@k2b/cloud 0.43.0 → 0.45.0

package/src/services/accounts/groups.ts

@@ -31,8 +31,6 @@ const listCanonical = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }): Promise<{
@@ -48,7 +46,6 @@ const listCanonical = async (params: {
   const scope = params.scope ?? (params.userId ? "member" : "all");
   const scopeUserId = params.userId ?? "00000000-0000-0000-0000-000000000000";
   const idsCondition = ids.length === 0 ? sql`TRUE` : sql`g.id = ANY(${toPgUuidArray(ids)}::uuid[])`;
-  const includePersonal = params.includePersonal === true || params.ids !== undefined;
 
   if (params.ids && params.ids.length === 0) {
     return {
@@ -69,7 +66,7 @@ const listCanonical = async (params: {
     ${personalOwnerJoin()}
     WHERE (${params.provider ?? null}::text IS NULL OR g.provider = ${params.provider ?? null})
       AND ${idsCondition}
-      AND (${includePersonal} = true OR personal_owner.personal_owner_id IS NULL)
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (
         ${scope === "all"} = true
         OR ${params.userId ?? null}::uuid IS NULL
@@ -86,7 +83,9 @@ const listCanonical = async (params: {
     OFFSET ${offset}
   `;
 
-  const total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  // A page past the end has no rows to carry the window count; the total still counts every match.
+  let total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  if (!rows.length && page > 1) total = (await listCanonical({ ...params, page: 1, perPage: 1 })).total;
   return {
     groups: rows.map(buildBaseGroup),
     total,
@@ -105,8 +104,6 @@ export const list = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }) => {
@@ -120,13 +117,13 @@ export const get = async (params: { id: string }): Promise<BaseGroup | null> =>
 export const getMembers = async (params: {
   id: string;
   provider?: UserProvider;
-  type?: "user" | "group";
+  type?: GroupMember["type"];
   recursive?: boolean;
 }): Promise<GroupMember[]> => {
   const provider = params.provider ?? (await getGroup(params.id))?.provider;
   if (provider === "local") return localGroups.getMembers(params);
-  if (!provider) return [];
-  return providers.ipa.groups.getMembers(params);
+  if (!provider || params.type === "service_account") return [];
+  return providers.ipa.groups.getMembers({ ...params, type: params.type });
 };
 
 export const getManagers = async (params: {
@@ -223,9 +220,13 @@ export const addMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.addMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.addMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.addMember({
@@ -241,9 +242,13 @@ export const removeMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.removeMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.removeMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.removeMember({

