portal-mojo 0.2.4 → 0.2.6

package/src/admin/identity/groups/group-sections/SubGroupsSection.tsx

@@ -0,0 +1,102 @@
+// group-sections/SubGroupsSection.tsx — the Sub-Groups TableView port
+// (GroupView.js:1203-1225): a compact table of the group's children —
+// Name / Kind badge / Status / Created — with row click-through to that
+// group's stacked GroupDetail, and the "Add Group" flow (GroupForms.create
+// minus the redundant parent field; the parent IS this group —
+// GroupView._addSubGroup:1670-1689).
+import {
+    Badge, Eyebrow,
+    fmt, formModal, toast,
+} from 'portal-mojo/ui';
+import { useCan } from 'portal-mojo/client/runtime';
+import { GROUP_MANAGE_PERMS, GroupModel, type GroupRow } from '../models';
+import { GROUP_KIND_COMBO_OPTIONS, kindLabel } from './models';
+
+/** GroupModel.useSave().mutateAsync — what the add-sub-group flow needs. */
+type GroupSaveFn = (vars: { id: number | string | null; changes: Record<string, unknown> }) => Promise<GroupRow>;
+
+/**
+ * The "Add Sub-Group" flow — shared by the section toolbar and the header
+ * kebab's "Add Sub-{Noun}" (source: both delegate to _addSubGroup). The
+ * parent field is dropped from the create form: the parent IS this group.
+ */
+export async function runAddSubGroupFlow(group: GroupRow, save: GroupSaveFn): Promise<void> {
+    const noun = kindLabel(group.kind) || 'Group';
+    const form = await formModal({
+        title: `Add sub-${noun.toLowerCase()} to ${group.name}`,
+        submitText: 'Create',
+        fields: [
+            { name: 'name', type: 'text', label: 'Name', required: true, placeholder: 'Enter group name' },
+            {
+                name: 'kind', type: 'combo', label: 'Kind', required: true,
+                options: GROUP_KIND_COMBO_OPTIONS, placeholder: 'Type or pick a kind…',
+            },
+        ],
+    });
+    if (!form) return;
+    try {
+        await save({ id: null, changes: { ...form, parent: group.id } });
+        toast.success(`Sub-${noun.toLowerCase()} created`);
+    } catch (err) {
+        toast.error(err instanceof Error ? err.message : `Failed to create sub-${noun.toLowerCase()}`);
+    }
+}
+
+export function SubGroupsSection({ group, openGroup }: {
+    group: GroupRow;
+    openGroup: (id: number) => void;
+}) {
+    const { data, isPending } = GroupModel.useList({ parent: group.id, size: 25, sort: 'name' });
+    const save = GroupModel.useSave();
+    const { can: canManage } = useCan(GROUP_MANAGE_PERMS);
+    const subs = data?.rows ?? [];
+
+    return (
+        <>
+            <Eyebrow>Sub-groups</Eyebrow>
+            {canManage && (
+                <div className="ga-toolbar">
+                    <button className="btn btn-primary btn-compact" onClick={() => void runAddSubGroupFlow(group, save.mutateAsync)}>
+                        <i className="bi bi-diagram-3" /> Add Group
+                    </button>
+                </div>
+            )}
+            {!isPending && subs.length === 0 && <p className="dim-italic">No sub-groups.</p>}
+            {subs.length > 0 && (
+                <div className="tbl-scroll">
+                    <table className="tbl ga-subgroups">
+                        <thead>
+                            <tr>
+                                <th>Name</th>
+                                <th>Kind</th>
+                                <th>Status</th>
+                                <th>Created</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {subs.map((sg) => (
+                                <tr key={sg.id} className="ga-row-link" onClick={() => openGroup(sg.id)}>
+                                    <td><b>{sg.name}</b></td>
+                                    <td>
+                                        {sg.kind
+                                            ? <Badge tone="primary">{kindLabel(sg.kind)}</Badge>
+                                            : <span className="dim">—</span>}
+                                    </td>
+                                    <td>
+                                        <Badge tone={sg.is_active ? 'success' : 'muted'}>
+                                            {sg.is_active ? 'Active' : 'Inactive'}
+                                        </Badge>
+                                    </td>
+                                    <td className="dim">{fmt.date(sg.created)}</td>
+                                </tr>
+                            ))}
+                        </tbody>
+                    </table>
+                </div>
+            )}
+            {(data?.count ?? 0) > subs.length && (
+                <p className="dim" style={{ marginTop: 8 }}>{data!.count - subs.length} more sub-groups not shown.</p>
+            )}
+        </>
+    );
+}

