@k2b/cloud 0.43.0 → 0.45.0

package/src/server/middleware/auth.ts

@@ -2,6 +2,7 @@ import type { Context, Env, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
 import { matchedRoutes } from "hono/route";
 import { findTargetHandler } from "hono/utils/handler";
+import { bindAppAccessRequest } from "../../_internal/app-access-request";
 import { measureServerPhase } from "../../_internal/server-timing";
 import {
   AI_INFERENCE_SCOPE,
@@ -58,6 +59,8 @@ export type ServiceAccountRequestActor =
       delegatedUser: User;
       scopes: string[];
       credentialId?: string | null;
+      /** Public OAuth client identifier; safe to retain, never the bearer token. */
+      oauthClientId?: string | null;
       credentialExpiresAt?: string | null;
       delegation?: InvocationProvenance;
     }
@@ -67,6 +70,8 @@ export type ServiceAccountRequestActor =
       delegatedUser: null;
       scopes: string[];
       credentialId?: string | null;
+      /** Public OAuth client identifier; safe to retain, never the bearer token. */
+      oauthClientId?: string | null;
       credentialExpiresAt?: string | null;
       delegation?: InvocationProvenance;
     };
@@ -248,6 +253,7 @@ const loadAuthenticatedActorUncached = async (
       delegatedUser: authResult.delegatedUser,
       scopes: authResult.scopes,
       credentialId: null,
+      oauthClientId: authResult.oauthClientId,
       credentialExpiresAt: typeof authResult.payload.exp === "number" ? new Date(authResult.payload.exp * 1_000).toISOString() : null,
     };
     c.set("actor", actor);
@@ -482,13 +488,21 @@ const getAuthority = <E extends AuthContext>(c: Context<E>): RequestAuthority =>
   const accessSubject = c.get("accessSubject");
   const credentialKind = c.get("credentialKind");
   if (!actor || !accessSubject || !credentialKind) throw new Error("Request authority has not been resolved");
-  return {
-    actor,
-    accessSubject,
-    credentialKind,
-    scopes: [...(c.get("credentialScopes") ?? [])],
-    ...(c.get("credentialProof") ? { credentialProof: c.get("credentialProof") } : {}),
-  };
+  return bindAppAccessRequest(
+    {
+      actor,
+      accessSubject,
+      credentialKind,
+      scopes: [...(c.get("credentialScopes") ?? [])],
+      ...(c.get("credentialProof") ? { credentialProof: c.get("credentialProof") } : {}),
+    },
+    c.req.raw,
+    credentialKind === "session"
+      ? c.get("sessionToken")
+      : credentialKind !== "invocation"
+        ? (session.getBearerToken(c) ?? undefined)
+        : undefined,
+  );
 };
 
 /**

package/src/server/middleware/index.ts

@@ -4,6 +4,7 @@ export {
   type AuthContext,
   auth,
   type InvocationProvenance,
+  isRequestCredentialCurrent,
   type RequestActor,
   type RequestAuthority,
   type RequestCredentialKind,

package/src/server/middleware/invocation.ts

@@ -1,5 +1,6 @@
 import type { Context, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
+import { bindAppAccessRequest } from "../../_internal/app-access-request";
 import { getApp } from "../../_internal/registry";
 import type { AppMeta } from "../../contracts/app";
 import { canUseApp } from "../../services/app-access";
@@ -53,6 +54,7 @@ export const requireInvocation = (
     if (!claims) return reject(c);
     const authority = await (dependencies.resolve ?? resolveInvocationAuthority)(claims);
     if (!authority) return reject(c);
+    bindAppAccessRequest(authority, c.req.raw);
     const app = await (dependencies.getApp ?? getApp)(expectation.targetAppId).catch(() => null);
     if (!app || !(await canUseApp(authority, app))) {
       if (app) recordAppAccessDenied(app.id);

