@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/hooks/__tests__/useOrganisationSecurity.unit.test.tsx

@@ -1,961 +0,0 @@
-import { renderHook, act } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach } from 'vitest';
-import { useOrganisationSecurity } from '../useOrganisationSecurity';
-import { useUnifiedAuth } from '../../providers';
-import { useOrganisations } from '../../hooks/useOrganisations';
-// Mock dependencies
-vi.mock('../../providers', () => ({
-  useUnifiedAuth: vi.fn(),
-}));
-
-vi.mock('../../providers/services/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: vi.fn(),
-}));
-
-vi.mock('../../hooks/useOrganisations', () => ({
-  useOrganisations: vi.fn(),
-}));
-
-// Mock the RBAC API
-vi.mock('../../rbac/api', () => ({
-  isPermitted: vi.fn(),
-  isPermittedCached: vi.fn(),
-  getPermissionMap: vi.fn(),
-  emitAuditEvent: vi.fn()
-}));
-
-// Mock the RBAC audit module
-vi.mock('../../rbac/audit', () => ({
-  emitAuditEvent: vi.fn()
-}));
-
-const mockUseUnifiedAuth = {
-  user: null,
-  session: null,
-  supabase: null
-};
-
-const mockUseOrganisations = {
-  selectedOrganisation: null,
-  getUserRole: vi.fn(),
-  validateOrganisationAccess: vi.fn()
-};
-
-// Mock Supabase client for database queries
-const mockSupabaseQuery = {
-  select: vi.fn().mockReturnThis(),
-  eq: vi.fn().mockReturnThis(),
-  lte: vi.fn().mockReturnThis(),
-  or: vi.fn().mockReturnThis(),
-  single: vi.fn(),
-  limit: vi.fn()
-};
-
-const mockSupabase = {
-  from: vi.fn().mockReturnValue(mockSupabaseQuery)
-};
-
-// Legacy useRBAC mock removed - global role now derived from user metadata
-
-describe('useOrganisationSecurity', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    vi.mocked(useUnifiedAuth).mockReturnValue(mockUseUnifiedAuth as any);
-    vi.mocked(useOrganisations).mockReturnValue(mockUseOrganisations as any);
-    
-    // Reset Supabase mock chain
-    mockSupabaseQuery.select.mockClear().mockReturnThis();
-    mockSupabaseQuery.eq.mockClear().mockReturnThis();
-    mockSupabaseQuery.lte.mockClear().mockReturnThis();
-    mockSupabaseQuery.or.mockClear().mockReturnThis();
-    mockSupabaseQuery.single.mockClear();
-    mockSupabaseQuery.limit.mockClear();
-    mockSupabase.from.mockClear().mockReturnValue(mockSupabaseQuery);
-    
-    // Default: not a super admin
-    mockSupabaseQuery.limit.mockResolvedValue({ data: [], error: null });
-    mockSupabaseQuery.single.mockResolvedValue({ data: null, error: { message: 'No rows found' } });
-  });
-
-  describe('Super admin context', () => {
-    it('should detect super admin from user metadata', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-      
-      expect(result.current.superAdminContext.isSuperAdmin).toBe(true);
-      expect(result.current.superAdminContext.hasGlobalAccess).toBe(true);
-      expect(result.current.superAdminContext.canManageAllOrganisations).toBe(true);
-    });
-
-    it('should not detect super admin when metadata is false', () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'regular_user' }
-      };
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.superAdminContext.isSuperAdmin).toBe(false);
-      expect(result.current.superAdminContext.hasGlobalAccess).toBe(false);
-      expect(result.current.superAdminContext.canManageAllOrganisations).toBe(false);
-    });
-
-    it('should not detect super admin when no user', () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.superAdminContext.isSuperAdmin).toBe(false);
-      expect(result.current.superAdminContext.hasGlobalAccess).toBe(false);
-      expect(result.current.superAdminContext.canManageAllOrganisations).toBe(false);
-    });
-  });
-
-  describe('validateOrganisationAccess', () => {
-    it('should return false when no user or supabase', async () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateOrganisationAccess('org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-
-    it('should return true for super admin', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      const hasAccess = await result.current.validateOrganisationAccess('org-123');
-
-      expect(hasAccess).toBe(true);
-    });
-
-    it('should check organisation membership for regular users', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSession = { access_token: 'test-token' };
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  is: vi.fn().mockReturnValue({
-                    in: vi.fn().mockReturnValue({
-                      single: vi.fn().mockResolvedValue({ data: { id: 'membership-123' }, error: null })
-                    })
-                  })
-                })
-              })
-            })
-          })
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateOrganisationAccess('org-123');
-
-      expect(hasAccess).toBe(true);
-      expect(mockSupabase.from).toHaveBeenCalledWith('rbac_organisation_roles');
-    });
-
-    it('should return false when membership query fails', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  is: vi.fn().mockReturnValue({
-                    in: vi.fn().mockReturnValue({
