@k2b/cloud 0.44.0 → 0.46.0

package/src/geo/AddressAutocomplete.tsx

@@ -0,0 +1,213 @@
+import { Combobox, type ComboboxOption, type FieldProps, TextInput, useLocale } from "@k2b/ui";
+import { createSignal, type JSX, onCleanup, onMount, Show } from "solid-js";
+import { invokeCapabilityWithDataSchema } from "../capabilities/client";
+import { type GeoAddress, type GeoAvailabilityData, geoContract } from "../contracts/geo";
+import { geoUiMessages } from "./messages";
+
+type Budget = { scope: "person" | "cloud"; resetsAt: string };
+
+export type AddressAutocompleteProps = Omit<FieldProps, "label"> & {
+  label: JSX.Element;
+  /** The street line as typed; the person's own text always stays possible. */
+  value: string;
+  onValueChange: (value: string) => void;
+  /** A chosen suggestion. The host fills its fields from it and keeps point and provenance. */
+  onPick: (address: GeoAddress) => void;
+  /** The person keeps the typed text instead of a suggestion. */
+  onOwnEntry?: (value: string) => void;
+  /** From the SSR snapshot. Without a configured geo service the field is a plain text input. */
+  availability?: GeoAvailabilityData;
+  placeholder?: string;
+  /** Icon of the plain text input when suggestions are off. */
+  icon?: string;
+};
+
+/** Suggestions cost a credit each: 3–300 characters, 250 ms pause, at most 5, one request per field in flight. */
+const MIN_TEXT = 3;
+const MAX_TEXT = 300;
+const LIMIT = 5;
+const DEBOUNCE_MS = 250;
+const OWN = "own";
+
+// The list only opens in the browser, so the browser's zone is the reader's zone here.
+const budgetText = (budget: Budget, locale: string, t: ReturnType<typeof geoUiMessages.resolve>["t"]) => {
+  const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  const at = new Date(budget.resetsAt);
+  return budget.scope === "person"
+    ? t.budgetPerson({ time: new Intl.DateTimeFormat(locale, { hour: "numeric", minute: "2-digit", timeZone }).format(at) })
+    : t.budgetCloud({ date: new Intl.DateTimeFormat(locale, { day: "numeric", month: "long", timeZone }).format(at) });
+};
+
+/** Address field with Cloud's budgeted suggestions; picking fills nothing by itself, the host owns its fields. */
+export function AddressAutocomplete(props: AddressAutocompleteProps): JSX.Element {
+  const locale = useLocale();
+  const t = () => geoUiMessages.resolve([locale()]).t;
+  const initialBudget = (): Budget | null => {
+    const value = props.availability;
+    if (value?.person.exhausted) return { scope: "person", ...value.person };
+    if (value?.cloud.exhausted) return { scope: "cloud", ...value.cloud };
+    return null;
+  };
+  const [budget, setBudget] = createSignal<Budget | null>(initialBudget());
+  const [phone, setPhone] = createSignal(false);
+  // The budget line names a time in the reader's browser zone; it exists only once the list can open.
+  const [mounted, setMounted] = createSignal(false);
+  onMount(() => {
+    setMounted(true);
+    const query = window.matchMedia("(max-width: 639px)");
+    const update = () => setPhone(query.matches);
+    update();
+    query.addEventListener("change", update);
+    onCleanup(() => query.removeEventListener("change", update));
+  });
+
+  // Options carry the id of the answer they came from, so a pick always resolves to the address it showed.
+  let suggestions = new Map<string, GeoAddress>();
+  let responses = 0;
+  // The keyboard hint belongs to a list of choices, not to an empty, failed, or budget answer.
+  const [choices, setChoices] = createSignal(false);
+  let inflight: Promise<unknown> | undefined;
+  const ownOption = (text: string): ComboboxOption => ({
+    id: OWN,
+    label: t().ownEntry({ text: text.trim() }),
+    description: t().ownEntryDetail,
+    icon: "ti ti-keyboard",
+  });
+  const withOwn = (text: string, options: ComboboxOption[]) => (phone() ? [ownOption(text), ...options] : [...options, ownOption(text)]);
+
+  const countryName = (code: string) => {
+    if (!code) return "";
+    try {
+      return new Intl.DisplayNames([locale()], { type: "region" }).of(code) ?? code;
+    } catch {
+      return code;
+    }
+  };
+
+  const fetchData = async (text: string, signal: AbortSignal): Promise<ComboboxOption[]> => {
+    if (text.trim().length > MAX_TEXT) return withOwn(text, []);
