@k2b/cloud 0.44.0 → 0.45.0

package/src/browser/shared-text-table-contract.ts

@@ -0,0 +1,150 @@
+import { encoding } from "@k2b/stdlib";
+import type { TableActionIntent, TableFocusWitness } from "../shared-text/table-actions";
+
+const { fromBase64, toBase64 } = encoding;
+
+import * as Y from "yjs";
+import { z } from "zod";
+
+/** Approved editor limit, measured in UTF-16 code units. Rejection must preserve the existing text. */
+export const TEXT_TABLE_ACTION_MAX_LENGTH = 2_097_152;
+
+// An item relative position is one tag, two safe-integer varuints (at most
+// ceil(53 / 7) bytes each), and the zero-association byte. No root-name/sentinel
+// positions are accepted. The base64 bound follows this Yjs wire format.
+const ITEM_ANCHOR_MAX_BYTES = 1 + 2 * Math.ceil(53 / 7) + 1;
+const ITEM_ANCHOR_MAX_BASE64_LENGTH = 4 * Math.ceil(ITEM_ANCHOR_MAX_BYTES / 3);
+const AnchorSchema = z
+  .string()
+  .min(1)
+  .max(ITEM_ANCHOR_MAX_BASE64_LENGTH)
+  .refine((encoded) => {
+    if (encoded.length > ITEM_ANCHOR_MAX_BASE64_LENGTH) return false;
+    try {
+      const bytes = fromBase64(encoded);
+      const position = Y.decodeRelativePosition(bytes);
+      return (
+        bytes.length <= ITEM_ANCHOR_MAX_BYTES &&
+        position.item !== null &&
+        position.assoc === 0 &&
+        Number.isSafeInteger(position.item.client) &&
+        position.item.client >= 0 &&
+        Number.isSafeInteger(position.item.clock) &&
+        position.item.clock >= 0 &&
+        toBase64(Y.encodeRelativePosition(position)) === encoded
+      );
+    } catch {
+      return false;
+    }
+  }, "Expected a canonical Yjs character anchor");
+
+const TableSchema = z.object({ headerBreak: AnchorSchema, separatorHyphen: AnchorSchema }).strict();
+const RowSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("header") }).strict(),
+  z.object({ kind: z.literal("body"), beforeBreak: AnchorSchema, inside: AnchorSchema, insideKind: z.enum(["pipe", "break"]) }).strict(),
+]);
+const ColumnSchema = z.object({ hyphen: AnchorSchema, left: AnchorSchema, right: AnchorSchema }).strict();
+
+export const TextTableFocusSchema = z.object({ table: TableSchema, row: RowSchema, column: ColumnSchema }).strict();
+export type EncodedTableFocus = z.infer<typeof TextTableFocusSchema>;
+export const encodeTableFocus = (focus: TableFocusWitness): EncodedTableFocus => ({
+  table: { headerBreak: toBase64(focus.table.headerBreak), separatorHyphen: toBase64(focus.table.separatorHyphen) },
+  row:
+    focus.row.kind === "header"
+      ? focus.row
+      : { ...focus.row, beforeBreak: toBase64(focus.row.beforeBreak), inside: toBase64(focus.row.inside) },
+  column: { hyphen: toBase64(focus.column.hyphen), left: toBase64(focus.column.left), right: toBase64(focus.column.right) },
+});
+export const decodeTableFocus = (focus: EncodedTableFocus): TableFocusWitness => ({
+  table: { headerBreak: fromBase64(focus.table.headerBreak), separatorHyphen: fromBase64(focus.table.separatorHyphen) },
+  row:
+    focus.row.kind === "header"
+      ? focus.row
+      : { ...focus.row, beforeBreak: fromBase64(focus.row.beforeBreak), inside: fromBase64(focus.row.inside) },
+  column: { hyphen: fromBase64(focus.column.hyphen), left: fromBase64(focus.column.left), right: fromBase64(focus.column.right) },
+});
+
+export const EncodedTableActionIntentSchema = z.discriminatedUnion("action", [
+  z.object({ action: z.enum(["moveRowUp", "moveRowDown"]), table: TableSchema, row: RowSchema, neighbor: RowSchema }).strict(),
+  z.object({ action: z.enum(["moveColLeft", "moveColRight"]), table: TableSchema, column: ColumnSchema, neighbor: ColumnSchema }).strict(),
