@twinfinity/permission 6.0.1 → 6.0.2

package/src/PermissionClient.ts

@@ -1,421 +1,421 @@
-import { TwinfinityHttpClient, HttpMethod } from '@twinfinity/authentication';
-import type {
-    PaginatedResponse,
-    User,
-    Group,
-    GroupMember,
-    PutGroupRequest,
-    DeleteGroupRequest,
-    PermissionErrorBody
-} from './types';
-import {
-    PermissionValidationError,
-    PermissionError,
-    PermissionForbiddenError,
-    PermissionConflictError,
-    PermissionNotFoundError
-} from './errors';
-
-export interface IPermissionClient {
-    listUsers(page?: string, limit?: number, q?: string, signal?: AbortSignal): Promise<PaginatedResponse<User>>;
-    listGroups(page?: string, limit?: number, q?: string, signal?: AbortSignal): Promise<PaginatedResponse<Group>>;
-    putGroup(id: string, request: PutGroupRequest, signal?: AbortSignal): Promise<Group>;
-    deleteGroup(id: string, request: DeleteGroupRequest, signal?: AbortSignal): Promise<Group>;
-    listGroupMembers(
-        groupId: string,
-        page?: string,
-        limit?: number,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<User>>;
-    addGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember>;
-    removeGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember>;
-    listUserGroups(
-        userId: string,
-        page?: string,
-        limit?: number,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<Group>>;
-}
-
-function isErrorBody(value: unknown): value is PermissionErrorBody {
-    return typeof value === 'object' && value !== null && 'detail' in value && 'cause' in value;
-}
-
-async function readErrorBody(response: Response): Promise<PermissionErrorBody | undefined> {
-    try {
-        const json = await response.json();
-        return isErrorBody(json) ? json : undefined;
-    } catch (err) {
-        if (err instanceof Error && err.name === 'AbortError') throw err;
-        return undefined;
-    }
-}
-
-async function readBodyText(response: Response): Promise<string> {
-    try {
-        return await response.text();
-    } catch (err) {
-        if (err instanceof Error && err.name === 'AbortError') throw err;
-        return '';
-    }
-}
-
-export class PermissionClient implements IPermissionClient {
-    private readonly _usersUrl: string;
-    private readonly _groupsUrl: string;
-
-    constructor(
-        baseUrl: string | URL,
-        private readonly _httpClient: TwinfinityHttpClient
-    ) {
-        const base = String(baseUrl).replace(/\/+$/, '');
-        this._usersUrl = `${base}/_ps/users`;
-        this._groupsUrl = `${base}/_ps/groups`;
-    }
-
-    async listUsers(
-        page: string | undefined = undefined,
-        limit = 500,
-        q?: string,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<User>> {
-        const params = new URLSearchParams();
-        if (page !== undefined) params.set('page', page);
-        params.set('limit', limit.toString());
-        if (q) params.set('q', q);
-
-        const url = `${this._usersUrl}?${params}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Get, url, {
-            signal
-        });
-
-        if (response.ok) {
-            return (await response.json()) as PaginatedResponse<User>;
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'User listing validation failed', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list users', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to list users: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async listGroups(
-        page: string | undefined = undefined,
-        limit = 500,
-        q?: string,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<Group>> {
-        const params = new URLSearchParams();
-        if (page !== undefined) params.set('page', page);
-        params.set('limit', limit.toString());
-        if (q) params.set('q', q);
-
-        const url = `${this._groupsUrl}?${params}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Get, url, {
-            signal
-        });
-
-        if (response.ok) {
-            return (await response.json()) as PaginatedResponse<Group>;
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Group listing validation failed', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list groups', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to list groups: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async putGroup(id: string, request: PutGroupRequest, signal?: AbortSignal): Promise<Group> {
-        const url = `${this._groupsUrl}/${encodeURIComponent(id)}`;
-        const response = await this._httpClient.fetch(HttpMethod.Put, url, {
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(request),
-            signal
-        });
-
-        if (response.ok) {
-            return (await response.json()) as Group;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? `Group '${id}' not found`, body);
-        }
-
-        if (response.status === 409) {
-            let json: unknown;
-            try {
-                json = await response.json();
-            } catch (err) {
-                if (err instanceof Error && err.name === 'AbortError') throw err;
-                throw new PermissionConflictError('Group conflict', undefined);
-            }
-            const body = isErrorBody(json) ? json : undefined;
-            const data =
-                body !== undefined && typeof json === 'object' && json !== null && 'currentState' in json
-                    ? (json as { currentState: Group }).currentState
-                    : undefined;
-            throw new PermissionConflictError(body?.detail ?? 'Group conflict', data, body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(
-                body?.detail ?? 'Insufficient permissions to create or update group',
-                body
-            );
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Group validation failed', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to put group: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async listGroupMembers(
-        groupId: string,