package/src/server/public-storage.ts

@@ -0,0 +1,106 @@
+import { objectStoreBackend } from "../_internal/object-store-config";
+import { validateObjectKey } from "../_internal/object-store-key";
+import { get } from "../services/settings";
+import { clientIpBucket } from "./client-ip";
+import { ratelimit } from "./ratelimit";
+
+const notFound = () => new Response(null, { status: 404, headers: { "Cache-Control": "no-store" } });
+
+/** Platform-owned anonymous delivery. Never accepts a bucket, private prefix or listing. */
+export const servePublicStorage = async (request: Request, clientAddress = "unknown"): Promise<Response> => {
+  let path: string;
+  try {
+    // Validate before application decoding; Bun has already resolved transport
+    // dot segments. The S3 key below always starts in the public area.
+    const raw = request.url.replace(/^[a-z]+:\/\/[^/]+/i, "").split(/[?#]/, 1)[0] ?? "";
+    if (/[\\]|%(?:2e|2f|5c)/i.test(raw)) return notFound();
+    const match = /^\/public\/storage\/([a-z][a-z0-9-]{0,79})\/(.+)$/.exec(raw);
+    if (!match || match[1] === "storage") return notFound();
+    const area = `public/${match[1]}/`;
+    path = area + validateObjectKey(decodeURIComponent(match[2] ?? ""), area);
+  } catch {
+    return notFound();
+  }
+  if (request.method !== "GET" && request.method !== "HEAD") return notFound();
+  try {
+    const perSecond = Math.max(1, Math.floor(await get<number>("security.rate_limit_per_second")));
+    const budget = await ratelimit({ id: "public-storage", limit: perSecond }).check(clientIpBucket(clientAddress));
+    if (budget.limited)
+      return new Response("Rate limit exceeded.", {
+        status: 429,
+        headers: { "Cache-Control": "no-store", "Retry-After": String(Math.max(1, Math.ceil(budget.resetIn / 1000))) },
+      });
+    const { client, limit } = await objectStoreBackend();
+    const stat = await client.stat(path);
+    if (stat.size > limit) return notFound();
+    const headers = new Headers({
+      "Content-Type": stat.type || "application/octet-stream",
+      "Content-Length": String(stat.size),
+      ETag: stat.etag,
+      "Last-Modified": stat.lastModified.toUTCString(),
+      "Cache-Control": "public, max-age=300",
+      "X-Content-Type-Options": "nosniff",
+      // Apply to every type, including mislabelled or future active formats.
+      "Content-Security-Policy": "sandbox; default-src 'none'; frame-ancestors 'none'",
+    });
+    const essence = stat.type.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    const inline =
+      /^(?:image\/(?:png|jpeg|gif|webp|avif|bmp|x-icon)|audio\/(?:mpeg|ogg|wav|webm|mp4)|video\/(?:mp4|webm|ogg)|text\/plain)$/;
+    if (!inline.test(essence)) headers.set("Content-Disposition", "attachment");
+    const ifNoneMatch = request.headers.get("if-none-match");
+    const modifiedSince = request.headers.get("if-modified-since");
+    if (
+      ifNoneMatch
+        ? ifNoneMatch.split(",").some((value) => value.trim() === stat.etag || value.trim() === "*")
+        : modifiedSince && stat.lastModified.getTime() <= Date.parse(modifiedSince)
+    ) {
+      headers.delete("Content-Length");
+      return new Response(null, { status: 304, headers });
+    }
+    if (request.method === "HEAD") return new Response(null, { headers });
+    const reader = client.file(path).stream().getReader();
+    let size = 0;
+    const abort = () => {
+      void reader.cancel(request.signal.reason).catch(() => {});
+    };
+    request.signal.addEventListener("abort", abort, { once: true });
+    const release = () => {
+      request.signal.removeEventListener("abort", abort);
+      reader.releaseLock();
+    };
+    if (request.signal.aborted) abort();
+    const stream = new ReadableStream<Uint8Array>(
+      {
+        async pull(controller) {
+          try {
+            const next = await reader.read();
+            if (next.done) {
+              release();
+              controller.close();
+              return;
+            }
+            size += next.value.byteLength;
+            if (size > limit) throw new RangeError("Public object exceeds the configured size limit.");
+            controller.enqueue(next.value);
+          } catch (error) {
+            await reader.cancel(error).catch(() => {});
+            release();
+            controller.error(error);
+          }
+        },
+        async cancel(reason) {
+          try {
+            await reader.cancel(reason);
+          } finally {
+            release();
+          }
+        },
+      },
+      { highWaterMark: 0 },
+    );
+    return new Response(stream, { headers });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && ["NoSuchKey", "NotFound", "ENOENT"].includes(String(error.code))) return notFound();
+    return new Response("Storage is unavailable.", { status: 503, headers: { "Cache-Control": "no-store" } });
+  }
+};

package/src/server/services/access.ts

@@ -2,9 +2,10 @@ import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { type SQLQuery, sql } from "bun";
 import { type ManagerCandidate, removesLastManager } from "../../access/managers";
 import { accessMessages } from "../../access/messages";
-import { recursiveGroupIdsSubquery } from "../../services/accounts/group-sql";
+import { recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";
+import type { RequestAuthority } from "../middleware/auth";
 
 export type AccessDb = typeof sql;
 