+    // A newer query waits for the open request instead of cancelling a call Core may already have paid for.
+    while (inflight) await inflight.catch(() => {});
+    signal.throwIfAborted();
+    const request = invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.autocomplete.id, input: { text, limit: LIMIT } },
+      geoContract.autocomplete.data,
+    );
+    inflight = request;
+    const result = await request.finally(() => {
+      if (inflight === request) inflight = undefined;
+    });
+    // A superseded answer never touches the state behind the options a newer answer shows.
+    signal.throwIfAborted();
+    setChoices(result.ok && result.data.data.suggestions.length > 0);
+    if (!result.ok) {
+      const details = result.error.details;
+      if (
+        result.error.code === "GEO_BUDGET_EXHAUSTED" &&
+        (details?.scope === "person" || details?.scope === "cloud") &&
+        typeof details.resetsAt === "string"
+      ) {
+        setBudget({ scope: details.scope, resetsAt: details.resetsAt });
+        return [];
+      }
+      throw new Error(t().unavailable);
+    }
+    responses += 1;
+    const answer = responses;
+    const found = result.data.data.suggestions.slice(0, LIMIT);
+    suggestions = new Map(found.map((address, index) => [`${answer}:${index}`, address]));
+    if (!found.length) return [];
+    return withOwn(
+      text,
+      found.map((address, index) => ({
+        id: `${answer}:${index}`,
+        label: address.line1 || address.formatted,
+        description: [[address.postalCode, address.city].filter(Boolean).join(" "), countryName(address.countryCode)]
+          .filter(Boolean)
+          .join(", "),
+        icon: "ti ti-map-pin",
+      })),
+    );
+  };
+
+  const budgetStatus = () => {
+    const value = budget();
+    if (!value) return undefined;
+    return (
+      <span class="flex items-start gap-2">
+        <i class="ti ti-hourglass" aria-hidden="true" />
+        <span>
+          <strong class="block font-medium">{budgetText(value, locale(), t())}</strong>
+          {t().budgetDetail}
+        </span>
+      </span>
+    );
+  };
+
+  return (
+    <Show
+      when={props.availability?.configured !== false}
+      fallback={
+        <TextInput
+          id={props.id}
+          class={props.class}
+          label={props.label}
+          description={props.description}
+          error={props.error}
+          required={props.required}
+          disabled={props.disabled}
+          placeholder={props.placeholder}
+          icon={props.icon}
+          value={() => props.value}
+          onValueChange={props.onValueChange}
+        />
+      }
+    >
+      <Combobox
+        id={props.id}
+        class={props.class}
+        label={props.label}
+        description={props.description}
+        error={props.error}
+        required={props.required}
+        disabled={props.disabled}
+        aria-label={props["aria-label"]}
+        aria-describedby={props["aria-describedby"]}
+        placeholder={props.placeholder}
+        freeText
+        autoHighlight={phone() ? 1 : 0}
+        minQueryLength={MIN_TEXT}
+        debounceMs={DEBOUNCE_MS}
+        query={() => props.value}
+        onQueryChange={props.onValueChange}
+        status={mounted() ? budgetStatus() : undefined}
+        empty={
+          <span>
+            <strong class="block font-medium">{t().noMatch}</strong>
+            {t().noMatchDetail}
+          </span>
+        }
+        footer={
+          <>
+            <span>{phone() || budget() || !choices() ? "" : t().keyboardHint}</span>
+            <span>
+              <a href="https://www.geoapify.com/" target="_blank" rel="noopener noreferrer">
+                Geoapify
+              </a>
+              {" · "}
+              <a href="https://www.openstreetmap.org/copyright" target="_blank" rel="noopener noreferrer">
+                OpenStreetMap
+              </a>
+            </span>
+          </>
+        }
+        fetchData={fetchData}
+        onSelect={(option) => {
+          if (option.id === OWN) return props.onOwnEntry?.(props.value);
+          const address = suggestions.get(option.id);
+          if (address) props.onPick(address);
+        }}
+      />
+    </Show>
+  );
+}

