@k2b/cloud 0.6.0 → 0.8.0

package/src/services/accounts/identities.ts

@@ -0,0 +1,249 @@
+import { type SQLQuery, sql } from "bun";
+import { z } from "zod";
+import { DEFAULT_LINUX_IDENTITY_CONFIGURATION, LinuxIdentityConfigurationSchema } from "../../contracts/posix";
+import type { RequestActor, UserProfile, UserProvider } from "../../contracts/shared";
+import { userFromActor } from "../../server/actor";
+import { isAccountCategoryAllowed } from "../account-category-policy";
+import { toPgTextArray } from "../postgres";
+import { decryptValue } from "../settings/crypto";
+import { buildMemberGroupScopeCondition } from "./group-sql";
+import { type AccountIdentityReconciliation, readUpstreamIdentity } from "./identity-reconciliation";
+
+export type AccountIdentityUser = {
+  id: string;
+  provider: UserProvider;
+  username: string;
+  profile: UserProfile;
+  posix: { uidNumber: number; primaryGidNumber: number } | null;
+};
+export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null };
+export type AccountIdentityPage<T> = { items: T[]; nextCursor: string | null };
+export type AccountIdentityAvailability = { localLinuxEnabled: boolean; freeipaEnabled: boolean };
+type InventoryFilter = { provider: UserProvider; after?: string; id?: string; name?: string };
+
+export class AccountIdentityError extends Error {
+  constructor(
+    public readonly code: string,
+    public readonly status: 400 | 401 | 403 = 403,
+  ) {
+    super(code);
+  }
+}
+
+// The same bounded page size as Linux identity administration.
+const PAGE_SIZE = 50;
+const cursorSchema = z.uuid();
+const positiveId = (value: number | null): value is number => Number.isSafeInteger(value) && value !== null && value > 0;
+type UserRow = {
+  id: string;
+  provider: UserProvider;
+  uid: string;
+  profile: UserProfile;
+  admin: boolean;
+  expired: boolean;
+  managed_by: UserProvider | null;
+  uid_number: number | null;
+  primary_gid_number: number | null;
+};
+const projectUser = (row: UserRow): AccountIdentityUser => ({
+  id: row.id,
+  provider: row.provider,
+  username: row.uid,
+  profile: row.profile,
+  posix:
+    row.managed_by === row.provider && positiveId(row.uid_number) && positiveId(row.primary_gid_number)
+      ? { uidNumber: row.uid_number, primaryGidNumber: row.primary_gid_number }
+      : null,
+});
+const page = <T extends { id: string }>(rows: T[]): AccountIdentityPage<T> => ({
+  items: rows.slice(0, PAGE_SIZE),
+  nextCursor: rows.length > PAGE_SIZE ? rows[PAGE_SIZE - 1]!.id : null,
+});
+const cursor = (after?: string): string | null => {
+  if (after !== undefined && !cursorSchema.safeParse(after).success) throw new AccountIdentityError("invalid_cursor", 400);
+  return after ?? null;
+};
+
+/** Server-side identity reads. Authentication and application resource authorization remain caller-owned. */
+export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdentity = readUpstreamIdentity) => {
+  const setting = async (key: string, fallback: unknown): Promise<unknown> => {
+    const [row] = await db<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${key}`;
+    return row ? decryptValue(row.value) : fallback;
+  };
+  const availability = async (): Promise<AccountIdentityAvailability> => {
+    const [raw, ipa] = await Promise.all([
+      setting("linux.identity_config", DEFAULT_LINUX_IDENTITY_CONFIGURATION),
+      setting("freeipa.enable", false),
+    ]);
+    try {
+      const config = LinuxIdentityConfigurationSchema.parse(typeof raw === "string" ? JSON.parse(raw) : raw);
+      if (typeof ipa !== "boolean") throw new Error("Invalid FreeIPA state");
+      return { localLinuxEnabled: config.enabled, freeipaEnabled: ipa };
+    } catch {
+      throw new AccountIdentityError("invalid_identity_configuration");
+    }
+  };
+  const userRows = (filter: SQLQuery) => db<UserRow[]>`
+    SELECT u.id, u.provider, u.uid, u.profile, u.admin,
+      (u.account_expires IS NOT NULL AND u.account_expires <= now()) AS expired,
+      p.managed_by, p.uid_number, p.primary_gid_number
