@k2b/cloud 0.44.0 → 0.46.0

package/src/services/accounts/entities.ts

@@ -1,14 +1,14 @@
-import { sql } from "bun";
+import { type SQLQuery, sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
 import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
-import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
+import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
-type SqlFragment = any;
+type SqlFragment = SQLQuery;
 
 export type EntityListParams = {
   visibility:
@@ -21,6 +21,7 @@ export type EntityListParams = {
   profile?: UserProfile;
   userIds?: string[];
   groupIds?: string[];
+  serviceAccountIds?: string[];
   serviceAccountKinds?: ServiceAccountKind[];
   serviceAccountStatus?: ServiceAccountStatus;
   excludeUserIds?: string[];
@@ -32,11 +33,6 @@ export type EntityListParams = {
   parentGroupId?: string;
   managedByUserId?: string;
   recursive?: boolean;
-  /**
-   * Personal Linux groups are left out of directory browsing and search by
-   * default. Exact `groupIds` lookups and relation filters always return them.
-   */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 };
@@ -429,11 +425,7 @@ export const list = async (
   const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
   const groupsAdminLiteral = toPgTextArray(groupsAdmin);
   const spec = buildQuerySpec(params);
-  const includePersonal =
-    params.includePersonal === true ||
-    params.groupIds !== undefined ||
-    Boolean(params.memberOfGroupId || params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
-  const personalCondition = includePersonal ? sql`TRUE` : sql`(kind <> 'group' OR personal_owner_id IS NULL)`;
+  const personalCondition = sql`(kind <> 'group' OR NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = entity_rows.id))`;
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
@@ -455,12 +447,13 @@ export const list = async (
           )
         )`;
   const kindsCondition = (params.kinds?.length ?? 0) === 0 ? sql`TRUE` : sql`kind = ANY(${toPgTextArray(params.kinds ?? [])}::text[])`;
-  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined;
+  const hasIdFilter = params.userIds !== undefined || params.groupIds !== undefined || params.serviceAccountIds !== undefined;
   const includeIdCondition = !hasIdFilter
     ? sql`TRUE`
     : sql`(
         (kind = 'user' AND id = ANY(${toPgUuidArray(params.userIds ?? [])}::uuid[]))
         OR (kind = 'group' AND id = ANY(${toPgUuidArray(params.groupIds ?? [])}::uuid[]))
+        OR (kind = 'service_account' AND id = ANY(${toPgUuidArray(params.serviceAccountIds ?? [])}::uuid[]))
       )`;
   const excludeUserCondition =
     (params.excludeUserIds?.length ?? 0) === 0
@@ -491,11 +484,37 @@ export const list = async (
             AND ug.group_id = ANY(${toPgUuidArray(params.userMemberOfGroupIds ?? [])}::uuid[])
         ))`;
 