package/src/geo/messages.ts

@@ -0,0 +1,29 @@
+import { i18n } from "@k2b/stdlib";
+
+export const geoUiMessages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      ownEntry: ({ text }: { text: string }) => `Use “${text}” as typed`,
+      ownEntryDetail: "You fill in street, postal code, and city yourself",
+      noMatch: "No matching address found.",
+      noMatchDetail: "Enter it yourself. It is saved exactly as you write it.",
+      unavailable: "Suggestions are unavailable right now. You can enter the address yourself.",
+      budgetPerson: ({ time }: { time: string }) => `Suggestions are used up for today, back at ${time}.`,
+      budgetCloud: ({ date }: { date: string }) => `Suggestions are used up until ${date}.`,
+      budgetDetail: "You can enter the address yourself.",
+      keyboardHint: "↑↓ choose · Enter accepts",
+    },
+    de: {
+      ownEntry: ({ text }) => `„${text}“ so übernehmen`,
+      ownEntryDetail: "Straße, PLZ und Ort trägst du selbst ein",
+      noMatch: "Keine passende Adresse gefunden.",
+      noMatchDetail: "Trag sie selbst ein. Sie wird so gespeichert, wie du sie schreibst.",
+      unavailable: "Vorschläge gerade nicht verfügbar. Du kannst die Adresse selbst eintragen.",
+      budgetPerson: ({ time }) => `Vorschläge heute aufgebraucht, ab ${time} Uhr wieder.`,
+      budgetCloud: ({ date }) => `Vorschläge bis ${date} aufgebraucht.`,
+      budgetDetail: "Du kannst die Adresse selbst eintragen.",
+      keyboardHint: "↑↓ wählen · Enter übernehmen",
+    },
+  },
+});

package/src/geo/navigation.ts

@@ -0,0 +1,25 @@
+import type { GeoPoint } from "../contracts/geo";
+
+export type GeoNavigationPlatform = "android" | "ios" | "desktop";
+
+/** Phones open their own maps app; everything else gets OpenStreetMap. */
+export const geoNavigationPlatform = (userAgent: string): GeoNavigationPlatform =>
+  /android/i.test(userAgent) ? "android" : /iphone|ipad|ipod/i.test(userAgent) ? "ios" : "desktop";
+
+/**
+ * A link into a navigation app. Cloud does no live navigation; the link leaves Cloud only on click and carries
+ * just the destination and an optional name. Without a point it navigates to the address text.
+ */
+export const geoNavigationHref = (
+  target: { point?: GeoPoint | null; text: string; name?: string },
+  platform: GeoNavigationPlatform,
+): string => {
+  const point = target.point ? `${target.point.lat},${target.point.lon}` : null;
+  const text = encodeURIComponent(target.text);
+  if (platform === "android")
+    return point ? `geo:0,0?q=${point}${target.name ? `(${encodeURIComponent(target.name)})` : ""}` : `geo:0,0?q=${text}`;
+  if (platform === "ios") return `https://maps.apple.com/?daddr=${point ? encodeURIComponent(point) : text}`;
+  return point
+    ? `https://www.openstreetmap.org/directions?route=%3B${encodeURIComponent(point)}`
+    : `https://www.openstreetmap.org/search?query=${text}`;
+};

package/src/geo/ui.ts

@@ -1 +1,3 @@
+export { AddressAutocomplete, type AddressAutocompleteProps } from "./AddressAutocomplete";
 export { CloudMap, CloudMapAttribution, type CloudMapProps } from "./CloudMap";
+export { type GeoNavigationPlatform, geoNavigationHref, geoNavigationPlatform } from "./navigation";

package/src/server/api/respond.ts

@@ -43,6 +43,12 @@ const toErrorResponse = (result: AnyResult): [ApiErrorBody, number] => {
   return [{ message: "Internal server error", code: "INTERNAL" }, 500];
 };
 
