@aiquants/auth-react-router 0.9.0 → 0.11.0

package/src/admin/server.ts

@@ -1,4 +1,4 @@
-import type { AuthAllowlistEntry, AuthGroup, AuthGroupMember, AuthUser } from "@aiquants/auth-core"
+import type { AuthAllowlistEntry, AuthDirectoryMembershipMode, AuthDirectoryStatus, AuthGroup, AuthGroupMember, AuthUser } from "@aiquants/auth-core"
 import { type PartialUserAdminLabels, resolveUserAdminLabels } from "./labels"
 
 /**
@@ -23,6 +23,38 @@ export type UserAdminStore = {
     listAllowlist: () => Promise<AuthAllowlistEntry[]>
     addAllowlistEntry: (data: { pattern: string; type: "email" | "domain"; description?: string }) => Promise<AuthAllowlistEntry>
     removeAllowlistEntry: (id: number) => Promise<void>
+
+    /**
+     * Allows every member of an externally-sourced group to sign in.
+     * 外部供給グループのメンバー全員にサインインを許可する処理。
+     *
+     * 判定は上流メンバー台帳を読むため、ローカル管理のグループを渡しても誰にも何も与えない。
+     * ストアはそれを拒否すること (無言の no-op を作らない)。
+     */
+    addAllowlistGroup: (groupId: number, description?: string) => Promise<void>
+    removeAllowlistGroup: (id: number) => Promise<void>
+
+    /**
+     * Links a local group to a group in the upstream directory.
+     * ローカルグループを上流ディレクトリのグループへ結び付ける処理。
+     *
+     * リンク後、そのグループの名称と所属は上流が所有する。ロール割当はローカルのままである。
+     */
+    linkDirectoryGroup: (groupId: number, data: { provider: string; externalKey: string; membershipMode: AuthDirectoryMembershipMode }) => Promise<void>
+    /** Stops following the upstream, keeping the memberships already projected. 連携の解除。 */
+    unlinkDirectoryGroup: (groupId: number) => Promise<void>
+    /** Pauses or resumes synchronization for one group. 1 グループの同期を停止・再開する処理。 */
+    setDirectorySyncEnabled: (groupId: number, isSyncEnabled: boolean) => Promise<void>
+    /**
+     * Queues a synchronization request. 同期要求をキューへ積む処理。
+     *
+     * 上流へ到達できるのは同期ジョブだけなので、web からは要求を残すことしかできない。
+     *
+     * @param groupId `null` requests every linked group of the tenant. `null` はテナント全件。
+     */
+    requestDirectorySync: (groupId: number | null) => Promise<void>
+    /** Health of the synchronization, for the header warning. 同期の健全性 (警告表示用)。 */
+    getDirectoryStatus: () => Promise<AuthDirectoryStatus>
 }
 
 /**
@@ -36,16 +68,16 @@ export function createInMemoryUserAdminStore(initial?: { users?: AuthUser[]; gro
         { id: 3, email: "user2@example.com", displayName: "営業 花子", isActive: true },
     ]
     let groups: AuthGroup[] = initial?.groups ?? [
-        { id: 1, groupKey: "dev-team", name: "開発チーム", description: "システム開発担当グループ", isActive: true },
-        { id: 2, groupKey: "sales-dept", name: "営業部", description: "営業ソリューション担当", isActive: true },
+        { id: 1, groupKey: "dev-team", name: "開発チーム", description: "システム開発担当グループ", isActive: true, readOnly: false },
+        { id: 2, groupKey: "sales-dept", name: "営業部", description: "営業ソリューション担当", isActive: true, readOnly: false },
     ]
     let groupMembers: AuthGroupMember[] = initial?.groupMembers ?? [
         { id: 1, groupId: 1, userId: 2 },
         { id: 2, groupId: 2, userId: 3 },
     ]
     let allowlist: AuthAllowlistEntry[] = initial?.allowlist ?? [
-        { id: 1, pattern: "admin@example.com", type: "email", description: "初期管理者" },
-        { id: 2, pattern: "@example.com", type: "domain", description: "社内ドメイン" },
+        { id: 1, pattern: "admin@example.com", type: "email", description: "初期管理者", owner: { kind: "tenant", tenantId: "default" }, readOnly: false },
+        { id: 2, pattern: "@example.com", type: "domain", description: "社内ドメイン", owner: { kind: "tenant", tenantId: "default" }, readOnly: false },
     ]
 