-        page: string | undefined = undefined,
-        limit = 500,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<User>> {
-        const params = new URLSearchParams();
-        if (page !== undefined) params.set('page', page);
-        params.set('limit', limit.toString());
-
-        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members?${params}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Get, url, { signal });
-
-        if (response.ok) {
-            return (await response.json()) as PaginatedResponse<User>;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? `Group '${groupId}' not found`, body);
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Group member listing validation failed', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list group members', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to list group members: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async addGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember> {
-        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members/${encodeURIComponent(userId)}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Put, url, { signal });
-
-        if (response.ok) {
-            return (await response.json()) as GroupMember;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? 'Group or user not found', body);
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Cannot modify this group', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to add group member', body);
-        }
-
-        if (response.status === 409) {
-            const body = await readErrorBody(response);
-            throw new PermissionConflictError(
-                body?.detail ?? 'Group membership was modified concurrently, please retry',
-                undefined,
-                body
-            );
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to add group member: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async removeGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember> {
-        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members/${encodeURIComponent(userId)}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Delete, url, { signal });
-
-        if (response.ok) {
-            return (await response.json()) as GroupMember;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? 'Group, user, or membership not found', body);
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Cannot modify this group', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to remove group member', body);
-        }
-
-        if (response.status === 409) {
-            const body = await readErrorBody(response);
-            throw new PermissionConflictError(
-                body?.detail ?? 'Group membership was modified concurrently, please retry',
-                undefined,
-                body
-            );
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to remove group member: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async listUserGroups(
-        userId: string,
-        page: string | undefined = undefined,
-        limit = 500,
-        signal?: AbortSignal
-    ): Promise<PaginatedResponse<Group>> {
-        const params = new URLSearchParams();
-        if (page !== undefined) params.set('page', page);
-        params.set('limit', limit.toString());
-
-        const url = `${this._usersUrl}/${encodeURIComponent(userId)}/groups?${params}`;
-
-        const response = await this._httpClient.fetch(HttpMethod.Get, url, { signal });
-
-        if (response.ok) {
-            return (await response.json()) as PaginatedResponse<Group>;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? `User '${userId}' not found`, body);
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'User group listing validation failed', body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list user groups', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to list user groups: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-
-    async deleteGroup(id: string, request: DeleteGroupRequest, signal?: AbortSignal): Promise<Group> {
-        const url = `${this._groupsUrl}/${encodeURIComponent(id)}`;
-        const response = await this._httpClient.fetch(HttpMethod.Delete, url, {
-            headers: { 'If-Match': request.etag },
-            signal
-        });
-
-        if (response.ok) {
-            return (await response.json()) as Group;
-        }
-
-        if (response.status === 404) {
-            const body = await readErrorBody(response);
-            throw new PermissionNotFoundError(body?.detail ?? `Group '${id}' not found`, body);
-        }
-
-        if (response.status === 409) {
-            let json: unknown;
-            try {
-                json = await response.json();
-            } catch (err) {
-                if (err instanceof Error && err.name === 'AbortError') throw err;
-                throw new PermissionConflictError('Group was modified by another user', undefined);
-            }
-            const body = isErrorBody(json) ? json : undefined;
-            const data =
-                body !== undefined && typeof json === 'object' && json !== null && 'currentState' in json
-                    ? (json as { currentState: Group }).currentState
-                    : undefined;
-            throw new PermissionConflictError(body?.detail ?? 'Group was modified by another user', data, body);
-        }
-
-        if (response.status === 403) {
-            const body = await readErrorBody(response);
-            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to delete group', body);
-        }
-
-        if (response.status === 400) {
-            const body = await readErrorBody(response);
-            throw new PermissionValidationError(body?.detail ?? 'Group deletion validation failed', body);
-        }
-
-        const errorText = await readBodyText(response);
-        throw new PermissionError(
-            `Failed to delete group: ${response.status} ${response.statusText} - ${errorText}`,
-            response.status,
-            response.statusText