package/src/admin/identity/groups/group-sections/auth-config.ts

@@ -0,0 +1,285 @@
+export interface RegistrationField {
+    name: string;
+    required: boolean;
+    verify: string | null;
+}
+
+export type AuthFormState = Record<string, unknown>;
+export type AuthConfig = Record<string, unknown>;
+
+export const LOGIN_METHOD_OPTS = [
+    { value: 'password', label: 'Password' },
+    { value: 'sms', label: 'SMS code' },
+    { value: 'passkey', label: 'Passkey' },
+    { value: 'magic', label: 'Magic link' },
+    { value: 'google', label: 'Google' },
+    { value: 'apple', label: 'Apple' },
+    { value: 'github', label: 'GitHub' },
+];
+
+export const REGISTRATION_METHOD_OPTS = [
+    { value: 'password', label: 'Password' },
+    { value: 'google', label: 'Google' },
+    { value: 'apple', label: 'Apple' },
+    { value: 'github', label: 'GitHub' },
+];
+
+export const LAYOUT_OPTS = [
+    { value: 'card', label: 'Card' },
+    { value: 'fullscreen', label: 'Full screen' },
+];
+
+export const PASSKEY_PROMPT_OPTS = [
+    { value: 'off', label: 'Off' },
+    { value: 'optional', label: 'Optional' },
+    { value: 'required', label: 'Required' },
+];
+
+export const IDENTITY_FIELD_OPTS = [
+    { value: '', label: 'Auto (email, then phone)' },
+    { value: 'email', label: 'Email' },
+    { value: 'phone', label: 'Phone' },
+];
+
+export const VERIFY_OPTS = [
+    { value: '', label: 'None' },
+    { value: 'email', label: 'Email' },
+    { value: 'sms', label: 'SMS' },
+];
+
+export const CANONICAL_REG_FIELDS = [
+    { name: 'first_name', label: 'First name' },
+    { name: 'last_name', label: 'Last name' },
+    { name: 'email', label: 'Email' },
+    { name: 'phone', label: 'Phone' },
+    { name: 'dob', label: 'Date of birth' },
+    { name: 'password', label: 'Password' },
+];
+const CANONICAL_REG_NAMES = new Set(CANONICAL_REG_FIELDS.map((field) => field.name));
+const EXTRA_FIELD_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+
+export const DEFAULT_REG_FIELDS: RegistrationField[] = [
+    { name: 'first_name', required: false, verify: null },
+    { name: 'last_name', required: false, verify: null },
+    { name: 'email', required: true, verify: 'email' },
+    { name: 'password', required: true, verify: null },
+];
+
+export const STATIC_DEFAULTS: AuthConfig = {
+    theme: {
+        app_title: 'DJANGO MOJO', logo_url: '', favicon_url: '', hero_image_url: '',
+        hero_headline: 'Welcome back', hero_subheadline: 'Admin Portal',
+        back_to_website_url: '', terms_url: '', layout: 'card', api_base: '',
+        success_redirect: '/', custom_css: '', custom_css_url: '',
+    },
+    registration: {
+        enabled: true, fields: null, extra_fields: [], identity_field: '', min_age: null,
+        methods: ['password', 'google', 'apple', 'github'], passkey_prompt: 'off',
+    },
+    login: { methods: ['password', 'sms', 'passkey', 'magic', 'google', 'apple', 'github'] },
+};
+
+export const THEME_TEXT_FIELDS = [
+    { name: 'app_title', path: 'theme.app_title', label: 'App title', help: 'Brand name shown in the login card header.' },
+    { name: 'logo_url', path: 'theme.logo_url', label: 'Logo URL', help: 'Logo image URL — appears in the header and hero panel.' },
+    { name: 'favicon_url', path: 'theme.favicon_url', label: 'Favicon URL', help: 'Favicon URL for the auth pages.' },
+    { name: 'hero_image_url', path: 'theme.hero_image_url', label: 'Hero image URL', help: 'Background image for the left hero panel.' },