+/** Add explicitly selected transport recovery fields without changing the error envelope. */
+export async function respond<D extends Record<string, unknown>, S extends LegacyErrorStatus>(
+  c: Context,
+  resultOrFn: ResultOrFn<LegacyErrorResult<S>>,
+  options: { errorDetails: D },
+): Promise<JsonTypedResponse<Omit<D, keyof ApiErrorBody> & ApiErrorBody, S>>;
 export async function respond<T>(
   c: Context,
   resultOrFn: ResultOrFn<AnyResult<T>>,
@@ -76,15 +82,17 @@ export async function respond<T>(
 export async function respond<T>(
   c: Context,
   resultOrFn: ResultOrFn<AnyResult<T>>,
-  successStatus: SuccessStatus | 202 = 200,
+  statusOrOptions: SuccessStatus | 202 | { errorDetails: Record<string, unknown> } = 200,
 ): Promise<JsonTypedResponse<T, SuccessStatus | 202> | ApiErrorResponse> {
   const result = typeof resultOrFn === "function" ? await resultOrFn() : await resultOrFn;
 
   if (!result.ok) {
     const [body, status] = toErrorResponse(result);
-    return c.json(body, status as ApiErrorStatus) as ApiErrorResponse;
+    const details = typeof statusOrOptions === "object" ? statusOrOptions.errorDetails : {};
+    return c.json({ ...details, ...body, code: body.code }, status as ApiErrorStatus) as ApiErrorResponse;
   }
 
+  const successStatus = typeof statusOrOptions === "number" ? statusOrOptions : 200;
   return c.json(result.data, successStatus) as JsonTypedResponse<T, SuccessStatus | 202>;
 }
 

package/src/server/index.ts

@@ -89,6 +89,7 @@ export {
   paginate,
   paginateItems,
   password,
+  recursiveServiceAccountGroupIdsSubquery,
   resolveDisplayNames,
   services,
   tryCatch,

package/src/server/services/access.ts

@@ -2,7 +2,7 @@ import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { type SQLQuery, sql } from "bun";
 import { type ManagerCandidate, removesLastManager } from "../../access/managers";
 import { accessMessages } from "../../access/messages";
-import { recursiveGroupIdsSubquery } from "../../services/accounts/group-sql";
+import { recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";
 import type { RequestAuthority } from "../middleware/auth";
@@ -266,19 +266,26 @@ export const ensureManagerRemains = (params: {
   return fail({ code: "LAST_MANAGER", message: t.lastManager({ level: params.level ?? t.manage }), status: 409 });
 };
 
-/** Resolve direct and nested group memberships from the authoritative database mirror. */
-export const getEffectiveGroups = async (params: { userId: string | null }, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
-  if (!params.userId) return [];
+type EffectiveGroupParams = { userId: string | null; serviceAccountId?: never } | { serviceAccountId: string | null; userId?: never };
+
+/** Resolve authoritative memberships; machine recipients inherit local groups only. */
+export const getEffectiveGroups = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<EffectiveGroup[]> => {
+  const groupIds = params.userId
+    ? recursiveGroupIdsSubquery(params.userId)
+    : params.serviceAccountId
+      ? recursiveServiceAccountGroupIdsSubquery(params.serviceAccountId)
+      : null;
+  if (!groupIds) return [];
   const rows = await db<{ id: string; name: string }[]>`
     SELECT g.id, g.name
     FROM auth.groups g
-    WHERE g.id IN (${recursiveGroupIdsSubquery(params.userId)})
+    WHERE g.id IN (${groupIds})
     ORDER BY g.name
   `;
   return rows;
 };
 
-export const getEffectiveGroupIds = async (params: { userId: string | null }, db: AccessDb = sql): Promise<string[]> =>
+export const getEffectiveGroupIds = async (params: EffectiveGroupParams, db: AccessDb = sql): Promise<string[]> =>
   (await getEffectiveGroups(params, db)).map((group) => group.id);
 