-        );
-    }
-}
+import { TwinfinityHttpClient, HttpMethod } from '@twinfinity/authentication';
+import type {
+    PaginatedResponse,
+    User,
+    Group,
+    GroupMember,
+    PutGroupRequest,
+    DeleteGroupRequest,
+    PermissionErrorBody
+} from './types';
+import {
+    PermissionValidationError,
+    PermissionError,
+    PermissionForbiddenError,
+    PermissionConflictError,
+    PermissionNotFoundError
+} from './errors';
+
+export interface IPermissionClient {
+    listUsers(page?: string, limit?: number, q?: string, signal?: AbortSignal): Promise<PaginatedResponse<User>>;
+    listGroups(page?: string, limit?: number, q?: string, signal?: AbortSignal): Promise<PaginatedResponse<Group>>;
+    putGroup(id: string, request: PutGroupRequest, signal?: AbortSignal): Promise<Group>;
+    deleteGroup(id: string, request: DeleteGroupRequest, signal?: AbortSignal): Promise<Group>;
+    listGroupMembers(
+        groupId: string,
+        page?: string,
+        limit?: number,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<User>>;
+    addGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember>;
+    removeGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember>;
+    listUserGroups(
+        userId: string,
+        page?: string,
+        limit?: number,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<Group>>;
+}
+
+function isErrorBody(value: unknown): value is PermissionErrorBody {
+    return typeof value === 'object' && value !== null && 'detail' in value && 'cause' in value;
+}
+
+async function readErrorBody(response: Response): Promise<PermissionErrorBody | undefined> {
+    try {
+        const json = await response.json();
+        return isErrorBody(json) ? json : undefined;
+    } catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') throw err;
+        return undefined;
+    }
+}
+
+async function readBodyText(response: Response): Promise<string> {
+    try {
+        return await response.text();
+    } catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') throw err;
+        return '';
+    }
+}
+
+export class PermissionClient implements IPermissionClient {
+    private readonly _usersUrl: string;
+    private readonly _groupsUrl: string;
+
+    constructor(
+        baseUrl: string | URL,
+        private readonly _httpClient: TwinfinityHttpClient
+    ) {
+        const base = String(baseUrl).replace(/\/+$/, '');
+        this._usersUrl = `${base}/_ps/users`;
+        this._groupsUrl = `${base}/_ps/groups`;
+    }
+
+    async listUsers(
+        page: string | undefined = undefined,
+        limit = 500,
+        q?: string,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<User>> {
+        const params = new URLSearchParams();
+        if (page !== undefined) params.set('page', page);
+        params.set('limit', limit.toString());
+        if (q) params.set('q', q);
+
+        const url = `${this._usersUrl}?${params}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Get, url, {
+            signal
+        });
+
+        if (response.ok) {
+            return (await response.json()) as PaginatedResponse<User>;
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'User listing validation failed', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list users', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to list users: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async listGroups(
+        page: string | undefined = undefined,
+        limit = 500,
+        q?: string,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<Group>> {
+        const params = new URLSearchParams();
+        if (page !== undefined) params.set('page', page);
+        params.set('limit', limit.toString());
+        if (q) params.set('q', q);
+
+        const url = `${this._groupsUrl}?${params}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Get, url, {
+            signal
+        });
+
+        if (response.ok) {
+            return (await response.json()) as PaginatedResponse<Group>;
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Group listing validation failed', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list groups', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to list groups: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async putGroup(id: string, request: PutGroupRequest, signal?: AbortSignal): Promise<Group> {
+        const url = `${this._groupsUrl}/${encodeURIComponent(id)}`;
+        const response = await this._httpClient.fetch(HttpMethod.Put, url, {
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(request),
+            signal
+        });
+
+        if (response.ok) {
+            return (await response.json()) as Group;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? `Group '${id}' not found`, body);
+        }
+
+        if (response.status === 409) {
+            let json: unknown;
+            try {
+                json = await response.json();
+            } catch (err) {
+                if (err instanceof Error && err.name === 'AbortError') throw err;
+                throw new PermissionConflictError('Group conflict', undefined);
+            }
+            const body = isErrorBody(json) ? json : undefined;
+            const data =
+                body !== undefined && typeof json === 'object' && json !== null && 'currentState' in json
+                    ? (json as { currentState: Group }).currentState
+                    : undefined;
+            throw new PermissionConflictError(body?.detail ?? 'Group conflict', data, body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(
+                body?.detail ?? 'Insufficient permissions to create or update group',
+                body
+            );
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Group validation failed', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to put group: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async listGroupMembers(
+        groupId: string,
+        page: string | undefined = undefined,
+        limit = 500,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<User>> {