+    { name: 'hero_headline', path: 'theme.hero_headline', label: 'Hero headline', help: 'Headline text shown over the hero image.' },
+    { name: 'hero_subheadline', path: 'theme.hero_subheadline', label: 'Hero subheadline', help: 'Supporting text below the hero headline.' },
+    { name: 'back_to_website_url', path: 'theme.back_to_website_url', label: 'Back-to-website URL', help: '"Back to website" link shown in the hero panel.' },
+    { name: 'terms_url', path: 'theme.terms_url', label: 'Terms URL', help: 'Terms & Conditions link shown on the register page.' },
+    { name: 'api_base', path: 'theme.api_base', label: 'API base', help: 'API host for the auth pages — leave blank for same origin.' },
+    { name: 'success_redirect', path: 'theme.success_redirect', label: 'Success redirect', help: 'Where to send the user after a successful login.' },
+    { name: 'custom_css_url', path: 'theme.custom_css_url', label: 'Custom CSS URL', help: 'URL to an external stylesheet — must start with https://.' },
+];
+
+export const BASE_THEME_FIELDS = [
+    'app_title', 'logo_url', 'favicon_url', 'hero_image_url',
+    'hero_headline', 'hero_subheadline', 'back_to_website_url', 'terms_url',
+];
+export const ADVANCED_THEME_FIELDS = ['api_base', 'success_redirect', 'custom_css_url'];
+
+type DescriptorKind = 'text' | 'select' | 'array' | 'bool' | 'int';
+interface Descriptor { form: string; path: string; kind: DescriptorKind }
+
+const FIELD_DESCRIPTORS: Descriptor[] = [
+    ...THEME_TEXT_FIELDS.map((field): Descriptor => ({ form: field.name, path: field.path, kind: 'text' })),
+    { form: 'custom_css', path: 'theme.custom_css', kind: 'text' },
+    { form: 'layout', path: 'theme.layout', kind: 'select' },
+    { form: 'login_methods', path: 'login.methods', kind: 'array' },
+    { form: 'reg_enabled', path: 'registration.enabled', kind: 'bool' },
+    { form: 'reg_passkey_prompt', path: 'registration.passkey_prompt', kind: 'select' },
+    { form: 'reg_identity_field', path: 'registration.identity_field', kind: 'select' },
+    { form: 'reg_min_age', path: 'registration.min_age', kind: 'int' },
+    { form: 'reg_methods', path: 'registration.methods', kind: 'array' },
+];
+
+export function getAuthPath(obj: unknown, path: string): unknown {
+    let current: unknown = obj;
+    for (const key of path.split('.')) {
+        if (current == null || typeof current !== 'object') return undefined;
+        current = (current as Record<string, unknown>)[key];
+    }
+    return current;
+}
+
+function setAuthPath(obj: AuthConfig, path: string, value: unknown): void {
+    const keys = path.split('.');
+    let current = obj;
+    for (let index = 0; index < keys.length - 1; index += 1) {
+        const key = keys[index]!;
+        if (current[key] == null || typeof current[key] !== 'object') current[key] = {};
+        current = current[key] as AuthConfig;
+    }
+    current[keys[keys.length - 1]!] = value;
+}
+
+export function deepMergeAuthConfig(base: AuthConfig, override: unknown): AuthConfig {
+    const output: AuthConfig = structuredClone(base);
+    if (override == null || typeof override !== 'object' || Array.isArray(override)) return output;
+    for (const [key, value] of Object.entries(override as AuthConfig)) {
+        const previous = output[key];
+        output[key] = previous != null && typeof previous === 'object' && !Array.isArray(previous)
+            && value != null && typeof value === 'object' && !Array.isArray(value)
