admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/admin.go

@@ -100,12 +100,16 @@ func (h *AdminHandler) CreateUser(c *gin.Context) {
 		return
 	}
 
+	// Sync Admins group membership with assigned role.
+	auth.SyncAdminsGroupMembership(c.Request.Context(), h.stores, user.ID, role)
+
 	h.auditLog(c, "user.create", "user", user.ID, nil)
 	c.JSON(http.StatusCreated, user)
 }
 
 func (h *AdminHandler) UpdateUserRole(c *gin.Context) {
 	id := c.Param("id")
+	ctx := c.Request.Context()
 	var req struct {
 		Role string `json:"role" binding:"required"`
 	}
@@ -114,27 +118,30 @@ func (h *AdminHandler) UpdateUserRole(c *gin.Context) {
 		return
 	}
 
-	// Guard: prevent demoting the last admin
-	if req.Role != models.UserRoleAdmin {
-		user, err := h.stores.Users.GetByID(c.Request.Context(), id)
-		if err != nil || user == nil {
-			c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+	user, err := h.stores.Users.GetByID(ctx, id)
+	if err != nil || user == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+		return
+	}
+
+	// Guard: prevent demoting the last admin.
+	// Count Admins group members — the source of truth for admin access.
+	if req.Role != models.UserRoleAdmin && user.Role == models.UserRoleAdmin {
+		members, _ := h.stores.Groups.ListMembers(ctx, auth.AdminsGroupID)
+		if len(members) <= 1 {
+			c.JSON(http.StatusConflict, gin.H{"error": "cannot demote the last admin"})
 			return
 		}
-		if user.Role == models.UserRoleAdmin {
-			adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-			if adminCount <= 1 {
-				c.JSON(http.StatusConflict, gin.H{"error": "cannot demote the last admin"})
-				return
-			}
-		}
 	}
 
-	if err := h.stores.Users.Update(c.Request.Context(), id, map[string]interface{}{"role": req.Role}); err != nil {
+	if err := h.stores.Users.Update(ctx, id, map[string]interface{}{"role": req.Role}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update role"})
 		return
 	}
 
+	// Sync Admins group membership with role change.
+	auth.SyncAdminsGroupMembership(ctx, h.stores, id, req.Role)
+
 	h.auditLog(c, "user.role_change", "user", id, gin.H{"role": req.Role})
 	if h.onUserChanged != nil {
 		h.onUserChanged(id)
@@ -254,8 +261,8 @@ func (h *AdminHandler) DeleteUser(c *gin.Context) {
 		return
 	}
 	if user.Role == models.UserRoleAdmin {
-		adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-		if adminCount <= 1 {
+		members, _ := h.stores.Groups.ListMembers(c.Request.Context(), auth.AdminsGroupID)
+		if len(members) <= 1 {
 			c.JSON(http.StatusConflict, gin.H{"error": "cannot delete the last admin"})
 			return
 		}