+    FROM auth.users u LEFT JOIN auth.user_posix p ON p.user_id = u.id
+    WHERE ${filter}
+    ORDER BY u.id LIMIT ${PAGE_SIZE + 1}
+  `;
+  const requireUser = async (actor: RequestActor) => {
+    const supplied = userFromActor(actor);
+    if (!supplied) throw new AccountIdentityError("user_required", 401);
+    const [row] = await userRows(sql`u.id = ${supplied.id}::uuid`);
+    if (!row || row.expired || row.provider !== supplied.provider || row.uid !== supplied.uid || row.profile !== supplied.profile)
+      throw new AccountIdentityError("identity_unavailable");
+    if (!(await isAccountCategoryAllowed(row, db))) throw new AccountIdentityError("identity_unavailable");
+    const state = await availability();
+    if (row.provider === "ipa" && !state.freeipaEnabled) throw new AccountIdentityError("identity_unavailable");
+    return { row, state, supplied };
+  };
+  const requireAdmin = async (actor: RequestActor) => {
+    const current = await requireUser(actor);
+    if (!current.supplied.roles.includes("admin")) throw new AccountIdentityError("admin_required");
+    if (current.row.provider === "local") {
+      if (!current.row.admin || current.row.profile !== "user") throw new AccountIdentityError("admin_required");
+    } else {
+      const configured = await setting("freeipa.groups.admin", ["admins"]);
+      if (!Array.isArray(configured) || !configured.every((value): value is string => typeof value === "string"))
+        throw new AccountIdentityError("invalid_identity_configuration");
+      const names = configured.length > 0 ? configured : ["admins"];
+      const [membership] = await db`SELECT 1 FROM auth.ipa_user_effective_groups
+        WHERE user_id = ${current.row.id}::uuid AND group_name = ANY(${toPgTextArray(names)}::text[]) LIMIT 1`;
+      if (!membership) throw new AccountIdentityError("admin_required");
+    }
+    return current;
+  };
+  const groupRows = async (filter: SQLQuery) => {
+    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null }[]>`
+      SELECT g.id, g.provider, g.name, g.gid_number FROM auth.groups g
+      WHERE ${filter} ORDER BY g.id LIMIT ${PAGE_SIZE + 1}
+    `;
+    return rows.map(
+      (row): AccountIdentityGroup => ({
+        id: row.id,
+        provider: row.provider,
+        name: row.name,
+        gidNumber: positiveId(row.gid_number) ? row.gid_number : null,
+      }),
+    );
+  };
+  async function inventory(
+    actor: RequestActor,
+    options: InventoryFilter & { kind: "users" },
+  ): Promise<AccountIdentityPage<AccountIdentityUser>>;
+  async function inventory(
+    actor: RequestActor,
+    options: InventoryFilter & { kind: "groups" },
+  ): Promise<AccountIdentityPage<AccountIdentityGroup>>;
+  async function inventory(actor: RequestActor, options: InventoryFilter & { kind: "users" | "groups" }) {
+    await requireAdmin(actor);
+    const after = cursor(options.after);
+    const id = cursor(options.id);
+    const name = options.name ?? null;
+    if (options.provider !== "local" && options.provider !== "ipa") throw new AccountIdentityError("invalid_provider", 400);
+    if (options.kind === "users") {
+      return page(
+        (
+          await userRows(sql`u.provider = ${options.provider} AND (${after}::uuid IS NULL OR u.id > ${after}::uuid)
+        AND (${id}::uuid IS NULL OR u.id = ${id}::uuid) AND (${name}::text IS NULL OR u.uid = ${name})`)
+        ).map(projectUser),
+      );
+    }
+    if (options.kind !== "groups") throw new AccountIdentityError("invalid_inventory_kind", 400);
+    return page(
+      await groupRows(sql`g.provider = ${options.provider} AND (${after}::uuid IS NULL OR g.id > ${after}::uuid)
+      AND (${id}::uuid IS NULL OR g.id = ${id}::uuid) AND (${name}::text IS NULL OR g.name = ${name})`),
+    );
+  }
+  const readLocalIdentity = async (input: {
+    kind: "users" | "groups";
+    name: string;
+    identityId?: string;
+  }): Promise<AccountIdentityReconciliation> => {
+    if (input.kind === "users") {