+            ? deepMergeAuthConfig(previous as AuthConfig, value)
+            : structuredClone(value);
+    }
+    return output;
+}
+
+/** Merge deployment defaults then root-to-leaf group overrides. */
+export function resolveAuthConfigChain(deployment: AuthConfig, chain: Array<{ metadata?: Record<string, unknown> }>): AuthConfig {
+    return chain.reduce((config, group) => {
+        const override = group.metadata?.auth_config;
+        return deepMergeAuthConfig(config, override);
+    }, deepMergeAuthConfig({}, deployment));
+}
+
+function sameSet(a: unknown, b: unknown): boolean {
+    const left = [...(Array.isArray(a) ? a : [])].map(String).sort();
+    const right = [...(Array.isArray(b) ? b : [])].map(String).sort();
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+function gridValuesFromArray(fields: RegistrationField[]): AuthFormState {
+    const byName = Object.fromEntries(fields.filter((field) => field?.name).map((field) => [field.name, field]));
+    const output: AuthFormState = {};
+    for (const field of CANONICAL_REG_FIELDS) {
+        const entry = byName[field.name];
+        const isPassword = field.name === 'password';
+        output[`regf_${field.name}_inc`] = !!entry;
+        output[`regf_${field.name}_req`] = isPassword ? true : !!entry?.required;
+        output[`regf_${field.name}_vfy`] = entry?.verify ? String(entry.verify) : '';
+    }
+    return output;
+}
+
+function extraNamesFromArray(value: unknown): string {
+    return (Array.isArray(value) ? value : [])
+        .map((entry) => entry && typeof entry === 'object' ? (entry as { name?: unknown }).name : entry)
+        .filter((name): name is string => typeof name === 'string' && name.trim() !== '')
+        .map((name) => name.trim())
+        .join(',');
+}
+
+export function assembleRegistrationFields(values: AuthFormState): RegistrationField[] {
+    const output: RegistrationField[] = [];
+    for (const field of CANONICAL_REG_FIELDS) {
+        if (values[`regf_${field.name}_inc`] !== true) continue;
+        output.push(field.name === 'password'
+            ? { name: 'password', required: true, verify: null }
+            : {
+                name: field.name,
+                required: values[`regf_${field.name}_req`] === true,
+                verify: values[`regf_${field.name}_vfy`] ? String(values[`regf_${field.name}_vfy`]) : null,
+            });
+    }
+    return output;
+}
+
+function assembleExtraFields(values: AuthFormState): { name: string }[] {
+    const raw = values.reg_extra_fields;
+    const parts = Array.isArray(raw) ? raw.map(String) : String(raw ?? '').split(',');
+    const seen = new Set<string>();
+    const output: { name: string }[] = [];
+    for (const part of parts) {
+        const name = part.trim();
+        if (!name || seen.has(name) || CANONICAL_REG_NAMES.has(name) || !EXTRA_FIELD_NAME_RE.test(name)) continue;
+        seen.add(name);
+        output.push({ name });
+    }
+    return output;
+}
+
+export function buildAuthBaseline(own: unknown, resolved: unknown): AuthFormState {
+    const baseline: AuthFormState = {};
+    for (const descriptor of FIELD_DESCRIPTORS) {
+        const ownValue = getAuthPath(own, descriptor.path);
+        const resolvedValue = getAuthPath(resolved, descriptor.path);
+        if (descriptor.kind === 'text') baseline[descriptor.form] = ownValue == null ? '' : String(ownValue);
+        else if (descriptor.kind === 'int') baseline[descriptor.form] = ownValue == null || ownValue === '' ? '' : String(ownValue);