package/src/services/accounts/identities.ts

@@ -189,40 +189,99 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         eligible: current.profile === "user",
       };
     }
+    const [ownership] = await db<{ personal: boolean }[]>`SELECT EXISTS (
+      SELECT 1 FROM auth.personal_groups p
+      WHERE (${input.identityId ?? null}::uuid IS NOT NULL AND p.group_id = ${input.identityId ?? null}::uuid)
+         OR (${input.identityId ?? null}::uuid IS NULL AND p.group_name = ${input.name})
+    ) AS personal`;
+    const personal = ownership?.personal === true;
     const rows = await groupRows(sql`(g.provider = 'local' AND g.name = ${input.name}) OR g.id = ${input.identityId ?? null}::uuid`);
     const expected = rows.find((row) => row.id === input.identityId);
     if (expected && (expected.provider !== "local" || expected.name !== input.name))
       return { state: "unknown", reason: "identity_conflict" };
     const matches = rows.filter((row) => row.provider === "local" && row.name === input.name);
-    if (!matches.length) return { state: "absent" };
+    if (!matches.length) return personal ? { state: "absent", personal: true } : { state: "absent" };
     if (matches.length !== 1) return { state: "unknown", reason: "invalid_response" };
     const current = matches[0]!;
     return {
       state: "present",
       identity: { id: current.id, name: current.name, uidNumber: null, gidNumber: current.gidNumber },
       eligible: current.gidNumber !== null,
+      ...(personal ? { personal: true } : {}),
     };
   };
   const validateLookup = (input: { kind: "users" | "groups"; name: string }) => {
     if ((input.kind !== "users" && input.kind !== "groups") || typeof input.name !== "string" || !input.name || input.name.includes("\0"))
       throw new AccountIdentityError("invalid_identity_lookup", 400);
   };
+  const reconcileIdentity = async (
+    input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
+    state: AccountIdentityAvailability,
+  ): Promise<AccountIdentityReconciliation> => {
+    validateLookup(input);
+    if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
+    if (input.identityId !== undefined) cursor(input.identityId);
+    if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
+    if (input.provider === "ipa") {
+      if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
+      return upstreamIdentity(input);
+    }
+    const result = await readLocalIdentity(input);
+    return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+  };
   return {
+    /** Trusted application provisioning only; no profile, grants, credentials, or administrator impersonation. */
+    async provisioningUsers(input: { provider?: UserProvider; id?: string; after?: string }) {
+      if (input.provider !== undefined && input.provider !== "local" && input.provider !== "ipa")
+        throw new AccountIdentityError("invalid_provider", 400);
+      const id = cursor(input.id);
+      const after = cursor(input.after);
+      const state = await availability();
+      const [localAllowed, ipaAllowed] = await Promise.all([
+        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db),
+        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db),
+      ]);
+      const rows = await db<
+        {
+          id: string;
+          provider: UserProvider;
+          uid: string;
+          managed_by: UserProvider | null;
+          uid_number: number | null;
+          primary_gid_number: number | null;
+        }[]
+      >`SELECT u.id,u.provider,u.uid,p.managed_by,p.uid_number,p.primary_gid_number
+        FROM auth.users u LEFT JOIN auth.user_posix p ON p.user_id=u.id
+        WHERE u.provider IN ('local','ipa') AND (${input.provider ?? null}::text IS NULL OR u.provider=${input.provider ?? null})
+          AND u.profile='user'
+          AND (u.account_expires IS NULL OR u.account_expires>now())
+          AND (${id}::uuid IS NULL OR u.id=${id}::uuid)
+          AND (${after}::uuid IS NULL OR u.id>${after}::uuid)
+        ORDER BY u.id LIMIT ${PAGE_SIZE + 1}`;
+      const source = page(rows);
+      const items = source.items
+        .filter((row) => (row.provider === "local" ? localAllowed : ipaAllowed && state.freeipaEnabled))
+        .map((row) => ({
+          id: row.id,
+          provider: row.provider,
+          username: row.uid,
+          posix:
+            row.managed_by === row.provider && positiveId(row.uid_number) && positiveId(row.primary_gid_number)
+              ? { uidNumber: row.uid_number, primaryGidNumber: row.primary_gid_number }
+              : null,
+        }));
+      return { items, nextCursor: source.nextCursor, availability: state };
+    },
     async reconcile(
       actor: RequestActor,
       input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
     ): Promise<AccountIdentityReconciliation> {
       const { state } = await requireAdmin(actor);
-      validateLookup(input);
-      if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
-      if (input.identityId !== undefined) cursor(input.identityId);
-      if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
-      if (input.provider === "ipa") {
-        if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
-        return upstreamIdentity(input);
-      }
-      const result = await readLocalIdentity(input);
-      return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+      return reconcileIdentity(input, state);
+    },
+    /** Trusted provisioning services use the same live identity check as administrator provisioning. */
+    async provisioningIdentity(input: { kind: "users"; provider: UserProvider; name: string; identityId: string; signal?: AbortSignal }) {
+      return reconcileIdentity(input, await availability());
     },
     /** Trusted application jobs only; this read does not authorize an HTTP caller or a filesystem mutation. */
     async localLifecycle(input: { kind: "users" | "groups"; identityId: string; name: string }) {