     return {
@@ -85,6 +117,7 @@ export function createInMemoryUserAdminStore(initial?: { users?: AuthUser[]; gro
                 name: data.name,
                 description: data.description,
                 isActive: true,
+                readOnly: false,
             }
             groups.push(newGroup)
             return newGroup
@@ -127,6 +160,8 @@ export function createInMemoryUserAdminStore(initial?: { users?: AuthUser[]; gro
                 pattern: data.pattern,
                 type: data.type,
                 description: data.description,
+                owner: { kind: "tenant", tenantId: "default" },
+                readOnly: false,
             }
             allowlist.push(newEntry)
             return newEntry
@@ -134,6 +169,33 @@ export function createInMemoryUserAdminStore(initial?: { users?: AuthUser[]; gro
         async removeAllowlistEntry(id) {
             allowlist = allowlist.filter((a) => a.id !== id)
         },
+
+        // --- ディレクトリ連携 ------------------------------------------------------------
+        // このメモリ実装はパッケージ自身の spec 用のテストシームであり、上流を持たない。
+        // 連携面は「結線されていない配備」を表現する形で応答する
+        async addAllowlistGroup(groupId, description) {
+            const group = groups.find((g) => g.id === groupId)
+            if (!group) throw new Error(`Group not found: ${groupId}`)
+            allowlist = [...allowlist, { id: Math.max(...allowlist.map((a) => a.id), 0) + 1, type: "group", groupId, groupKey: group.groupKey, groupName: group.name, description, owner: { kind: "tenant", tenantId: "default" }, readOnly: false }]
+        },
+        async removeAllowlistGroup(id) {
+            allowlist = allowlist.filter((a) => !(a.type === "group" && a.id === id))
+        },
+        async linkDirectoryGroup() {
+            throw new Error("This in-memory store has no upstream directory; inject a real store to link groups.")
+        },
+        async unlinkDirectoryGroup() {
+            throw new Error("This in-memory store has no upstream directory; inject a real store to unlink groups.")
+        },
+        async setDirectorySyncEnabled() {
+            throw new Error("This in-memory store has no upstream directory; inject a real store to pause synchronization.")
+        },
+        async requestDirectorySync() {
+            throw new Error("This in-memory store has no upstream directory; inject a real store to request a sync.")
+        },
+        async getDirectoryStatus() {
+            return { isEnabled: false, linkedGroupCount: 0, isStale: false, pausedGroupCount: 0, stalenessThresholdSec: 0, erroredGroupIds: [], pendingRequestCount: 0 }
+        },
     }
 }
 
@@ -188,6 +250,16 @@ const INTENT_ACCESS = new Map<string, UserAdminAccess>([
     ["removeGroupMember", "delete"],
     ["addAllowlistEntry", "create"],
     ["removeAllowlistEntry", "delete"],
+    ["addAllowlistGroup", "create"],
+    ["removeAllowlistGroup", "delete"],
+    // 連携の開始・解除は行の追加削除ではなく、既存グループの属性変更である。create / delete に
+    // 寄せると、グループ本体を作れない権限でリンクだけ張れてしまう
+    ["linkDirectoryGroup", "update"],
+    ["unlinkDirectoryGroup", "update"],
+    ["setDirectorySyncEnabled", "update"],
+    // 書き込みを伴わないが update を要求する。読取権限だけの主体が上流問い合わせを誘発できると、
+    // レート制限を外部から枯渇させられる
+    ["requestDirectorySync", "update"],
 ])
 
 /**
@@ -259,6 +331,33 @@ function requireText(formData: FormData, field: string): string {
     return value
 }
 