+  z.object({ action: z.enum(["undo", "redo"]), receiptCursor: z.string().min(1).max(256) }).strict(),
+  z
+    .object({
+      action: z.literal("replaceSource"),
+      table: TableSchema,
+      expected: z.string().max(TEXT_TABLE_ACTION_MAX_LENGTH),
+      source: z.string().max(TEXT_TABLE_ACTION_MAX_LENGTH),
+    })
+    .strict(),
+  z.object({ action: z.enum(["completeColumns", "toggleHeader", "deleteTable"]), table: TableSchema }).strict(),
+  z.object({ action: z.enum(["rowAbove", "rowBelow", "deleteRow"]), table: TableSchema, row: RowSchema }).strict(),
+  z
+    .object({
+      action: z.enum(["colLeft", "colRight", "deleteCol", "alignLeft", "alignCenter", "alignRight"]),
+      table: TableSchema,
+      column: ColumnSchema,
+    })
+    .strict(),
+]);
+
+export const TextTableActionRequestSchema = z
+  .object({
+    // The application stores this token in a nonnegative Postgres bigint.
+    restoreRevision: z
+      .string()
+      .min(1)
+      .max(19)
+      .regex(/^(0|[1-9]\d*)$/)
+      .refine((value) => value.length <= 19 && /^(0|[1-9]\d*)$/.test(value) && BigInt(value) <= 9_223_372_036_854_775_807n),
+    actionId: z.uuid(),
+    intent: EncodedTableActionIntentSchema,
+    focus: TextTableFocusSchema.optional(),
+    caret: z
+      .object({
+        row: z.number().int().nonnegative().max(TEXT_TABLE_ACTION_MAX_LENGTH),
+        column: z.number().int().nonnegative().max(TEXT_TABLE_ACTION_MAX_LENGTH),
+      })
+      .strict()
+      .optional(),
+  })
+  .strict();
+
+export type EncodedTableActionIntent = z.infer<typeof EncodedTableActionIntentSchema>;
+export type TextTableActionRequest = z.infer<typeof TextTableActionRequestSchema>;
+
+/** Decode only schema-validated transport; planning still validates identity and current context. */
+export type TextTableIntent = TableActionIntent | { action: "undo" | "redo"; receiptCursor: string };
+export const decodeTableActionIntent = (intent: EncodedTableActionIntent): TextTableIntent => {
+  if ("receiptCursor" in intent) return intent;
+  const table = { headerBreak: fromBase64(intent.table.headerBreak), separatorHyphen: fromBase64(intent.table.separatorHyphen) };
+  if ("source" in intent) return { action: intent.action, table, expected: intent.expected, source: intent.source };
+  if (!("row" in intent) && !("column" in intent)) return { action: intent.action, table };
+  const decodeRow = (row: z.infer<typeof RowSchema>) =>
+    row.kind === "header"
+      ? row
+      : { kind: "body" as const, beforeBreak: fromBase64(row.beforeBreak), inside: fromBase64(row.inside), insideKind: row.insideKind };
+  const decodeColumn = (column: z.infer<typeof ColumnSchema>) => ({
+    hyphen: fromBase64(column.hyphen),
+    left: fromBase64(column.left),
+    right: fromBase64(column.right),
+  });
+  if ("row" in intent) {
+    const row = decodeRow(intent.row);
+    return "neighbor" in intent
+      ? { action: intent.action, table, row, neighbor: decodeRow(intent.neighbor) }
+      : { action: intent.action, table, row };
+  }
+  const column = decodeColumn(intent.column);
+  return "neighbor" in intent
+    ? { action: intent.action, table, column, neighbor: decodeColumn(intent.neighbor) }
+    : { action: intent.action, table, column };
+};
+
+export const TextTableActionReceiptSchema = z.object({ actionId: z.uuid(), update: z.string() });
+export const TextTableActionResponseSchema = z.object({
+  changed: z.boolean(),
+  focus: TextTableFocusSchema.nullable().optional(),
+  cursor: z.string().nullable(),
+  receipt: TextTableActionReceiptSchema.nullable(),
+});
+export type TextTableActionResponse = z.infer<typeof TextTableActionResponseSchema>;

