Cordy/Cairn
2
1
Fork 0
Code Issues 20 Pull requests Projects Releases Packages Wiki Activity Actions

Accounts & Groups tabs under Users & access — app-owned groups alongside directory groups #550

New issue
Closed
opened 2026-09-14 18:14:21 +00:00 by Cordy · 3 comments
Cordy commented 2026-09-14 18:14:21 +00:00
Owner
Copy link

Follow-on from #533, approved with mockup admin-accounts-groups-mockup.html (rev 1) on 2026-09-14. The Access tab's account lists can grow very large and deserve their own surface, and Cairn gains app-owned groups so admins can group users without (or alongside) an IdP.

Approved design

Tab layout: Users & access becomes Access · Accounts · Groups · Seats (#admin/users/accounts, #admin/users/groups, shared admtab idiom).

  • Access slims to identity wiring and health: auth mode, issuer, admin group, admin-client chip, signed-in/active counters. The Administrators section is removed as redundant — admins are visible on Accounts, especially with the role filter (Nikola, mockup review).
  • Accounts hosts the two lists moved from Access, behaviour unchanged from v0.6.196: Local accounts (create / reset / role / remove, 50-cap meter) and Directory accounts (read-only rows, Cairn-admin grant; group-granted admin shows its source and disables Revoke with a tooltip). One filter box over both sections that also filters by role (e.g. admins only) and by group (typing a group name shows the accounts assigned to it). Directory section paginated ("Load more") — never render everything (the Nextcloud users-page lesson).
  • Groups mirrors that shape:
    • App-owned groups: created and managed in Cairn, members can be local or directory accounts. Chip-style member editing, bulk add with per-name success/failure reporting, rename, delete. Usable everywhere a directory group works: space membership, share targets, peering receiver lists, admin group.
    • Directory groups: OpenCloud-style lock treatment — visible, countable, "View members" drill-in, but read-only with one line saying where to edit them. Degraded state without the IdP admin client: names seen in sign-in tokens only, counts shown as —, warn notebox pointing at the admin-client config. In pure local mode the directory sections don't render at all.
    • Used by column: counts of shares / spaces / peering receiver lists / admin-group role referencing the group, so an admin knows what breaks before deleting or renaming.

Approved decisions

  1. Single namespace: app and directory groups share one name space. Creating an app group whose name Cairn knows as a directory group is refused (not warned) — shares and spaces address groups by name; ambiguity would be a security bug.
  2. Internal ids: app groups carry an internal id so rename does not rewrite every share/space reference.
  3. Delete fails closed: deleting a referenced app group leaves references inert (a share/receiver list addressed to it matches nobody) rather than mutating other subsystems' state; the confirm dialog lists what stops working.
  4. Administrators section on Access: removed (see above).

Competitor grounding (research 2026-09-14)

  • Nextcloud: all-users view loads everything (30s–2min waits reported); LDAP groups greyed out with no explanation → our paging + explicit lock copy.
  • OpenCloud: external groups locked with a lock symbol, local groups editable → adopted.
  • ownCloud oCIS: shipped with no group UI (API only); the later extension is praised for bulk member-add with per-name reporting → adopted; criticised for missing descriptions/nesting; claim-based group assignment is a requested feature (ocis#7341) — Cairn already has claims groups via livegroups, the merged view is the differentiator.

Implementation sketch

  • internal/auth/groupstore.go: GroupStore at /data/.cairn/groups.json (statestore-bound like local-users): id, name, members, created. CRUD + membership lookup.
  • WithAppGroups(inner, store) provider wrapper merging app-group membership into User.Groups, placed under WithAdminFlag so an app group can serve as admin group.
  • internal/api/groups.go: GET/POST /api/v1/admin/groups, DELETE/rename /{id}, POST/DELETE members; directory-group section in the same GET payload (admin-client listing where possible, else seen-names fallback with a partial flag); references counts.
  • Audit verbs: group-create, group-remove, group-rename, group-member-add, group-member-remove (registry group "users").
  • Frontend: tab split, moved sections, filters, groups UI + dialogs per mockup, i18n ×4, #389 fence gate on index.html.

