AI-1065 Frontend Group Management (#51)

Author: dbarkowsky

.github/workflows/frontend-qa.yml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   test-and-lint:
-    name: Linting
+    name: Test and Lint
     runs-on: ubuntu-latest
     outputs:
       environment: ${{ steps.env.outputs.environment }}

apps/backend-services/src/api-key/api-key.controller.ts

@@ -87,8 +87,7 @@ export class ApiKeyController {
     @Req() req: Request,
     @Body() body: GenerateApiKeyRequestDto,
   ): Promise<{ apiKey: GeneratedApiKeyDto }> {
-    const user = req.user;
-    const userId = user?.sub as string;
+    const userId = req.resolvedIdentity?.userId ?? "";
     if (!userId) {
       throw new BadRequestException(
         "User ID is required to generate an API key",
@@ -147,8 +146,7 @@ export class ApiKeyController {
     @Req() req: Request,
     @Body() body: ApiKeyByIdRequestDto,
   ): Promise<{ apiKey: GeneratedApiKeyDto }> {
-    const user = req.user;
-    const userId = user?.sub as string;
+    const userId = req.resolvedIdentity?.userId ?? "";
     if (!userId) {
       throw new BadRequestException(
         "User ID is required to regenerate an API key",

apps/backend-services/src/auth/auth.controller.spec.ts

@@ -1,3 +1,4 @@
+import { GroupRole } from "@generated/client";
 import { Test, TestingModule } from "@nestjs/testing";
 import { Request, Response } from "express";
 import { DatabaseService } from "../database/database.service";
@@ -38,6 +39,15 @@ describe("AuthController", () => {
       isUserSystemAdmin: jest.fn().mockResolvedValue(false),
     } as unknown as jest.Mocked<Pick<DatabaseService, "isUserSystemAdmin">>;
 
+    groupService = {
+      getUserGroups: jest.fn().mockResolvedValue([]),
+      getAllGroups: jest.fn().mockResolvedValue([]),
+    } as unknown as jest.Mocked<GroupService>;
+
+    databaseService = {
+      isUserSystemAdmin: jest.fn().mockResolvedValue(false),
+    } as unknown as jest.Mocked<Pick<DatabaseService, "isUserSystemAdmin">>;
+
     res = {
       redirect: jest.fn(),
       status: jest.fn().mockReturnThis(),
@@ -328,31 +338,36 @@ describe("AuthController", () => {
   });
 
   describe("getMe", () => {
-    it("should return user profile with groups from JWT payload", async () => {
+    it("should return user profile with isAdmin false and groups including role", async () => {
       const user: User = {
         sub: "user-123",
         name: "Test User",
         preferred_username: "testuser",
         email: "test@example.com",
-        roles: ["admin"],
         exp: Math.floor(Date.now() / 1000) + 3600,
       };
       req.user = user;
-      const userGroups = [{ id: "group-1", name: "Group One" }];
+      req.resolvedIdentity = { userId: user.sub };
+      const userGroups = [
+        { id: "group-1", name: "Group One", role: GroupRole.MEMBER },
+      ];
       groupService.getUserGroups.mockResolvedValue(userGroups);
 
       const result = await controller.getMe(req as Request);
 
       expect(databaseService.isUserSystemAdmin).toHaveBeenCalledWith(
         "user-123",
       );
-      expect(groupService.getUserGroups).toHaveBeenCalledWith("user-123");
+      expect(groupService.getUserGroups).toHaveBeenCalledWith(
+        "user-123",
+        "user-123",
+      );
       expect(result).toEqual({
         sub: "user-123",
         name: "Test User",
         preferred_username: "testuser",
         email: "test@example.com",
-        roles: ["admin"],
+        isAdmin: false,
         expires_in: expect.any(Number),
         groups: userGroups,
       });
@@ -363,10 +378,10 @@ describe("AuthController", () => {
     it("should return empty groups array for user with no memberships", async () => {
       const user: User = {
         sub: "user-456",
-        roles: [],
         exp: Math.floor(Date.now() / 1000) + 100,
       };
       req.user = user;
+      req.resolvedIdentity = { userId: user.sub };
       groupService.getUserGroups.mockResolvedValue([]);
 
       const result = await controller.getMe(req as Request);
@@ -375,47 +390,51 @@ describe("AuthController", () => {
       expect(result.name).toBeUndefined();
       expect(result.preferred_username).toBeUndefined();
       expect(result.email).toBeUndefined();
-      expect(result.roles).toEqual([]);
+      expect(result.isAdmin).toBe(false);
       expect(result.groups).toEqual([]);
     });
 
