null },
+        error: null
+      });
+
+      const result = await authService.refreshSession();
+
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toBeNull();
+      expect(result.data?.session).toBeNull();
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+    });
+
+    it('should handle session refresh with user but no session by clearing both', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+
+      mockSupabase.auth.refreshSession.mockResolvedValue({
+        data: { session: null, user: mockUser },
+        error: null
+      });
+
+      const result = await authService.refreshSession();
+
+      // If there's no session, we should clear user state too
+      expect(result.ok).toBe(true);
+      expect(result.data?.user).toBeNull();
+      expect(result.data?.session).toBeNull();
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+    });
+
+    it('should handle refresh session errors by clearing state', async () => {
+      const mockError = new AuthError('Session expired');
+
+      mockSupabase.auth.refreshSession.mockResolvedValue({
+        data: { session: null, user: null },
+        error: mockError
+      });
+
+      const result = await authService.refreshSession();
+
+      expect(result.ok).toBe(false);
+      expect(result.error).toMatchObject({ message: mockError.message });
+      expect(authService.getUser()).toBeNull();
+      expect(authService.getSession()).toBeNull();
+      expect(authService.isAuthenticated()).toBe(false);
+    });
+  });
+
+  describe('Initialization Edge Cases', () => {
+    it('should handle initialization without Supabase client', async () => {
+      const serviceWithoutClient = new AuthService(null as any);
+      await serviceWithoutClient.initialize();
+
+      expect(mockSupabase.auth.getSession).not.toHaveBeenCalled();
+      expect(mockSupabase.auth.onAuthStateChange).not.toHaveBeenCalled();
+    });
+
+    it('should handle initialization with getSession error', async () => {
+      const sessionError = new AuthError('Session error');
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: sessionError
+      });
+      mockSupabase.auth.getUser.mockResolvedValue({
+        data: { user: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
+      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
+    });
+
+    it('should not call getUser when getSession succeeds with no session (prevents AuthSessionMissingError)', async () => {
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // When getSession succeeds with no session, getUser is NOT called to prevent
+      // AuthSessionMissingError from being raised on public pages (e.g., login page)
+      // This is intentional behavior to avoid noisy error banners for benign unauthenticated states
+      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
+      expect(mockSupabase.auth.getUser).not.toHaveBeenCalled();
+    });
+
+    it('should restore session from storage during initialization', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: mockSession },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      expect(authService.getUser()).toEqual(mockUser);
+      expect(authService.getSession()).toEqual(mockSession);
+      expect(authService.isAuthenticated()).toBe(true);
+    });
+
+    it('should handle auth state change unsubscribe gracefully', () => {
+      const unsubscribeFn = vi.fn();
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: unsubscribeFn } }
+      });
+
+      authService.cleanup();
+
+      // Should not throw error
+      expect(unsubscribeFn).not.toHaveBeenCalled();
+    });
+
+    it('should handle auth state change events correctly', async () => {
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      await authService.initialize();
+
+      // Simulate SIGNED_IN event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+        expect(authService.getUser()).toEqual(mockUser);
+        expect(authService.getSession()).toEqual(mockSession);
+      }
+
+      // Simulate SIGNED_OUT event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_OUT', null);
+        expect(authService.getUser()).toBeNull();
+        expect(authService.getSession()).toBeNull();
+      }
+
+      // Simulate TOKEN_REFRESHED event
+      const refreshedSession = { ...mockSession, access_token: 'new_token' };
+      if (authStateCallback) {
+        authStateCallback('TOKEN_REFRESHED', refreshedSession);
+        expect(authService.getSession()).toEqual(refreshedSession);
+      }
+
+      // Simulate INITIAL_SESSION event
+      const initialSession = { access_token: 'initial_token', user: mockUser };
+      if (authStateCallback) {
+        authStateCallback('INITIAL_SESSION', initialSession);
+        expect(authService.getSession()).toEqual(initialSession);
+      }
+    });
+
+    it('should handle errors in auth state change callback', async () => {