+  // Machine management is direct only; membership never implies management.
+  const otherRelation = Boolean(params.parentGroupId || params.managedByUserId);
+  const machineRelation = params.memberOfGroupId
+    ? sql`sa.kind IN ('standalone', 'agent') AND EXISTS (
+        SELECT 1 FROM auth.groups target
+        WHERE target.id = ${params.memberOfGroupId}::uuid AND target.provider = 'local'
+          AND ${
+            params.recursive === true
+              ? sql`target.id IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+              : sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+                  WHERE sg.service_account_id = sa.id AND sg.group_id = target.id)`
+          }
+      )`
+    : params.managerOfGroupId
+      ? sql`sa.kind IN ('standalone', 'agent') AND EXISTS (
+        SELECT 1 FROM auth.group_manager_service_accounts gm JOIN auth.groups g ON g.id = gm.group_id
+        WHERE gm.service_account_id = sa.id AND gm.group_id = ${params.managerOfGroupId}::uuid AND g.provider = 'local'
+      )`
+      : sql`TRUE`;
+  const machineDirect = params.memberOfGroupId
+    ? sql`EXISTS (SELECT 1 FROM auth.service_account_groups sg
+        WHERE sg.service_account_id = sa.id AND sg.group_id = ${params.memberOfGroupId}::uuid)`
+    : params.managerOfGroupId
+      ? sql`TRUE`
+      : sql`NULL::boolean`;
   const where = sql`
     ${visibilityCondition}
     AND ${kindsCondition}
     AND ${includeIdCondition}
-    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null})
+    AND (${params.provider ?? null}::text IS NULL OR provider = ${params.provider ?? null}
+      OR (kind = 'service_account' AND ${params.provider ?? null}::text = 'local'))
     AND (${params.profile ?? null}::text IS NULL OR kind = 'group' OR profile = ${params.profile ?? null})
     AND ${excludeUserCondition}
     AND ${excludeGroupCondition}
@@ -612,7 +631,7 @@ export const list = async (
       service_account_rows AS (
         SELECT
           'service_account'::text AS kind,
-          NULL::boolean AS direct,
+          ${machineDirect} AS direct,
           sa.id,
           NULL::text AS provider,
           NULL::text AS profile,
@@ -644,6 +663,7 @@ export const list = async (
           NULL::text AS personal_owner_display_name,
           LOWER(sa.name) AS sort_label
         FROM auth.service_accounts sa
+        WHERE NOT ${otherRelation} AND ${machineRelation}
       ),
       entity_rows AS (
         SELECT * FROM user_rows

package/src/services/accounts/group-sql.ts

@@ -104,3 +104,26 @@ export const buildManagedGroupScopeCondition = (params: { userId: SqlValue; grou
     })}
   )
 `;
+
+/** Local recipient membership only; never supplies user roles or directory identity. */
+export const recursiveServiceAccountGroupIdsSubquery = (serviceAccountId: SqlValue) => sql`
+  WITH RECURSIVE account_subject AS (
+    -- Resolve a correlated column before introducing aliases used by directory callers (for example sa.id).
+    SELECT ${serviceAccountId}::uuid AS id
+  ), account_groups AS (
+    SELECT sg.group_id
+    FROM auth.service_account_groups sg
+    JOIN auth.service_accounts sa ON sa.id = sg.service_account_id
+    JOIN account_subject subject ON subject.id = sa.id
+    JOIN auth.groups g ON g.id = sg.group_id
+    WHERE sa.status = 'active' AND sa.kind IN ('standalone', 'agent')
+      AND g.provider = 'local'
+    UNION
+    SELECT gg.parent_group_id
+    FROM auth.group_groups_v2 gg
+    JOIN auth.groups parent ON parent.id = gg.parent_group_id
+    JOIN account_groups ag ON ag.group_id = gg.child_group_id
+    WHERE parent.provider = 'local'
+  )
+  SELECT group_id FROM account_groups
+`;

package/src/services/accounts/groups.ts

@@ -31,8 +31,6 @@ const listCanonical = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }): Promise<{
@@ -48,7 +46,6 @@ const listCanonical = async (params: {
   const scope = params.scope ?? (params.userId ? "member" : "all");
   const scopeUserId = params.userId ?? "00000000-0000-0000-0000-000000000000";
   const idsCondition = ids.length === 0 ? sql`TRUE` : sql`g.id = ANY(${toPgUuidArray(ids)}::uuid[])`;
-  const includePersonal = params.includePersonal === true || params.ids !== undefined;
 
   if (params.ids && params.ids.length === 0) {
     return {
@@ -69,7 +66,7 @@ const listCanonical = async (params: {
     ${personalOwnerJoin()}
     WHERE (${params.provider ?? null}::text IS NULL OR g.provider = ${params.provider ?? null})
       AND ${idsCondition}
-      AND (${includePersonal} = true OR personal_owner.personal_owner_id IS NULL)
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (
         ${scope === "all"} = true
         OR ${params.userId ?? null}::uuid IS NULL
@@ -107,8 +104,6 @@ export const list = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }) => {
@@ -122,13 +117,13 @@ export const get = async (params: { id: string }): Promise<BaseGroup | null> =>
 export const getMembers = async (params: {
   id: string;
   provider?: UserProvider;
-  type?: "user" | "group";
+  type?: GroupMember["type"];
   recursive?: boolean;
 }): Promise<GroupMember[]> => {
   const provider = params.provider ?? (await getGroup(params.id))?.provider;
   if (provider === "local") return localGroups.getMembers(params);
-  if (!provider) return [];
-  return providers.ipa.groups.getMembers(params);
+  if (!provider || params.type === "service_account") return [];
+  return providers.ipa.groups.getMembers({ ...params, type: params.type });
 };
 
