@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/services/OrganisationService.ts

@@ -17,29 +17,10 @@ import type {
   OrganisationSecurityError,
   OrganisationHierarchy
 } from '../types/organisation';
-import { setOrganisationContext } from '../utils/context/organisationContext';
 import { logger } from '../utils/core/logger';
 import { assertUserId, assertOrganisationId } from '../types/core';
 import type { UUID } from '../rbac/types';
 
-// Type for RPC response from data_user_organisation_roles_get
-interface OrganisationRoleRpcResponse {
-  user_id: string;
-  organisation_id: string;
-  role: 'org_admin' | 'leader' | 'member' | 'supporter';
-  status: 'active' | 'inactive' | 'suspended';
-  // Organisation fields from RPC
-  name?: string;
-  display_name?: string;
-  subscription_tier?: string;
-  settings?: unknown;
-  is_active?: boolean;
-  parent_id?: string;
-  organisation_created_at?: string;
-  organisation_updated_at?: string;
-  [key: string]: unknown;
-}
-
 export class OrganisationService extends BaseService implements IOrganisationService {
   private static instanceCount = 0;
   private instanceId: number;
@@ -160,6 +141,7 @@ export class OrganisationService extends BaseService implements IOrganisationSer
 
     if (userChanged || needsRetry || isEmpty) {
       if (userChanged) {
+        // User changed - reset state
       } else if (needsRetry) {
         logger.debug('OrganisationService', `Previous error detected [ID:${this.instanceId}], retrying initialization`);
       } else if (isEmpty) {
@@ -327,7 +309,7 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     // Cleanup any resources
   }
 
-  private async setDatabaseOrganisationContext(organisation: Organisation): Promise<void> {
+  private async setDatabaseOrganisationContext(_organisation: Organisation): Promise<void> {
     // Organisation context is now handled via secure client and explicit parameters
     // This function is kept for backward compatibility but is effectively a no-op
     // The setOrganisationContext function has been deprecated and no longer sets database context
@@ -337,189 +319,220 @@ export class OrganisationService extends BaseService implements IOrganisationSer
     this.notify();
   }
 
-  private async loadUserOrganisations(): Promise<void> {
+  /** Returns false if load should return early; when true, abort controller and loading state are set. */
+  private prepareLoad(): boolean {
     if (!this.user || !this.session || !this.supabaseClient) {
-      // Clear state when no user, session, or supabase client
       this._selectedOrganisation = null;
       this._organisations = [];
       this._userMemberships = [];
       this._isLoading = false;
       this._error = null;
       this.notify();
-      return;
+      return false;
     }
-
-    // Additional check to prevent loading during auth state changes
     if (this.isLoadingRef) {
-      // Ensure loading state is correct
       this._isLoading = true;
       this.notify();
-      return;
+      return false;
     }
-
-    // Prevent rapid retries - minimum 2 seconds between attempts
-    // Skip this check if we don't have any organisations yet
     const now = Date.now();
     if (this._organisations.length > 0 && now - this.lastLoadTimeRef < 2000) {
-      // Ensure loading state is correct
       if (this._organisations.length > 0 || this._selectedOrganisation) {
         this._isLoading = false;
       } else {
         this._isLoading = true;
       }
       this.notify();
-      return;
+      return false;
     }
-
-    // Cancel any existing request
     if (this.abortControllerRef) {
       this.abortControllerRef.abort();
     }
-
-    // Create new abort controller for this request
     this.abortControllerRef = new AbortController();
-    const abortSignal = this.abortControllerRef.signal;
-
     this.lastLoadTimeRef = now;
     this.isLoadingRef = true;
     this._isLoading = true;
     this._error = null;
     this.notify();
+    return true;
+  }
 