+      const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        // Simulate error in callback
+        try {
+          callback('INITIAL_SESSION', null);
+        } catch (_error) {
+          // Error is expected to be caught and logged
+        }
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      await authService.initialize();
+
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      consoleWarnSpy.mockRestore();
+    });
+  });
+
+  describe('Get Session with Null User', () => {
+    it('should handle session with null user object', () => {
+      const mockSessionWithNullUser = { access_token: 'token', user: null };
+      
+      // This would be set via internal state
+      (authService as any).session = mockSessionWithNullUser;
+      
+      expect(authService.getSession()).toEqual(mockSessionWithNullUser);
+      expect(authService.getUser()).toBeNull();
+      expect(authService.isAuthenticated()).toBe(false);
+    });
+  });
+
+  describe('Automatic Session Tracking', () => {
+    beforeEach(() => {
+      // Mock rpc function for session tracking
+      (mockSupabase as any).rpc = vi.fn();
+      // Mock from().select() chain for app ID resolution
+      (mockSupabase as any).from = vi.fn().mockReturnValue({
+        select: vi.fn().mockReturnValue({
+          eq: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              single: vi.fn().mockResolvedValue({
+                data: { id: 'app-id-123' },
+                error: null
+              })
+            })
+          })
+        })
+      });
+    });
+
+    it('should track login session automatically on SIGNED_IN event', async () => {
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      
+      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      // Initialize with appName to test app ID resolution
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      // Simulate SIGNED_IN event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+        
+        // Wait a bit for async tracking to complete
+        await new Promise(resolve => setTimeout(resolve, 100));
+        
+        // Verify rbac_session_track was called with correct parameters
+        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
+          p_user_id: 'user-123',
+          p_session_type: 'login',
+          p_event_id: null,
+          p_app_id: 'app-id-123', // Should be resolved from appName
+          // p_user_agent, p_device_fingerprint, p_ip_address may be undefined in test environment
+        }));
+      }
+
+      authServiceWithApp.cleanup();
+    });
+
+    it('should track logout session automatically on SIGNED_OUT event', async () => {
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      
+      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      // Simulate SIGNED_OUT event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_OUT', mockSession);
+        
+        // Wait a bit for async tracking to complete
+        await new Promise(resolve => setTimeout(resolve, 100));
+        
+        // Verify rbac_session_track was called with logout type
+        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
+          p_user_id: 'user-123',
+          p_session_type: 'logout',
+        }));
+      }
+
+      authServiceWithApp.cleanup();
+    });
+
+    it('should NOT track session on TOKEN_REFRESHED event (to avoid duplicate login records)', async () => {
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'new_token', user: mockUser };
+      
+      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      // Simulate TOKEN_REFRESHED event
+      if (authStateCallback) {
+        authStateCallback('TOKEN_REFRESHED', mockSession);
+        
+        // Wait a bit for any async operations
+        await new Promise(resolve => setTimeout(resolve, 100));
+        
+        // Verify rbac_session_track was NOT called
+        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
+      }
+
+      authServiceWithApp.cleanup();
+    });
+
+    it('should handle tracking errors gracefully without breaking authentication', async () => {
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      
+      // Mock rpc to reject (this will trigger the catch block in trackSession)
+      (mockSupabase as any).rpc = vi.fn().mockRejectedValue(new Error('Tracking failed'));
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      // Simulate SIGNED_IN event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+        
+        // Wait for async tracking to complete (trackSession is async)
+        // The catch block in trackSession will log the error
+        // Note: The logger may be called in the .catch() handler with "Failed to track" 
+        // or in the catch block with "Error tracking"
+        await new Promise(resolve => setTimeout(resolve, 500));
+        
+        // Check for either error message pattern