+/**
+ * Reads an explicit boolean. 明示的な真偽値の読み取り。
+ *
+ * `"true"` / `"false"` のみを受け付ける。欠落を既定へ倒すと、破壊側 (停止) が既定方向になる。
+ *
+ * @throws when the field is absent or not one of the two literals. 明示指定でない場合。
+ */
+function requireBoolean(formData: FormData, field: string): boolean {
+    const raw = String(formData.get(field) ?? "")
+    if (raw !== "true" && raw !== "false") throw new Error(`Invalid or missing "${field}"`)
+    return raw === "true"
+}
+
+/**
+ * Reads the membership expansion mode. 所属展開モードの読み取り。
+ *
+ * 既定へ倒さない。入れ子展開が黙って有効になると権限が静かに広がり、黙って無効になると
+ * 入れ子側の全員が削除候補になる。どちらの向きにも倒さず、明示させる。
+ *
+ * @throws when the value is not one of the two modes. 2 値でない場合。
+ */
+function requireMembershipMode(formData: FormData): AuthDirectoryMembershipMode {
+    const raw = String(formData.get("membershipMode") ?? "")
+    if (raw !== "direct" && raw !== "transitive") throw new Error('Invalid or missing "membershipMode"')
+    return raw
+}
+
 /** Reads an optional trimmed string; blank becomes `undefined`. 任意文字列の読み取り (空は undefined)。 */
 function optionalText(formData: FormData, field: string): string | undefined {
     const value = String(formData.get(field) ?? "").trim()
@@ -281,11 +380,12 @@ export function createUserAdminApp(config: UserAdminAppConfig) {
         const pathSegments = url.pathname.split("/").filter(Boolean)
         const segment = pathSegments[pathSegments.length - 1] ?? "users"
 
-        const [users, groups, groupMembers, allowlist, myPermissions] = await Promise.all([
+        const [users, groups, groupMembers, allowlist, directoryStatus, myPermissions] = await Promise.all([
             config.store.listUsers(),
             config.store.listGroups(),
             config.store.listGroupMembers(),
             config.store.listAllowlist(),
+            config.store.getDirectoryStatus(),
             // 取得できない場合は null (= 権限不明)。空マップに倒すと「付与ゼロ」と区別できなくなる
             config.getMyPermissions
                 ? config.getMyPermissions(request).catch((e) => {
@@ -297,11 +397,12 @@ export function createUserAdminApp(config: UserAdminAppConfig) {
 
         return {
             resourceLabels: config.resourceLabels,
-            segment: ["groups", "group_members", "allowlist"].includes(segment) ? segment : "users",
+            segment: ["groups", "group_members", "allowlist", "directory"].includes(segment) ? segment : "users",
             users,
             groups,
             groupMembers,
             allowlist,
+            directoryStatus,
             myPermissions,
             labels,
         }
@@ -382,6 +483,35 @@ export function createUserAdminApp(config: UserAdminAppConfig) {
             return { ok: true }
         }
 
+        if (intent === "addAllowlistGroup") {
+            await config.store.addAllowlistGroup(requireId(formData, "groupId"), optionalText(formData, "description"))
+            return { ok: true }
+        }
+        if (intent === "removeAllowlistGroup") {
+            await config.store.removeAllowlistGroup(requireId(formData, "entryId"))
+            return { ok: true }
+        }
+        if (intent === "linkDirectoryGroup") {
+            await config.store.linkDirectoryGroup(requireId(formData, "groupId"), {
+                provider: requireText(formData, "provider"),
+                externalKey: requireText(formData, "externalKey"),
+                membershipMode: requireMembershipMode(formData),
+            })
+            return { ok: true }
+        }
+        if (intent === "unlinkDirectoryGroup") {
+            await config.store.unlinkDirectoryGroup(requireId(formData, "groupId"))
+            return { ok: true }
+        }
+        if (intent === "setDirectorySyncEnabled") {
+            await config.store.setDirectorySyncEnabled(requireId(formData, "groupId"), requireBoolean(formData, "isSyncEnabled"))
+            return { ok: true }
+        }
+        if (intent === "requestDirectorySync") {
+            const raw = String(formData.get("groupId") ?? "").trim()
+            await config.store.requestDirectorySync(raw === "" ? null : requireId(formData, "groupId"))
+            return { ok: true }
+        }
         if (intent === "removeAllowlistEntry") {
             await config.store.removeAllowlistEntry(requireId(formData, "entryId"))
             return { ok: true }

package/src/admin/views.tsx

@@ -1,4 +1,4 @@
-import type { AuthAllowlistEntry, AuthGroup, AuthGroupMember, AuthUser } from "@aiquants/auth-core"
+import type { AuthAllowlistEntry, AuthDirectoryStatus, AuthGroup, AuthGroupMember, AuthUser } from "@aiquants/auth-core"
 import type React from "react"
 import { useState } from "react"
 import { useFetcher, useLoaderData } from "react-router"
@@ -11,6 +11,7 @@ export type UserAdminLoaderData = {
     groups: AuthGroup[]
     groupMembers: AuthGroupMember[]
     allowlist: AuthAllowlistEntry[]
+    directoryStatus: AuthDirectoryStatus
     labels?: UserAdminLabels
 }
 