-      
+  private async fetchRolesAndOrganisations(signal: AbortSignal): Promise<{
+    memberships: OrganisationMembership[];
+    organisations: Organisation[];
+  }> {
+    if (signal.aborted) {
+      throw new Error('Request aborted');
+    }
+    if (!this.supabaseClient || !this.user) {
+      throw new Error('Missing supabase client or user');
+    }
     try {
-      // Get user's organisation roles directly from rbac_organisation_roles table
-      // This queries the source table directly instead of using the RPC which filters to match core_organisation_memberships view
-      // We still filter to active, non-revoked roles for the org selector
-      // The join includes organisation data, so we don't need a separate query that might be filtered by RLS
-      let memberships, membershipError, organisations: Organisation[] = [];
-      try {
-        // Check if request was aborted before making query
-        if (abortSignal.aborted) {
-          throw new Error('Request aborted');
-        }
-
-        const { data: rolesData, error: rolesError } = await this.supabaseClient
-          .from('rbac_organisation_roles')
-          .select(`
+      const { data: rolesData, error: rolesError } = await this.supabaseClient
+        .from('rbac_organisation_roles')
+        .select(`
+          id,
+          user_id,
+          organisation_id,
+          role,
+          status,
+          granted_at,
+          granted_by,
+          revoked_at,
+          revoked_by,
+          notes,
+          created_at,
+          updated_at,
+          core_organisations!inner(
             id,
-            user_id,
-            organisation_id,
-            role,
-            status,
-            granted_at,
-            granted_by,
-            revoked_at,
-            revoked_by,
-            notes,
+            name,
+            display_name,
+            subscription_tier,
+            settings,
+            is_active,
+            parent_id,
             created_at,
-            updated_at,
-            core_organisations!inner(
-              id,
-              name,
-              display_name,
-              subscription_tier,
-              settings,
-              is_active,
-              parent_id,
-              created_at,
-              updated_at
-            )
-          `)
-          .eq('user_id', this.user.id)
-          .eq('status', 'active')
-          .is('revoked_at', null);
-        
-        if (rolesError) {
-          logger.error("OrganisationService", "Error loading organisation roles:", rolesError);
-          throw rolesError;
-        }
-        
-        // Map to branded types and extract organisation data from the join
-        // The join already includes organisation data, so we don't need a separate query
-        memberships = rolesData?.map((m) => ({
-          ...m,
-          user_id: assertUserId(m.user_id),
-          organisation_id: assertOrganisationId(m.organisation_id),
-        })) || [];
-        
-        // Extract unique organisations from the join results
-        // Use a Map to deduplicate by organisation ID
-        // Supabase returns joined data nested under the relation name
-        const organisationsMap = new Map<string, Organisation>();
-        rolesData?.forEach((role: any) => {
-          // The join returns organisation data nested under 'core_organisations' key
-          const orgData = role.core_organisations;
-          if (orgData && role.organisation_id && !organisationsMap.has(role.organisation_id)) {
-            organisationsMap.set(role.organisation_id, {
-              id: orgData.id,
-              name: orgData.name,
-              display_name: orgData.display_name,
-              subscription_tier: orgData.subscription_tier,
-              settings: orgData.settings,
-              is_active: orgData.is_active,
-              parent_id: orgData.parent_id,
-              created_at: orgData.created_at,
-              updated_at: orgData.updated_at,
-            } as Organisation);
-          }
-        });
-        
-        organisations = Array.from(organisationsMap.values());
-        
-        
-        // Extract organisations from join results
-      } catch (queryError) {
-        // Extract error message properly from Supabase error objects
-        if (queryError instanceof Error) {
-          membershipError = queryError;
-        } else if (queryError && typeof queryError === 'object' && 'message' in queryError) {
-          membershipError = new Error(String((queryError as any).message));
-        } else {
-          membershipError = new Error(String(queryError));
+            updated_at
+          )
+        `)
+        .eq('user_id', this.user.id)
+        .eq('status', 'active')
+        .is('revoked_at', null);
+
+      if (rolesError) {
+        logger.error('OrganisationService', 'Error loading organisation roles:', rolesError);
+        throw rolesError;
+      }
+
+      const memberships = (rolesData?.map((m) => ({
+        ...m,
+        user_id: assertUserId(m.user_id),
+        organisation_id: assertOrganisationId(m.organisation_id),
+      })) || []) as OrganisationMembership[];
+
+      const organisationsMap = new Map<string, Organisation>();
+      rolesData?.forEach((role) => {
+        const roleWithOrg = role as unknown as Record<string, unknown> & { organisation_id?: string; core_organisations?: Record<string, unknown> };