package/src/browser/shared-text.ts

@@ -0,0 +1,19 @@
+/** Browser-safe identity helpers; no server log, storage, or process state. */
+export { captureTextAnchor, resolveTextAnchor } from "../shared-text/anchors";
+export {
+  captureTableAction,
+  captureTableFocus,
+  captureTableSource,
+  prepareTableActionFocus,
+  resolveTableFocus,
+  type TableActionIntent,
+  TableActionLimitError,
+  TableActionRejectedError,
+  type TableFocusWitness,
+} from "../shared-text/table-actions";
+export { createSharedTextActionHistory, type SharedTextInverseRequest } from "./shared-text-history";
+export * from "./shared-text-offline";
+export { openAuthorizedSharedTextOffline } from "./shared-text-offline-authorized";
+export * from "./shared-text-provider";
+
+export * from "./shared-text-table-contract";

package/src/contracts/shared.ts

@@ -146,9 +146,10 @@ export const EntityListItemSchema = z.discriminatedUnion("kind", [
 export type EntityListItem = z.infer<typeof EntityListItemSchema>;
 
 export const GroupMemberSchema = z.object({
-  type: z.enum(["user", "group"]),
+  type: z.enum(["user", "group", "service_account"]),
   id: z.string(),
   displayName: z.string().nullable(),
+  serviceAccountKind: ServiceAccountKindSchema.optional(),
 });
 export type GroupMember = z.infer<typeof GroupMemberSchema>;
 

package/src/server/api/respond.ts

@@ -43,6 +43,12 @@ const toErrorResponse = (result: AnyResult): [ApiErrorBody, number] => {
   return [{ message: "Internal server error", code: "INTERNAL" }, 500];
 };
 
+/** Add explicitly selected transport recovery fields without changing the error envelope. */
+export async function respond<D extends Record<string, unknown>, S extends LegacyErrorStatus>(
+  c: Context,
+  resultOrFn: ResultOrFn<LegacyErrorResult<S>>,
+  options: { errorDetails: D },
+): Promise<JsonTypedResponse<Omit<D, keyof ApiErrorBody> & ApiErrorBody, S>>;
 export async function respond<T>(
   c: Context,
   resultOrFn: ResultOrFn<AnyResult<T>>,
@@ -76,15 +82,17 @@ export async function respond<T>(
 export async function respond<T>(
   c: Context,
   resultOrFn: ResultOrFn<AnyResult<T>>,
-  successStatus: SuccessStatus | 202 = 200,
+  statusOrOptions: SuccessStatus | 202 | { errorDetails: Record<string, unknown> } = 200,
 ): Promise<JsonTypedResponse<T, SuccessStatus | 202> | ApiErrorResponse> {
   const result = typeof resultOrFn === "function" ? await resultOrFn() : await resultOrFn;
 
   if (!result.ok) {
     const [body, status] = toErrorResponse(result);
-    return c.json(body, status as ApiErrorStatus) as ApiErrorResponse;
+    const details = typeof statusOrOptions === "object" ? statusOrOptions.errorDetails : {};
+    return c.json({ ...details, ...body, code: body.code }, status as ApiErrorStatus) as ApiErrorResponse;
   }
 
+  const successStatus = typeof statusOrOptions === "number" ? statusOrOptions : 200;
   return c.json(result.data, successStatus) as JsonTypedResponse<T, SuccessStatus | 202>;
 }
 

package/src/server/index.ts

@@ -89,6 +89,7 @@ export {
   paginate,
   paginateItems,
   password,
+  recursiveServiceAccountGroupIdsSubquery,
   resolveDisplayNames,
   services,
   tryCatch,

package/src/server/services/access.ts

@@ -2,7 +2,7 @@ import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { type SQLQuery, sql } from "bun";
 import { type ManagerCandidate, removesLastManager } from "../../access/managers";
 import { accessMessages } from "../../access/messages";
-import { recursiveGroupIdsSubquery } from "../../services/accounts/group-sql";
+import { recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";
 import type { RequestAuthority } from "../middleware/auth";
@@ -266,19 +266,26 @@ export const ensureManagerRemains = (params: {
   return fail({ code: "LAST_MANAGER", message: t.lastManager({ level: params.level ?? t.manage }), status: 409 });
 };
 