+        const warnCalls = mockLoggerFunctions.warn.mock.calls;
+        const hasErrorTracking = warnCalls.some(call => 
+          call[0] === 'AuthService' && 
+          typeof call[1] === 'string' && 
+          call[1].includes('Error tracking')
+        );
+        const hasFailedToTrack = warnCalls.some(call => 
+          call[0] === 'AuthService' && 
+          typeof call[1] === 'string' && 
+          call[1].includes('Failed to track')
+        );
+        
+        expect(hasErrorTracking || hasFailedToTrack).toBe(true);
+        expect(mockLoggerFunctions.warn).toHaveBeenCalled();
+        expect(authServiceWithApp.isAuthenticated()).toBe(true);
+      }
+      authServiceWithApp.cleanup();
+    });
+
+    it('should work without appName (app_id will be null)', async () => {
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+      
+      (mockSupabase as any).rpc.mockResolvedValue({ error: null });
+      
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      // Initialize without appName
+      await authService.initialize();
+
+      // Simulate SIGNED_IN event
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+        
+        // Wait a bit for async tracking to complete
+        await new Promise(resolve => setTimeout(resolve, 100));
+        
+        // Verify rbac_session_track was called with null app_id
+        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
+          p_user_id: 'user-123',
+          p_session_type: 'login',
+          p_app_id: undefined, // Should be undefined when appName not provided
+        }));
+      }
+    });
+  });
+
+  describe('Session Restoration Edge Cases', () => {
+    it('should handle getSession throwing exception', async () => {
+      mockSupabase.auth.getSession.mockRejectedValue(new Error('getSession exception'));
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // Should handle exception gracefully
+      expect(mockSupabase.auth.getSession).toHaveBeenCalled();
+    });
+
+    it('should handle getUser when getSession fails', async () => {
+      const sessionError = new AuthError('Session error');
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: sessionError
+      });
+      mockSupabase.auth.getUser.mockResolvedValue({
+        data: { user: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
+    });
+
+    it('should handle getUser also failing', async () => {
+      const sessionError = new AuthError('Session error');
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: sessionError
+      });
+      mockSupabase.auth.getUser.mockRejectedValue(new Error('getUser exception'));
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // Should handle both failures gracefully
+      expect(mockSupabase.auth.getUser).toHaveBeenCalled();
+    });
+
+    it('should handle session restoration timeout', async () => {
+      // Mock getSession to hang (simulate timeout scenario)
+      mockSupabase.auth.getSession.mockImplementation(() => {
+        return new Promise(() => {
+          // Never resolves - will timeout after 5 seconds in real scenario
+        });
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      // Start initialization (will hang waiting for getSession)
+      const initPromise = authService.initialize();
+
+      // Use a timeout to simulate the service's internal timeout
+      const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error('Test timeout')), 100);
+      });
+
+      // Race between initialization and test timeout
+      try {
+        await Promise.race([initPromise, timeoutPromise]);
+      } catch (_error) {
+        // Expected to timeout in test
+      }
+
+      // Verify that restoration state is managed
+      const restorationState = authService.getSessionRestorationState();
+      expect(restorationState).toBeDefined();
+    }, 1000);
+
+    it('should finish restoration with timeout error', async () => {
+      // Mock getSession to hang (simulate timeout scenario)
+      mockSupabase.auth.getSession.mockImplementation(() => {
+        return new Promise(() => {
+          // Never resolves - will timeout after 5 seconds in real scenario
+        });
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      // Start initialization (will hang waiting for getSession)
+      const initPromise = authService.initialize();
+
+      // Use a timeout to simulate the service's internal timeout
+      const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error('Test timeout')), 100);
+      });
+
+      // Race between initialization and test timeout
+      try {
+        await Promise.race([initPromise, timeoutPromise]);
+      } catch (_error) {
+        // Expected to timeout in test
+      }
+
+      // Verify that restoration state is managed
+      const restorationState = authService.getSessionRestorationState();