+        const orgData = roleWithOrg.core_organisations as Record<string, unknown> | undefined;
+        if (orgData && roleWithOrg.organisation_id && !organisationsMap.has(roleWithOrg.organisation_id)) {
+          organisationsMap.set(roleWithOrg.organisation_id, {
+            id: orgData.id,
+            name: orgData.name,
+            display_name: orgData.display_name,
+            subscription_tier: orgData.subscription_tier,
+            settings: orgData.settings,
+            is_active: orgData.is_active,
+            parent_id: orgData.parent_id,
+            created_at: orgData.created_at,
+            updated_at: orgData.updated_at,
+          } as Organisation);
         }
-        logger.error("OrganisationService", "Error loading organisation roles:", membershipError);
-        throw membershipError;
+      });
+      const organisations = Array.from(organisationsMap.values());
+      return { memberships, organisations };
+    } catch (queryError) {
+      const err = queryError instanceof Error
+        ? queryError
+        : queryError && typeof queryError === 'object' && 'message' in queryError
+          ? new Error(String((queryError as { message: unknown }).message))
+          : new Error(String(queryError));
+      logger.error('OrganisationService', 'Error loading organisation roles:', err);
+      throw err;
+    }
+  }
+
+  private async checkAndCacheSuperAdmin(): Promise<boolean> {
+    if (!this.user?.id) {
+      this._isSuperAdmin = false;
+      return false;
+    }
+    try {
+      const { isSuperAdmin: checkSuperAdmin, isRBACInitialized, setupRBAC } = await import('../rbac/api');
+      if (!isRBACInitialized() && this.supabaseClient) {
+        setupRBAC(this.supabaseClient);
       }
-      
-      // Check if user is super admin - super admins don't need organisation memberships
-      let userIsSuperAdmin = false;
-      if (this.user?.id) {
-        try {
-          // Dynamic import to avoid circular dependencies and ensure RBAC is initialized
-          const { isSuperAdmin: checkSuperAdmin, isRBACInitialized, setupRBAC } = await import('../rbac/api');
-          
-          // Ensure RBAC is initialized if possible
-          if (!isRBACInitialized() && this.supabaseClient) {
-            setupRBAC(this.supabaseClient);
-          }
-          
-          if (isRBACInitialized()) {
-            userIsSuperAdmin = await checkSuperAdmin(this.user.id as UUID);
+      if (isRBACInitialized()) {
+        const result = await checkSuperAdmin(this.user.id as UUID);
+        const isSuper = result.ok && result.data;
+        this._isSuperAdmin = isSuper;
+        return isSuper;
+      }
+      this._isSuperAdmin = false;
+      return false;
+    } catch (error) {
+      logger.warn('OrganisationService', 'Failed to check super admin status', { error });
+      this._isSuperAdmin = false;
+      return false;
+    }
+  }
+
+  private applyEmptyStateAndNotify(): void {
+    this._organisations = [];
+    this._userMemberships = [];
+    this._isLoading = false;
+    this._error = null;
+    this._isContextReady = true;
+    this.notify();
+  }
+
+  private selectInitialOrganisation(
+    activeOrgs: Organisation[],
+    memberships: OrganisationMembership[],
+    organisations: Organisation[]
+  ): Organisation {
+    let initialOrg: Organisation | null = null;
+
+    try {
+      const persistedOrgString = localStorage.getItem('pace-core-selected-organisation');
+      if (persistedOrgString) {
+        const persistedOrg = JSON.parse(persistedOrgString) as Organisation;
+        if (persistedOrg.id && typeof persistedOrg.id === 'string' && persistedOrg.id.trim() !== '') {
+          const validPersistedOrg = activeOrgs.find((org) => org.id === persistedOrg.id);
+          if (validPersistedOrg) {
+            initialOrg = validPersistedOrg;
           } else {
-            userIsSuperAdmin = false;
+            localStorage.removeItem('pace-core-selected-organisation');
           }
-          
-          this._isSuperAdmin = userIsSuperAdmin; // Cache the result
-        } catch (error) {
-          logger.warn('OrganisationService', 'Failed to check super admin status', { error });
-          // Continue with normal flow if check fails
-          this._isSuperAdmin = false;
+        } else {
+          localStorage.removeItem('pace-core-selected-organisation');
         }
-      } else {
-        this._isSuperAdmin = false;
       }
+    } catch {
+      localStorage.removeItem('pace-core-selected-organisation');
+    }
+
+    if (!initialOrg) {
+      const adminMembership = memberships.find((m) => m.role === 'org_admin');
+      if (adminMembership) {
+        const foundOrg = organisations.find((org) => org.id === adminMembership.organisation_id);
+        if (foundOrg) initialOrg = foundOrg;
+      }
+    }
+
+    if (!initialOrg) {
+      initialOrg = activeOrgs[0];
+    }
+
+    if (!initialOrg) {
+      throw new Error('No valid organisation found for user') as OrganisationSecurityError;
+    }
+
+    localStorage.setItem('pace-core-selected-organisation', JSON.stringify(initialOrg));
+    return initialOrg;
+  }
+
+  private async loadUserOrganisations(): Promise<void> {
+    if (!this.prepareLoad()) return;
+
+    const abortSignal = this.abortControllerRef!.signal;
+
+    try {
+      const { memberships, organisations } = await this.fetchRolesAndOrganisations(abortSignal);
+      const userIsSuperAdmin = await this.checkAndCacheSuperAdmin();
 