 export const getManagers = async (params: {
@@ -225,9 +220,13 @@ export const addMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.addMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.addMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.addMember({
@@ -243,9 +242,13 @@ export const removeMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.removeMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.removeMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.removeMember({
@@ -261,9 +264,12 @@ export const addManager = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.addManager({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.addManager({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount) return { ok: false, error: "Machine management requires a local group", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.addManager({
@@ -279,9 +285,12 @@ export const removeManager = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.removeManager({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.removeManager({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount) return { ok: false, error: "Machine management requires a local group", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.removeManager({

package/src/services/accounts/identities.ts

@@ -189,18 +189,25 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         eligible: current.profile === "user",
       };
     }
+    const [ownership] = await db<{ personal: boolean }[]>`SELECT EXISTS (
+      SELECT 1 FROM auth.personal_groups p
+      WHERE (${input.identityId ?? null}::uuid IS NOT NULL AND p.group_id = ${input.identityId ?? null}::uuid)
+         OR (${input.identityId ?? null}::uuid IS NULL AND p.group_name = ${input.name})
+    ) AS personal`;
+    const personal = ownership?.personal === true;
     const rows = await groupRows(sql`(g.provider = 'local' AND g.name = ${input.name}) OR g.id = ${input.identityId ?? null}::uuid`);
     const expected = rows.find((row) => row.id === input.identityId);
     if (expected && (expected.provider !== "local" || expected.name !== input.name))
       return { state: "unknown", reason: "identity_conflict" };
     const matches = rows.filter((row) => row.provider === "local" && row.name === input.name);
-    if (!matches.length) return { state: "absent" };
+    if (!matches.length) return personal ? { state: "absent", personal: true } : { state: "absent" };
     if (matches.length !== 1) return { state: "unknown", reason: "invalid_response" };
     const current = matches[0]!;
     return {
       state: "present",
       identity: { id: current.id, name: current.name, uidNumber: null, gidNumber: current.gidNumber },
       eligible: current.gidNumber !== null,
+      ...(personal ? { personal: true } : {}),
     };
   };
   const validateLookup = (input: { kind: "users" | "groups"; name: string }) => {

package/src/services/accounts/identity-reconciliation.ts

@@ -9,8 +9,10 @@ export type AccountIdentityReconciliation =
       state: "present";
       identity: { id: string | null; name: string; uidNumber: number | null; gidNumber: number | null };
       eligible: boolean;
+      /** Proven Cloud personal-group ownership, including retained directory bindings. */
+      personal?: boolean;
     }
-  | { state: "absent" }
+  | { state: "absent"; personal?: boolean }
   | { state: "unknown"; reason: "provider_disabled" | "provider_unavailable" | "invalid_response" | "identity_conflict" };
 export type IdentityLookup = { kind: "users" | "groups"; name: string; signal?: AbortSignal };
 

package/src/services/accounts/local-groups.ts

@@ -1,7 +1,8 @@
-import { sql } from "bun";
+import { sql, type TransactionSQL } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
+import { recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
 
@@ -22,8 +23,8 @@ const toBaseGroup = (row: LocalGroupRow): BaseGroup => ({
   personalOwner: null,
 });
 
-const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
-  const [row] = await sql<DbRow[]>`
+const getLocalGroupById = async (id: string, db: typeof sql | TransactionSQL = sql): Promise<LocalGroupRow | null> => {
+  const [row] = await db<DbRow[]>`
     SELECT id, provider, name, description, gid_number
     FROM auth.groups
     WHERE id = ${id}::uuid AND provider = 'local'
@@ -38,20 +39,23 @@ const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
   };
 };
 