@@ -234,6 +235,33 @@ export function UsersView() {
  * View for managing user groups (create, edit, delete).
  * ユーザーグループ管理ビュー (作成・編集・削除)。
  */
+/**
+ * Warns when synchronization is not actually keeping the mirror fresh.
+ * 同期が実際には鏡を新しく保てていないことを警告する部品。
+ *
+ * 同期の停止は「上流から外れた人がテナントに居続ける」というセキュリティ事象である。件数と
+ * エラー数だけを見ると何も起きていないように読めるため、**滞留・全停止・未結線の 3 つを
+ * それぞれ名指しで** 出す。出さなければ、状態を計算している意味がない。
+ */
+function DirectorySyncBanner({ status, labels }: { status: AuthDirectoryStatus; labels: UserAdminLabels }) {
+    if (status.linkedGroupCount === 0) return null
+    const warnings: Array<{ id: string; text: string }> = []
+    if (!status.isEnabled) warnings.push({ id: "disabled", text: labels.directoryView.disabledWarning })
+    if (status.pausedGroupCount > 0) warnings.push({ id: "paused", text: `${labels.directoryView.syncPaused}: ${status.pausedGroupCount} / ${status.linkedGroupCount}` })
+    if (status.isStale) warnings.push({ id: "stale", text: labels.directoryView.staleWarning })
+    if (status.erroredGroupIds.length > 0) warnings.push({ id: "errored", text: `${labels.directoryView.title}: ${status.erroredGroupIds.join(", ")}` })
+    if (warnings.length === 0) return null
+    return (
+        <div data-testid="directory-sync-banner" role="status" style={{ display: "flex", flexDirection: "column", gap: "0.35rem", padding: "0.7rem 1rem", borderRadius: "6px", border: "1px solid #fde68a", backgroundColor: "#fffbeb", color: "#92400e", fontSize: "0.85rem" }}>
+            {warnings.map((w) => (
+                <span key={w.id} data-directory-warning={w.id}>
+                    {w.text}
+                </span>
+            ))}
+        </div>
+    )
+}
+
 export function GroupsView() {
     const data = useLoaderData() as UserAdminLoaderData
     const fetcher = useFetcher()
@@ -274,6 +302,7 @@ export function GroupsView() {
     return (
         <section data-testid="groups-view-section" style={{ display: "flex", flexDirection: "column", gap: "1rem" }}>
             <ActionError fetcher={fetcher} />
+            <DirectorySyncBanner status={data.directoryStatus} labels={labels} />
             <div style={{ display: "flex", justifyContent: "space-between", alignItems: "center", backgroundColor: "#ffffff", padding: "1rem", borderRadius: "8px", border: "1px solid #e2e8f0" }}>
                 <input
                     type="text"
@@ -292,34 +321,58 @@ export function GroupsView() {
                 {filteredGroups.map((g) => {
                     const memberCount = data.groupMembers.filter((m) => m.groupId === g.id).length
                     return (
-                        <div key={g.id} style={{ backgroundColor: "#ffffff", borderRadius: "8px", border: "1px solid #e2e8f0", padding: "1rem", display: "flex", flexDirection: "column", justifyContent: "space-between" }} data-testid={`group-card-${g.id}`}>
+                        <div
+                            key={g.id}
+                            style={{ backgroundColor: "#ffffff", borderRadius: "8px", border: "1px solid #e2e8f0", padding: "1rem", display: "flex", flexDirection: "column", justifyContent: "space-between" }}
+                            data-testid={`group-card-${g.id}`}
+                            data-group-readonly={g.readOnly ? "true" : "false"}>
                             <div>
                                 <div style={{ display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: "0.5rem" }}>
                                     <h4 style={{ margin: 0, fontSize: "1rem", color: "#0f172a" }}>{g.name}</h4>
                                     <span style={{ fontSize: "0.72rem", backgroundColor: "#e0e7ff", color: "#4338ca", padding: "2px 6px", borderRadius: "4px", fontFamily: "monospace" }}>{g.groupKey}</span>
                                 </div>
                                 <p style={{ margin: "0 0 0.8rem 0", fontSize: "0.82rem", color: "#64748b", minHeight: "2.4em" }}>{g.description || labels.groupsView.noDescription}</p>
+                                {/* 所属も名称も上流が所有していることを、操作を試す前に伝える */}
+                                {g.externalLink && (
+                                    <div data-testid={`group-source-${g.id}`} style={{ display: "flex", alignItems: "center", gap: "6px", flexWrap: "wrap", marginBottom: "0.6rem" }}>
+                                        <span style={{ fontSize: "0.72rem", padding: "2px 8px", borderRadius: "10px", backgroundColor: "#ede9fe", color: "#6d28d9", fontWeight: 600 }}>{labels.directoryView.managedUpstream}</span>