-                      single: vi.fn().mockResolvedValue({ data: null, error: new Error('Database error') })
-                    })
-                  })
-                })
-              })
-            })
-          })
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateOrganisationAccess('org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-
-    it('should return false when membership query throws exception', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = {
-        from: vi.fn().mockImplementation(() => {
-          throw new Error('Network error');
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateOrganisationAccess('org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-  });
-
-  describe('hasMinimumRole', () => {
-    it('should return true for super admin regardless of role', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      expect(result.current.hasMinimumRole('org_admin')).toBe(true);
-      expect(result.current.hasMinimumRole('member')).toBe(true);
-    });
-
-    it('should return false when no organisation selected', () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.hasMinimumRole('member')).toBe(false);
-    });
-
-    it('should check role hierarchy correctly', () => {
-      const mockOrg = { id: 'org-123' };
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      // Test different role combinations
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('member');
-      const { result: memberResult } = renderHook(() => useOrganisationSecurity());
-      expect(memberResult.current.hasMinimumRole('member')).toBe(true);
-      expect(memberResult.current.hasMinimumRole('leader')).toBe(false);
-
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('leader');
-      const { result: leaderResult } = renderHook(() => useOrganisationSecurity());
-      expect(leaderResult.current.hasMinimumRole('member')).toBe(true);
-      expect(leaderResult.current.hasMinimumRole('leader')).toBe(true);
-      expect(leaderResult.current.hasMinimumRole('org_admin')).toBe(false);
-
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('org_admin');
-      const { result: adminResult } = renderHook(() => useOrganisationSecurity());
-      expect(adminResult.current.hasMinimumRole('member')).toBe(true);
-      expect(adminResult.current.hasMinimumRole('leader')).toBe(true);
-      expect(adminResult.current.hasMinimumRole('org_admin')).toBe(true);
-    });
-
-    it('should use provided organisation ID when passed', () => {
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('member');
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.hasMinimumRole('member', 'org-456')).toBe(true);
-      expect(mockUseOrganisations.getUserRole).toHaveBeenCalledWith('org-456');
-    });
-  });
-
-  describe('canAccessChildOrganisations', () => {
-    it('should return true for super admin', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      expect(result.current.canAccessChildOrganisations()).toBe(true);
-    });
-
-    it('should return true for org_admin', () => {
-      const mockOrg = { id: 'org-123' };
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('org_admin');
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.canAccessChildOrganisations()).toBe(true);
-    });
-
-    it('should return false for other roles', () => {
-      const mockOrg = { id: 'org-123' };
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('member');
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.canAccessChildOrganisations()).toBe(false);
-    });
-
-    it('should return false when no organisation selected', () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      expect(result.current.canAccessChildOrganisations()).toBe(false);
-    });
-  });
-
-  describe('hasPermission', () => {
-    it('should return false when no user or supabase', async () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasPermission = await result.current.hasPermission('view_basic');
-
-      expect(hasPermission).toBe(false);
-    });
-
-    it('should return true for super admin', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      const hasPermission = await result.current.hasPermission('view_basic');
-
-      expect(hasPermission).toBe(true);
-    });
-
-    it('should call RBAC API for regular users', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-      const mockOrg = { id: 'org-123' };
-
-      // Mock the RBAC API
-      const { isPermittedCached } = await import('../../rbac/api');
-      vi.mocked(isPermittedCached).mockResolvedValue(true);
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasPermission = await result.current.hasPermission('view_basic');
-
-      expect(hasPermission).toBe(true);
-      expect(isPermittedCached).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        permission: 'view_basic'
-      });
-    });
-
-    it('should return false when RBAC API fails', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-      const mockOrg = { id: 'org-123' };
-
-      // Mock the RBAC API to throw an error
-      const { isPermittedCached } = await import('../../rbac/api');
-      vi.mocked(isPermittedCached).mockRejectedValue(new Error('RBAC API error'));