+      const rows = await userRows(sql`(u.provider = 'local' AND u.uid = ${input.name}) OR u.id = ${input.identityId ?? null}::uuid`);
+      const expected = rows.find((row) => row.id === input.identityId);
+      if (expected && (expected.provider !== "local" || expected.uid !== input.name))
+        return { state: "unknown", reason: "identity_conflict" };
+      const matches = rows.filter((row) => row.provider === "local" && row.uid === input.name);
+      if (!matches.length) return { state: "absent" };
+      if (matches.length !== 1) return { state: "unknown", reason: "invalid_response" };
+      const current = projectUser(matches[0]!);
+      return {
+        state: "present",
+        identity: {
+          id: current.id,
+          name: current.username,
+          uidNumber: current.posix?.uidNumber ?? null,
+          gidNumber: current.posix?.primaryGidNumber ?? null,
+        },
+        eligible: current.profile === "user",
+      };
+    }
+    const rows = await groupRows(sql`(g.provider = 'local' AND g.name = ${input.name}) OR g.id = ${input.identityId ?? null}::uuid`);
+    const expected = rows.find((row) => row.id === input.identityId);
+    if (expected && (expected.provider !== "local" || expected.name !== input.name))
+      return { state: "unknown", reason: "identity_conflict" };
+    const matches = rows.filter((row) => row.provider === "local" && row.name === input.name);
+    if (!matches.length) return { state: "absent" };
+    if (matches.length !== 1) return { state: "unknown", reason: "invalid_response" };
+    const current = matches[0]!;
+    return {
+      state: "present",
+      identity: { id: current.id, name: current.name, uidNumber: null, gidNumber: current.gidNumber },
+      eligible: current.gidNumber !== null,
+    };
+  };
+  const validateLookup = (input: { kind: "users" | "groups"; name: string }) => {
+    if ((input.kind !== "users" && input.kind !== "groups") || typeof input.name !== "string" || !input.name || input.name.includes("\0"))
+      throw new AccountIdentityError("invalid_identity_lookup", 400);
+  };
+  return {
+    async reconcile(
+      actor: RequestActor,
+      input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
+    ): Promise<AccountIdentityReconciliation> {
+      const { state } = await requireAdmin(actor);
+      validateLookup(input);
+      if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
+      if (input.identityId !== undefined) cursor(input.identityId);
+      if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
+      if (input.provider === "ipa") {
+        if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
+        return upstreamIdentity(input);
+      }
+      const result = await readLocalIdentity(input);
+      return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+    },
+    /** Trusted application jobs only; this read does not authorize an HTTP caller or a filesystem mutation. */
+    async localLifecycle(input: { kind: "users" | "groups"; identityId: string; name: string }) {
+      validateLookup(input);
+      cursor(input.identityId);
+      const { localLinuxEnabled } = await availability();
+      return { localLinuxEnabled, identity: await readLocalIdentity(input) };
+    },
+    async self(actor: RequestActor) {
+      const { row, state } = await requireUser(actor);
+      return { user: projectUser(row), availability: state };
+    },
+    async groups(actor: RequestActor, options: { after?: string } = {}): Promise<AccountIdentityPage<AccountIdentityGroup>> {
+      const { row, state } = await requireUser(actor);
+      const after = cursor(options.after);
+      return page(
+        await groupRows(sql`
+        (${after}::uuid IS NULL OR g.id > ${after}::uuid)
+        AND (g.provider = 'local' OR ${state.freeipaEnabled})
+        AND ${buildMemberGroupScopeCondition({ userId: row.id, groupProvider: sql`g.provider` })}
+      `),
+      );
+    },
+    inventory,
+  };
+};
+
+export const accountIdentities = createAccountIdentityService();