+                                        <span style={{ fontSize: "0.72rem", fontFamily: "monospace", color: "#64748b" }}>{g.externalLink.externalKey}</span>
+                                        {g.externalLink.unresolvedCount > 0 && (
+                                            <span data-testid={`group-unresolved-${g.id}`} style={{ fontSize: "0.72rem", color: "#b45309" }}>
+                                                {g.externalLink.unresolvedCount} {labels.directoryView.unresolved}
+                                            </span>
+                                        )}
+                                    </div>
+                                )}
                             </div>
                             <div style={{ display: "flex", justifyContent: "space-between", alignItems: "center", borderTop: "1px solid #f1f5f9", paddingTop: "0.6rem" }}>
                                 <span style={{ fontSize: "0.78rem", color: "#475569" }}>
-                                    👥 メンバー: <strong>{memberCount}</strong> 人
+                                    👥 <strong>{memberCount}</strong>
                                 </span>
-                                <div>
-                                    <button
-                                        type="button"
-                                        onClick={() => setEditingGroup(g)}
-                                        data-testid={`edit-group-btn-${g.id}`}
-                                        style={{ padding: "3px 8px", borderRadius: "4px", border: "1px solid #cbd5e1", backgroundColor: "#ffffff", fontSize: "0.75rem", cursor: "pointer", marginRight: "4px" }}>
-                                        {labels.usersView.edit}
-                                    </button>
-                                    <button
-                                        type="button"
-                                        onClick={() => handleDeleteGroup(g.id)}
-                                        data-testid={`delete-group-btn-${g.id}`}
-                                        style={{ padding: "3px 8px", borderRadius: "4px", border: "1px solid #fee2e2", backgroundColor: "#fff5f5", color: "#b91c1c", fontSize: "0.75rem", cursor: "pointer" }}>
-                                        削除
-                                    </button>
-                                </div>
+                                {/* 上流が所有する行では操作を **描かない**。無効化したボタンを出すと、
+                                    押せる操作と見分けがつかず、押せない理由も伝わらない */}
+                                {g.readOnly ? (
+                                    <span data-testid={`readonly-group-${g.id}`} style={{ fontSize: "0.75rem", color: "#94a3b8" }}>
+                                        {labels.allowlistView.readOnly}
+                                    </span>
+                                ) : (
+                                    <div>
+                                        <button
+                                            type="button"
+                                            onClick={() => setEditingGroup(g)}
+                                            data-testid={`edit-group-btn-${g.id}`}
+                                            style={{ padding: "3px 8px", borderRadius: "4px", border: "1px solid #cbd5e1", backgroundColor: "#ffffff", fontSize: "0.75rem", cursor: "pointer", marginRight: "4px" }}>
+                                            {labels.usersView.edit}
+                                        </button>
+                                        <button
+                                            type="button"
+                                            onClick={() => handleDeleteGroup(g.id)}
+                                            data-testid={`delete-group-btn-${g.id}`}
+                                            style={{ padding: "3px 8px", borderRadius: "4px", border: "1px solid #fee2e2", backgroundColor: "#fff5f5", color: "#b91c1c", fontSize: "0.75rem", cursor: "pointer" }}>
+                                            {labels.allowlistView.delete}
+                                        </button>
+                                    </div>
+                                )}
                             </div>
                         </div>
                     )
@@ -541,6 +594,20 @@ export function GroupMembersView() {
     )
 }
 