+        const params = new URLSearchParams();
+        if (page !== undefined) params.set('page', page);
+        params.set('limit', limit.toString());
+
+        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members?${params}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Get, url, { signal });
+
+        if (response.ok) {
+            return (await response.json()) as PaginatedResponse<User>;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? `Group '${groupId}' not found`, body);
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Group member listing validation failed', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list group members', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to list group members: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async addGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember> {
+        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members/${encodeURIComponent(userId)}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Put, url, { signal });
+
+        if (response.ok) {
+            return (await response.json()) as GroupMember;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? 'Group or user not found', body);
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Cannot modify this group', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to add group member', body);
+        }
+
+        if (response.status === 409) {
+            const body = await readErrorBody(response);
+            throw new PermissionConflictError(
+                body?.detail ?? 'Group membership was modified concurrently, please retry',
+                undefined,
+                body
+            );
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to add group member: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async removeGroupMember(groupId: string, userId: string, signal?: AbortSignal): Promise<GroupMember> {
+        const url = `${this._groupsUrl}/${encodeURIComponent(groupId)}/members/${encodeURIComponent(userId)}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Delete, url, { signal });
+
+        if (response.ok) {
+            return (await response.json()) as GroupMember;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? 'Group, user, or membership not found', body);
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Cannot modify this group', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to remove group member', body);
+        }
+
+        if (response.status === 409) {
+            const body = await readErrorBody(response);
+            throw new PermissionConflictError(
+                body?.detail ?? 'Group membership was modified concurrently, please retry',
+                undefined,
+                body
+            );
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to remove group member: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async listUserGroups(
+        userId: string,
+        page: string | undefined = undefined,
+        limit = 500,
+        signal?: AbortSignal
+    ): Promise<PaginatedResponse<Group>> {
+        const params = new URLSearchParams();
+        if (page !== undefined) params.set('page', page);
+        params.set('limit', limit.toString());
+
+        const url = `${this._usersUrl}/${encodeURIComponent(userId)}/groups?${params}`;
+
+        const response = await this._httpClient.fetch(HttpMethod.Get, url, { signal });
+
+        if (response.ok) {
+            return (await response.json()) as PaginatedResponse<Group>;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? `User '${userId}' not found`, body);
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'User group listing validation failed', body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to list user groups', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to list user groups: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+
+    async deleteGroup(id: string, request: DeleteGroupRequest, signal?: AbortSignal): Promise<Group> {
+        const url = `${this._groupsUrl}/${encodeURIComponent(id)}`;
+        const response = await this._httpClient.fetch(HttpMethod.Delete, url, {
+            headers: { 'If-Match': request.etag },
+            signal
+        });
+
+        if (response.ok) {
+            return (await response.json()) as Group;
+        }
+
+        if (response.status === 404) {
+            const body = await readErrorBody(response);
+            throw new PermissionNotFoundError(body?.detail ?? `Group '${id}' not found`, body);
+        }
+
+        if (response.status === 409) {
+            let json: unknown;
+            try {
+                json = await response.json();
+            } catch (err) {
+                if (err instanceof Error && err.name === 'AbortError') throw err;
+                throw new PermissionConflictError('Group was modified by another user', undefined);
+            }
+            const body = isErrorBody(json) ? json : undefined;
+            const data =
+                body !== undefined && typeof json === 'object' && json !== null && 'currentState' in json
+                    ? (json as { currentState: Group }).currentState
+                    : undefined;
+            throw new PermissionConflictError(body?.detail ?? 'Group was modified by another user', data, body);
+        }
+
+        if (response.status === 403) {
+            const body = await readErrorBody(response);
+            throw new PermissionForbiddenError(body?.detail ?? 'Insufficient permissions to delete group', body);
+        }
+
+        if (response.status === 400) {
+            const body = await readErrorBody(response);
+            throw new PermissionValidationError(body?.detail ?? 'Group deletion validation failed', body);
+        }
+
+        const errorText = await readBodyText(response);
+        throw new PermissionError(
+            `Failed to delete group: ${response.status} ${response.statusText} - ${errorText}`,
+            response.status,
+            response.statusText
+        );
+    }
+}