@@ -265,19 +266,26 @@ export const ensureManagerRemains = (params: {
   return fail({ code: "LAST_MANAGER", message: t.lastManager({ level: params.level ?? t.manage }), status: 409 });
 };
 
-/** Resolve direct and nested group memberships from the authoritative database mirror. */
-export const getEffectiveGroups = async (params: { userId: string | null }, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
-  if (!params.userId) return [];
+type EffectiveGroupParams = { userId: string | null; serviceAccountId?: never } | { serviceAccountId: string | null; userId?: never };
+
+/** Resolve authoritative memberships; machine recipients inherit local groups only. */
+export const getEffectiveGroups = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
+  const groupIds = params.userId
+    ? recursiveGroupIdsSubquery(params.userId)
+    : params.serviceAccountId
+      ? recursiveServiceAccountGroupIdsSubquery(params.serviceAccountId)
+      : null;
+  if (!groupIds) return [];
   const rows = await db<{ id: string; name: string }[]>`
     SELECT g.id, g.name
     FROM auth.groups g
-    WHERE g.id IN (${recursiveGroupIdsSubquery(params.userId)})
+    WHERE g.id IN (${groupIds})
     ORDER BY g.name
   `;
   return rows;
 };
 
-export const getEffectiveGroupIds = async (params: { userId: string | null }, db: AccessDb = sql): Promise<string[]> =>
+export const getEffectiveGroupIds = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<string[]> =>
   (await getEffectiveGroups(params, db)).map((group) => group.id);
 
 /**
@@ -305,6 +313,13 @@ export const deleteAccess = async (params: { id: string }, db: AccessDb = sql):
  * Each app implements this to connect their resources to auth.access.
  */
 export type ResourceAccessAdapter<TResourceId = string> = {
+  /**
+   * Whether any resource in this adapter has an effective read/write/admin right.
+   * Use an existence query, never enumerate resources. Preserve domain eligibility,
+   * principal semantics, resource binding and credential ceilings. Use db and signal.
+   * Optional for existing adapters; required when selected by appAccess.resources().
+   */
+  hasAnyRight?: (subject: AccessSubject, context: { authority: RequestAuthority; db: AccessDb; signal: AbortSignal }) => Promise<boolean>;
   /** Get all access entries for a resource */
   list: (resourceId: TResourceId) => Promise<AccessEntry[]>;
   /** Add an access entry to a resource */
@@ -321,7 +336,7 @@ export type ResourceAccessAdapter<TResourceId = string> = {
  *
  * Apps provide column fragments because access rows are commonly joined under
  * different aliases. The subject is authoritative: group membership is always
- * resolved recursively from its user id and never accepted from a caller.
+ * resolved recursively from its user or service-account id and never accepted from a caller.
  * Resource binding, credential scopes, and permission precedence remain the
  * responsibility of the app using the predicate.
  */
@@ -338,8 +353,13 @@ export const buildAccessPrincipalTierConditions = (params: {
     serviceAccount: sql`${columns.serviceAccountId} = ${serviceAccountId}::uuid`,
     user: sql`${columns.userId} = ${userId}::uuid`,
     group: sql`(
-      ${userId}::uuid IS NOT NULL
-      AND ${columns.groupId} IN (${userId ? recursiveGroupIdsSubquery(userId) : sql`SELECT NULL::uuid WHERE FALSE`})
+      ${columns.groupId} IN (${
+        userId
+          ? recursiveGroupIdsSubquery(userId)
+          : serviceAccountId
+            ? recursiveServiceAccountGroupIdsSubquery(serviceAccountId)
+            : sql`SELECT NULL::uuid WHERE FALSE`
+      })
     )`,
     authenticated: sql`${authenticated} AND ${columns.authenticatedOnly} = true`,
     public: sql`(
@@ -361,7 +381,7 @@ export const buildAccessPrincipalCondition = (params: { subject: AccessSubject |
  * Get the effective permission level for an actor on a resource.
  * Returns the highest permission from:
  * - Direct user or service-account access
- * - Direct and nested user group memberships resolved from the database
+ * - Direct and nested group memberships for users and active standalone/agent accounts
  * - Authenticated access for every authenticated subject
  * - Public access for every subject, including anonymous callers
  *
@@ -457,6 +477,7 @@ export const getEffectivePermissions = async (params: {
           a.service_account_id = s.service_account_id
           OR a.user_id = s.user_id
           OR (s.user_id IS NOT NULL AND a.group_id IN (${recursiveGroupIdsSubquery(sql`s.user_id`)}))
+          OR (s.service_account_id IS NOT NULL AND a.group_id IN (${recursiveServiceAccountGroupIdsSubquery(sql`s.service_account_id`)}))
           OR a.authenticated_only = true
           OR (a.user_id IS NULL AND a.group_id IS NULL AND a.service_account_id IS NULL AND a.authenticated_only = false)
         )