+/** Badge colours per allowlist kind. 許可種別ごとのバッジ配色。 */
+function allowlistBadgeStyle(type: AuthAllowlistEntry["type"]): { backgroundColor: string; color: string } {
+    if (type === "email") return { backgroundColor: "#e0f2fe", color: "#0369a1" }
+    if (type === "domain") return { backgroundColor: "#fef3c7", color: "#b45309" }
+    return { backgroundColor: "#ede9fe", color: "#6d28d9" }
+}
+
+/** Badge text per allowlist kind. 許可種別ごとのバッジ文言。 */
+function allowlistTypeLabel(type: AuthAllowlistEntry["type"], labels: UserAdminLabels): string {
+    if (type === "email") return labels.allowlistView.emailTypeShort
+    if (type === "domain") return labels.allowlistView.domainTypeShort
+    return labels.allowlistView.groupTypeShort
+}
+
 /**
  * View for managing authentication allowlist entries.
  * アクセス許可リスト (Allowlist) 管理ビュー。
@@ -566,6 +633,11 @@ export function AllowlistView() {
         fetcher.submit({ intent: "removeAllowlistEntry", entryId: String(id) }, { method: "post" })
     }
 
+    /** グループ許可は別の表に住むため、別の intent で消す。 */
+    const handleRemoveGroupEntry = (id: number) => {
+        fetcher.submit({ intent: "removeAllowlistGroup", entryId: String(id) }, { method: "post" })
+    }
+
     return (
         <section data-testid="allowlist-view-section" style={{ display: "flex", flexDirection: "column", gap: "1.2rem" }}>
             <ActionError fetcher={fetcher} />
@@ -621,7 +693,7 @@ export function AllowlistView() {
                     <thead>
                         <tr style={{ backgroundColor: "#f8fafc", borderBottom: "1px solid #e2e8f0", color: "#475569" }}>
                             <th style={{ padding: "10px 14px" }}>ID</th>
-                            <th style={{ padding: "10px 14px" }}>{labels.allowlistView.pattern}</th>
+                            <th style={{ padding: "10px 14px" }}>{labels.allowlistView.target}</th>
                             <th style={{ padding: "10px 14px" }}>{labels.allowlistView.type}</th>
                             <th style={{ padding: "10px 14px" }}>{labels.allowlistView.description}</th>
                             <th style={{ padding: "10px 14px", textAlign: "right" }}>{labels.allowlistView.actions}</th>
@@ -629,17 +701,35 @@ export function AllowlistView() {
                     </thead>
                     <tbody>
                         {data.allowlist.map((item) => (
-                            <tr key={item.id} style={{ borderBottom: "1px solid #f1f5f9" }} data-testid={`allowlist-row-${item.id}`}>
+                            <tr key={`${item.type}-${item.id}`} style={{ borderBottom: "1px solid #f1f5f9" }} data-testid={`allowlist-row-${item.id}`} data-allowlist-type={item.type}>
                                 <td style={{ padding: "10px 14px", color: "#64748b" }}>#{item.id}</td>
-                                <td style={{ padding: "10px 14px", fontWeight: 600, color: "#0f172a", fontFamily: "monospace" }}>{item.pattern}</td>
+                                <td style={{ padding: "10px 14px", fontWeight: 600, color: "#0f172a" }}>
+                                    {/* パターン許可とグループ許可では正準値が違う。グループはアドレスではなく
+                                        グループそのものが対象なので、名前とキーを見せる */}
+                                    {item.type === "group" ? (
+                                        <span data-testid={`allowlist-group-${item.id}`}>
+                                            {item.groupName}
+                                            <span style={{ marginLeft: "6px", fontFamily: "monospace", fontSize: "0.78rem", color: "#64748b" }}>{item.groupKey}</span>
+                                        </span>
+                                    ) : (
+                                        <span style={{ fontFamily: "monospace" }}>{item.pattern}</span>
+                                    )}
+                                </td>
                                 <td style={{ padding: "10px 14px" }}>
-                                    <span style={{ fontSize: "0.75rem", padding: "2px 8px", borderRadius: "10px", backgroundColor: item.type === "email" ? "#e0f2fe" : "#fef3c7", color: item.type === "email" ? "#0369a1" : "#b45309", fontWeight: 600 }}>
-                                        {item.type === "email" ? labels.allowlistView.emailTypeShort : labels.allowlistView.domainTypeShort}
-                                    </span>
+                                    <span style={{ fontSize: "0.75rem", padding: "2px 8px", borderRadius: "10px", ...allowlistBadgeStyle(item.type), fontWeight: 600 }}>{allowlistTypeLabel(item.type, labels)}</span>
+                                </td>
+                                <td style={{ padding: "10px 14px", color: "#475569" }}>
+                                    {item.description || "-"}
+                                    {/* 配備全体が所有する行は、どのテナントの管理者でも編集できない */}
+                                    {item.owner.kind === "deployment" && (
+                                        <span data-testid={`allowlist-owner-${item.id}`} style={{ marginLeft: "8px", fontSize: "0.72rem", color: "#94a3b8" }}>
+                                            {labels.allowlistView.deploymentOwner}
+                                        </span>
+                                    )}
                                 </td>
-                                <td style={{ padding: "10px 14px", color: "#475569" }}>{item.description || "-"}</td>
                                 <td style={{ padding: "10px 14px", textAlign: "right" }}>
-                                    {/* 変更不能な供給元 (環境変数など) は削除ボタンを出さない */}
+                                    {/* 変更不能な供給元 (環境変数など) は削除ボタンを出さない。無効化ではなく
+                                        非描画にするのは、押せないボタンが押せる操作と見分けられないため */}
                                     {item.readOnly ? (
                                         <span data-testid={`readonly-allowlist-${item.id}`} style={{ fontSize: "0.75rem", color: "#94a3b8" }}>
                                             {labels.allowlistView.readOnly}
@@ -647,10 +737,10 @@ export function AllowlistView() {
                                     ) : (
                                         <button
                                             type="button"
-                                            onClick={() => handleRemoveEntry(item.id)}
+                                            onClick={() => (item.type === "group" ? handleRemoveGroupEntry(item.id) : handleRemoveEntry(item.id))}
                                             data-testid={`remove-allowlist-btn-${item.id}`}
                                             style={{ padding: "3px 8px", borderRadius: "4px", border: "1px solid #fee2e2", backgroundColor: "#fff5f5", color: "#b91c1c", fontSize: "0.78rem", cursor: "pointer" }}>
-                                            削除
+                                            {labels.allowlistView.delete}
                                         </button>
                                     )}
                                 </td>