+        else if (descriptor.kind === 'array') {
+            const value = ownValue != null ? ownValue : resolvedValue;
+            baseline[descriptor.form] = Array.isArray(value) ? value.map(String) : [];
+        } else if (descriptor.kind === 'bool') baseline[descriptor.form] = !!(ownValue != null ? ownValue : resolvedValue);
+        else baseline[descriptor.form] = String(ownValue != null ? ownValue : resolvedValue ?? '');
+    }
+    const ownFields = getAuthPath(own, 'registration.fields');
+    const resolvedFields = getAuthPath(resolved, 'registration.fields');
+    const fields = Array.isArray(ownFields) ? ownFields as RegistrationField[]
+        : Array.isArray(resolvedFields) ? resolvedFields as RegistrationField[] : DEFAULT_REG_FIELDS;
+    Object.assign(baseline, gridValuesFromArray(fields));
+    const ownExtra = getAuthPath(own, 'registration.extra_fields');
+    const resolvedExtra = getAuthPath(resolved, 'registration.extra_fields');
+    baseline.reg_extra_fields = extraNamesFromArray(Array.isArray(ownExtra) ? ownExtra : resolvedExtra);
+    return baseline;
+}
+
+export function buildAuthPlaceholders(resolved: unknown): Record<string, string> {
+    const placeholders: Record<string, string> = {};
+    for (const descriptor of FIELD_DESCRIPTORS) {
+        if (descriptor.kind !== 'text' && descriptor.kind !== 'int') continue;
+        const value = getAuthPath(resolved, descriptor.path);
+        placeholders[descriptor.form] = value == null ? '' : String(value);
+    }
+    return placeholders;
+}
+
+function isDifferent(current: unknown, baseline: unknown, kind: DescriptorKind): boolean {
+    if (kind === 'array') return !sameSet(current, baseline);
+    if (kind === 'bool') return !!current !== !!baseline;
+    if (kind === 'int') {
+        const left = current === '' || current == null ? null : Number(current);
+        const right = baseline === '' || baseline == null ? null : Number(baseline);
+        return left !== right;
+    }
+    return String(current ?? '').trim() !== String(baseline ?? '').trim();
+}
+
+function normalizeForSave(current: unknown, kind: DescriptorKind): unknown {
+    if (kind === 'array') return [...(Array.isArray(current) ? current : [])];
+    if (kind === 'bool') return !!current;
+    if (kind === 'int') return current === '' || current == null ? null : Number(current);
+    return current == null ? '' : String(current);
+}
+
+export function buildAuthConfigDiff(values: AuthFormState, baseline: AuthFormState): AuthConfig | null {
+    const payload: AuthConfig = {};
+    let changed = false;
+    for (const descriptor of FIELD_DESCRIPTORS) {
+        if (!isDifferent(values[descriptor.form], baseline[descriptor.form], descriptor.kind)) continue;
+        setAuthPath(payload, descriptor.path, normalizeForSave(values[descriptor.form], descriptor.kind));
+        changed = true;
+    }
+    const fields = assembleRegistrationFields(values);
+    if (JSON.stringify(fields) !== JSON.stringify(assembleRegistrationFields(baseline))) {
+        setAuthPath(payload, 'registration.fields', fields);
+        changed = true;
+    }
+    const extraFields = assembleExtraFields(values);
+    if (JSON.stringify(extraFields) !== JSON.stringify(assembleExtraFields(baseline))) {
+        setAuthPath(payload, 'registration.extra_fields', extraFields);
+        changed = true;
+    }
+    return changed ? payload : null;
+}

