feat(peering): receivers in admin API/UI, inbound group resolution, group-only warning (#129) #139

Merged

Cordy merged 1 commit from feat/peering-receivers-129 into main

2026-08-08 23:42:28 +00:00

Cordy commented

2026-08-08 23:42:14 +00:00

Owner

Closes #129.

Bigger than filed: the receivers allowlist (#123) existed only in the registry — addPeer never decoded it, listPeers never returned it, the panel had no fields for it, and peerRecipients passed nil groups unconditionally, so a group-based receivers list matched nobody on every instance, admin client or not.

Server:

addPeer decodes receivers {users, groups} and stores it; listPeers returns each peer's receivers plus a top-level groupsLive capability bit (spacesMgr != nil — the Keycloak admin client).
peerRecipients gains a groups hook wired to spaces.Manager.UserGroups when the admin client is configured — inbound group resolution now actually works (natural completion of #123). Without the client the hook is nil and group lists keep failing closed.
New test TestAddPeerRoundTripsReceivers: round-trip, groupsLive presence, group receiver honoured with groups, group-only list matches nobody without them.

Panel:

The register form gains captioned sections — "May send to this peer" / "May receive from this peer" — each with Users/Groups fields, plus a fail-closed hint for receivers.
Saving a group-only receivers list on an instance without the admin client shows the #129 warning: saved, but it matches nobody until the Keycloak admin client is configured.
Peer rows now show both directions: send: zeus321 · receive: staff (group).
Fixes a latent unparsed-Response bug in the peers list render (same class as #136; never seen because no peer had been registered yet).

Green on branch: gofmt/vet, full go test ./... incl. the new test, node --check both blocks. Removes the three scout workflows.

Closes #129. **Bigger than filed:** the receivers allowlist (#123) existed only in the registry — `addPeer` never decoded it, `listPeers` never returned it, the panel had no fields for it, and `peerRecipients` passed `nil` groups unconditionally, so a group-based receivers list matched nobody on *every* instance, admin client or not. **Server:** - `addPeer` decodes `receivers {users, groups}` and stores it; `listPeers` returns each peer's receivers plus a top-level `groupsLive` capability bit (`spacesMgr != nil` — the Keycloak admin client). - `peerRecipients` gains a `groups` hook wired to `spaces.Manager.UserGroups` when the admin client is configured — inbound group resolution now actually works (natural completion of #123). Without the client the hook is nil and group lists keep failing closed. - New test `TestAddPeerRoundTripsReceivers`: round-trip, `groupsLive` presence, group receiver honoured with groups, group-only list matches nobody without them. **Panel:** - The register form gains captioned sections — "May send to this peer" / "May receive from this peer" — each with Users/Groups fields, plus a fail-closed hint for receivers. - Saving a **group-only** receivers list on an instance without the admin client shows the #129 warning: saved, but it matches nobody until the Keycloak admin client is configured. - Peer rows now show both directions: `send: zeus321 · receive: staff (group)`. - Fixes a latent unparsed-`Response` bug in the peers list render (same class as #136; never seen because no peer had been registered yet). Green on branch: gofmt/vet, full `go test ./...` incl. the new test, `node --check` both blocks. Removes the three scout workflows.

Cordy added 1 commit

2026-08-08 23:42:16 +00:00