M:M User and Group Relationship #1174

tankerkiller125 · 2025-12-27T01:20:46Z

What type of PR is this?

feature

What this PR does / why we need it:

Summary

This migration converts the User-Group relationship from 1:M (one group per user) to M:M (users can belong to multiple groups) while introducing multi-tenant support via the X-Tenant header.

Schema Changes

1. User Entity (`backend/internal/data/ent/schema/user.go`)

Removed:

GroupMixin{ref: "users"} from Mixin slice

Added:

default_group_id field (UUID, optional, nullable) - tracks user's primary tenant
M:M edge to Group: edge.To("groups", Group.Type)

// Fields added
field.UUID("default_group_id", uuid.UUID{}).
    Optional().
    Nillable(),

// Edges added
edge.To("groups", Group.Type),

2. Group Entity (`backend/internal/data/ent/schema/group.go`)

Changed:

Users edge from owned (1:M) to M:M relationship
Changed from: owned("users", User.Type)
Changed to: edge.To("users", User.Type)

Database Migrations

SQLite3 Migration (`20251226000000_user_group_m2m.sql`)

Creates junction table: user_groups with composite primary key
Migrates data: Copies existing group_users values to junction table
Adds column: default_group_id to users table
Sets defaults: Initializes default_group_id from current group
Removes old FK: Drops group_users foreign key column

Rollback:

Recreates original schema with group_users foreign key
Populates from junction table using default_group_id as fallback

PostgreSQL Migration (`20251226000000_user_group_m2m.sql`)

Equivalent migration with PostgreSQL-specific syntax:

Uses CASCADE and NO ACTION for FK constraints
Drops constraints by name: users_groups_users
Handles nullable default_group_id with SET NULL

Code Changes

1. Repository Layer (`backend/internal/data/repo/repo_users.go`)

UserCreate struct:

DefaultGroupID uuid.UUID `json:"defaultGroupID"`  // was: GroupID

UserOut struct:

DefaultGroupID uuid.UUID   `json:"defaultGroupId"`  // was: GroupID
GroupIDs       []uuid.UUID `json:"groupIds"`       // was: GroupName

Query updates:

GetOneID(): .WithGroups() instead of .WithGroup()
GetOneEmail(): .WithGroups() instead of .WithGroup()
GetAll(): .WithGroups() instead of .WithGroup()
GetOneOIDC(): .WithGroups() instead of .WithGroup()

Create methods:

Use SetDefaultGroupID(usr.DefaultGroupID) instead of SetGroupID()
Add user to group via .AddGroupIDs(usr.DefaultGroupID)

2. Services Layer

service_user.go:

Updated UserCreate instantiation to use DefaultGroupID instead of GroupID
Uses DefaultGroupID for creating default labels/locations

service_group.go:

Removed automatic group name defaulting (no longer single group per user)
Now requires explicit group name in UpdateGroup

3. Context Management (`backend/internal/core/services/contexts.go`)

Context struct:

type Context struct {
    UID uuid.UUID  // User ID
    GID uuid.UUID  // Active tenant (from X-Tenant header or user's default)
    // User is the acting user with DefaultGroupID and GroupIDs
}

New functions:

UseTenantCtx(ctx) - retrieves active tenant from context
SetTenantCtx(ctx, tenantID) - sets active tenant in context
ContextTenant - context key for tenant

4. Middleware (`backend/app/api/middleware.go`)

New mwTenant middleware:

Parses X-Tenant header (optional)
Validates user has access to requested tenant
Falls back to user's DefaultGroupID if header not provided
Returns 403 Forbidden if user lacks access
Returns 400 Bad Request if header format is invalid
Sets tenant in context for use by services

Route integration:

userMW := []errchain.Middleware{
    a.mwAuthToken,
    a.mwTenant,  // NEW
    a.mwRoles(...),
}

5. API Handlers

Updated references from GroupID/GroupName to DefaultGroupID:

v1_ctrl_items.go: CSV import
v1_ctrl_reporting.go: Bill of materials export
demo.go: Demo setup CSV import

Usage

Default Behavior (No X-Tenant Header)

All requests use the user's DefaultGroupID as the active tenant.

curl -H "Authorization: Bearer TOKEN" \
     https://api.example.com/api/v1/groups/statistics

Multi-Tenant Requests (With X-Tenant Header)

Explicitly switch to a different tenant group.

curl -H "Authorization: Bearer TOKEN" \
     -H "X-Tenant: 550e8400-e29b-41d4-a716-446655440000" \
     https://api.example.com/api/v1/groups/statistics

Response codes:

400 - Invalid X-Tenant UUID format
403 - User not member of requested tenant
200 - Success (tenant switched)

Backward Compatibility

✅ Existing clients continue working without modification:

Requests without X-Tenant header automatically use user's DefaultGroupID
All existing data is preserved during migration
User-group relationships migrated to junction table

Testing Recommendations

Migration Safety:
- Verify data integrity before/after migration
- Test rollback path
- Check both SQLite3 and PostgreSQL
Multi-Tenant Features:
- User with multiple groups can switch between them
- Access control validates group membership
- Invalid tenant IDs return 403 Forbidden
Backward Compatibility:
- Single-group users work without X-Tenant header
- X-Tenant header is optional
Default Group:
- First group user creates/joins becomes default
- Default is used when X-Tenant header absent

Generated Code

After running go generate ./... in backend/internal/data:

User entity includes DefaultGroupID field
User has M:M relationship methods: AddGroupIDs(), QueryGroups(), etc.
Group has M:M relationship methods: AddUserIDs(), QueryUsers(), etc.

Which issue(s) this PR fixes:

Implements part of #760

Special notes for your reviewer:

Still working on this.

