@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/components/__tests__/NavigationGuard.test.tsx

@@ -1,975 +0,0 @@
-/**
- * @file NavigationGuard Component Tests
- * @package @jmruthers/pace-core
- * @module RBAC/Components/NavigationGuard
- * @since 2.0.0
- * 
- * Comprehensive tests for the NavigationGuard component covering all critical functionality.
- */
-
-import { render, screen, waitFor } from '@testing-library/react';
-import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { ReactNode } from 'react';
-import { NavigationGuard } from '../NavigationGuard';
-import { useMultiplePermissions } from '../../hooks/usePermissions';
-import { useUnifiedAuth } from '../../../providers/services/UnifiedAuthProvider';
-import { getRBACLogger } from '../../config';
-
-// Mock the RBAC logger - create shared mock
-const mockLogger = {
-  debug: vi.fn(),
-  error: vi.fn(),
-  warn: vi.fn(),
-  info: vi.fn(),
-};
-
-vi.mock('../../config', () => ({
-  getRBACLogger: vi.fn(() => mockLogger),
-  getRBACConfig: vi.fn(() => ({
-    debug: true,
-    logLevel: 'debug',
-    developmentMode: true,
-    audit: {
-      enabled: true,
-      logLevel: 'debug'
-    }
-  })),
-  isDebugMode: vi.fn(() => true),
-  isDevelopmentMode: vi.fn(() => true),
-}));
-
-// Mock the RBAC hooks
-vi.mock('../../hooks/usePermissions', () => ({
-  useMultiplePermissions: vi.fn()
-}));
-
-// Mock the auth provider
-const mockUseUnifiedAuthFn = vi.fn();
-vi.mock('../../../providers/services/UnifiedAuthProvider', () => ({
-  useUnifiedAuth: () => mockUseUnifiedAuthFn(),
-  UnifiedAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}</>,
-}));
-
-// Mock the event context utility
-vi.mock('../../utils/eventContext', () => ({
-  createScopeFromEvent: vi.fn()
-}));
-
-// Mock useResolvedScope hook
-vi.mock('../../hooks/useResolvedScope', () => ({
-  useResolvedScope: vi.fn()
-}));
-
-import { createScopeFromEvent } from '../../utils/eventContext';
-import { useResolvedScope } from '../../hooks/useResolvedScope';
-
-// Mock data
-const mockUser = {
-  id: 'user-123',
-  email: 'test@example.com'
-};
-
-const mockScope = {
-  organisationId: 'org-123',
-  eventId: 'event-123',
-  appId: 'app-123'
-};
-
-const mockNavigationItem = {
-  id: 'nav-dashboard',
-  label: 'Dashboard',
-  path: '/dashboard',
-  permissions: ['read:dashboard'] as const,
-  pageId: 'dashboard',
-  icon: 'dashboard',
-  order: 1,
-  hidden: false
-};
-
-// Test component
-const TestComponent = ({ children }: { children: ReactNode }) => (
-  <div data-testid="test-component">{children}</div>
-);
-
-const TestFallback = () => (
-  <div data-testid="test-fallback">Access Denied</div>
-);
-
-const TestLoading = () => (
-  <div data-testid="test-loading">Loading...</div>
-);
-
-describe('NavigationGuard Component', () => {
-  const mockUseMultiplePermissions = vi.mocked(useMultiplePermissions);
-  const mockCreateScopeFromEvent = vi.mocked(createScopeFromEvent);
-  const mockUseResolvedScope = vi.mocked(useResolvedScope);
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    
-    // Default mock implementations
-    mockUseUnifiedAuthFn.mockReturnValue({
-      user: mockUser,
-      selectedOrganisation: { id: 'org-123' },
-      selectedEvent: { event_id: 'event-123' },
-      supabase: {} as any
-    });
-    
-    // Mock useResolvedScope to return resolved scope immediately
-    mockUseResolvedScope.mockReturnValue({
-      resolvedScope: {
-        organisationId: 'org-123',
-        eventId: 'event-123',
-        appId: 'app-123'
-      },
-      isLoading: false,
-      error: null
-    });
-    
-    mockUseMultiplePermissions.mockReturnValue({
-      results: { 'read:dashboard': true } as Record<string, boolean>,
-      isLoading: false,
-      error: null,
-      refetch: vi.fn()
-    });
-  });
-
-    describe('Rendering', () => {
-    it('renders children when permission is granted', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-        expect(screen.getByText('Navigation Link')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('renders fallback when permission is denied', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-        expect(screen.queryByTestId('test-component')).not.toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('shows loading state during permission check', () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: true,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          loading={<TestLoading />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      expect(screen.getByTestId('test-loading')).toBeInTheDocument();
-      expect(screen.queryByTestId('test-component')).not.toBeInTheDocument();
-    });
-
-    it('uses default fallback when none provided', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByText('Access Denied')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('uses default loading when none provided', () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: true,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      expect(screen.getByText('Checking...')).toBeInTheDocument();
-    });
-  });
-
-  describe('Permission Checking', () => {
-    it('enforces navigation permissions correctly', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('handles multiple permissions', async () => {
-      const multiPermissionItem = {
-        ...mockNavigationItem,
-        permissions: ['read:dashboard', 'write:dashboard'] as const
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true, 'write:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={multiPermissionItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Should check all permissions when multiple are provided
-      // The component filters permissions and calls useMultiplePermissions
-      // Verify it was called with correct scope (appId is included from useResolvedScope)
-      expect(mockUseMultiplePermissions).toHaveBeenCalled();
-      const calls = mockUseMultiplePermissions.mock.calls;
-      // Find the call with multiple permissions (if any)
-      const hasMultiPermissionCall = calls.some(call => 
-        Array.isArray(call[2]) && call[2].length >= 1
-      );
-      expect(hasMultiPermissionCall).toBe(true);
-      
-      // Verify at least one call has the correct scope structure
-      const callWithCorrectScope = calls.find(call => 
-        call[1] && typeof call[1] === 'object' && 'organisationId' in call[1]
-      );