package/src/admin/identity/groups/group-sections/geofence-data.ts

@@ -0,0 +1,40 @@
+// group-sections/geofence-data.ts — a RE-EXPORT SHIM.
+//
+// Wave 4 lifted ~13 exports of web-mojo
+// `@ext/admin/security/geofence/geofenceData.js` into this file for the
+// group-scoped panel. Board #1287 promoted that module into the package
+// (`portal-mojo/admin` → `admin/network/geofence/geofence-data.ts`) and added
+// the exports the platform surfaces need, so the lossy rule↔form projection is
+// defined exactly ONCE — which is what the source file's own docstring asks
+// for. The inline 249-entry country table that lived here is gone: names come
+// from #1426's `COUNTRY_CENTROIDS`, the framework's only country-name source.
+//
+// This file exists so `GeofenceSection.tsx` keeps its short import path. Add
+// nothing here; extend the package module.
+export {
+    ABUSE_FLAGS,
+    COUNTRY_MODE_OPTS,
+    COUNTRY_OPTIONS,
+    EMPTY_RULE_FORM,
+    GEOFENCE_MANAGE_PERMS,
+    GEOFENCE_VIEW_PERMS,
+    GROUP_GEOFENCE_EDIT_PERMS,
+    SECURITY_EVENTS_PERMS,
+    US_STATES,
+    buildGroupRulePayload,
+    coerceRuleInput,
+    countryName,
+    describeRule,
+    formToRule,
+    isAdvancedRule,
+    regionName,
+    ruleToForm,
+} from 'portal-mojo/admin/security';
+
+export type {
+    AbuseFlagKey,
+    GeoRulesConfig,
+    GeofenceRule,
+    RuleClause,
+    RuleForm,
+} from 'portal-mojo/admin/security';