-const getUserProvider = async (userId: string): Promise<UserProvider | null> => {
-  const [row] = await sql<DbRow[]>`SELECT provider FROM auth.users WHERE id = ${userId}`;
+const getUserProvider = async (userId: string, db: typeof sql | TransactionSQL = sql): Promise<UserProvider | null> => {
+  const [row] = await db<DbRow[]>`SELECT provider FROM auth.users WHERE id = ${userId}`;
   return (row?.provider as UserProvider | undefined) ?? null;
 };
 
-const ensureLocalGroupTreeMember = async (groupId: string): Promise<boolean> => {
-  const [row] = await sql<DbRow[]>`SELECT 1 FROM auth.groups WHERE id = ${groupId} AND provider = 'local'`;
+const ensureLocalGroupTreeMember = async (groupId: string, db: typeof sql | TransactionSQL = sql): Promise<boolean> => {
+  const [row] = await db<DbRow[]>`SELECT 1 FROM auth.groups WHERE id = ${groupId} AND provider = 'local'`;
   return Boolean(row);
 };
 
-const wouldCreateLocalGroupCycle = async (params: { parentGroupId: string; childGroupId: string }): Promise<boolean> => {
+const wouldCreateLocalGroupCycle = async (
+  params: { parentGroupId: string; childGroupId: string },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<boolean> => {
   if (params.parentGroupId === params.childGroupId) return true;
 
-  const [row] = await sql<DbRow[]>`
+  const [row] = await db<DbRow[]>`
     WITH RECURSIVE descendants AS (
       SELECT gg.child_group_id
       FROM auth.group_groups_v2 gg
@@ -122,6 +126,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     SELECT COUNT(*)::int AS count
     FROM auth.groups g
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
   `;
   const total = Number(countRow?.count ?? 0);
@@ -130,6 +135,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     FROM auth.groups g
     ${personalOwnerJoin()}
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
     ORDER BY g.name
     LIMIT ${perPage} OFFSET ${offset}
@@ -177,7 +183,7 @@ export const remove = async (params: { id: string }): Promise<MutationResult<voi
   return { ok: true, data: undefined };
 };
 
-export const getMembers = async (params: { id: string; type?: "user" | "group"; recursive?: boolean }): Promise<GroupMember[]> => {
+export const getMembers = async (params: { id: string; type?: GroupMember["type"]; recursive?: boolean }): Promise<GroupMember[]> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return [];
   const members: GroupMember[] = [];
@@ -231,6 +237,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           SELECT DISTINCT g.id, g.name
           FROM local_group_tree tree
           JOIN auth.groups g ON g.id = tree.child_group_id
+          WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `
       : await sql<DbRow[]>`
@@ -238,6 +245,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           FROM auth.group_groups_v2 gg
           JOIN auth.groups g ON g.id = gg.child_group_id
           WHERE gg.parent_group_id = ${group.id} AND g.provider = 'local'
+            AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `;
     for (const row of groupRows) {
@@ -245,10 +253,33 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
     }
   }
 
+  if (!params.type || params.type === "service_account") {
+    const rows = await sql<{ id: string; name: string; kind: "standalone" | "agent" }[]>`
+      SELECT sa.id, sa.name, sa.kind
+      FROM auth.service_accounts sa
+      WHERE sa.kind IN ('standalone', 'agent') AND ${
+        params.recursive === true
+          ? sql`${group.id}::uuid IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+          : sql`EXISTS (
+              SELECT 1 FROM auth.service_account_groups sg
+              WHERE sg.service_account_id = sa.id AND sg.group_id = ${group.id}::uuid
+            )`
+      }
+      ORDER BY sa.name, sa.id
+    `;
+    members.push(
+      ...rows.map((row) => ({ type: "service_account" as const, id: row.id, displayName: row.name, serviceAccountKind: row.kind })),
+    );
+  }
+
   return members;
 };
 