package/src/server/services/index.ts

@@ -1,4 +1,5 @@
 // Cloud-specific server services
+export { recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 
 export type {
   AccessDb,

package/src/services/accounts/app.ts

@@ -8,6 +8,8 @@ import type {
   EntityListItem,
   GroupMember,
   MutationResult,
+  ServiceAccountKind,
+  ServiceAccountStatus,
   User,
   UserProfile,
   UserProvider,
@@ -413,7 +415,6 @@ export const accountsAppService = {
         const userGroups = await users.getGroups({
           id: config.userId,
           recursive: config.recursive,
-          includePersonal: false,
         });
         const query = config.filter?.query?.trim().toLowerCase();
         const filtered = query ? userGroups.filter((groupName) => groupName.toLowerCase().includes(query)) : userGroups;
@@ -968,7 +969,7 @@ export const accountsAppService = {
   group: {
     list: async (config: {
       pagination?: PageParams;
-      filter?: { search?: string; includePersonal?: boolean };
+      filter?: { search?: string };
       scope?: { userId?: string; ids?: string[]; provider?: UserProvider; mode?: "all" | "member" | "managed" };
     }): Promise<Paginated<BaseGroup>> => {
       const { page, perPage } = paginate(config.pagination);
@@ -980,7 +981,6 @@ export const accountsAppService = {
         scope: config.scope?.mode,
         ids: config.scope?.ids,
         provider: config.scope?.provider,
-        includePersonal: config.filter?.includePersonal,
       });
 
       return {
@@ -991,7 +991,10 @@ export const accountsAppService = {
         hasNext: result.pagination.hasNext,
       };
     },
-    get: async (config: { id: string }) => groups.get(config),
+    get: async (config: { id: string }) => {
+      const result = await groups.list({ ids: [config.id], perPage: 1 });
+      return result.groups[0] ?? null;
+    },
     member: {
       list: async (config: {
         id: string;
@@ -1014,7 +1017,14 @@ export const accountsAppService = {
         });
         return paginateItems(filtered, config.pagination);
       },
-      add: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      add: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1033,17 +1043,25 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.add",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
-      remove: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      remove: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1062,13 +1080,14 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.remove",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
@@ -1253,6 +1272,9 @@ export const accountsAppService = {
       profile?: UserProfile;
       userIds?: string[];
       groupIds?: string[];
+      serviceAccountIds?: string[];
+      serviceAccountKinds?: ServiceAccountKind[];
+      serviceAccountStatus?: ServiceAccountStatus;
       excludeUserIds?: string[];
       excludeGroupIds?: string[];
       excludeServiceAccountIds?: string[];
@@ -1262,7 +1284,6 @@ export const accountsAppService = {
       parentGroupId?: string;
       managedByUserId?: string;
       recursive?: boolean;
-      includePersonal?: boolean;
     }): Promise<Paginated<EntityListItem>> => {
       const canSearchDirectory = config.actor.roles.includes("user");
       const usesRelationFilter = Boolean(
@@ -1284,6 +1305,9 @@ export const accountsAppService = {
         profile: config.profile,
         userIds: config.userIds,
         groupIds: config.groupIds,
+        serviceAccountIds: config.serviceAccountIds,
+        serviceAccountKinds: config.serviceAccountKinds,
+        serviceAccountStatus: config.serviceAccountStatus,
         excludeUserIds: config.excludeUserIds,
         excludeGroupIds: config.excludeGroupIds,
         excludeServiceAccountIds: config.excludeServiceAccountIds,
@@ -1293,7 +1317,6 @@ export const accountsAppService = {
         parentGroupId: config.parentGroupId,
         managedByUserId: config.managedByUserId,
         recursive: config.recursive,
-        includePersonal: config.includePersonal,
         page,
         perPage,
       });
@@ -1655,9 +1678,9 @@ export const accountsAppService = {
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local') AS local_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'user') AS local_user_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'guest') AS local_guest_accounts_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS ipa_groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS local_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS ipa_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS local_groups_total,
           (SELECT COUNT(*)::int FROM auth.account_requests WHERE status = 'pending') AS open_requests,
           (
             SELECT COUNT(*)::int