-/** Resolve direct and nested group memberships from the authoritative database mirror. */
-export const getEffectiveGroups = async (params: { userId: string | null }, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
-  if (!params.userId) return [];
+type EffectiveGroupParams = { userId: string | null; serviceAccountId?: never } | { serviceAccountId: string | null; userId?: never };
+
+/** Resolve authoritative memberships; machine recipients inherit local groups only. */
+export const getEffectiveGroups = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
+  const groupIds = params.userId
+    ? recursiveGroupIdsSubquery(params.userId)
+    : params.serviceAccountId
+      ? recursiveServiceAccountGroupIdsSubquery(params.serviceAccountId)
+      : null;
+  if (!groupIds) return [];
   const rows = await db<{ id: string; name: string }[]>`
     SELECT g.id, g.name
     FROM auth.groups g
-    WHERE g.id IN (${recursiveGroupIdsSubquery(params.userId)})
+    WHERE g.id IN (${groupIds})
     ORDER BY g.name
   `;
   return rows;
 };
 
-export const getEffectiveGroupIds = async (params: { userId: string | null }, db: AccessDb = sql): Promise<string[]> =>
+export const getEffectiveGroupIds = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<string[]> =>
   (await getEffectiveGroups(params, db)).map((group) => group.id);
 
 /**
@@ -329,7 +336,7 @@ export type ResourceAccessAdapter<TResourceId = string> = {
  *
  * Apps provide column fragments because access rows are commonly joined under
  * different aliases. The subject is authoritative: group membership is always
- * resolved recursively from its user id and never accepted from a caller.
+ * resolved recursively from its user or service-account id and never accepted from a caller.
  * Resource binding, credential scopes, and permission precedence remain the
  * responsibility of the app using the predicate.
  */
@@ -346,8 +353,13 @@ export const buildAccessPrincipalTierConditions = (params: {
     serviceAccount: sql`${columns.serviceAccountId} = ${serviceAccountId}::uuid`,
     user: sql`${columns.userId} = ${userId}::uuid`,
     group: sql`(
-      ${userId}::uuid IS NOT NULL
-      AND ${columns.groupId} IN (${userId ? recursiveGroupIdsSubquery(userId) : sql`SELECT NULL::uuid WHERE FALSE`})
+      ${columns.groupId} IN (${
+        userId
+          ? recursiveGroupIdsSubquery(userId)
+          : serviceAccountId
+            ? recursiveServiceAccountGroupIdsSubquery(serviceAccountId)
+            : sql`SELECT NULL::uuid WHERE FALSE`
+      })
     )`,
     authenticated: sql`${authenticated} AND ${columns.authenticatedOnly} = true`,
     public: sql`(
@@ -369,7 +381,7 @@ export const buildAccessPrincipalCondition = (params: { subject: AccessSubject |
  * Get the effective permission level for an actor on a resource.
  * Returns the highest permission from:
  * - Direct user or service-account access
- * - Direct and nested user group memberships resolved from the database
+ * - Direct and nested group memberships for users and active standalone/agent accounts
  * - Authenticated access for every authenticated subject
  * - Public access for every subject, including anonymous callers
  *
@@ -465,6 +477,7 @@ export const getEffectivePermissions = async (params: {
           a.service_account_id = s.service_account_id
           OR a.user_id = s.user_id
           OR (s.user_id IS NOT NULL AND a.group_id IN (${recursiveGroupIdsSubquery(sql`s.user_id`)}))
+          OR (s.service_account_id IS NOT NULL AND a.group_id IN (${recursiveServiceAccountGroupIdsSubquery(sql`s.service_account_id`)}))
           OR a.authenticated_only = true
           OR (a.user_id IS NULL AND a.group_id IS NULL AND a.service_account_id IS NULL AND a.authenticated_only = false)
         )

package/src/server/services/index.ts

@@ -1,4 +1,5 @@
 // Cloud-specific server services
+export { recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 
 export type {
   AccessDb,

package/src/services/accounts/app.ts

@@ -415,7 +415,6 @@ export const accountsAppService = {
         const userGroups = await users.getGroups({
           id: config.userId,
           recursive: config.recursive,
-          includePersonal: false,
         });
         const query = config.filter?.query?.trim().toLowerCase();
         const filtered = query ? userGroups.filter((groupName) => groupName.toLowerCase().includes(query)) : userGroups;
@@ -970,7 +969,7 @@ export const accountsAppService = {
   group: {
     list: async (config: {
       pagination?: PageParams;
-      filter?: { search?: string; includePersonal?: boolean };
+      filter?: { search?: string };
       scope?: { userId?: string; ids?: string[]; provider?: UserProvider; mode?: "all" | "member" | "managed" };
     }): Promise<Paginated<BaseGroup>> => {
       const { page, perPage } = paginate(config.pagination);
@@ -982,7 +981,6 @@ export const accountsAppService = {
         scope: config.scope?.mode,
         ids: config.scope?.ids,
         provider: config.scope?.provider,
-        includePersonal: config.filter?.includePersonal,
       });
 