package/src/admin/identity/groups/group-sections/models.ts

@@ -0,0 +1,110 @@
+// group-sections/models.ts — model definitions + wire helpers for the FULL
+// GroupView port (web-mojo admin/account/groups/GroupView.js, read in full
+// 2026-08-05). These defs live beside the group sections (NOT in the app's
+// models.ts, which another wave owns) and cover the group-scoped surfaces the
+// first GroupDetail pass left out.
+//
+// Wire facts measured live (mverify @9009, portal_test, 2026-08-05):
+//   · /api/group/apikey 200 — row {id, created, modified, name, is_active,
+//     permissions{}, limits{}, last_used, expires_at, metadata, override_user,
+//     group:{…embedded}, user}. NOTE `name` (not the user-key surface's
+//     `label`) and `expires_at` (not `expires`).
+//   · Create echo carries `token` ONCE (api_key.py on_rest_get attaches
+//     _raw_token). Managers can ALSO read it later via ?graph=token — the
+//     token is not write-once on this backend (rotate_token docstring).
+//   · POST /api/group/apikey/rotate is apikey-auth SELF-SERVICE (401 for
+//     JWT callers) — deliberately NOT surfaced in this portal UI.
+//   · /api/group/webhook_subscriptions 200 — row {id, created, modified,
+//     url, events[], is_active, group:{…}}.
+//   · POST /api/group/webhook_secret {group} → {status, data:{secret,
+//     created_at, last_rotated_at}} — timestamps are ISO STRINGS
+//     (dates.utcnow().isoformat()), NOT epochs. web-mojo formatted them
+//     through ['epoch','relative'] (a bug not carried here).
+//   · POST /api/group/member/invite {email, group} — backend perms
+//     manage_users|manage_members|manage_group|manage_groups on the group.
+//   · /api/incident/event 200 (empty on the instance) — columns per the
+//     django model: created/category/title (+ level/details/model_*).
+import { defineModel } from 'portal-mojo/client/runtime';
+
+// ── Group kinds (Group.js GroupKinds — the FULL known-kind catalog) ───
+export const GROUP_KINDS: Record<string, string> = {
+    org: 'Organization',
+    platform: 'Platform',
+    division: 'Division',
+    department: 'Department',
+    team: 'Team',
+    merchant: 'Merchant',
+    partner: 'Partner',
+    client: 'Client',
+    iso: 'ISO',
+    sales: 'Sales',
+    reseller: 'Reseller',
+    location: 'Location',
+    region: 'Region',
+    route: 'Route',
+    project: 'Project',
+    inventory: 'Inventory',
+    test: 'Testing',
+    misc: 'Miscellaneous',
+    qa: 'Quality Assurance',
+};
+
+/** Combo options — known kinds; free-typed kinds are allowed (combo). */
+export const GROUP_KIND_COMBO_OPTIONS = Object.entries(GROUP_KINDS).map(([value, label]) => ({ value, label }));
+
+/** Kind → label: catalog name, else capitalized raw kind (GroupView.kindLabel). */
+export function kindLabel(kind: string | null | undefined): string {
+    if (!kind) return '';
+    const known = GROUP_KINDS[kind];
+    if (known) return known;
+    const s = String(kind);
+    return s.charAt(0).toUpperCase() + s.slice(1);
+}
+
+/** Kind → header icon (GroupView.iconForKind, ported verbatim). */
+export function iconForKind(kind: string | null | undefined): string {
+    const k = String(kind ?? '').toLowerCase();
+    if (k === 'org' || k === 'organization') return 'bi-buildings';
+    if (k === 'division' || k === 'department') return 'bi-buildings';
+    if (k === 'region' || k === 'location') return 'bi-geo-alt';
+    if (k === 'project') return 'bi-kanban';
+    if (k === 'merchant' || k === 'partner' || k === 'client' || k === 'reseller') return 'bi-shop';
+    if (k === 'iso' || k === 'sales') return 'bi-briefcase';
+    if (k === 'route') return 'bi-signpost-2';
+    if (k === 'inventory') return 'bi-box-seam';
+    if (k === 'qa' || k === 'test' || k === 'testing') return 'bi-clipboard-check';
+    return 'bi-people-fill';
+}
+
+// ── Canonical option lists (Group.js) ─────────────────────────────────
+/** End-of-day hour options, 0–23 with 12-hour labels (EodHourOptions port). */
+export const EOD_HOUR_OPTIONS = Array.from({ length: 24 }, (_, h) => {
+    let label: string;
+    if (h === 0) label = 'Midnight';
+    else if (h === 12) label = 'Noon';
+    else label = `${h % 12 === 0 ? 12 : h % 12} ${h < 12 ? 'AM' : 'PM'}`;
+    return { value: h, label };
+});
+
+// ── Incident events — /api/incident/event ─────────────────────────────
+/** Row typed from django-mojo incident/models/event.py (live table empty). */
+export interface IncidentEventRow {
+    id: number;
+    created: number;
+    level: number;
+    scope?: string;
+    category: string;
+    title: string | null;
+    details?: string | null;
+    source_ip?: string | null;
+    hostname?: string | null;
+    country_code?: string | null;
+    model_name?: string | null;
+    model_id?: number | null;
+    metadata?: Record<string, unknown>;
+}
+
+export const IncidentEventModel = defineModel<IncidentEventRow>({
+    name: 'incident_event',
+    endpoint: '/api/incident/event',
+});

package/src/admin/identity/groups/group-sections/shared.ts

@@ -0,0 +1,21 @@
+// group-sections/shared.ts — tiny helpers shared across the group sections.
+import type { Params } from 'portal-mojo/client/runtime';
+import type { Tone } from 'portal-mojo/ui';
+
+/** Audit log level → Timeline tone (GroupView.js LOG_LEVEL_TONE). */
+export const LOG_TONE: Record<string, Tone> = {
+    error: 'danger',
+    critical: 'danger',
+    warning: 'warning',
+    warn: 'warning',
+    info: 'info',
+};
+
+/**
+ * The group's OBJECT logs — what the source's shared audit collection
+ * fetched (LogList {model_name:'account.Group', model_id:<id>}), feeding the
+ * Overview activity feed, the Audit timeline, and the Audit rail badge.
+ */
+export function groupAuditParams(groupId: number): Params {
+    return { model_name: 'account.Group', model_id: groupId, sort: '-created' };
+}