Waves: 1 backend core (TDD), 2 frontend, docs ride along. Ship train per wave, live-verify on files-bao.

Follow-on from #533, approved with mockup `admin-accounts-groups-mockup.html` (rev 1) on 2026-09-14. The Access tab's account lists can grow very large and deserve their own surface, and Cairn gains **app-owned groups** so admins can group users without (or alongside) an IdP. ## Approved design **Tab layout:** Users & access becomes Access · **Accounts** · **Groups** · Seats (`#admin/users/accounts`, `#admin/users/groups`, shared admtab idiom). - **Access** slims to identity wiring and health: auth mode, issuer, admin group, admin-client chip, signed-in/active counters. **The Administrators section is removed as redundant** — admins are visible on Accounts, especially with the role filter (Nikola, mockup review). - **Accounts** hosts the two lists moved from Access, behaviour unchanged from v0.6.196: Local accounts (create / reset / role / remove, 50-cap meter) and Directory accounts (read-only rows, Cairn-admin grant; group-granted admin shows its source and disables Revoke with a tooltip). One filter box over both sections that also filters **by role** (e.g. admins only) and **by group** (typing a group name shows the accounts assigned to it). Directory section paginated ("Load more") — never render everything (the Nextcloud users-page lesson). - **Groups** mirrors that shape: - *App-owned groups*: created and managed in Cairn, members can be local or directory accounts. Chip-style member editing, bulk add with per-name success/failure reporting, rename, delete. Usable everywhere a directory group works: space membership, share targets, peering receiver lists, admin group. - *Directory groups*: OpenCloud-style lock treatment — visible, countable, "View members" drill-in, but read-only with one line saying where to edit them. Degraded state without the IdP admin client: names seen in sign-in tokens only, counts shown as —, warn notebox pointing at the admin-client config. In pure local mode the directory sections don't render at all. - *Used by* column: counts of shares / spaces / peering receiver lists / admin-group role referencing the group, so an admin knows what breaks before deleting or renaming. ## Approved decisions 1. **Single namespace:** app and directory groups share one name space. Creating an app group whose name Cairn knows as a directory group is **refused** (not warned) — shares and spaces address groups by name; ambiguity would be a security bug. 2. **Internal ids:** app groups carry an internal id so rename does not rewrite every share/space reference. 3. **Delete fails closed:** deleting a referenced app group leaves references inert (a share/receiver list addressed to it matches nobody) rather than mutating other subsystems' state; the confirm dialog lists what stops working. 4. Administrators section on Access: removed (see above). ## Competitor grounding (research 2026-09-14) - Nextcloud: all-users view loads everything (30s–2min waits reported); LDAP groups greyed out with no explanation → our paging + explicit lock copy. - OpenCloud: external groups locked with a lock symbol, local groups editable → adopted. - ownCloud oCIS: shipped with no group UI (API only); the later extension is praised for bulk member-add with per-name reporting → adopted; criticised for missing descriptions/nesting; claim-based group assignment is a requested feature (ocis#7341) — Cairn already has claims groups via livegroups, the merged view is the differentiator. ## Implementation sketch - `internal/auth/groupstore.go`: GroupStore at `/data/.cairn/groups.json` (statestore-bound like local-users): id, name, members, created. CRUD + membership lookup. - `WithAppGroups(inner, store)` provider wrapper merging app-group membership into `User.Groups`, placed **under** WithAdminFlag so an app group can serve as admin group. - `internal/api/groups.go`: GET/POST `/api/v1/admin/groups`, DELETE/rename `/{id}`, POST/DELETE members; directory-group section in the same GET payload (admin-client listing where possible, else seen-names fallback with a `partial` flag); references counts. - Audit verbs: `group-create`, `group-remove`, `group-rename`, `group-member-add`, `group-member-remove` (registry group "users"). - Frontend: tab split, moved sections, filters, groups UI + dialogs per mockup, i18n ×4, #389 fence gate on index.html. Waves: 1 backend core (TDD), 2 frontend, docs ride along. Ship train per wave, live-verify on files-bao.
Cordy commented 2026-09-14 19:11:22 +00:00
Author
Owner
Copy link

Shipped: v0.6.199 (backend) + v0.6.200 (UI), PR #551, live on both dogfoods.