-      // Super admins can proceed without organisation memberships
       if (!memberships || memberships.length === 0) {
         if (userIsSuperAdmin) {
-          // Super admin without org memberships - allow empty state
-          this._organisations = [];
-          this._userMemberships = [];
-          this._isLoading = false;
-          this._error = null;
-          this._isContextReady = true;
-          this.notify();
+          this.applyEmptyStateAndNotify();
           return;
         }
         throw new Error('User has no active organisation memberships') as OrganisationSecurityError;
@@ -527,148 +540,64 @@ export class OrganisationService extends BaseService implements IOrganisationSer
 
       if (!organisations || organisations.length === 0) {
         if (userIsSuperAdmin) {
-          // Super admin without orgs - allow empty state
-          this._organisations = [];
-          this._userMemberships = [];
-          this._isLoading = false;
-          this._error = null;
-          this._isContextReady = true;
-          this.notify();
+          this.applyEmptyStateAndNotify();
           return;
         }
         throw new Error('No organisations found in role data') as OrganisationSecurityError;
       }
 
-      // Create a map of organisation_id to role from the memberships data
       const roleMap = new Map<string, string>();
-      memberships?.forEach((membership) => {
+      memberships.forEach((membership) => {
         roleMap.set(membership.organisation_id, membership.role);
       });
 
-      // Extract organisations and memberships
-      const orgs = organisations as Organisation[];
-      const activeOrgs = orgs.filter(org => org.is_active);
-      
-      // Filter to active organisations only
-      
+      const activeOrgs = organisations.filter((org) => org.is_active);
+
       if (activeOrgs.length === 0) {
         if (userIsSuperAdmin) {
-          // Super admin without active orgs - allow empty state
-          this._organisations = [];
-          this._userMemberships = [];
-          this._isLoading = false;
-          this._error = null;
-          this._isContextReady = true;
-          this.notify();
+          this.applyEmptyStateAndNotify();
           return;
         }
         throw new Error('User has no access to active organisations') as OrganisationSecurityError;
       }
 