+      expect(restorationState).toBeDefined();
+    }, 1000);
+
+    it('should handle restoration error during initialization', async () => {
+      const restorationError = new Error('Restoration failed');
+      mockSupabase.auth.getSession.mockRejectedValue(restorationError);
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      const restorationState = authService.getSessionRestorationState();
+      expect(restorationState.restorationError).toBeDefined();
+    });
+
+    it('should reset restoration state when valid session arrives after timeout', async () => {
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      // Mock getSession to fail initially
+      mockSupabase.auth.getSession.mockRejectedValue(new Error('Timeout'));
+
+      await authService.initialize();
+
+      // Simulate INITIAL_SESSION arriving after timeout
+      const mockSession = { access_token: 'token', user: { id: '1', email: 'test@example.com' } };
+      if (authStateCallback) {
+        authStateCallback('INITIAL_SESSION', mockSession);
+      }
+
+      // Wait a bit for state to update
+      await new Promise(resolve => setTimeout(resolve, 10));
+
+      const restorationState = authService.getSessionRestorationState();
+      expect(restorationState.restorationComplete).toBe(true);
+    });
+  });
+
+  describe('Error Handlers', () => {
+    it('should setup error handlers on initialization', async () => {
+      const addEventListenerSpy = vi.spyOn(window, 'addEventListener');
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // Error handlers should be set up
+      expect(addEventListenerSpy).toHaveBeenCalledWith('error', expect.any(Function));
+      expect(addEventListenerSpy).toHaveBeenCalledWith('unhandledrejection', expect.any(Function));
+
+      addEventListenerSpy.mockRestore();
+    });
+
+    it('should suppress AuthSessionMissingError in error handler', async () => {
+      const preventDefaultSpy = vi.fn();
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // Trigger error handler
+      const errorEvent = new ErrorEvent('error', { error: { message: 'AuthSessionMissingError' } as any });
+      window.dispatchEvent(errorEvent);
+
+      // Error should be suppressed
+      expect(preventDefaultSpy).not.toHaveBeenCalled(); // In test environment, preventDefault may not work
+    });
+
+    it('should suppress AuthSessionMissingError in unhandled rejection', async () => {
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      await authService.initialize();
+
+      // Create a promise that will be rejected
+      const rejectedPromise = Promise.reject(new Error('AuthSessionMissingError'));
+      
+      // Catch the rejection to prevent it from being unhandled
+      rejectedPromise.catch(() => {
+        // The error handler should suppress this
+      });
+
+      // Trigger unhandled rejection using a custom event
+      const rejectionEvent = new Event('unhandledrejection') as any;
+      rejectionEvent.promise = rejectedPromise;
+      rejectionEvent.reason = { message: 'AuthSessionMissingError' };
+
+      // The handler should be set up and will suppress the error
+      window.dispatchEvent(rejectionEvent);
+
+      // Test passes if no error propagates
+      expect(true).toBe(true);
+    });
+
+    it('should handle window undefined environment', async () => {
+      const originalWindow = global.window;
+      // @ts-expect-error Deleting global.window for SSR/window-undefined test
+      delete global.window;
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+      mockSupabase.auth.onAuthStateChange.mockReturnValue({
+        data: { subscription: { unsubscribe: vi.fn() } }
+      });
+
+      // Should not throw error
+      await expect(authService.initialize()).resolves.toBeUndefined();
+
+      global.window = originalWindow;
+    });
+  });
+
+  describe('Session Tracking Edge Cases', () => {
+    it('should handle tracking when app lookup fails', async () => {
+      (mockSupabase as any).rpc = vi.fn();
+      (mockSupabase as any).from = vi.fn().mockReturnValue({
+        select: vi.fn().mockReturnValue({
+          eq: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              single: vi.fn().mockResolvedValue({
+                data: null,
+                error: { message: 'App not found' }
+              })
+            })
+          })
+        })
+      });
+
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+
+        await new Promise(resolve => setTimeout(resolve, 100));
+
+        // Should still track with null app_id
+        expect((mockSupabase as any).rpc).toHaveBeenCalledWith('rbac_session_track', expect.objectContaining({
+          p_app_id: undefined
+        }));
+      }
+
+      authServiceWithApp.cleanup();
+    });
+
+    it('should handle tracking when RPC fails', async () => {
+      vi.clearAllMocks();
+      (mockSupabase as any).rpc = vi.fn().mockResolvedValue({