package/src/services/accounts/identity-reconciliation.ts

@@ -9,8 +9,10 @@ export type AccountIdentityReconciliation =
       state: "present";
       identity: { id: string | null; name: string; uidNumber: number | null; gidNumber: number | null };
       eligible: boolean;
+      /** Proven Cloud personal-group ownership, including retained directory bindings. */
+      personal?: boolean;
     }
-  | { state: "absent" }
+  | { state: "absent"; personal?: boolean }
   | { state: "unknown"; reason: "provider_disabled" | "provider_unavailable" | "invalid_response" | "identity_conflict" };
 export type IdentityLookup = { kind: "users" | "groups"; name: string; signal?: AbortSignal };
 

package/src/services/accounts/local-groups.ts

@@ -2,6 +2,7 @@ import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
+import { recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
 
@@ -122,6 +123,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     SELECT COUNT(*)::int AS count
     FROM auth.groups g
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
   `;
   const total = Number(countRow?.count ?? 0);
@@ -130,6 +132,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     FROM auth.groups g
     ${personalOwnerJoin()}
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
     ORDER BY g.name
     LIMIT ${perPage} OFFSET ${offset}
@@ -177,7 +180,7 @@ export const remove = async (params: { id: string }): Promise<MutationResult<voi
   return { ok: true, data: undefined };
 };
 
-export const getMembers = async (params: { id: string; type?: "user" | "group"; recursive?: boolean }): Promise<GroupMember[]> => {
+export const getMembers = async (params: { id: string; type?: GroupMember["type"]; recursive?: boolean }): Promise<GroupMember[]> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return [];
   const members: GroupMember[] = [];
@@ -231,6 +234,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           SELECT DISTINCT g.id, g.name
           FROM local_group_tree tree
           JOIN auth.groups g ON g.id = tree.child_group_id
+          WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `
       : await sql<DbRow[]>`
@@ -238,6 +242,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           FROM auth.group_groups_v2 gg
           JOIN auth.groups g ON g.id = gg.child_group_id
           WHERE gg.parent_group_id = ${group.id} AND g.provider = 'local'
+            AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `;
     for (const row of groupRows) {
@@ -245,6 +250,25 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
     }
   }
 
+  if (!params.type || params.type === "service_account") {
+    const rows = await sql<{ id: string; name: string; kind: "standalone" | "agent" }[]>`
+      SELECT sa.id, sa.name, sa.kind
+      FROM auth.service_accounts sa
+      WHERE sa.kind IN ('standalone', 'agent') AND ${
+        params.recursive === true
+          ? sql`${group.id}::uuid IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+          : sql`EXISTS (
+              SELECT 1 FROM auth.service_account_groups sg
+              WHERE sg.service_account_id = sa.id AND sg.group_id = ${group.id}::uuid
+            )`
+      }
+      ORDER BY sa.name, sa.id
+    `;
+    members.push(
+      ...rows.map((row) => ({ type: "service_account" as const, id: row.id, displayName: row.name, serviceAccountKind: row.kind })),
+    );
+  }
+
   return members;
 };
 
@@ -310,6 +334,7 @@ export const getManagers = async (params: { id: string; type?: "user" | "group";
       FROM auth.group_manager_groups_v2 gmg
       JOIN auth.groups g ON g.id = gmg.manager_group_id
       WHERE gmg.group_id = ${group.id} AND g.provider = 'local'
+        AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       ORDER BY g.name
     `;
     for (const row of groupRows) {
@@ -340,7 +365,8 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
           WHERE g.provider = 'local'
         )
         SELECT DISTINCT parent_group_id
-        FROM local_parent_tree
+        FROM local_parent_tree tree
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = tree.parent_group_id)
       `
     : await sql<DbRow[]>`
         SELECT gg.parent_group_id
@@ -348,6 +374,7 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
         JOIN auth.groups g ON g.id = gg.parent_group_id
         WHERE gg.child_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
@@ -374,6 +401,7 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.group_manager_groups_v2 gmg ON gmg.manager_group_id = tree.manager_group_id
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       `
     : await sql<DbRow[]>`
         SELECT gmg.group_id
@@ -381,15 +409,38 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE gmg.manager_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
   return rows.map((row) => row.group_id as string);
 };
 