package/src/services/accounts/identity-reconciliation.ts

@@ -0,0 +1,87 @@
+import { z } from "zod";
+import { freeipa } from "../../server/services";
+import type { IpaRpcResponse } from "../../server/services/freeipa/client";
+import { FREEIPA_REQUEST_TIMEOUT_MS } from "../../server/services/freeipa/transport";
+import { getFreeIpaConfig } from "../freeipa-config";
+
+export type AccountIdentityReconciliation =
+  | {
+      state: "present";
+      identity: { id: string | null; name: string; uidNumber: number | null; gidNumber: number | null };
+      eligible: boolean;
+    }
+  | { state: "absent" }
+  | { state: "unknown"; reason: "provider_disabled" | "provider_unavailable" | "invalid_response" | "identity_conflict" };
+export type IdentityLookup = { kind: "users" | "groups"; name: string; signal?: AbortSignal };
+
+const number = z
+  .union([z.number().int(), z.string().regex(/^\d+$/).transform(Number)])
+  .pipe(z.number().int().positive().max(2_147_483_647));
+const attributeNumber = z.array(number).length(1).optional();
+const userRecord = z.object({ uid: z.array(z.string()).length(1), uidnumber: attributeNumber, gidnumber: attributeNumber });
+const groupRecord = z.object({ cn: z.array(z.string()).length(1), gidnumber: attributeNumber });
+const notFound = (response: IpaRpcResponse) =>
+  response.error?.kind === "rpc" && response.error.code === 4001 && response.error.name === "NotFound";
+
+// Exact show responses have no pagination or Cloud sync filter. Only the named
+// upstream NotFound error proves absence; HTTP 404 and malformed success do not.
+export function parseIdentityShow(input: IdentityLookup, response: IpaRpcResponse): AccountIdentityReconciliation {
+  if (notFound(response)) return { state: "absent" };
+  if (response.error)
+    return { state: "unknown", reason: response.error.kind === "invalid_response" ? "invalid_response" : "provider_unavailable" };
+  const parsed = input.kind === "users" ? userRecord.safeParse(response.result?.result) : groupRecord.safeParse(response.result?.result);
+  if (!parsed.success) return { state: "unknown", reason: "invalid_response" };
+  const record = parsed.data;
+  const name = "uid" in record ? record.uid[0]! : record.cn[0]!;
+  if (name !== input.name) return { state: "unknown", reason: "invalid_response" };
+  const uidNumber = "uidnumber" in record ? (record.uidnumber?.[0] ?? null) : null;
+  const gidNumber = record.gidnumber?.[0] ?? null;
+  return {
+    state: "present",
+    identity: { id: null, name, uidNumber, gidNumber },
+    eligible: gidNumber !== null && (input.kind === "groups" || uidNumber !== null),
+  };
+}
+
+export const readUpstreamIdentity = async (
+  input: IdentityLookup,
+  deps = { config: getFreeIpaConfig, session: freeipa.session.getServiceSession, call: freeipa.client.call },
+): Promise<AccountIdentityReconciliation> => {
+  try {
+    const timeout = AbortSignal.timeout(FREEIPA_REQUEST_TIMEOUT_MS);
+    const signal = input.signal ? AbortSignal.any([input.signal, timeout]) : timeout;
+    signal.throwIfAborted();
+    const config = await deps.config();
+    signal.throwIfAborted();
+    if (!config.enabled) return { state: "unknown", reason: "provider_disabled" };
+    if (!config.configured) return { state: "unknown", reason: "provider_unavailable" };
+    const ipaSession = await deps.session({
+      url: config.url,
+      serviceUser: config.serviceUser,
+      servicePassword: config.servicePassword,
+      signal,
+    });
+    signal.throwIfAborted();
+    const query = async (method: string) => {
+      signal.throwIfAborted();
+      const response = await deps.call({
+        url: config.url,
+        ipaSession,
+        method,
+        args: [input.name],
+        options: { all: true, no_members: true },
+        signal,
+      });
+      signal.throwIfAborted();
+      return response;
+    };
+    const result = parseIdentityShow(input, await query(input.kind === "users" ? "user_show" : "group_show"));
+    if (input.kind !== "users" || result.state !== "absent") return result;
+    // user_show includes preserved users, but staged users live in a separate
+    // container and can retain a former account's data while awaiting activation.
+    const staged = parseIdentityShow(input, await query("stageuser_show"));
+    return staged.state === "present" ? { ...staged, eligible: false } : staged;
+  } catch {
+    return { state: "unknown", reason: "provider_unavailable" };
+  }
+};