-    it("should return all groups for a system-admin user", async () => {
+    it("should return user groups with isAdmin true for a system-admin user", async () => {
       const user: User = {
         sub: "admin-user",
         name: "Admin User",
-        roles: ["system-admin"],
         exp: Math.floor(Date.now() / 1000) + 3600,
       };
       req.user = user;
-      const allGroups = [
-        { id: "group-1", name: "Group One" },
-        { id: "group-2", name: "Group Two" },
+      req.resolvedIdentity = { userId: user.sub };
+      const adminGroups = [
+        { id: "group-1", name: "Group One", role: GroupRole.ADMIN },
       ];
       (databaseService.isUserSystemAdmin as jest.Mock).mockResolvedValue(true);
-      groupService.getAllGroups.mockResolvedValue(allGroups);
+      groupService.getUserGroups.mockResolvedValue(adminGroups);
 
       const result = await controller.getMe(req as Request);
 
       expect(databaseService.isUserSystemAdmin).toHaveBeenCalledWith(
         "admin-user",
       );
-      expect(groupService.getAllGroups).toHaveBeenCalled();
-      expect(groupService.getUserGroups).not.toHaveBeenCalled();
-      expect(result.groups).toEqual(allGroups);
+      expect(groupService.getUserGroups).toHaveBeenCalledWith(
+        "admin-user",
+        "admin-user",
+      );
+      expect(groupService.getAllGroups).not.toHaveBeenCalled();
+      expect(result.isAdmin).toBe(true);
+      expect(result.groups).toEqual(adminGroups);
     });
 
     it("should return 0 expires_in if token is expired", async () => {
       const user: User = {
         sub: "user-789",
-        roles: [],
         exp: Math.floor(Date.now() / 1000) - 100, // expired
       };
       req.user = user;
+      req.resolvedIdentity = { userId: user.sub };
 
       const result = await controller.getMe(req as Request);
 
       expect(result.expires_in).toBe(0);
       expect(result.groups).toEqual([]);
+      expect(result.groups).toEqual([]);
     });
   });
 });

apps/backend-services/src/auth/auth.controller.ts

@@ -264,40 +264,39 @@ export class AuthController {
   /**
    * Returns the authenticated user's profile information, including group memberships.
    * Requires a valid access_token cookie or Bearer token.
-   * The frontend uses this to display user info, schedule token refresh, and
-   * determine available groups without making an additional API call.
+   * The frontend uses this to display user info, schedule token refresh, determine
+   * system-admin status, and access available groups with per-group roles.
    * System-admin users receive all groups in the system.
    */
   @Get("me")
   @ApiOperation({
     summary: "Get current user profile from validated JWT",
     description:
-      "Returns the user's profile, token expiry, and group memberships. System-admins receive all groups.",
+      "Returns the user's profile, token expiry, system-admin status, and group memberships with per-group roles. System-admins receive all groups.",
   })
   @ApiOkResponse({
     type: MeResponseDto,
-    description: "Returns current user profile, token expiry, and groups",
+    description:
+      "Returns current user profile, token expiry, admin status, and groups with roles",
   })
   @ApiUnauthorizedResponse({ description: "Not authenticated" })
   @ApiForbiddenResponse({ description: "Invalid token" })
   async getMe(@Req() req: Request): Promise<MeResponseDto> {
     const user = req.user as User;
     const now = Math.floor(Date.now() / 1000);
     const exp = (user.exp as number) || now;
-    const userId = user.sub || "";
+    const userId = req.resolvedIdentity?.userId ?? "";
 
     const isAdmin = await this.databaseService.isUserSystemAdmin(userId);
-    const groups = isAdmin
-      ? await this.groupService.getAllGroups()
-      : await this.groupService.getUserGroups(userId);
+    const groups = await this.groupService.getUserGroups(userId, userId);
 
     return {
       sub: userId,
       name: (user.name as string) || (user.display_name as string),
       preferred_username:
         (user.preferred_username as string) || (user.idir_username as string),
       email: user.email,
-      roles: user.roles || [],
+      isAdmin,
       expires_in: Math.max(exp - now, 0),
       groups,
     };

apps/backend-services/src/auth/dto/me-response.dto.ts

@@ -1,3 +1,4 @@
+import { GroupRole } from "@generated/client";
 import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
 
 /**
@@ -10,6 +11,12 @@ export class GroupSummaryDto {
 
   @ApiProperty({ description: "Group display name" })
   name: string;
+
+  @ApiProperty({
+    description: "The authenticated user's role in this group",
+    enum: GroupRole,
+  })
+  role: GroupRole;
 }
 
 /**
@@ -32,10 +39,9 @@ export class MeResponseDto {
   email?: string;
 
   @ApiProperty({
-    description: "Normalized roles from Keycloak JWT",
-    type: [String],
+    description: "Whether the user has system-admin status in the database",
   })
-  roles: string[];
+  isAdmin: boolean;
 