 /**
@@ -329,7 +336,7 @@ export type ResourceAccessAdapter<TResourceId = string> = {
  *
  * Apps provide column fragments because access rows are commonly joined under
  * different aliases. The subject is authoritative: group membership is always
- * resolved recursively from its user id and never accepted from a caller.
+ * resolved recursively from its user or service-account id and never accepted from a caller.
  * Resource binding, credential scopes, and permission precedence remain the
  * responsibility of the app using the predicate.
  */
@@ -346,8 +353,13 @@ export const buildAccessPrincipalTierConditions = (params: {
     serviceAccount: sql`${columns.serviceAccountId} = ${serviceAccountId}::uuid`,
     user: sql`${columns.userId} = ${userId}::uuid`,
     group: sql`(
-      ${userId}::uuid IS NOT NULL
-      AND ${columns.groupId} IN (${userId ? recursiveGroupIdsSubquery(userId) : sql`SELECT NULL::uuid WHERE FALSE`})
+      ${columns.groupId} IN (${
+        userId
+          ? recursiveGroupIdsSubquery(userId)
+          : serviceAccountId
+            ? recursiveServiceAccountGroupIdsSubquery(serviceAccountId)
+            : sql`SELECT NULL::uuid WHERE FALSE`
+      })
     )`,
     authenticated: sql`${authenticated} AND ${columns.authenticatedOnly} = true`,
     public: sql`(
@@ -369,7 +381,7 @@ export const buildAccessPrincipalCondition = (params: { subject: AccessSubject |
  * Get the effective permission level for an actor on a resource.
  * Returns the highest permission from:
  * - Direct user or service-account access
- * - Direct and nested user group memberships resolved from the database
+ * - Direct and nested group memberships for users and active standalone/agent accounts
  * - Authenticated access for every authenticated subject
  * - Public access for every subject, including anonymous callers
  *
@@ -465,6 +477,7 @@ export const getEffectivePermissions = async (params: {
           a.service_account_id = s.service_account_id
           OR a.user_id = s.user_id
           OR (s.user_id IS NOT NULL AND a.group_id IN (${recursiveGroupIdsSubquery(sql`s.user_id`)}))
+          OR (s.service_account_id IS NOT NULL AND a.group_id IN (${recursiveServiceAccountGroupIdsSubquery(sql`s.service_account_id`)}))
           OR a.authenticated_only = true
           OR (a.user_id IS NULL AND a.group_id IS NULL AND a.service_account_id IS NULL AND a.authenticated_only = false)
         )

package/src/server/services/index.ts

@@ -1,4 +1,5 @@
 // Cloud-specific server services
+export { recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 
 export type {
   AccessDb,

package/src/services/accounts/app.ts

@@ -14,6 +14,7 @@ import type {
   UserProfile,
   UserProvider,
 } from "../../contracts/shared";
+import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
 import {
   err,
   fail,
@@ -41,6 +42,7 @@ import type { AvatarChange, AvatarState } from "./avatar";
 import { listDuplicateEmails } from "./duplicate-emails";
 import * as entities from "./entities";
 import * as groups from "./groups";
+import { mutateMachineGroupMember } from "./machine-group-management";
 import type { AccountsNotificationSender } from "./notification-sender";
 import { PosixError } from "./posix";
 import { accountRequestsEnabled } from "./request-policy";
@@ -415,7 +417,6 @@ export const accountsAppService = {
         const userGroups = await users.getGroups({
           id: config.userId,
           recursive: config.recursive,
-          includePersonal: false,
         });
         const query = config.filter?.query?.trim().toLowerCase();
         const filtered = query ? userGroups.filter((groupName) => groupName.toLowerCase().includes(query)) : userGroups;
@@ -970,7 +971,7 @@ export const accountsAppService = {
   group: {
     list: async (config: {
       pagination?: PageParams;
-      filter?: { search?: string; includePersonal?: boolean };
+      filter?: { search?: string };
       scope?: { userId?: string; ids?: string[]; provider?: UserProvider; mode?: "all" | "member" | "managed" };
     }): Promise<Paginated<BaseGroup>> => {
       const { page, perPage } = paginate(config.pagination);
@@ -982,7 +983,6 @@ export const accountsAppService = {
         scope: config.scope?.mode,
         ids: config.scope?.ids,
         provider: config.scope?.provider,
-        includePersonal: config.filter?.includePersonal,
       });
 