package/src/services/accounts/ipa-data.ts

@@ -3,9 +3,9 @@ import type { IpaUserData } from "../../contracts/shared";
 
 type DbRow = Record<string, unknown>;
 
-export const userIpaDataJoin = sql`LEFT JOIN auth.user_ipa_data ui ON ui.user_id = u.id`;
+export const userIpaDataJoin = () => sql`LEFT JOIN auth.user_ipa_data ui ON ui.user_id = u.id`;
 
-export const userIpaDataColumns = sql`
+export const userIpaDataColumns = () => sql`
   CASE WHEN EXISTS(SELECT 1 FROM auth.user_posix p WHERE p.user_id = u.id AND p.managed_by = 'ipa')
     THEN (SELECT p.uid_number FROM auth.user_posix p WHERE p.user_id = u.id AND p.managed_by = 'ipa')
     ELSE ui.uid_number END AS ipa_uid_number,

package/src/services/accounts/local-groups.ts

@@ -77,10 +77,10 @@ export const get = async (params: { id: string }): Promise<BaseGroup | null> =>
   return row ? toBaseGroup(row) : null;
 };
 
-export const create = async (params: { name: string; description?: string }): Promise<MutationResult<BaseGroup>> => {
+export const create = async (params: { name: string; description?: string }, db: typeof sql = sql): Promise<MutationResult<BaseGroup>> => {
   const storedCn = `local:${params.name}`;
   try {
-    const rows = await sql<DbRow[]>`
+    const rows = await db<DbRow[]>`
       INSERT INTO auth.groups (id, cn, provider, name, description, synced_at)
       VALUES (gen_random_uuid(), ${storedCn}, 'local', ${params.name}, ${params.description ?? null}, now())
       RETURNING id, provider, name, description, gid_number

package/src/services/accounts/notification-sender.ts

@@ -3,7 +3,12 @@ import type { TypedNotificationSendResult } from "../notifications/platform";
 export type AccountNotificationDeliveryResult = Pick<TypedNotificationSendResult, "id" | "status">;
 
 export type AccountsNotificationSender = {
-  sendLoginLink: (input: { email: string; token: string; magicLink: string; locale?: string }) => Promise<AccountNotificationDeliveryResult>;
+  sendLoginLink: (input: {
+    email: string;
+    token: string;
+    magicLink: string;
+    locale?: string;
+  }) => Promise<AccountNotificationDeliveryResult>;
   sendFreeIpaWelcome: (input: {
     userId: string;
     uid: string;
@@ -11,7 +16,12 @@ export type AccountsNotificationSender = {
     accountExpires: string | null;
     locale?: string;
   }) => Promise<AccountNotificationDeliveryResult>;
-  sendLocalWelcome: (input: { userId: string; email: string; accountExpires: string | null; locale?: string }) => Promise<AccountNotificationDeliveryResult>;
+  sendLocalWelcome: (input: {
+    userId: string;
+    email: string;
+    accountExpires: string | null;
+    locale?: string;
+  }) => Promise<AccountNotificationDeliveryResult>;
   sendRequestDenied: (input: {
     requestId: string;
     userId: string;