-export const getManagers = async (params: { id: string; type?: "user" | "group"; recursive?: boolean }): Promise<GroupMember[]> => {
+export const getManagers = async (params: {
+  id: string;
+  type?: "user" | "group" | "service_account";
+  recursive?: boolean;
+}): Promise<GroupMember[]> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return [];
 
@@ -310,6 +341,7 @@ export const getManagers = async (params: { id: string; type?: "user" | "group";
       FROM auth.group_manager_groups_v2 gmg
       JOIN auth.groups g ON g.id = gmg.manager_group_id
       WHERE gmg.group_id = ${group.id} AND g.provider = 'local'
+        AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       ORDER BY g.name
     `;
     for (const row of groupRows) {
@@ -317,6 +349,16 @@ export const getManagers = async (params: { id: string; type?: "user" | "group";
     }
   }
 
+  if (!params.type || params.type === "service_account") {
+    const rows = await sql<{ id: string; name: string; kind: "standalone" | "agent" }[]>`
+      SELECT sa.id, sa.name, sa.kind FROM auth.group_manager_service_accounts gm
+      JOIN auth.service_accounts sa ON sa.id = gm.service_account_id
+      WHERE gm.group_id = ${group.id}::uuid AND sa.kind IN ('standalone', 'agent')
+      ORDER BY sa.name, sa.id`;
+    managers.push(
+      ...rows.map((row) => ({ type: "service_account" as const, id: row.id, displayName: row.name, serviceAccountKind: row.kind })),
+    );
+  }
   return managers;
 };
 
@@ -340,7 +382,8 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
           WHERE g.provider = 'local'
         )
         SELECT DISTINCT parent_group_id
-        FROM local_parent_tree
+        FROM local_parent_tree tree
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = tree.parent_group_id)
       `
     : await sql<DbRow[]>`
         SELECT gg.parent_group_id
@@ -348,6 +391,7 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
         JOIN auth.groups g ON g.id = gg.parent_group_id
         WHERE gg.child_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
@@ -374,6 +418,7 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.group_manager_groups_v2 gmg ON gmg.manager_group_id = tree.manager_group_id
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       `
     : await sql<DbRow[]>`
         SELECT gmg.group_id
@@ -381,20 +426,46 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE gmg.manager_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
   return rows.map((row) => row.group_id as string);
 };
 
-export const addMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
-  const group = await getLocalGroupById(params.id);
+export const addMember = async (
+  params: {
+    id: string;
+    user?: string;
+    group?: string;
+    serviceAccount?: string;
+  },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<MutationResult<void>> => {
+  const group = await getLocalGroupById(params.id, db);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
+
+  if (params.serviceAccount) {
+    const [account] = await db<{ id: string }[]>`
+      SELECT id FROM auth.service_accounts
+      WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')
+    `;
+    if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
+    const inserted = await db`
+      INSERT INTO auth.service_account_groups (service_account_id, group_id)
+      VALUES (${account.id}::uuid, ${group.id}::uuid) ON CONFLICT DO NOTHING
+    `;
+    if (inserted.count === 0) return { ok: false, error: "Service account is already a direct member of this group", status: 409 };
+    return { ok: true, data: undefined };
+  }
 
   if (params.user) {
-    const provider = await getUserProvider(params.user);
+    const provider = await getUserProvider(params.user, db);
     if (!provider) return { ok: false, error: "User not found", status: 404 };
-    const [existing] = await sql<DbRow[]>`
+    const [existing] = await db<DbRow[]>`
       SELECT 1
       FROM auth.user_groups_v2
       WHERE user_id = ${params.user}::uuid
@@ -402,14 +473,14 @@ export const addMember = async (params: { id: string; user?: string; group?: str
       LIMIT 1
     `;
     if (existing) return { ok: false, error: "User is already a direct member of this group", status: 409 };
-    await sql`INSERT INTO auth.user_groups_v2 (user_id, group_id) VALUES (${params.user}, ${group.id}) ON CONFLICT DO NOTHING`;
+    await db`INSERT INTO auth.user_groups_v2 (user_id, group_id) VALUES (${params.user}, ${group.id}) ON CONFLICT DO NOTHING`;
     return { ok: true, data: undefined };
   }
 