-export const addMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const addMember = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
+
+  if (params.serviceAccount) {
+    const [account] = await sql<{ id: string }[]>`
+      SELECT id FROM auth.service_accounts
+      WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')
+    `;
+    if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
+    const inserted = await sql`
+      INSERT INTO auth.service_account_groups (service_account_id, group_id)
+      VALUES (${account.id}::uuid, ${group.id}::uuid) ON CONFLICT DO NOTHING
+    `;
+    if (inserted.count === 0) return { ok: false, error: "Service account is already a direct member of this group", status: 409 };
+    return { ok: true, data: undefined };
+  }
 
   if (params.user) {
     const provider = await getUserProvider(params.user);
@@ -427,10 +478,21 @@ export const addMember = async (params: { id: string; user?: string; group?: str
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const removeMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const removeMember = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
+  if (params.serviceAccount) {
+    await sql`DELETE FROM auth.service_account_groups
+      WHERE service_account_id = ${params.serviceAccount}::uuid AND group_id = ${group.id}::uuid`;
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
     await sql`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
     return { ok: true, data: undefined };
@@ -447,6 +509,9 @@ export const removeMember = async (params: { id: string; user?: string; group?:
 export const addManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
 
   if (params.user) {
     const provider = await getUserProvider(params.user);

package/src/services/accounts/users.ts

@@ -1,10 +1,19 @@
 import { type SQL, sql } from "bun";
-import type { BaseUser, MutationResult, PaginationResponse, Role, User, UserProfile, UserProvider } from "../../contracts/shared";
+import type {
+  BaseUser,
+  MutationResult,
+  PaginationResponse,
+  RequestActor,
+  Role,
+  User,
+  UserProfile,
+  UserProvider,
+} from "../../contracts/shared";
 import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import type { AuditActor } from "../audit";
-import { getFreeIpaConfig } from "../freeipa-config";
+import { getFreeIpaAdminGroups, getFreeIpaConfig } from "../freeipa-config";
 import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgTextArray, toPgUuidArray } from "../postgres";
 import { providers } from "../providers";
@@ -168,11 +177,12 @@ const buildUser = (row: DbRow, groupsAdmin: string[]): User => {
   };
 };
 
-export const get = async (params: { id: string } | { uid: string }): Promise<User | null> => {
-  const whereClause = "id" in params ? sql`u.id = ${params.id}` : sql`u.uid = ${params.uid}`;
-  const userIdExpr = "id" in params ? sql`${params.id}` : sql`u.id`;
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const rows = await sql<DbRow[]>`
+export const get = async (params: { id: string } | { uid: string }, options: { db?: SQL } = {}): Promise<User | null> => {
+  const db = options.db ?? sql;
+  const whereClause = "id" in params ? db`u.id = ${params.id}` : db`u.uid = ${params.uid}`;
+  const userIdExpr = "id" in params ? db`${params.id}` : db`u.id`;
+  const groupsAdmin = options.db ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const rows = await db<DbRow[]>`
     SELECT u.*,
       ${userIpaDataColumns()},
       CASE
@@ -224,9 +234,10 @@ export const getMinimal = async (params: { id: string } | { uid: string }): Prom
 };
 