package/src/services/accounts/posix.ts

@@ -2,18 +2,19 @@ import { sql } from "bun";
 import {
   DEFAULT_LINUX_IDENTITY_CONFIGURATION,
   isPosixName,
-  LinuxIdentityConfigurationSchema,
   type LinuxIdentityConfiguration,
+  LinuxIdentityConfigurationSchema,
   type PosixIdentity,
   PosixOverridesSchema,
 } from "../../contracts/posix";
+import type { MutationResult } from "../../contracts/shared";
 import { freeipa } from "../../server/services";
+import { type AuditActor, audit } from "../audit";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { readCompleteIpaList } from "../ipa/sync-planning";
-import { decryptValue } from "../settings/crypto";
 import * as settings from "../settings";
-import { audit, type AuditActor } from "../audit";
-import type { MutationResult } from "../../contracts/shared";
+import { decryptValue } from "../settings/crypto";
+import { create as createLocalGroup } from "./local-groups";
 
 const CONFIG_KEY = "linux.identity_config";
 export const POSIX_PAGE_SIZE = 50;
@@ -274,6 +275,34 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     }
   };
 
+  const assignGroup = async (tx: typeof sql, actor: Actor, id: string, ranges: IpaIdRange[]) => {
+    const config = await readConfig(tx);
+    if (!config.enabled) throw new PosixError("setup_disabled");
+    const [group] = await tx<
+      { id: string; name: string; provider: string; gid_number: number | null }[]
+    >`SELECT id, name, provider, gid_number FROM auth.groups WHERE id = ${id}::uuid`;
+    if (!group) throw new PosixError("group_not_found", 404);
+    if (group.provider !== "local") throw new PosixError("identity_not_locally_managed");
+    if (group.gid_number !== null) return { gidNumber: group.gid_number };
+    if (!isPosixName(group.name)) throw new PosixError("invalid_name");
+    const [conflict] = await tx`SELECT 1 FROM auth.groups WHERE id <> ${id}::uuid AND lower(name) = lower(${group.name}) LIMIT 1`;
+    if (conflict) throw new PosixError("group_conflict");
+    await checkRange(tx, config, ranges);
+    const gidNumber = await allocate(tx, "gid", id, config);
+    await tx`UPDATE auth.groups SET gid_number = ${gidNumber} WHERE id = ${id}::uuid`;
+    await audit.record(
+      {
+        action: "accounts.linux.provision_group",
+        outcome: "allowed",
+        actor: { userId: actor.id, roles: actor.roles },
+        target: { type: "group", id },
+        metadata: { gidNumber },
+      },
+      tx,
+    );
+    return { gidNumber };
+  };
+
   const service = {
     async configuration(actor: Actor) {
       requireAdmin(actor);
@@ -347,36 +376,23 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
         return { ...candidate(row), identity: { ...candidate(row).identity!, ...parsed.data } };
       });
     },
+    async createGroup(actor: Actor, input: { name: string; description?: string }) {
+      requireAdmin(actor);
+      const ranges = await readRanges();
+      return db.begin(async (tx) => {
+        await lock(tx);
+        const created = await createLocalGroup(input, tx);
+        if (!created.ok) throw new PosixError("group_conflict");
+        const { gidNumber } = await assignGroup(tx, actor, created.data.id, ranges);
+        return { ...created.data, gidnumber: gidNumber };
+      });
+    },
     async provisionGroup(actor: Actor, id: string) {
       requireAdmin(actor);
       const ranges = await readRanges();
       return db.begin(async (tx) => {
         await lock(tx);
-        const config = await readConfig(tx);
-        if (!config.enabled) throw new PosixError("setup_disabled");
-        const [group] = await tx<
-          { id: string; name: string; provider: string; gid_number: number | null }[]
-        >`SELECT id, name, provider, gid_number FROM auth.groups WHERE id = ${id}::uuid`;
-        if (!group) throw new PosixError("group_not_found", 404);
-        if (group.provider !== "local") throw new PosixError("identity_not_locally_managed");
-        if (group.gid_number !== null) return { gidNumber: group.gid_number };
-        if (!isPosixName(group.name)) throw new PosixError("invalid_name");
-        const [conflict] = await tx`SELECT 1 FROM auth.groups WHERE id <> ${id}::uuid AND lower(name) = lower(${group.name}) LIMIT 1`;
-        if (conflict) throw new PosixError("group_conflict");
-        await checkRange(tx, config, ranges);
-        const gidNumber = await allocate(tx, "gid", id, config);
-        await tx`UPDATE auth.groups SET gid_number = ${gidNumber} WHERE id = ${id}::uuid`;
-        await audit.record(
-          {
-            action: "accounts.linux.provision_group",
-            outcome: "allowed",
-            actor: { userId: actor.id, roles: actor.roles },
-            target: { type: "group", id },
-            metadata: { gidNumber },
-          },
-          tx,
-        );
-        return { gidNumber };
+        return assignGroup(tx, actor, id, ranges);
       });
     },
   };