-      expect(callWithCorrectScope).toBeDefined();
-      if (callWithCorrectScope) {
-        expect(callWithCorrectScope[1]).toMatchObject({
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        });
-      }
-    });
-
-    it('handles empty permissions array', async () => {
-      const noPermissionItem = {
-        ...mockNavigationItem,
-        permissions: [] as const
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={noPermissionItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-
-    it('handles permission checking errors gracefully', async () => {
-      const error = new Error('Permission check failed');
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-  });
-
-  describe('Scope Resolution', () => {
-    it('uses provided scope when available', async () => {
-      const customScope = {
-        organisationId: 'custom-org',
-        eventId: 'custom-event',
-        appId: 'custom-app'
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          scope={customScope}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        customScope,
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('resolves scope from organisation and event context (org-required app)', async () => {
-      // For org-required apps, organisation is primary, event is optional
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('resolves scope from organisation only (org-required app)', async () => {
-      // For org-required apps, organisation is primary context, event is optional
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: { id: 'org-123' },
-        selectedEvent: null,
-        supabase: {} as any
-      });
-
-      // Mock useResolvedScope to return scope without event
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: 'app-123'
-        },
-        isLoading: false,
-        error: null
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: undefined,
-          appId: 'app-123'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('resolves scope from event context when organisation not available (event-required app)', async () => {
-      // For event-required apps, selectedOrganisation is null, org is derived from event
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null, // Not available for event-required apps
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      // Mock useResolvedScope to return scope resolved from event
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: {
-          organisationId: 'resolved-org',
-          eventId: 'event-123',
-          appId: 'resolved-app'
-        },
-        isLoading: false,
-        error: null
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={mockNavigationItem}>
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'resolved-org',
-          eventId: 'event-123',
-          appId: 'resolved-app'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('handles scope resolution errors', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null,
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      const error = new Error('Could not resolve organisation from event');
-      // Component checks !effectiveScope first, which causes loading state
-      // When there's an error, effectiveScope is null, so component shows loading
-      // The component logic: if (isLoading || !effectiveScope || !hasChecked) return loading
-      // So even with an error, if effectiveScope is null, it shows loading
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: null,
-        isLoading: false,
-        error
-      });
-
-      // Mock permissions to return quickly
-      mockUseMultiplePermissions.mockReturnValue({
-        results: {} as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      // Component shows loading when effectiveScope is null (even with error)
-      // The component checks !effectiveScope before checking checkError
-      expect(screen.getByText('Checking...')).toBeInTheDocument();
-    });
-
-    it('handles missing context gracefully', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: mockUser,
-        selectedOrganisation: null,
-        selectedEvent: null,
-        supabase: null
-      });
-
-      mockUseResolvedScope.mockReturnValue({
-        resolvedScope: null,
-        isLoading: true,
-        error: null
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      expect(screen.getByText('Checking...')).toBeInTheDocument();
-    });
-  });
-
-  describe('Security Features', () => {
-
-    it('prevents bypassing in strict mode', async () => {
-      vi.clearAllMocks();
-      
-      // Create a local mock logger to ensure we can track calls
-      const localMockLogger = {
-        debug: vi.fn(),
-        error: vi.fn(),
-        warn: vi.fn(),
-        info: vi.fn(),
-      };
-      
-      // Mock getRBACLogger to return our local mock
-      const mockGetRBACLogger = vi.mocked(getRBACLogger);
-      mockGetRBACLogger.mockReturnValue(localMockLogger);
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          strictMode={true}
-          auditLog={true}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      await waitFor(() => {
-        expect(localMockLogger.error).toHaveBeenCalledWith(
-          expect.stringContaining('STRICT MODE VIOLATION'),
-          expect.objectContaining({
-            navigationItem: 'nav-dashboard',
-            permissions: ['read:dashboard'],
-            userId: 'user-123'
-          })
-        );
-      }, { timeout: 2000, interval: 100 });
-    });
-
-    it('logs navigation access attempts for audit', async () => {
-      vi.clearAllMocks();
-      
-      // Create a local mock logger to ensure we can track calls
-      const localMockLogger = {
-        debug: vi.fn(),
-        error: vi.fn(),
-        warn: vi.fn(),
-        info: vi.fn(),
-      };
-      
-      // Mock getRBACLogger to return our local mock
-      const mockGetRBACLogger = vi.mocked(getRBACLogger);
-      mockGetRBACLogger.mockReturnValue(localMockLogger);
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          auditLog={true}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Note: NavigationGuard currently doesn't log navigation access attempts
-      // The component has a comment indicating it should log, but the implementation
-      // is not present. The test verifies the component renders correctly when
-      // access is denied, which is the primary functionality.