 /** Audience roles for a resolved access subject, including delegated users and group managers. */
-export const getRoles = async (userId: string): Promise<Role[]> => {
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const [row] = await sql<DbRow[]>`SELECT u.provider, u.profile,
+export const getRoles = async (userId: string, options?: { db: typeof sql }): Promise<Role[]> => {
+  const db = options?.db ?? sql;
+  const groupsAdmin = options ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const [row] = await db<DbRow[]>`SELECT u.provider, u.profile,
     CASE WHEN u.provider='local' THEN u.admin ELSE EXISTS (
       SELECT 1 FROM auth.ipa_user_effective_groups eg WHERE eg.user_id=u.id
         AND eg.group_name=ANY(${toPgTextArray(groupsAdmin)}::text[])
@@ -238,6 +249,26 @@ export const getRoles = async (userId: string): Promise<Role[]> => {
   return buildRoles({ provider, profile, memberofGroup: [], manages: stringArray(row.manages), admin: Boolean(row.effective_admin) });
 };
 
+/**
+ * Revalidate installation authority and retain it until the caller commits.
+ * Lock users before grant/membership or mandate/profile locks, matching user
+ * deletion and provider sync. Projection and settings locks also cover rows
+ * inserted or replaced while lock acquisition was waiting.
+ */
+export const hasInstallationAdminInTransaction = async (actor: RequestActor, db: typeof sql): Promise<boolean> => {
+  if (actor.kind !== "user" || actor.sessionKind === "app" || !actor.user.roles.includes("admin")) return false;
+  const [user] = await db<{ provider: UserProvider; profile: UserProfile; expired: boolean }[]>`
+    SELECT provider, profile, (account_expires IS NOT NULL AND account_expires <= statement_timestamp()) AS expired
+    FROM auth.users WHERE id=${actor.user.id}::uuid FOR SHARE`;
+  if (!user || user.expired || user.profile !== "user") return false;
+  await db`LOCK TABLE settings.entries IN SHARE MODE`;
+  if (!(await isAccountCategoryAllowed(user, db))) return false;
+  if (user.provider === "ipa") {
+    await db`LOCK TABLE auth.ipa_user_effective_groups IN SHARE MODE`;
+  }
+  return (await getRoles(actor.user.id, { db })).includes("admin");
+};
+
 export const getByUid = async (params: { uid: string }): Promise<{ id: string; roles: Role[] } | null> => {
   const { groupsAdmin } = await getFreeIpaConfig();
   const rows = await sql<DbRow[]>`
@@ -346,15 +377,15 @@ export const list = async (params: {
   };
 };
 
-/** Technical membership reads stay complete; human-facing lists exclude personal groups explicitly. */
-export const getGroups = async (params: { id: string; recursive?: boolean; includePersonal?: boolean }): Promise<string[]> => {
+/** Exported group names exclude personal groups; authorization uses the complete group ID projection. */
+export const getGroups = async (params: { id: string; recursive?: boolean }): Promise<string[]> => {
   if (params.recursive) {
     const rows = await sql<DbRow[]>`${recursiveUserGroupsSubquery({
       userId: params.id,
       select: sql`
         SELECT DISTINCT g.name FROM user_all_groups ag
         JOIN auth.groups g ON g.id = ag.group_id
-        WHERE (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `,
     })}`;
@@ -363,7 +394,7 @@ export const getGroups = async (params: { id: string; recursive?: boolean; inclu
   const rows = await sql<DbRow[]>`
     SELECT g.name FROM auth.groups g
     WHERE g.id IN (SELECT group_id FROM auth.user_groups_v2 WHERE user_id = ${params.id}::uuid)
-      AND (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
     ORDER BY g.name
   `;
   return rows.map((row) => row.name as string);