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasPermission = await result.current.hasPermission('view_basic');
-
-      expect(hasPermission).toBe(false);
-    });
-
-    it('should return false when RBAC API throws exception', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-      const mockOrg = { id: 'org-123' };
-
-      // Mock the RBAC API to throw an error
-      const { isPermittedCached } = await import('../../rbac/api');
-      vi.mocked(isPermittedCached).mockImplementation(() => {
-        throw new Error('RBAC API exception');
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasPermission = await result.current.hasPermission('view_basic');
-
-      expect(hasPermission).toBe(false);
-    });
-
-    it('should use provided organisation ID when passed', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-
-      // Mock the RBAC API
-      const { isPermittedCached } = await import('../../rbac/api');
-      vi.mocked(isPermittedCached).mockResolvedValue(true);
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      await result.current.hasPermission('view_basic', 'org-456');
-
-      expect(isPermittedCached).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: {
-          organisationId: 'org-456',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        permission: 'view_basic'
-      });
-    });
-  });
-
-  describe('getUserPermissions', () => {
-    it('should return empty array when no user or supabase', async () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const permissions = await result.current.getUserPermissions();
-
-      expect(permissions).toEqual([]);
-    });
-
-    it('should return all permissions for super admin', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      const permissions = await result.current.getUserPermissions();
-
-      expect(permissions).toEqual(['*']);
-    });
-
-    it('should return role-based permissions for regular users', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-      const mockOrg = { id: 'org-123' };
-
-      // Mock the RBAC API
-      const { getPermissionMap } = await import('../../rbac/api');
-      const mockPermissions = {
-        'view_basic': true,
-        'view_details': true,
-        'moderate_content': true,
-        'manage_events': true,
-        'manage_members': true,
-        'manage_settings': true
-      };
-      vi.mocked(getPermissionMap).mockResolvedValue(mockPermissions);
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const permissions = await result.current.getUserPermissions();
-
-      expect(permissions).toEqual([
-        'view_basic',
-        'view_details',
-        'moderate_content',
-        'manage_events',
-        'manage_members',
-        'manage_settings'
-      ]);
-      expect(getPermissionMap).toHaveBeenCalledWith({
-        userId: 'user-123',
-        scope: {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        }
-      });
-    });
-
-    it('should return empty array when role not found', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = { rpc: vi.fn() };
-      const mockOrg = { id: 'org-123' };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('unknown_role');
-
-      // Mock the RBAC import to return empty permissions
-      vi.doMock('../../rbac/api', () => ({
-        getPermissionMap: vi.fn().mockResolvedValue({})
-      }));
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const permissions = await result.current.getUserPermissions();
-
-      expect(permissions).toEqual([]);
-    });
-
-    it('should return empty array when import fails', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = { rpc: vi.fn() };
-      const mockOrg = { id: 'org-123' };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-      vi.mocked(mockUseOrganisations.getUserRole).mockReturnValue('org_admin');
-
-      // Mock RBAC import to throw error
-      vi.doMock('../../rbac/api', () => {
-        throw new Error('Import failed');
-      });
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const permissions = await result.current.getUserPermissions();
-
-      expect(permissions).toEqual([]);
-    });
-  });
-
-  describe('logOrganisationAccess', () => {
-    it('should not log when no user, supabase, or organisation', async () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      await result.current.logOrganisationAccess('test_action');
-
-      // Should not throw error
-    });
-
-    it('should call RBAC API to log access', async () => {
-      const mockUser = { id: 'user-123', user_metadata: { eventId: 'event-123', appId: 'app-123' } };
-      const mockOrg = { id: 'org-123' };
-
-      // Mock the RBAC audit API
-      const { emitAuditEvent } = await import('../../rbac/audit');
-      vi.mocked(emitAuditEvent).mockResolvedValue(undefined);
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: { rpc: vi.fn() }
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      await result.current.logOrganisationAccess('test_action', { detail: 'test' });
-
-      expect(emitAuditEvent).toHaveBeenCalledWith({
-        type: 'permission_check',