package/src/admin/identity/groups/index.ts

@@ -0,0 +1,6 @@
+export * from './group-permissions';
+export * from './models';
+export * from './GroupsPage';
+export * from './GroupDetail';
+
+export const loadGroupsPage = () => import('./GroupsPage').then(({ GroupsPage }) => ({ default: GroupsPage }));

package/src/admin/identity/groups/models.ts

@@ -0,0 +1,70 @@
+// Source: NativeMojo portal-mojo v0.2.5 reference app, apps/portal/src/models.ts.
+import { defineModel, type Group } from '../../../client/runtime';
+import { GROUP_DESTRUCTIVE_PERMS, GROUP_MANAGE_PERMS, GROUP_VIEW_PERMS } from './group-permissions';
+
+export { MemberModel, type MemberRow } from '../members';
+
+export { GROUP_DESTRUCTIVE_PERMS, GROUP_MANAGE_PERMS, GROUP_VIEW_PERMS } from './group-permissions';
+
+export const GROUP_KIND_OPTIONS = [
+    { value: 'org', label: 'Org' },
+    { value: 'organization', label: 'Organization' },
+    { value: 'team', label: 'Team' },
+    { value: 'project', label: 'Project' },
+    { value: 'group', label: 'Group' },
+];
+
+export type GroupRow = Group & {
+    id: number;
+    uuid: string | null;
+    created: number;
+    modified: number;
+    last_activity: number | null;
+    is_active: boolean;
+    auth_domain: string | null;
+    metadata: Record<string, unknown>;
+    member_count: number;
+};
+
+export const GroupModel = defineModel<GroupRow>({
+    name: 'group',
+    endpoint: '/api/group',
+    permissions: { view: GROUP_VIEW_PERMS, manage: GROUP_MANAGE_PERMS },
+    forms: {
+        create: {
+            title: 'Add group',
+            submitText: 'Create',
+            fields: [
+                { name: 'name', type: 'text', label: 'Name', required: true, placeholder: 'Acme West' },
+                {
+                    name: 'kind', type: 'combo', label: 'Kind', required: true,
+                    options: GROUP_KIND_OPTIONS, placeholder: 'Type or pick a kind…',
+                    help: 'Drives the sidebar menu context and the portal look for this group.',
+                },
+                {
+                    name: 'parent', type: 'collection', label: 'Parent group',
+                    endpoint: '/api/group', labelField: 'name', valueField: 'id',
+                    placeholder: 'None — top-level', help: 'Optional. Search by name.',
+                },
+            ],
+        },
+        disable: {
+            title: 'Deactivate group',
+            submitText: 'Deactivate',
+            fields: [
+                {
+                    name: 'reason', type: 'select', label: 'Reason', required: true, options: [
+                        { value: 'admin', label: 'Admin — manual block' },
+                        { value: 'abuse', label: 'Abuse — banned' },
+                        { value: 'archived', label: 'Archived — no longer in use' },
+                    ],
+                },
+                { name: 'note', type: 'textarea', label: 'Note', placeholder: 'Optional note about why this group is being deactivated.' },
+            ],
+        },
+    },
+    actions: {
+        disable: { permissions: GROUP_DESTRUCTIVE_PERMS },
+        reactivate: { permissions: GROUP_DESTRUCTIVE_PERMS },
+    },
+});

package/src/admin/identity/index.ts

@@ -1,5 +1,6 @@
 export * from './users';
 export * from './members';
+export * from './groups';
 
 export { USERS_ADMIN_SECTION } from './users';
 export { MEMBERS_ADMIN_SECTION } from './members';