package/src/services/app-access.ts

@@ -1,9 +1,10 @@
 import { type SQL, sql } from "bun";
 import type { Context } from "hono";
+import { RESOURCE_ACCESS_TIMEOUT_MS, resourceAppAccess } from "../_internal/app-access-resources";
 import type { AppMeta } from "../contracts/app";
 import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
 import { userFromActor } from "../server/actor";
-import type { AuthContext, RequestAuthority } from "../server/middleware/auth";
+import { type AuthContext, auth, type RequestAuthority } from "../server/middleware/auth";
 import { buildAccessPrincipalCondition } from "../server/services/access";
 import { logger } from "./logging";
 import { toPgTextArray } from "./postgres";
@@ -17,7 +18,7 @@ export const appAccessAuthority = <E extends AuthContext>(c: Context<E>): Reques
   const accessSubject = c.get("accessSubject");
   const credentialKind = c.get("credentialKind");
   if (!actor || !accessSubject || !credentialKind) return null;
-  return { actor, accessSubject, credentialKind, scopes: c.get("credentialScopes") ?? [] };
+  return auth.getAuthority(c);
 };
 
 const credentialAllows = (authority: RequestAuthority, appId: string): boolean => {
@@ -65,6 +66,7 @@ export const evaluateAppAccess = (authority: RequestAuthority | null, app: Acces
   const parsed = AppAccessRuleSchema.safeParse(app.access);
   if (!parsed.success) return false;
   const rule = parsed.data;
+  if (rule.kind === "resources") return false; // Asynchronous adapter decision only.
   if (rule.kind !== "grants") return fixedAllows(authority, rule);
   if (!state?.configured) return !!rule.until && fixedAllows(authority, rule.until);
   return state.permission === "read" || state.permission === "admin";
@@ -74,21 +76,34 @@ let lastFailureLog = -Infinity;
 const reportFailure = () => {
   if (Date.now() - lastFailureLog < 60_000) return;
   lastFailureLog = Date.now();
-  logger("app-access").error("Application access could not be resolved; configurable applications are unavailable");
+  logger("app-access").error("Application access could not be resolved; affected applications are unavailable");
 };
 
 /**
- * One authoritative SQL read for all configurable apps. No grant cache: revocation applies on the next request.
+ * One authoritative SQL read for all configurable lists; resource rules query the owning adapters.
+ * No cross-request grant cache: revocation applies on the next request.
  * Pass the reserved transaction as `db` when checking access inside a guarded operation.
+ * A supplied `signal` replaces the default resource budget; the caller must bound it.
  */
 export const usableAppIds = async (
   authority: RequestAuthority | null,
   apps: readonly AccessApp[],
-  options: { db?: SQL } = {},
+  options: { db?: SQL; signal?: AbortSignal } = {},
 ): Promise<Set<string>> => {
   const db = options.db ?? sql;
   const allowed = new Set(apps.filter((app) => app.access?.kind !== "grants" && evaluateAppAccess(authority, app)).map((app) => app.id));
   if (!authority) return allowed;
+  let resourceSignal = options.signal;
+  // Sequential: one existence probe in flight per decision, no resource enumeration.
+  for (const app of apps) {
+    if (app.access?.kind !== "resources" || !credentialAllows(authority, app.id)) continue;
+    resourceSignal ??= AbortSignal.timeout(RESOURCE_ACCESS_TIMEOUT_MS);
+    try {
+      if (await resourceAppAccess(authority, app, { ...options, signal: resourceSignal })) allowed.add(app.id);
+    } catch {
+      if (!options.signal?.aborted) reportFailure();
+    }
+  }
   const configurable = apps.filter((app) => app.access?.kind === "grants" && credentialAllows(authority, app.id));
   if (configurable.length === 0) return allowed;
   try {
@@ -119,5 +134,8 @@ export const usableAppIds = async (
   return allowed;
 };
 
-export const canUseApp = async (authority: RequestAuthority | null, app: AccessApp, options: { db?: SQL } = {}): Promise<boolean> =>
-  (await usableAppIds(authority, [app], options)).has(app.id);
+export const canUseApp = async (
+  authority: RequestAuthority | null,
+  app: AccessApp,
+  options: { db?: SQL; signal?: AbortSignal } = {},
+): Promise<boolean> => (await usableAppIds(authority, [app], options)).has(app.id);