+        error: { message: 'RPC failed' }
+      });
+      (mockSupabase as any).from = vi.fn().mockReturnValue({
+        select: vi.fn().mockReturnValue({
+          eq: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              single: vi.fn().mockResolvedValue({
+                data: { id: 'app-id-123' },
+                error: null
+              })
+            })
+          })
+        })
+      });
+
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      const authServiceWithApp = new AuthService(mockSupabase as any, 'TEST_APP');
+      await authServiceWithApp.initialize();
+
+      const mockUser = { id: 'user-123', email: 'test@example.com' };
+      const mockSession = { access_token: 'token', user: mockUser };
+
+      if (authStateCallback) {
+        authStateCallback('SIGNED_IN', mockSession);
+
+        // Wait for async tracking to complete
+        await new Promise(resolve => setTimeout(resolve, 200));
+        expect(mockLoggerFunctions.warn).toHaveBeenCalledWith(
+          'AuthService',
+          expect.stringContaining('Failed to track'),
+          expect.anything()
+        );
+      }
+      authServiceWithApp.cleanup();
+    });
+
+    it('should not track when session is null', async () => {
+      (mockSupabase as any).rpc = vi.fn();
+
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      await authService.initialize();
+
+      if (authStateCallback) {
+        authStateCallback('SIGNED_OUT', null);
+
+        await new Promise(resolve => setTimeout(resolve, 100));
+
+        // Should not track when session is null
+        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
+      }
+    });
+
+    it('should not track when user is null in session', async () => {
+      (mockSupabase as any).rpc = vi.fn();
+
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      await authService.initialize();
+
+      if (authStateCallback) {
+        const sessionWithoutUser = { access_token: 'token', user: null };
+        authStateCallback('SIGNED_IN', sessionWithoutUser);
+
+        await new Promise(resolve => setTimeout(resolve, 100));
+
+        // Should not track when user is null
+        expect((mockSupabase as any).rpc).not.toHaveBeenCalled();
+      }
+    });
+  });
+
+  describe('Auth State Change Events', () => {
+    it('should handle INITIAL_SESSION event with null session', async () => {
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+
+      await authService.initialize();
+
+      if (authStateCallback) {
+        authStateCallback('INITIAL_SESSION', null);
+
+        expect(authService.getUser()).toBeNull();
+        expect(authService.getSession()).toBeNull();
+      }
+    });
+
+    it('should handle TOKEN_REFRESHED event', async () => {
+      let authStateCallback: any;
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        authStateCallback = callback;
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+
+      await authService.initialize();
+
+      const mockUser = { id: '1', email: 'test@example.com' };
+      const refreshedSession = { access_token: 'new_token', user: mockUser };
+
+      if (authStateCallback) {
+        authStateCallback('TOKEN_REFRESHED', refreshedSession);
+
+        expect(authService.getSession()).toEqual(refreshedSession);
+        expect(authService.getUser()).toEqual(mockUser);
+      }
+    });
+
+    it('should handle errors in auth state change callback', async () => {
+      const consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+      mockSupabase.auth.onAuthStateChange.mockImplementation((callback) => {
+        try {
+          // Simulate error in callback
+          callback('INITIAL_SESSION', null);
+        } catch (_error) {
+          // Error should be caught
+        }
+        return { data: { subscription: { unsubscribe: vi.fn() } } };
+      });
+
+      mockSupabase.auth.getSession.mockResolvedValue({
+        data: { session: null },
+        error: null
+      });
+
+      await authService.initialize();
+
+      // Should handle error gracefully
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+
+      consoleWarnSpy.mockRestore();
+    });
+  });
+
+  describe('Session Restoration State', () => {
+    it('should return session restoration state', () => {
+      const state = authService.getSessionRestorationState();
+
+      expect(state).toHaveProperty('isRestoring');
+      expect(state).toHaveProperty('restorationComplete');
+      expect(state).toHaveProperty('restorationError');
+    });
+
+    it('should return copy of restoration state', () => {
+      const state1 = authService.getSessionRestorationState();
+      const state2 = authService.getSessionRestorationState();
+
+      // Should be different objects (copies)
+      expect(state1).not.toBe(state2);
+      expect(state1).toEqual(state2);
+    });
+  });
+});