-        userId: 'user-123',
-        organisationId: 'org-123',
-        permission: 'test_action',
-        decision: true,
-        source: 'api',
-        duration_ms: 0,
-        metadata: { detail: 'test' }
-      });
-    });
-
-    it('should handle RPC errors gracefully', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = {
-        rpc: vi.fn().mockImplementation(() => {
-          throw new Error('Logging failed');
-        })
-      };
-      const mockOrg = { id: 'org-123' };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-      vi.mocked(useOrganisations).mockReturnValue({
-        ...mockUseOrganisations,
-        selectedOrganisation: mockOrg
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      // Should not throw error
-      await result.current.logOrganisationAccess('test_action');
-    });
-  });
-
-  describe('ensureOrganisationAccess', () => {
-    it('should not throw when access is granted', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSession = { access_token: 'test-token' };
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  is: vi.fn().mockReturnValue({
-                    in: vi.fn().mockReturnValue({
-                      single: vi.fn().mockResolvedValue({ data: { id: 'membership-123' }, error: null })
-                    })
-                  })
-                })
-              })
-            })
-          })
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      // Should not throw
-      await result.current.ensureOrganisationAccess('org-123');
-    });
-
-    it('should throw OrganisationSecurityError when access denied', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  is: vi.fn().mockReturnValue({
-                    in: vi.fn().mockReturnValue({
-                      single: vi.fn().mockResolvedValue({ data: null, error: null })
-                    })
-                  })
-                })
-              })
-            })
-          })
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      await expect(result.current.ensureOrganisationAccess('org-123')).rejects.toThrow('User does not have access to organisation org-123');
-    });
-  });
-
-  describe('validateUserAccess', () => {
-    it('should return false when no supabase', async () => {
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateUserAccess('user-123', 'org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-
-    it('should return true for super admin', async () => {
-      const mockUser = {
-        id: 'user-123',
-        user_metadata: { globalRole: 'super_admin' },
-        app_metadata: { globalRole: 'super_admin' }
-      };
-      
-      // Mock database query to return super admin role
-      mockSupabaseQuery.limit.mockResolvedValue({
-        data: [{ role: 'super_admin' }],
-        error: null
-      });
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: { access_token: 'token' },
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-      
-      // Wait for async super admin check to complete
-      await act(async () => {
-        await new Promise(resolve => setTimeout(resolve, 0));
-      });
-
-      const hasAccess = await result.current.validateUserAccess('other-user', 'org-123');
-
-      expect(hasAccess).toBe(true);
-    });
-
-    it('should return false when user is not self', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = { from: vi.fn() };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateUserAccess('other-user', 'org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-
-    it('should validate own access', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSession = { access_token: 'test-token' };
-      const mockSupabase = {
-        from: vi.fn().mockReturnValue({
-          select: vi.fn().mockReturnValue({
-            eq: vi.fn().mockReturnValue({
-              eq: vi.fn().mockReturnValue({
-                eq: vi.fn().mockReturnValue({
-                  is: vi.fn().mockReturnValue({
-                    in: vi.fn().mockReturnValue({
-                      single: vi.fn().mockResolvedValue({ data: { id: 'membership-123' }, error: null })
-                    })
-                  })
-                })
-              })
-            })
-          })
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        session: mockSession,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateUserAccess('user-123', 'org-123');
-
-      expect(hasAccess).toBe(true);
-    });
-
-    it('should handle validation errors gracefully', async () => {
-      const mockUser = { id: 'user-123' };
-      const mockSupabase = {
-        from: vi.fn().mockImplementation(() => {
-          throw new Error('Validation error');
-        })
-      };
-      
-      vi.mocked(useUnifiedAuth).mockReturnValue({
-        ...mockUseUnifiedAuth,
-        user: mockUser,
-        supabase: mockSupabase
-      } as any);
-
-      const { result } = renderHook(() => useOrganisationSecurity());
-
-      const hasAccess = await result.current.validateUserAccess('user-123', 'org-123');
-
-      expect(hasAccess).toBe(false);
-    });
-  });
-});