-      // Sort organisations alphabetically by display_name
       const sortedOrgs = [...activeOrgs].sort((a, b) => {
         const nameA = (a.display_name || a.name || '').toLowerCase();
         const nameB = (b.display_name || b.name || '').toLowerCase();
         return nameA.localeCompare(nameB);
       });
-      
+
       this._organisations = sortedOrgs;
-      // Memberships already have branded types from earlier mapping
-      this._userMemberships = memberships as OrganisationMembership[];
-      
-      // Store role map in component state for later use
+      this._userMemberships = memberships;
       this._roleMapState = roleMap;
-      
-      // Auto-select organisation: try persisted, then primary, then first
-      let initialOrg: Organisation | null = null;
-      let selectionMethod: 'persisted' | 'admin' | 'first' = 'first';
-      
-      // 1. Try to restore from localStorage
-      try {
-        const persistedOrgString = localStorage.getItem('pace-core-selected-organisation');
-        if (persistedOrgString) {
-          const persistedOrg = JSON.parse(persistedOrgString) as Organisation;
-          // Validate persisted org ID before using it
-          if (persistedOrg.id && typeof persistedOrg.id === 'string' && persistedOrg.id.trim() !== '') {
-            const validPersistedOrg = activeOrgs.find(org => org.id === persistedOrg.id);
-            if (validPersistedOrg) {
-              initialOrg = validPersistedOrg;
-              selectionMethod = 'persisted';
-            } else {
-              localStorage.removeItem('pace-core-selected-organisation');
-            }
-          } else {
-            localStorage.removeItem('pace-core-selected-organisation');
-          }
-        }
-      } catch (storageError) {
-        // Clear potentially corrupted cache
-        localStorage.removeItem('pace-core-selected-organisation');
-      }
-      
-      // 2. Fall back to org_admin role organisation (highest privilege)
-      if (!initialOrg) {
-        const adminMembership = memberships.find((m) => m.role === 'org_admin');
-        if (adminMembership) {
-          const foundOrg = organisations.find((org) => org.id === adminMembership.organisation_id);
-          if (foundOrg) {
-            initialOrg = foundOrg;
-            selectionMethod = 'admin';
-          }
-        }
-      }
-      
-      // 3. Fall back to first organisation
-      if (!initialOrg) {
-        initialOrg = activeOrgs[0];
-        selectionMethod = 'first';
-      }
-      
-      if (!initialOrg) {
-        throw new Error('No valid organisation found for user') as OrganisationSecurityError;
-      }
 
-      // SECURITY: Validate current selected organisation is still valid (in case it was set before orgs loaded)
+      const initialOrg = this.selectInitialOrganisation(activeOrgs, memberships, organisations);
+
       const currentSelectedOrg = this._selectedOrganisation;
-      if (currentSelectedOrg && !activeOrgs.some(org => org.id === currentSelectedOrg.id)) {
+      if (currentSelectedOrg && !activeOrgs.some((org) => org.id === currentSelectedOrg.id)) {
         logger.warn('OrganisationService', 'Current selected organisation is no longer valid, resetting', {
           invalidOrgId: currentSelectedOrg.id,
-          validOrgIds: activeOrgs.map(o => o.id)
+          validOrgIds: activeOrgs.map((o) => o.id),
         });
         this._selectedOrganisation = null;
       }
 
       this._selectedOrganisation = initialOrg;
-      
-      // Persist selection
-      localStorage.setItem('pace-core-selected-organisation', JSON.stringify(initialOrg));
-      
-      // Set database organisation context
       await this.setDatabaseOrganisationContext(initialOrg);
-      
-      // Reset retry count and failed flag on success
+
       this.retryCount = 0;
       this.hasFailedRef = false;
-      
     } catch (err) {
       const error = err as Error;
-      // "User has no access to active organisations" is a valid state for users without orgs (e.g., profile pages)
-      // Only log actual errors, not expected states
       if (error.message !== 'User has no access to active organisations') {
-        logger.error("OrganisationService", "Failed to load organisations:", err);
+        logger.error('OrganisationService', 'Failed to load organisations:', err);
       }
       this._error = error;
-      // Increment retry count on error
       this.retryCount = this.retryCount + 1;
-      // Set failed flag to prevent further attempts
       this.hasFailedRef = true;
-      // Clear all cached data on error to prevent corruption
       this.clearAllCachedData();
-      // Mark context as ready even on error - this allows the app to proceed
-      // The app can check hasValidOrganisationContext() to determine if org context is available
       this._isContextReady = true;
     } finally {
-      // Always cleanup refs and abort controller
       this.isLoadingRef = false;
       this._isLoading = false;
       this.abortControllerRef = null;