package/src/services/accounts/users.ts

@@ -172,7 +172,7 @@ export const get = async (params: { id: string } | { uid: string }): Promise<Use
   const { groupsAdmin } = await getFreeIpaConfig();
   const rows = await sql<DbRow[]>`
     SELECT u.*,
-      ${userIpaDataColumns},
+      ${userIpaDataColumns()},
       CASE
         WHEN u.provider = 'local' THEN u.admin
         ELSE EXISTS(
@@ -203,7 +203,7 @@ export const get = async (params: { id: string } | { uid: string }): Promise<Use
         ${managedGroupIdsSubquery(userIdExpr)}
       ), '{}') AS manages_group_ids
     FROM auth.users u
-    ${userIpaDataJoin}
+    ${userIpaDataJoin()}
     WHERE ${whereClause}
   `;
   if (rows.length === 0) return null;

package/src/services/announcements/index.ts

@@ -1,5 +1,7 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { sql } from "bun";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
 import type {
   AnnouncementCookieState,
   AnnouncementDisplayEntry,
@@ -7,10 +9,25 @@ import type {
   CreateAnnouncement,
   UpdateAnnouncement,
 } from "../../contracts/announcements";
+import { AnnouncementDisplayEntrySchema } from "../../contracts/announcements";
+import { hasRole, type User } from "../../contracts/shared";
 import { markdown } from "../../shared/markdown";
+import { claimCacheFill, completeCacheFill } from "../cache-fill";
 import { logger } from "../logging";
+import { requestCacheRedis } from "../request-cache-redis";
 
 const log = logger("announcements");
+const ACTIVE_CACHE_KEY = "appglobalcache:shared:announcements:v1";
+const invalidateActiveCache = async () => (await requestCacheRedis()).del(ACTIVE_CACHE_KEY);
+const invalidateAfterMutation = async () => {
+  try {
+    await invalidateActiveCache();
+  } catch (error) {
+    // The database mutation already succeeded; do not invite duplicate creates.
+    // Unavailable Redis reads fall back to Postgres; old cache entries expire.
+    log.warn("Announcement saved but cache invalidation failed", { error: error instanceof Error ? error.message : String(error) });
+  }
+};
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 type AnnouncementRow = {
@@ -119,6 +136,7 @@ const create = async (params: { data: CreateAnnouncement; actorId: string }): Pr
       RETURNING id, version, kind, title, body, tone, published_at, expires_at,
         created_at, updated_at, created_by, updated_by
     `;
+    if (row) await invalidateAfterMutation();
     return row ? ok(mapRow(row)) : fail(err.internal("Failed to create announcement."));
   } catch (error) {
     log.error("Failed to create announcement", { error: error instanceof Error ? error.message : String(error) });
@@ -156,6 +174,7 @@ const update = async (params: { id: string; data: UpdateAnnouncement; actorId: s
       RETURNING id, version, kind, title, body, tone, published_at, expires_at,
         created_at, updated_at, created_by, updated_by
     `;
+    if (row) await invalidateAfterMutation();
     return row ? ok(mapRow(row)) : fail(err.notFound("Announcement"));
   } catch (error) {
     log.error("Failed to update announcement", { id: params.id, error: error instanceof Error ? error.message : String(error) });
@@ -166,6 +185,7 @@ const update = async (params: { id: string; data: UpdateAnnouncement; actorId: s
 const remove = async (params: { id: string }): Promise<Result<void>> => {
   if (!UUID_PATTERN.test(params.id)) return fail(err.notFound("Announcement"));
   const result = await sql`DELETE FROM announcements.entries WHERE id = ${params.id}::uuid`;
+  if (result.count > 0) await invalidateAfterMutation();
   return result.count > 0 ? ok() : fail(err.notFound("Announcement"));
 };
 