   @ApiProperty({
     description: "Seconds until the current access token expires",

apps/backend-services/src/database/database.service.spec.ts

@@ -1334,21 +1334,20 @@ describe("DatabaseService", () => {
 
   describe("isUserSystemAdmin", () => {
     it("should return true when the user has the system-admin role", async () => {
-      mockPrisma.userRole = {
-        findFirst: jest
-          .fn()
-          .mockResolvedValueOnce({ user_id: "user-1", role_id: "role-1" }),
+      mockPrisma.user = {
+        findUnique: jest.fn().mockResolvedValueOnce({ is_system_admin: true }),
       };
       const result = await service.isUserSystemAdmin("user-1");
       expect(result).toBe(true);
-      expect(mockPrisma.userRole.findFirst).toHaveBeenCalledWith({
-        where: { user_id: "user-1", role: { name: "system-admin" } },
+      expect(mockPrisma.user.findUnique).toHaveBeenCalledWith({
+        where: { id: "user-1" },
+        select: { is_system_admin: true },
       });
     });
 
     it("should return false when the user does not have the system-admin role", async () => {
-      mockPrisma.userRole = {
-        findFirst: jest.fn().mockResolvedValueOnce(null),
+      mockPrisma.user = {
+        findUnique: jest.fn().mockResolvedValueOnce({ is_system_admin: false }),
       };
       const result = await service.isUserSystemAdmin("user-1");
       expect(result).toBe(false);

apps/backend-services/src/database/database.service.ts

@@ -372,19 +372,16 @@ export class DatabaseService {
   }
 
   /**
-   * Checks whether a user holds the `system-admin` role.
+   * Checks whether a user is a system admin.
    *
    * @param userId - The ID of the user to check.
-   * @returns `true` when the user has a UserRole record linked to a Role with
-   *   name `"system-admin"`, `false` otherwise.
+   * @returns `true` when the user has `is_system_admin` set to `true`, `false` otherwise.
    */
   async isUserSystemAdmin(userId: string): Promise<boolean> {
-    const entry = await this.prisma.userRole.findFirst({
-      where: {
-        user_id: userId,
-        role: { name: "system-admin" },
-      },
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { is_system_admin: true },
     });
-    return entry != null;
+    return user?.is_system_admin ?? false;
   }
 }

apps/backend-services/src/group/dto/create-group.dto.ts

@@ -0,0 +1,18 @@
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { IsNotEmpty, IsOptional, IsString } from "class-validator";
+
+/**
+ * DTO for creating a new group.
+ * The calling user must be a system admin. Identity is derived from the JWT token.
+ */
+export class CreateGroupDto {
+  @ApiProperty({ description: "The name of the group to create" })
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @ApiPropertyOptional({ description: "An optional description for the group" })
+  @IsString()
+  @IsOptional()
+  description?: string;
+}

apps/backend-services/src/group/dto/group-member.dto.ts

@@ -0,0 +1,15 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+/**
+ * Represents a single member of a group, returned by the GET /api/groups/:groupId/members endpoint.
+ */
+export class GroupMemberDto {
+  @ApiProperty({ description: "The user's unique identifier" })
+  userId: string;
+
+  @ApiProperty({ description: "The user's email address" })
+  email: string;
+
+  @ApiProperty({ description: "The date the user joined the group" })
+  joinedAt: Date;
+}

apps/backend-services/src/group/dto/group-membership-request.dto.ts

@@ -0,0 +1,42 @@
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+
+/**
+ * Represents a single group membership request, returned by the GET /api/groups/:groupId/requests endpoint.
+ */
+export class GroupMembershipRequestDto {
+  @ApiProperty({ description: "The unique identifier of the request" })
+  id: string;
+
+  @ApiProperty({ description: "The ID of the user who made the request" })
+  userId: string;
+
+  @ApiProperty({
+    description: "The email address of the user who made the request",
+  })
+  email: string;
+
+  @ApiProperty({ description: "The ID of the group the request is for" })
+  groupId: string;
+
+  @ApiProperty({
+    description: "The current status of the request",
+    enum: ["PENDING", "APPROVED", "DENIED", "CANCELLED"],
+  })
+  status: string;
+
+  @ApiPropertyOptional({
+    description: "The ID of the admin who acted on the request",
+  })
+  actorId?: string;
+
+  @ApiPropertyOptional({
+    description: "The reason provided when acting on the request",
+  })
+  reason?: string;
+
+  @ApiPropertyOptional({ description: "The date the request was resolved" })
+  resolvedAt?: Date;
+
+  @ApiProperty({ description: "The date the request was created" })
+  createdAt: Date;
+}