Backend (v0.6.199, red witnessed on the runner before implementation):

  • auth.GroupStore at /data/.cairn/groups.json — statestore-bound like local-users, internal ids (decision 2), case-insensitive single namespace, idempotent membership ops, sorted listings.
  • WithAppGroups merges membership into User.Groups on every authentication, under the admin flag and above live groups — so an app group can be the admin group, and a live IdP refresh never drops app groups.
  • /api/v1/admin/groups: CRUD + rename, bulk member add with per-name {added, invalid} reporting (the oCIS lesson), directory listing (spaces.Manager.ListGroups via the IdP admin client; known-names fallback flagged dirSource: "seen"), per-group directory member drill-in. Creating or renaming onto a known directory name → 409 (decision 1). Delete fails closed (decision 3) — references in peering lists and the admin group simply stop matching; nothing else is mutated.
  • Peering group resolution consults app groups first, then the IdP: group-based peering allow-lists now work with no IdP client at all when the group is app-owned. Audit verbs group-create/-rename/-remove/-member-add/-member-remove (registry group users).

Frontend (v0.6.200): Access · Accounts · Groups · Seats. Access slimmed to identity wiring + counters, Administrators section removed (decision 4). Accounts: both lists moved intact, one filter (name substring / admin / app-group name — typing a group shows its members), account rows show their app groups, directory list pages 25 at a time. Groups: app-owned CRUD with chip member editing, comma-separated bulk add, reference counts on rows and in the delete confirm; directory groups read-only with live listing where the admin client exists, and the honest "names seen so far" note where it doesn't; hidden entirely in pure local mode. Deep links #admin/users/accounts and #admin/users/groups. i18n ×4, #389 fence gate green.

Verification so far: full go test ./... green; both pods booted clean on v0.6.200; fence gate + node --check on the shipped page. The signed-in admin views need a human session (redeploy cleared sessions) — Nikola's checklist:

  1. #admin/users — four tabs; Access shows wiring rows only, no Administrators list.
  2. Accounts — both lists present, filter by a name, by admin, and by a group name once one exists; create/reset/role/remove still work.
  3. Groups — create project-rhine with a member; check the members chip editor, bulk add with a junk name (per-name report), rename, delete confirm showing references; directory section shows keycloak groups with View members (files-bao has the admin client).
  4. Peering: add an app group to a receiver list on one side — should resolve without warnings.

Known follow-ups (not blocking): the peering "group lists need the IdP admin client" copy predates app groups and could soften; space names appear among directory groups (they ARE Keycloak groups) — a "space" badge would help; docs handbook page for groups rides with the #533 no-IdP page.

**Shipped: v0.6.199 (backend) + v0.6.200 (UI), PR #551, live on both dogfoods.** **Backend (v0.6.199, red witnessed on the runner before implementation):** - `auth.GroupStore` at `/data/.cairn/groups.json` — statestore-bound like local-users, internal ids (decision 2), case-insensitive single namespace, idempotent membership ops, sorted listings. - `WithAppGroups` merges membership into `User.Groups` on every authentication, under the admin flag and above live groups — so an app group can be the admin group, and a live IdP refresh never drops app groups. - `/api/v1/admin/groups`: CRUD + rename, bulk member add with per-name `{added, invalid}` reporting (the oCIS lesson), directory listing (`spaces.Manager.ListGroups` via the IdP admin client; known-names fallback flagged `dirSource: "seen"`), per-group directory member drill-in. Creating or renaming onto a known directory name → 409 (decision 1). Delete fails closed (decision 3) — references in peering lists and the admin group simply stop matching; nothing else is mutated. - Peering group resolution consults app groups first, then the IdP: **group-based peering allow-lists now work with no IdP client at all** when the group is app-owned. Audit verbs `group-create/-rename/-remove/-member-add/-member-remove` (registry group `users`). **Frontend (v0.6.200):** Access · **Accounts** · **Groups** · Seats. Access slimmed to identity wiring + counters, Administrators section removed (decision 4). Accounts: both lists moved intact, one filter (name substring / `admin` / app-group name — typing a group shows its members), account rows show their app groups, directory list pages 25 at a time. Groups: app-owned CRUD with chip member editing, comma-separated bulk add, reference counts on rows and in the delete confirm; directory groups read-only with live listing where the admin client exists, and the honest "names seen so far" note where it doesn't; hidden entirely in pure local mode. Deep links `#admin/users/accounts` and `#admin/users/groups`. i18n ×4, #389 fence gate green. **Verification so far:** full `go test ./...` green; both pods booted clean on v0.6.200; fence gate + `node --check` on the shipped page. The signed-in admin views need a human session (redeploy cleared sessions) — **Nikola's checklist:** 1. `#admin/users` — four tabs; Access shows wiring rows only, no Administrators list. 2. Accounts — both lists present, filter by a name, by `admin`, and by a group name once one exists; create/reset/role/remove still work. 3. Groups — create `project-rhine` with a member; check the members chip editor, bulk add with a junk name (per-name report), rename, delete confirm showing references; directory section shows keycloak groups with View members (files-bao has the admin client). 4. Peering: add an app group to a receiver list on one side — should resolve without warnings. Known follow-ups (not blocking): the peering "group lists need the IdP admin client" copy predates app groups and could soften; space names appear among directory groups (they ARE Keycloak groups) — a "space" badge would help; docs handbook page for groups rides with the #533 no-IdP page.
Cordy commented 2026-09-14 22:47:20 +00:00
Author
Owner
Copy link