@@ -182,28 +202,65 @@ const listActive = async (params: { now?: Date } = {}): Promise<AnnouncementEntr
   return rows.map(mapRow);
 };
 
-export const selectVisibleForState = (
-  entries: AnnouncementEntry[],
+const selectEntriesForState = <T extends { kind: AnnouncementEntry["kind"]; version: number }>(
+  entries: T[],
   state: AnnouncementCookieState,
-): { banners: AnnouncementDisplayEntry[]; announcements: AnnouncementDisplayEntry[]; latestAnnouncementVersion: number } => {
+) => {
   const dismissedBanners = new Set(state.dismissedBannerVersions);
   const activeAnnouncements = entries.filter((entry) => entry.kind === "announcement");
   const latestAnnouncementVersion = activeAnnouncements.reduce((max, entry) => Math.max(max, entry.version), state.seenAnnouncementVersion);
   return {
     banners: entries
       .filter((entry) => entry.kind === "banner" && !dismissedBanners.has(entry.version))
-      .sort((a, b) => b.version - a.version)
-      .map(renderAnnouncement),
+      .sort((a, b) => b.version - a.version),
     announcements: activeAnnouncements
       .filter((entry) => entry.version > state.seenAnnouncementVersion)
-      .sort((a, b) => b.version - a.version)
-      .map(renderAnnouncement),
+      .sort((a, b) => b.version - a.version),
     latestAnnouncementVersion,
   };
 };
 
+export const selectVisibleForState = (entries: AnnouncementEntry[], state: AnnouncementCookieState) => {
+  const selected = selectEntriesForState(entries, state);
+  return { ...selected, banners: selected.banners.map(renderAnnouncement), announcements: selected.announcements.map(renderAnnouncement) };
+};
+
+const cachedActive = async (): Promise<AnnouncementDisplayEntry[]> => {
+  let cached: string | null = null;
+  try {
+    cached = await (await requestCacheRedis()).get(ACTIVE_CACHE_KEY);
+  } catch {
+    /* Read authoritative data below. */
+  }
+  let entries: AnnouncementDisplayEntry[] | undefined;
+  if (cached !== null) {
+    try {
+      entries = z.array(AnnouncementDisplayEntrySchema).parse(JSON.parse(cached));
+    } catch {
+      /* Miss. */
+    }
+  }
+  if (!entries) {
+    const lease = await claimCacheFill(ACTIVE_CACHE_KEY, cached);
+    // Include scheduled entries: publish/expiry boundaries are applied at read time.
+    const rows = await sql<AnnouncementRow[]>`
+      SELECT id, version, kind, title, body, tone, published_at, expires_at,
+        created_at, updated_at, created_by, updated_by
+      FROM announcements.entries
+      WHERE expires_at IS NULL OR expires_at > now()
+      ORDER BY version DESC
+    `;
+    entries = rows.map((row) => renderAnnouncement(mapRow(row)));
+    await completeCacheFill(ACTIVE_CACHE_KEY, lease, JSON.stringify(entries), 300);
+  }
+  const now = Date.now();
+  return entries.filter((entry) => Date.parse(entry.publishedAt) <= now && (!entry.expiresAt || Date.parse(entry.expiresAt) > now));
+};
+
 const activeForState = async (params: { state: AnnouncementCookieState; now?: Date }) =>
-  selectVisibleForState(await listActive({ now: params.now }), params.state);
+  params.now
+    ? selectVisibleForState(await listActive({ now: params.now }), params.state)
+    : selectEntriesForState(await cachedActive(), params.state);
 
 export const announcements = {
   admin: {
@@ -212,6 +269,10 @@ export const announcements = {
     create,
     update,
     remove,
+    invalidateCache: async (actor: User | undefined) => {
+      if (!actor || !hasRole(actor, "admin")) throw new HTTPException(403, { message: "Administrator access required" });
+      await invalidateActiveCache();
+    },
   },
   active: {
     list: listActive,