       return {
@@ -993,7 +991,10 @@ export const accountsAppService = {
         hasNext: result.pagination.hasNext,
       };
     },
-    get: async (config: { id: string }) => groups.get(config),
+    get: async (config: { id: string }) => {
+      const result = await groups.list({ ids: [config.id], perPage: 1 });
+      return result.groups[0] ?? null;
+    },
     member: {
       list: async (config: {
         id: string;
@@ -1016,7 +1017,14 @@ export const accountsAppService = {
         });
         return paginateItems(filtered, config.pagination);
       },
-      add: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      add: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1035,17 +1043,25 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.add",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
-      remove: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      remove: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1064,13 +1080,14 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.remove",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
@@ -1255,6 +1272,7 @@ export const accountsAppService = {
       profile?: UserProfile;
       userIds?: string[];
       groupIds?: string[];
+      serviceAccountIds?: string[];
       serviceAccountKinds?: ServiceAccountKind[];
       serviceAccountStatus?: ServiceAccountStatus;
       excludeUserIds?: string[];
@@ -1266,7 +1284,6 @@ export const accountsAppService = {
       parentGroupId?: string;
       managedByUserId?: string;
       recursive?: boolean;
-      includePersonal?: boolean;
     }): Promise<Paginated<EntityListItem>> => {
       const canSearchDirectory = config.actor.roles.includes("user");
       const usesRelationFilter = Boolean(
@@ -1288,6 +1305,7 @@ export const accountsAppService = {
         profile: config.profile,
         userIds: config.userIds,
         groupIds: config.groupIds,
+        serviceAccountIds: config.serviceAccountIds,
         serviceAccountKinds: config.serviceAccountKinds,
         serviceAccountStatus: config.serviceAccountStatus,
         excludeUserIds: config.excludeUserIds,
@@ -1299,7 +1317,6 @@ export const accountsAppService = {
         parentGroupId: config.parentGroupId,
         managedByUserId: config.managedByUserId,
         recursive: config.recursive,
-        includePersonal: config.includePersonal,
         page,
         perPage,
       });
@@ -1661,9 +1678,9 @@ export const accountsAppService = {
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local') AS local_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'user') AS local_user_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'guest') AS local_guest_accounts_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS ipa_groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS local_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS ipa_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS local_groups_total,
           (SELECT COUNT(*)::int FROM auth.account_requests WHERE status = 'pending') AS open_requests,
           (
             SELECT COUNT(*)::int

package/src/services/accounts/entities.ts

@@ -1,14 +1,14 @@
-import { sql } from "bun";
+import { type SQLQuery, sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
 import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
-import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
+import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
-type SqlFragment = any;
+type SqlFragment = SQLQuery;
 
 export type EntityListParams = {
   visibility:
@@ -21,6 +21,7 @@ export type EntityListParams = {
   profile?: UserProfile;
   userIds?: string[];
   groupIds?: string[];
+  serviceAccountIds?: string[];
   serviceAccountKinds?: ServiceAccountKind[];
   serviceAccountStatus?: ServiceAccountStatus;
   excludeUserIds?: string[];
@@ -32,11 +33,6 @@ export type EntityListParams = {
   parentGroupId?: string;
   managedByUserId?: string;
   recursive?: boolean;
-  /**
-   * Personal Linux groups are left out of directory browsing and search by
-   * default. Exact `groupIds` lookups and relation filters always return them.
-   */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 };
@@ -429,11 +425,7 @@ export const list = async (
   const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
   const groupsAdminLiteral = toPgTextArray(groupsAdmin);
   const spec = buildQuerySpec(params);
-  const includePersonal =
-    params.includePersonal === true ||
-    params.groupIds !== undefined ||
-    Boolean(params.memberOfGroupId || params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
-  const personalCondition = includePersonal ? sql`TRUE` : sql`(kind <> 'group' OR personal_owner_id IS NULL)`;
+  const personalCondition = sql`(kind <> 'group' OR NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = entity_rows.id))`;
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
@@ -455,12 +447,13 @@ export const list = async (
           )
         )`;
   const kindsCondition = (params.kinds?.length ?? 0) === 0 ? sql`TRUE` : sql`kind = ANY(${toPgTextArray(params.kinds ?? [])}::text[])`;
-  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined;
+  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined || params.serviceAccountIds !== undefined;
   const includeIdCondition = !hasIdFilter
     ? sql`TRUE`
     : sql`(
         (kind = 'user' AND id = ANY(${toPgUuidArray(params.userIds ?? [])}::uuid[]))
         OR (kind = 'group' AND id = ANY(${toPgUuidArray(params.groupIds ?? [])}::uuid[]))
+        OR (kind = 'service_account' AND id = ANY(${toPgUuidArray(params.serviceAccountIds ?? [])}::uuid[]))
       )`;
   const excludeUserCondition =
     (params.excludeUserIds?.length ?? 0) === 0
@@ -491,11 +484,30 @@ export const list = async (
             AND ug.group_id = ANY(${toPgUuidArray(params.userMemberOfGroupIds ?? [])}::uuid[])
         ))`;
 