package/src/services/accounts/entities.ts

@@ -1,14 +1,14 @@
-import { sql } from "bun";
+import { type SQLQuery, sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
-import type { ServiceAccountKind } from "../service-accounts";
+import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
-import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
+import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
-type SqlFragment = any;
+type SqlFragment = SQLQuery;
 
 export type EntityListParams = {
   visibility:
@@ -21,6 +21,9 @@ export type EntityListParams = {
   profile?: UserProfile;
   userIds?: string[];
   groupIds?: string[];
+  serviceAccountIds?: string[];
+  serviceAccountKinds?: ServiceAccountKind[];
+  serviceAccountStatus?: ServiceAccountStatus;
   excludeUserIds?: string[];
   excludeGroupIds?: string[];
   excludeServiceAccountIds?: string[];
@@ -30,11 +33,6 @@ export type EntityListParams = {
   parentGroupId?: string;
   managedByUserId?: string;
   recursive?: boolean;
-  /**
-   * Personal Linux groups are left out of directory browsing and search by
-   * default. Exact `groupIds` lookups and relation filters always return them.
-   */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 };
@@ -427,11 +425,7 @@ export const list = async (
   const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
   const groupsAdminLiteral = toPgTextArray(groupsAdmin);
   const spec = buildQuerySpec(params);
-  const includePersonal =
-    params.includePersonal === true ||
-    params.groupIds !== undefined ||
-    Boolean(params.memberOfGroupId || params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
-  const personalCondition = includePersonal ? sql`TRUE` : sql`(kind <> 'group' OR personal_owner_id IS NULL)`;
+  const personalCondition = sql`(kind <> 'group' OR NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = entity_rows.id))`;
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
@@ -453,12 +447,13 @@ export const list = async (
           )
         )`;
   const kindsCondition = (params.kinds?.length ?? 0) === 0 ? sql`TRUE` : sql`kind = ANY(${toPgTextArray(params.kinds ?? [])}::text[])`;
-  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined;
+  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined || params.serviceAccountIds !== undefined;
   const includeIdCondition = !hasIdFilter
     ? sql`TRUE`
     : sql`(
         (kind = 'user' AND id = ANY(${toPgUuidArray(params.userIds ?? [])}::uuid[]))
         OR (kind = 'group' AND id = ANY(${toPgUuidArray(params.groupIds ?? [])}::uuid[]))
+        OR (kind = 'service_account' AND id = ANY(${toPgUuidArray(params.serviceAccountIds ?? [])}::uuid[]))
       )`;
   const excludeUserCondition =
     (params.excludeUserIds?.length ?? 0) === 0
@@ -472,6 +467,13 @@ export const list = async (
     (params.excludeServiceAccountIds?.length ?? 0) === 0
       ? sql`TRUE`
       : sql`(kind <> 'service_account' OR id <> ALL(${toPgUuidArray(params.excludeServiceAccountIds ?? [])}::uuid[]))`;
+  const serviceAccountKindsCondition =
+    (params.serviceAccountKinds?.length ?? 0) === 0
+      ? sql`TRUE`
+      : sql`(kind <> 'service_account' OR service_account_kind = ANY(${toPgTextArray(params.serviceAccountKinds ?? [])}::text[]))`;
+  const serviceAccountStatusCondition = params.serviceAccountStatus
+    ? sql`(kind <> 'service_account' OR status = ${params.serviceAccountStatus})`
+    : sql`TRUE`;
   const userMemberOfGroupCondition =
     (params.userMemberOfGroupIds?.length ?? 0) === 0
       ? sql`TRUE`
@@ -482,15 +484,36 @@ export const list = async (
             AND ug.group_id = ANY(${toPgUuidArray(params.userMemberOfGroupIds ?? [])}::uuid[])
         ))`;
 