-    });
-
-    it('calls onDenied callback when access is denied', async () => {
-      const onDeniedSpy = vi.fn();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          onDenied={onDeniedSpy}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(onDeniedSpy).toHaveBeenCalledWith(mockNavigationItem);
-    });
-
-    it('does not call onDenied when access is granted', async () => {
-      const onDeniedSpy = vi.fn();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          onDenied={onDeniedSpy}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(onDeniedSpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Configuration Options', () => {
-    it('respects strictMode setting', async () => {
-      vi.clearAllMocks();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          strictMode={false}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Strict mode is disabled, so error should not be called
-      expect(mockLogger.error).not.toHaveBeenCalledWith(
-        expect.stringContaining('STRICT MODE VIOLATION'),
-        expect.anything()
-      );
-    });
-
-    it('respects auditLog setting', async () => {
-      vi.clearAllMocks();
-      
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          auditLog={false}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Audit log is disabled, so debug should not be called
-      expect(mockLogger.debug).not.toHaveBeenCalledWith(
-        'Navigation access attempt:',
-        expect.anything()
-      );
-    });
-
-    it('respects requireAll setting', async () => {
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          requireAll={false}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      // Should still check the first permission as representative
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-  });
-
-  describe('Error Handling', () => {
-    it('handles missing user gracefully', async () => {
-      mockUseUnifiedAuthFn.mockReturnValue({
-        user: null,
-        selectedOrganisation: { id: 'org-123' },
-        selectedEvent: { event_id: 'event-123' },
-        supabase: {} as any
-      });
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        '',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:dashboard'],
-        true
-      );
-    });
-
-    it('handles permission check errors', async () => {
-      const error = new Error('Database connection failed');
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': false } as Record<string, boolean>,
-        isLoading: false,
-        error,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard 
-          navigationItem={mockNavigationItem}
-          fallback={<TestFallback />}
-        >
-          <TestComponent>Navigation Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-fallback')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-  });
-
-  describe('Navigation Item Properties', () => {
-    it('handles different navigation item types', async () => {
-      const differentItem = {
-        id: 'nav-settings',
-        label: 'Settings',
-        path: '/settings',
-        permissions: ['read:settings'] as const,
-        pageId: 'settings',
-        icon: 'settings',
-        order: 2,
-        hidden: false
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={differentItem}>
-          <TestComponent>Settings Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-
-      expect(mockUseMultiplePermissions).toHaveBeenCalledWith(
-        'user-123',
-        {
-          organisationId: 'org-123',
-          eventId: 'event-123',
-          appId: 'app-123'
-        },
-        ['read:settings'],
-        true
-      );
-    });
-
-    it('handles hidden navigation items', async () => {
-      const hiddenItem = {
-        ...mockNavigationItem,
-        hidden: true
-      };
-
-      mockUseMultiplePermissions.mockReturnValue({
-        results: { 'read:dashboard': true } as Record<string, boolean>,
-        isLoading: false,
-        error: null,
-        refetch: vi.fn()
-      });
-
-      render(
-        <NavigationGuard navigationItem={hiddenItem}>
-          <TestComponent>Hidden Link</TestComponent>
-        </NavigationGuard>
-      );
-
-      await waitFor(() => {
-        expect(screen.getByTestId('test-component')).toBeInTheDocument();
-      }, { interval: 10 });
-    });
-  });
-});