+  // Machine recipients have local membership, but no directory management/parent relation.
+  const otherRelation = Boolean(params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
+  const machineRelation = params.memberOfGroupId
+    ? sql`sa.kind IN ('standalone', 'agent') AND EXISTS (
+        SELECT 1 FROM auth.groups target
+        WHERE target.id = ${params.memberOfGroupId}::uuid AND target.provider = 'local'
+          AND ${
+            params.recursive === true
+              ? sql`target.id IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+              : sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+                  WHERE sg.service_account_id = sa.id AND sg.group_id = target.id)`
+          }
+      )`
+    : sql`TRUE`;
+  const machineDirect = params.memberOfGroupId
+    ? sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+        WHERE sg.service_account_id = sa.id AND sg.group_id = ${params.memberOfGroupId}::uuid)`
+    : sql`NULL::boolean`;
   const where = sql`
     ${visibilityCondition}
     AND ${kindsCondition}
     AND ${includeIdCondition}
-    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null})
+    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null}
+      OR (kind = 'service_account' AND ${params.provider ?? null}::text = 'local'))
     AND (${params.profile ?? null}::text IS NULL OR kind = 'group' OR profile = ${params.profile ?? null})
     AND ${excludeUserCondition}
     AND ${excludeGroupCondition}
@@ -612,7 +624,7 @@ export const list = async (
       service_account_rows AS (
         SELECT
           'service_account'::text AS kind,
-          NULL::boolean AS direct,
+          ${machineDirect} AS direct,
           sa.id,
           NULL::text AS provider,
           NULL::text AS profile,
@@ -644,6 +656,7 @@ export const list = async (
           NULL::text AS personal_owner_display_name,
           LOWER(sa.name) AS sort_label
         FROM auth.service_accounts sa
+        WHERE NOT ${otherRelation} AND ${machineRelation}
       ),
       entity_rows AS (
         SELECT * FROM user_rows

package/src/services/accounts/group-sql.ts

@@ -104,3 +104,26 @@ export const buildManagedGroupScopeCondition = (params: { userId: SqlValue; grou
     })}
   )
 `;
+
+/** Local recipient membership only; never supplies user roles or directory identity. */
+export const recursiveServiceAccountGroupIdsSubquery = (serviceAccountId: SqlValue) => sql`
+  WITH RECURSIVE account_subject AS (
+    -- Resolve a correlated column before introducing aliases used by directory callers (for example sa.id).
+    SELECT ${serviceAccountId}::uuid AS id
+  ), account_groups AS (
+    SELECT sg.group_id
+    FROM auth.service_account_groups sg
+    JOIN auth.service_accounts sa ON sa.id = sg.service_account_id
+    JOIN account_subject subject ON subject.id = sa.id
+    JOIN auth.groups g ON g.id = sg.group_id
+    WHERE sa.status = 'active' AND sa.kind IN ('standalone', 'agent')
+      AND g.provider = 'local'
+    UNION
+    SELECT gg.parent_group_id
+    FROM auth.group_groups_v2 gg
+    JOIN auth.groups parent ON parent.id = gg.parent_group_id
+    JOIN account_groups ag ON ag.group_id = gg.child_group_id
+    WHERE parent.provider = 'local'
+  )
+  SELECT group_id FROM account_groups
+`;