Fix round + docs shipped.

v0.6.201 (PR #553, live on both dogfoods, clean boot with groups.json in the 19 statestore files): all five dogfood findings from Nikola's screenshots — Group/Members/Used-by columns with headers on both tables, View members now toggles instead of appending, New group / Add local user at mockup size beside the filter, surface-background inputs, inline duplicate-name message in the dialogs instead of the hidden 409 — plus the two ship-note follow-ups: Space marker on directory groups that are Cairn spaces (owner attribute + -ro twins, flagged through spaces.ListGroups with a test) and the peering receiver copy rewritten now that app-owned groups resolve without the IdP admin client. Deeper polish is parked in #552 (v0.7).

Docs run (PR #554, merged): the handbook was current through v0.6.178 — now aligned through v0.6.201. New pages local-accounts.md (the no-IdP story, Manuel's #533 request) and groups.md; users-access.md rewritten for four tabs; peering.md, index.md, README, ARCHITECTURE (§5.1 + new §5.5), encryption.md (#528 custody lifecycle) and file-browser.md (#389 phone section) all updated.

Remaining on this issue: nothing backend/UI — Nikola's live pass on v0.6.201 (columns, toggle, inline 409, Space markers) decides whether this closes.

**Fix round + docs shipped.** **v0.6.201** (PR #553, live on both dogfoods, clean boot with `groups.json` in the 19 statestore files): all five dogfood findings from Nikola's screenshots — Group/Members/Used-by columns with headers on both tables, View members now toggles instead of appending, New group / Add local user at mockup size beside the filter, surface-background inputs, inline duplicate-name message in the dialogs instead of the hidden 409 — plus the two ship-note follow-ups: **Space** marker on directory groups that are Cairn spaces (owner attribute + `-ro` twins, flagged through `spaces.ListGroups` with a test) and the peering receiver copy rewritten now that app-owned groups resolve without the IdP admin client. Deeper polish is parked in **#552** (v0.7). **Docs run** (PR #554, merged): the handbook was current through v0.6.178 — now aligned through v0.6.201. New pages `local-accounts.md` (the no-IdP story, Manuel's #533 request) and `groups.md`; `users-access.md` rewritten for four tabs; `peering.md`, `index.md`, README, ARCHITECTURE (§5.1 + new §5.5), `encryption.md` (#528 custody lifecycle) and `file-browser.md` (#389 phone section) all updated. Remaining on this issue: nothing backend/UI — Nikola's live pass on v0.6.201 (columns, toggle, inline 409, Space markers) decides whether this closes.
Cordy commented 2026-09-16 01:22:14 +00:00
Author
Owner
Copy link

Closing — feature complete and live.