Testing

Will need to validate tenant switching works properly, users can't force a tenant they don't belong to, etc.

- Introduced `default_group_id` field in the User model to manage user group defaults. - Updated user creation and update logic to utilize the new default group ID. - Implemented a many-to-many relationship between users and groups via a new `user_groups` junction table. - Refactored relevant queries and middleware to support tenant-based access using the default group.

coderabbitai · 2025-12-27T01:20:52Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch mk/multi-groups

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cloudflare-workers-and-pages · 2025-12-28T16:42:58Z

Deploying homebox-docs with Cloudflare Pages

Latest commit:	`24a49dd`
Status:	✅ Deploy successful!
Preview URL:	https://6e78f314.homebox-docs.pages.dev
Branch Preview URL:	https://mk-multi-groups.homebox-docs.pages.dev

View logs

# Conflicts: # backend/internal/data/repo/repo_items_test.go

tonyaellie · 2026-01-03T16:49:30Z

frontend/stores/collection.ts

not sure about having this be a store, might be better not to

Not sure on this one either, I'm no vue expert.

tonyaellie · 2026-01-03T16:50:51Z

frontend/components/Collection/Selector.vue

+    >
+      <Command :ignore-filter="true">
+        <CommandGroup>
+          <CommandItem as-child value="collection-settings">


settings should prob be below create and join

…roups

… old store

…roups

Merge branch 'main' into mk/multi-groups

70adb00

tankerkiller125 and others added 14 commits December 28, 2025 11:50

Fix Sqlite migration (or at least make sure it doesn't wipe things

3fcb1cc

The basics of the app are working again now

9f5095a

Forgot to update the API stuff and data-contracts.ts

f3b4c0c

Fix golang test

74bdaa4

New API endpoints for basic group management

ab9b821

Merge remote-tracking branch 'origin/main' into mk/multi-groups

825eda0

# Conflicts: # backend/internal/data/repo/repo_items_test.go

Add member management routes

6c4ce49

Fix some tests

e6c1a5a

Go lint things

301098b

Fix front-end tests for groups

2e5a2c9

Merge branch 'main' into mk/multi-groups

6dc801d

fix: ensure all groups only returns groups user is part of

6a1539a

Add the swagger/openapi stuff

22a9451

feat: begin adding frontend for collection

091d8ad

tonyaellie reviewed Jan 3, 2026

View reviewed changes

tonyaellie and others added 10 commits January 3, 2026 17:18

fix: collection id being wrong causes big problems

3077d43

Lets try this for the new tenant switching and events.

2bbd93e

Merge remote-tracking branch 'origin/mk/multi-groups' into mk/multi-g…

e8dd14a

…roups

Adds invitation acceptance and deletion endpoints

a75b498

Return information about group after accepting invitation

557383a

Forgot the swag stuff

24a49dd

feat: join collection

4fdb060

feat: customize group name during creation

adaf719

feat: refactor collection management to use new composable and remove…

7c1ac46

… old store

chore: make sure users can't join group they already exist in

a8ca8e8

tankerkiller125 and others added 4 commits January 4, 2026 12:54

Merge remote-tracking branch 'origin/mk/multi-groups' into mk/multi-g…

b006e9d

…roups

weird merge issue or something?

443a442

feat: begin adding collection pages

4d3f3f7

feat: implement collection options pages

a1dfdbf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

M:M User and Group Relationship #1174

M:M User and Group Relationship #1174

Uh oh!

tankerkiller125 commented Dec 27, 2025

Uh oh!

coderabbitai bot commented Dec 27, 2025

Review skipped

Uh oh!

cloudflare-workers-and-pages bot commented Dec 28, 2025 •

edited

Loading

Uh oh!

tonyaellie Jan 3, 2026

Uh oh!

tankerkiller125 Jan 3, 2026

Uh oh!

tonyaellie Jan 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

M:M User and Group Relationship #1174

Are you sure you want to change the base?

M:M User and Group Relationship #1174

Uh oh!

Conversation

tankerkiller125 commented Dec 27, 2025

What type of PR is this?

What this PR does / why we need it:

Summary

Schema Changes

1. User Entity (backend/internal/data/ent/schema/user.go)

2. Group Entity (backend/internal/data/ent/schema/group.go)

Database Migrations

SQLite3 Migration (20251226000000_user_group_m2m.sql)

PostgreSQL Migration (20251226000000_user_group_m2m.sql)

Code Changes

1. Repository Layer (backend/internal/data/repo/repo_users.go)

2. Services Layer

3. Context Management (backend/internal/core/services/contexts.go)

4. Middleware (backend/app/api/middleware.go)

5. API Handlers

Usage

Default Behavior (No X-Tenant Header)

Multi-Tenant Requests (With X-Tenant Header)

Backward Compatibility

Testing Recommendations

Generated Code

Which issue(s) this PR fixes:

Special notes for your reviewer:

Testing

Uh oh!

coderabbitai bot commented Dec 27, 2025

Review skipped

Uh oh!

cloudflare-workers-and-pages bot commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying homebox-docs with Cloudflare Pages

Uh oh!

tonyaellie Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

tankerkiller125 Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

tonyaellie Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

1. User Entity (`backend/internal/data/ent/schema/user.go`)

2. Group Entity (`backend/internal/data/ent/schema/group.go`)

SQLite3 Migration (`20251226000000_user_group_m2m.sql`)

PostgreSQL Migration (`20251226000000_user_group_m2m.sql`)

1. Repository Layer (`backend/internal/data/repo/repo_users.go`)

3. Context Management (`backend/internal/core/services/contexts.go`)

4. Middleware (`backend/app/api/middleware.go`)

cloudflare-workers-and-pages bot commented Dec 28, 2025 •

edited

Loading