Replace is_wizard with more generic groups

auth/api.py

@@ -21,7 +21,8 @@ def me():
         name=request.oauth.user.name,
         is_subscribed=request.oauth.user.has_active_sub,
         scopes=request.oauth.scopes,
-        is_wizard=request.oauth.user.is_wizard,
+        is_wizard='wizard' in request.oauth.user.groups,
+        groups=request.oauth.user.groups,
         has_timeline=request.oauth.user.has_timeline,
         timeline_ttl=request.oauth.user.timeline_ttl,
         boot_overrides=request.oauth.user.boot_overrides

auth/discourse.py

@@ -50,7 +50,7 @@ def sso_redirect_url(nonce, user):
         'username': user.username
     }
 
-    if user.is_wizard:
+    if 'wizard' in user.groups:
         attributes['admin'] = 'true'
 
     add_groups = []

auth/models.py

@@ -29,6 +29,7 @@ class User(UserMixin, db.Model):
     stripe_subscription_id = db.Column(db.String, nullable=True, index=True)
     subscription_expiry = db.Column(db.DateTime, nullable=True)
     is_wizard = db.Column(db.Boolean, server_default='false')
+    groups = db.Column(ARRAY(db.String), nullable=False, server_default='{}')
     boot_overrides = db.Column(JSONB)
     audio_debug_mode = db.Column(db.DateTime, nullable=True)
     username = db.Column(db.String(24), unique=True, index=True)
@@ -39,7 +40,7 @@ def has_active_sub(self):
 
     @property
     def has_timeline(self):
-        return self.is_wizard or self.has_active_sub or \
+        return 'wizard' in self.groups or self.has_active_sub or \
                (datetime.datetime.utcnow() > (NONSUBSCRIBER_ROLLOUT_START + datetime.timedelta(seconds = self.id * 2)))
 
     @property

auth/wizard/__init__.py

@@ -18,7 +18,7 @@ def format_datetime(value, format='%B %-d %Y, %H:%M:%S'):
     return value.strftime(format)
 
 def ensure_wizard():
-    if not current_user.is_wizard:
+    if not 'wizard' in current_user.groups:
         abort(401, 'Hmm... how did you get here?')
 
 def audit(str):
@@ -181,7 +181,8 @@ def make_wizard(idp_name, idp_user_id):
     identity = UserIdentity.query.filter_by(idp=idp_name, idp_user_id=idp_user_id).one()
     user = identity.user
 
-    user.is_wizard = True    
+    if not 'wizard' in user.group:
+        user.groups = user.groups.append('wizard')
     db.session.commit()
 
     print(f"Ok, made {user.name} <{user.email}> a wizard.")

migrations/versions/3ebafc557e02_add_groups_array_to_user.py

@@ -0,0 +1,29 @@
+"""Add groups array to User
+
+Revision ID: 3ebafc557e02
+Revises: 29e40065e295
+Create Date: 2026-02-26 11:30:18.088070
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = '3ebafc557e02'
+down_revision = '29e40065e295'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column('users', sa.Column('groups', postgresql.ARRAY(sa.String()), server_default='{}', nullable=False))
+    op.execute("UPDATE users SET groups = ARRAY['wizard'] WHERE is_wizard = true")
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('users', 'groups')
+    # ### end Alembic commands ###