Shipped across v0.6.199 (backend) → v0.6.206 (last fidelity round), all live on both dogfoods:

  • v0.6.199 — auth.GroupStore, WithAppGroups, full /api/v1/admin/groups CRUD, single-namespace 409, fail-closed delete, five audit verbs, group-based peering allow-lists resolving without an IdP admin client.
  • v0.6.200 — Access · Accounts · Groups · Seats; Access slimmed to identity wiring; Administrators section removed.
  • v0.6.201 — dogfood round 1: column headers, View-members toggle, toolbar sizing, inline duplicate-name message, Space markers on directory groups, peering copy rewritten.
  • v0.6.202 — house-style table headers, lock treatment, pagination with 25/50/100 page size, delete dialog per mockup.
  • v0.6.203 — lock beside the heading, mockup member panel with dashed directory chips, danger-button style de-scoped so it applies globally.
  • v0.6.206 — initial-circle avatars, one badge family, "Cairn role" header.

Docs: docs/handbook/groups.md and local-accounts.md written, users-access.md rewritten for four tabs (PR #554).

Remaining polish is tracked in #552 — live collision preview while typing, and an empty/degraded-state review against mockup variant D. The Used-by share count is tracked in #529, where it belongs: the column can only gain a real number once sharing can address a group.

**Closing — feature complete and live.** Shipped across v0.6.199 (backend) → v0.6.206 (last fidelity round), all live on both dogfoods: - **v0.6.199** — `auth.GroupStore`, `WithAppGroups`, full `/api/v1/admin/groups` CRUD, single-namespace 409, fail-closed delete, five audit verbs, group-based peering allow-lists resolving without an IdP admin client. - **v0.6.200** — Access · Accounts · Groups · Seats; Access slimmed to identity wiring; Administrators section removed. - **v0.6.201** — dogfood round 1: column headers, View-members toggle, toolbar sizing, inline duplicate-name message, Space markers on directory groups, peering copy rewritten. - **v0.6.202** — house-style table headers, lock treatment, pagination with 25/50/100 page size, delete dialog per mockup. - **v0.6.203** — lock beside the heading, mockup member panel with dashed directory chips, danger-button style de-scoped so it applies globally. - **v0.6.206** — initial-circle avatars, one badge family, "Cairn role" header. Docs: `docs/handbook/groups.md` and `local-accounts.md` written, `users-access.md` rewritten for four tabs (PR #554). Remaining polish is tracked in **#552** — live collision preview while typing, and an empty/degraded-state review against mockup variant D. The Used-by share count is tracked in **#529**, where it belongs: the column can only gain a real number once sharing can address a group.
Cordy closed this issue 2026-09-16 01:22:17 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fix-escguard
fix-vard
fix-middot
fix-552d
fix-552c
fix-543
scout-tf
v0.6.265
v0.6.264
v0.6.263
v0.6.262