       return {
@@ -993,7 +993,10 @@ export const accountsAppService = {
         hasNext: result.pagination.hasNext,
       };
     },
-    get: async (config: { id: string }) => groups.get(config),
+    get: async (config: { id: string }) => {
+      const result = await groups.list({ ids: [config.id], perPage: 1 });
+      return result.groups[0] ?? null;
+    },
     member: {
       list: async (config: {
         id: string;
@@ -1016,7 +1019,16 @@ export const accountsAppService = {
         });
         return paginateItems(filtered, config.pagination);
       },
-      add: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      add: async (config: {
+        actor: AccountsActor | ServiceAccountRequestActor;
+        requestId?: string;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
+        if ("kind" in config.actor) return mutateMachineGroupMember({ ...config, actor: config.actor, operation: "add" });
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1035,17 +1047,27 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.add",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
-      remove: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      remove: async (config: {
+        actor: AccountsActor | ServiceAccountRequestActor;
+        requestId?: string;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
+        if ("kind" in config.actor) return mutateMachineGroupMember({ ...config, actor: config.actor, operation: "remove" });
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1064,13 +1086,14 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.member.remove",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
@@ -1093,7 +1116,14 @@ export const accountsAppService = {
         });
         return paginateItems(filtered, config.pagination);
       },
-      add: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      add: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1116,17 +1146,25 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.manager.add",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
-      remove: async (config: { actor: AccountsActor; id: string; provider?: UserProvider; userId?: string; groupId?: string }) => {
+      remove: async (config: {
+        actor: AccountsActor;
+        id: string;
+        provider?: UserProvider;
+        userId?: string;
+        groupId?: string;
+        serviceAccountId?: string;
+      }) => {
         const group = await groups.get({ id: config.id });
         if (!group) {
           const result = fail(err.notFound("Group not found"));
@@ -1149,13 +1187,14 @@ export const accountsAppService = {
             provider: config.provider,
             user: config.userId,
             group: config.groupId,
+            serviceAccount: config.serviceAccountId,
           }),
         );
         return recordCompletedMutation({
           action: "accounts.group.manager.remove",
           actor: auditActor(config.actor),
           target: groupTarget(group),
-          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null },
+          metadata: { userId: config.userId ?? null, groupId: config.groupId ?? null, serviceAccountId: config.serviceAccountId ?? null },
           result,
         });
       },
@@ -1255,6 +1294,7 @@ export const accountsAppService = {
       profile?: UserProfile;
       userIds?: string[];
       groupIds?: string[];
+      serviceAccountIds?: string[];
       serviceAccountKinds?: ServiceAccountKind[];
       serviceAccountStatus?: ServiceAccountStatus;
       excludeUserIds?: string[];
@@ -1266,7 +1306,6 @@ export const accountsAppService = {
       parentGroupId?: string;
       managedByUserId?: string;
       recursive?: boolean;
-      includePersonal?: boolean;
     }): Promise<Paginated<EntityListItem>> => {
       const canSearchDirectory = config.actor.roles.includes("user");
       const usesRelationFilter = Boolean(
@@ -1288,6 +1327,7 @@ export const accountsAppService = {
         profile: config.profile,
         userIds: config.userIds,
         groupIds: config.groupIds,
+        serviceAccountIds: config.serviceAccountIds,
         serviceAccountKinds: config.serviceAccountKinds,
         serviceAccountStatus: config.serviceAccountStatus,
         excludeUserIds: config.excludeUserIds,
@@ -1299,7 +1339,6 @@ export const accountsAppService = {
         parentGroupId: config.parentGroupId,
         managedByUserId: config.managedByUserId,
         recursive: config.recursive,
-        includePersonal: config.includePersonal,
         page,
         perPage,
       });
@@ -1661,9 +1700,9 @@ export const accountsAppService = {
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local') AS local_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'user') AS local_user_accounts_total,
           (SELECT COUNT(*)::int FROM auth.users WHERE provider = 'local' AND profile = 'guest') AS local_guest_accounts_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS ipa_groups_total,
-          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id)) AS local_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'ipa' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS ipa_groups_total,
+          (SELECT COUNT(*)::int FROM auth.groups g WHERE provider = 'local' AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)) AS local_groups_total,
           (SELECT COUNT(*)::int FROM auth.account_requests WHERE status = 'pending') AS open_requests,
           (
             SELECT COUNT(*)::int