   if (params.group) {
-    const isLocal = await ensureLocalGroupTreeMember(params.group);
+    const isLocal = await ensureLocalGroupTreeMember(params.group, db);
     if (!isLocal) return { ok: false, error: "Only local groups can be nested into local groups", status: 400 };
-    const [existing] = await sql<DbRow[]>`
+    const [existing] = await db<DbRow[]>`
       SELECT 1
       FROM auth.group_groups_v2
       WHERE parent_group_id = ${group.id}::uuid
@@ -417,36 +488,68 @@ export const addMember = async (params: { id: string; user?: string; group?: str
       LIMIT 1
     `;
     if (existing) return { ok: false, error: "Group is already a direct member of this group", status: 409 };
-    if (await wouldCreateLocalGroupCycle({ parentGroupId: group.id, childGroupId: params.group })) {
+    if (await wouldCreateLocalGroupCycle({ parentGroupId: group.id, childGroupId: params.group }, db)) {
       return { ok: false, error: "Local group nesting cannot create cycles", status: 400 };
     }
-    await sql`INSERT INTO auth.group_groups_v2 (parent_group_id, child_group_id) VALUES (${group.id}, ${params.group}) ON CONFLICT DO NOTHING`;
+    await db`INSERT INTO auth.group_groups_v2 (parent_group_id, child_group_id) VALUES (${group.id}, ${params.group}) ON CONFLICT DO NOTHING`;
     return { ok: true, data: undefined };
   }
 
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const removeMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
-  const group = await getLocalGroupById(params.id);
+export const removeMember = async (
+  params: {
+    id: string;
+    user?: string;
+    group?: string;
+    serviceAccount?: string;
+  },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<MutationResult<void>> => {
+  const group = await getLocalGroupById(params.id, db);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
+  if (params.serviceAccount) {
+    await db`DELETE FROM auth.service_account_groups
+      WHERE service_account_id = ${params.serviceAccount}::uuid AND group_id = ${group.id}::uuid`;
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
-    await sql`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
+    await db`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
     return { ok: true, data: undefined };
   }
 
   if (params.group) {
-    await sql`DELETE FROM auth.group_groups_v2 WHERE parent_group_id = ${group.id}::uuid AND child_group_id = ${params.group}::uuid`;
+    await db`DELETE FROM auth.group_groups_v2 WHERE parent_group_id = ${group.id}::uuid AND child_group_id = ${params.group}::uuid`;
     return { ok: true, data: undefined };
   }
 
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const addManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const addManager = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
+
+  if (params.serviceAccount) {
+    const [account] = await sql`SELECT id FROM auth.service_accounts
+      WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')`;
+    if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
+    const inserted = await sql`INSERT INTO auth.group_manager_service_accounts(group_id, service_account_id)
+      VALUES (${group.id}::uuid, ${params.serviceAccount}::uuid) ON CONFLICT DO NOTHING`;
+    if (inserted.count === 0) return { ok: false, error: "Service account already manages this group", status: 409 };
+    return { ok: true, data: undefined };
+  }
 
   if (params.user) {
     const provider = await getUserProvider(params.user);
@@ -481,10 +584,21 @@ export const addManager = async (params: { id: string; user?: string; group?: st
   return { ok: false, error: "Missing manager", status: 400 };
 };
 
-export const removeManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const removeManager = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
+  if (params.serviceAccount) {
+    await sql`DELETE FROM auth.group_manager_service_accounts
+      WHERE group_id = ${group.id}::uuid AND service_account_id = ${params.serviceAccount}::uuid`;
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
     await sql`DELETE FROM auth.group_manager_users_v2 WHERE group_id = ${group.id}::uuid AND user_id = ${params.user}::uuid`;
     return { ok: true, data: undefined };