v0.6.261
v0.6.260
v0.6.259
v0.6.258
v0.6.257
v0.6.256
v0.6.255
v0.6.254
v0.6.253
v0.6.252
v0.6.251
v0.6.250
v0.6.249
v0.6.248
v0.6.247
v0.6.246
v0.6.245
v0.6.244
v0.6.243
v0.6.242
v0.6.241
v0.6.240
v0.6.239
v0.6.238
v0.6.237
v0.6.236
v0.6.235
v0.6.234
v0.6.233
v0.6.232
v0.6.231
v0.6.230
v0.6.229
v0.6.228
v0.6.227
v0.6.226
v0.6.225
v0.6.224
v0.6.223
v0.6.222
v0.6.221
v0.6.220
v0.6.219
v0.6.218
v0.6.217
v0.6.216
v0.6.215
v0.6.214
v0.6.213
v0.6.212
v0.6.211
v0.6.210
v0.6.209
v0.6.208
v0.6.207
v0.6.206
v0.6.205
v0.6.204
v0.6.203
v0.6.202
v0.6.201
v0.6.200
v0.6.199
v0.6.198
v0.6.197
v0.6.196
v0.6.195
v0.6.194
v0.6.193
v0.6.192
v0.6.191
v0.6.190
v0.6.189
v0.6.188
v0.6.187
v0.6.186
v0.6.185
v0.6.184
v0.6.183
v0.6.182
v0.6.181
v0.6.180
v0.6.179
v0.6.178
v0.6.177
v0.6.176
v0.6.175
v0.6.174
v0.6.173
v0.6.172
v0.6.171
v0.6.170
v0.6.169
v0.6.168
v0.6.167
v0.6.166
v0.6.165
v0.6.164
v0.6.163
v0.6.162
v0.6.161
v0.6.160
v0.6.159
v0.6.158
v0.6.157
v0.6.156
v0.6.155
v0.6.154
v0.6.153
v0.6.152
v0.6.151
v0.6.150
v0.6.149
v0.6.148
v0.6.147
v0.6.146
v0.6.145
v0.6.144
v0.6.143
v0.6.142
v0.6.141
v0.6.140
v0.6.139
v0.6.138
v0.6.137
v0.6.136
v0.6.135
v0.6.134
v0.6.133
v0.6.132
v0.6.131
v0.6.130
v0.6.129
v0.6.128
v0.6.127
v0.6.126
v0.6.125
v0.6.124
v0.6.123
v0.6.122
v0.6.121
v0.6.120
v0.6.119
v0.6.118
v0.6.117
v0.6.116
v0.6.115
v0.6.114
v0.6.113
v0.6.112
v0.6.111
v0.6.110
v0.6.109
v0.6.108
v0.6.107
v0.6.106
v0.6.105
v0.6.104
v0.6.103
v0.6.102
v0.6.101
v0.6.100
v0.6.99
v0.6.98
v0.6.97
v0.6.96
v0.6.95
v0.6.94
v0.6.93
v0.6.92
v0.6.91
v0.6.90
v0.6.89
v0.6.88
v0.6.87
v0.6.86
v0.6.85
v0.6.84
v0.6.83
v0.6.82
v0.6.81
v0.6.80
v0.6.79
v0.6.78
v0.6.77
v0.6.76
v0.6.75
v0.6.74
v0.6.73
v0.6.72
v0.6.71
v0.6.70
v0.6.69
v0.6.68
v0.6.67
v0.6.66
v0.6.65
v0.6.64
v0.6.63
v0.6.62
v0.6.61
v0.6.60
v0.6.59
v0.6.58
v0.6.57
v0.6.56
v0.6.55
v0.6.54
v0.6.53
v0.6.52
v0.6.51
v0.6.50
v0.6.49
v0.6.48
v0.6.47
v0.6.46
v0.6.45
v0.6.44
v0.6.43
v0.6.42
v0.6.41
v0.6.40
v0.6.39
v0.6.38
v0.6.37
v0.6.36
v0.6.35
v0.6.34
v0.6.33
v0.6.32
v0.6.31
v0.6.30
v0.6.29
v0.6.28
v0.6.25
v0.6.24
v0.6.23
v0.6.22
v0.6.21
v0.6.20
v0.6.19
v0.6.18
v0.6.17
v0.6.16
v0.6.15
v0.6.14
v0.6.12
v0.6.11
v0.6.10
v0.6.9
v0.6.8
v0.6.7
v0.6.6
v0.6.5
v0.6.4
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.7
v0.5.6
v0.5.5
v0.5.4
v0.5.3
v0.5.2
v0.5.1
v0.5.0
v0.4.12
v0.4.11
v0.4.10
v0.4.9
v0.4.8
v0.4.7
v0.4.6
v0.4.5
v0.4.4
v0.4.3
v0.4.2
v0.4.1
v0.3.30
v0.3.29
v0.3.28
v0.3.27
v0.3.26
v0.3.25
v0.3.24
v0.3.23
v0.3.22
v0.3.21
v0.3.20
v0.3.19
v0.3.18
v0.3.17
v0.3.16
v0.3.15
v0.3.14
v0.3.13
v0.3.12
v0.3.11
v0.3.10
v0.3.9
v0.3.8
v0.3.7
v0.3.6
v0.3.5
v0.3.4
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.7
v0.2.6
v0.2.5
v0.2.4
v0.2.3
v0.2.2
v0.2.1
v0.2.0
v0.0.3
v0.0.2
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
v0.7 — Closed beta (dogfood + hardening)
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#550
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?