package/src/server/authenticate-in-loader.ts

@@ -10,7 +10,7 @@
  */
 import type { AuthenticationPayload, MyGoogleProfile, SessionProfile } from "@aiquants/auth-core"
 import { redirect } from "react-router"
-import { AuthRequiredError, type AuthenticateFns } from "./authenticate"
+import { type AuthenticateFns, AuthRequiredError } from "./authenticate"
 import type { AuthServerConfig, LoggerPort } from "./ports"
 import type { AuthSessionStorage } from "./session"
 

package/src/server/google-strategy.ts

@@ -120,7 +120,7 @@ export const createGoogleAuthenticator = (config: AuthServerConfig): Authenticat
 
                 // バックエンドでのサインアップ処理 (毎ログイン実行の挙動を保存)
                 if (config.backendAuth) {
-                    await config.backendAuth.signup(provider, accessToken)
+                    await config.backendAuth.signup(provider, accessToken, profile)
                 }
 
                 logger.info("Authenticated complete: ", profile.displayName)

package/src/server/ports.ts

@@ -37,8 +37,14 @@ export type SessionConfig = {
 export type BackendAuthPort = {
     /** GET /openid/verify 相当。ok なら true。 */
     verify: (provider: string, accessToken: string) => Promise<boolean>
-    /** POST /openid/signup?overwrite_existing=true 相当 (毎ログイン実行)。 */
-    signup: (provider: string, accessToken: string) => Promise<unknown>
+    /**
+     * POST /openid/signup?overwrite_existing=true 相当 (毎ログイン実行)。
+     *
+     * `profile` を渡すのは、サインアップ直後にホスト側が identity を必要とするためである。
+     * この呼び出しでユーザー行が作られるので、直後に「この人物は何に属するか」を解決したい
+     * ホストは、ここでプロフィールを受け取れないとトークンから引き直すしかない。
+     */
+    signup: (provider: string, accessToken: string, profile: GoogleProfileBase) => Promise<unknown>
 }
 
 /** ユーザー写真解決ポート (DB 参照等の実装はアプリ側)。キャッシュ + dedup はパッケージ内。 */