+  // Machine recipients have local membership, but no directory management/parent relation.
+  const otherRelation = Boolean(params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
+  const machineRelation = params.memberOfGroupId
+    ? sql`sa.kind IN ('standalone', 'agent') AND EXISTS (
+        SELECT 1 FROM auth.groups target
+        WHERE target.id = ${params.memberOfGroupId}::uuid AND target.provider = 'local'
+          AND ${
+            params.recursive === true
+              ? sql`target.id IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+              : sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+                  WHERE sg.service_account_id = sa.id AND sg.group_id = target.id)`
+          }
+      )`
+    : sql`TRUE`;
+  const machineDirect = params.memberOfGroupId
+    ? sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+        WHERE sg.service_account_id = sa.id AND sg.group_id = ${params.memberOfGroupId}::uuid)`
+    : sql`NULL::boolean`;
   const where = sql`
     ${visibilityCondition}
     AND ${kindsCondition}
     AND ${includeIdCondition}
-    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null})
+    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null}
+      OR (kind = 'service_account' AND ${params.provider ?? null}::text = 'local'))
     AND (${params.profile ?? null}::text IS NULL OR kind = 'group' OR profile = ${params.profile ?? null})
     AND ${excludeUserCondition}
     AND ${excludeGroupCondition}
     AND ${excludeServiceAccountCondition}
+    AND ${serviceAccountKindsCondition}
+    AND ${serviceAccountStatusCondition}
     AND ${userMemberOfGroupCondition}
     AND ${personalCondition}
     AND (
@@ -601,7 +624,7 @@ export const list = async (
       service_account_rows AS (
         SELECT
           'service_account'::text AS kind,
-          NULL::boolean AS direct,
+          ${machineDirect} AS direct,
           sa.id,
           NULL::text AS provider,
           NULL::text AS profile,
@@ -633,6 +656,7 @@ export const list = async (
           NULL::text AS personal_owner_display_name,
           LOWER(sa.name) AS sort_label
         FROM auth.service_accounts sa
+        WHERE NOT ${otherRelation} AND ${machineRelation}
       ),
       entity_rows AS (
         SELECT * FROM user_rows
@@ -649,9 +673,9 @@ export const list = async (
     OFFSET ${offset}
   `;
 
+  // A page past the end has no rows to carry the window count; the total still counts every match.
   let total = rows.length > 0 ? Number(rows[0]!.total) : 0;
-  if (params.visibility.type === "directory_shares" && !rows.length && page > 1)
-    total = (await list({ ...params, page: 1, perPage: 1 })).total;
+  if (!rows.length && page > 1) total = (await list({ ...params, page: 1, perPage: 1 })).total;
   return {
     items: rows.map((row) => {
       const entity = mapEntityRow(row);

package/src/services/accounts/group-sql.ts

@@ -104,3 +104,26 @@ export const buildManagedGroupScopeCondition = (params: { userId: SqlValue; grou
     })}
   )
 `;
+
+/** Local recipient membership only; never supplies user roles or directory identity. */
+export const recursiveServiceAccountGroupIdsSubquery = (serviceAccountId: SqlValue) => sql`
+  WITH RECURSIVE account_subject AS (
+    -- Resolve a correlated column before introducing aliases used by directory callers (for example sa.id).
+    SELECT ${serviceAccountId}::uuid AS id
+  ), account_groups AS (
+    SELECT sg.group_id
+    FROM auth.service_account_groups sg
+    JOIN auth.service_accounts sa ON sa.id = sg.service_account_id
+    JOIN account_subject subject ON subject.id = sa.id
+    JOIN auth.groups g ON g.id = sg.group_id
+    WHERE sa.status = 'active' AND sa.kind IN ('standalone', 'agent')
+      AND g.provider = 'local'
+    UNION
+    SELECT gg.parent_group_id
+    FROM auth.group_groups_v2 gg
+    JOIN auth.groups parent ON parent.id = gg.parent_group_id
+    JOIN account_groups ag ON ag.group_id = gg.child_group_id
+    WHERE parent.provider = 'local'
+  )
+  SELECT group_id FROM account_groups
+`;