Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/admin.go

@@ -69,29 +69,25 @@ func (h *AdminHandler) CreateUser(c *gin.Context) {
 		Username string `json:"username" binding:"required"`
 		Email    string `json:"email" binding:"required"`
 		Password string `json:"password" binding:"required,min=8"`
-		Role     string `json:"role"`
+		IsAdmin  bool   `json:"is_admin"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
+	ctx := c.Request.Context()
 	hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcryptCost)
-	role := models.UserRoleUser
-	if req.Role == models.UserRoleAdmin {
-		role = models.UserRoleAdmin
-	}
 
 	user := &models.User{
 		Username:     strings.ToLower(req.Username),
 		Email:        strings.ToLower(req.Email),
 		PasswordHash: string(hash),
-		Role:         role,
 		IsActive:     true,
-		Handle:       auth.UniqueHandle(c.Request.Context(), h.stores.Users, models.HandleFromName(req.Username)),
+		Handle:       auth.UniqueHandle(ctx, h.stores.Users, models.HandleFromName(req.Username)),
 	}
 
-	if err := h.stores.Users.Create(c.Request.Context(), user); err != nil {
+	if err := h.stores.Users.Create(ctx, user); err != nil {
 		if database.IsUniqueViolation(err) {
 			c.JSON(http.StatusConflict, gin.H{"error": "username or email already exists"})
 			return
@@ -100,46 +96,55 @@ func (h *AdminHandler) CreateUser(c *gin.Context) {
 		return
 	}
 
+	auth.EnsureEveryoneGroup(ctx, h.stores, user.ID)
+	if req.IsAdmin {
+		auth.AddToAdminsGroup(ctx, h.stores, user.ID)
+	}
+
 	h.auditLog(c, "user.create", "user", user.ID, nil)
 	c.JSON(http.StatusCreated, user)
 }
 
 func (h *AdminHandler) UpdateUserRole(c *gin.Context) {
 	id := c.Param("id")
+	ctx := c.Request.Context()
 	var req struct {
-		Role string `json:"role" binding:"required"`
+		IsAdmin bool `json:"is_admin"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	// Guard: prevent demoting the last admin
-	if req.Role != models.UserRoleAdmin {
-		user, err := h.stores.Users.GetByID(c.Request.Context(), id)
-		if err != nil || user == nil {
-			c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
-			return
-		}
-		if user.Role == models.UserRoleAdmin {
-			adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-			if adminCount <= 1 {
-				c.JSON(http.StatusConflict, gin.H{"error": "cannot demote the last admin"})
-				return
-			}
-		}
-	}
-
-	if err := h.stores.Users.Update(c.Request.Context(), id, map[string]interface{}{"role": req.Role}); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update role"})
+	if _, err := h.stores.Users.GetByID(ctx, id); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
 		return
 	}
 
-	h.auditLog(c, "user.role_change", "user", id, gin.H{"role": req.Role})
+	if !req.IsAdmin {
+		// Guard: prevent removing the last admin from Admins group.
+		members, _ := h.stores.Groups.ListMembers(ctx, auth.AdminsGroupID)
+		isMember := false
+		for _, m := range members {
+			if m.UserID == id {
+				isMember = true
+				break
+			}
+		}
+		if isMember && len(members) <= 1 {
+			c.JSON(http.StatusConflict, gin.H{"error": "cannot remove the last admin"})
+			return
+		}
+		auth.RemoveFromAdminsGroup(ctx, h.stores, id)
+	} else {
+		auth.AddToAdminsGroup(ctx, h.stores, id)
+	}
+
+	h.auditLog(c, "user.role_change", "user", id, gin.H{"is_admin": req.IsAdmin})
 	if h.onUserChanged != nil {
 		h.onUserChanged(id)
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "role updated"})
+	c.JSON(http.StatusOK, gin.H{"message": "admin status updated"})
 }
 
 func (h *AdminHandler) ToggleUserActive(c *gin.Context) {
@@ -248,18 +253,22 @@ func (h *AdminHandler) DeleteUser(c *gin.Context) {
 	id := c.Param("id")
 
 	// Guard: prevent deleting the last admin
-	user, err := h.stores.Users.GetByID(c.Request.Context(), id)
-	if err != nil || user == nil {
+	if _, err := h.stores.Users.GetByID(c.Request.Context(), id); err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
 		return
 	}
-	if user.Role == models.UserRoleAdmin {
-		adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-		if adminCount <= 1 {
-			c.JSON(http.StatusConflict, gin.H{"error": "cannot delete the last admin"})
-			return
+	members, _ := h.stores.Groups.ListMembers(c.Request.Context(), auth.AdminsGroupID)
+	isAdmin := false
+	for _, m := range members {
+		if m.UserID == id {
+			isAdmin = true
+			break
 		}
 	}
+	if isAdmin && len(members) <= 1 {
+		c.JSON(http.StatusConflict, gin.H{"error": "cannot delete the last admin"})
+		return
+	}
 
 	// Destroy vault and personal BYOK keys before deleting the user row
 	h.destroyVault(c, id)

server/handlers/auth.go

@@ -32,7 +32,6 @@ const bcryptCost = 12
 type Claims struct {
 	UserID string `json:"user_id"`
 	Email  string `json:"email"`
-	Role   string `json:"role"`
 	jwt.RegisteredClaims
 }
 
@@ -295,7 +294,6 @@ func (h *AuthHandler) generateTokens(user *models.User) (gin.H, error) {
 	accessClaims := Claims{
 		UserID: user.ID,
 		Email:  user.Email,
-		Role:   user.Role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
@@ -327,7 +325,6 @@ func (h *AuthHandler) generateTokens(user *models.User) (gin.H, error) {
 			"username":     user.Username,
 			"email":        user.Email,
 			"display_name": user.DisplayName,
-			"role":         user.Role,
 			"handle":       user.Handle,
 			"auth_source":  user.AuthSource,
 		},
@@ -489,10 +486,9 @@ func BootstrapAdmin(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKC
 
 	existing, _ := s.Users.GetByUsername(ctx, cfg.AdminUsername)
 	if existing != nil {
-		// Update password and ensure admin role
+		// Update password
 		s.Users.Update(ctx, existing.ID, map[string]interface{}{
 			"password_hash": string(hash),
-			"role":          models.UserRoleAdmin,
 			"is_active":     true,
 		})
 		// If the actual password changed, the vault seal is stale. Probe it
@@ -507,6 +503,8 @@ func BootstrapAdmin(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKC
 			cache = uekCache[0]
 		}
 		ProbeAndRepairVault(ctx, s, existing.ID, cfg.AdminPassword, cache)
+		auth.EnsureEveryoneGroup(ctx, s, existing.ID)
+		auth.AddToAdminsGroup(ctx, s, existing.ID)
 		log.Printf("  ✅ Admin user '%s' updated", cfg.AdminUsername)
 		return
 	}
@@ -521,7 +519,6 @@ func BootstrapAdmin(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKC
 		Username:     strings.ToLower(cfg.AdminUsername),
 		Email:        strings.ToLower(email),
 		PasswordHash: string(hash),
-		Role:         models.UserRoleAdmin,
 		IsActive:     true,
 		AuthSource:   "builtin",
 		Handle:       handle,
@@ -531,12 +528,14 @@ func BootstrapAdmin(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKC
 		log.Printf("⚠ Failed to create admin user: %v", err)
 		return
 	}
+	auth.EnsureEveryoneGroup(ctx, s, user.ID)
+	auth.AddToAdminsGroup(ctx, s, user.ID)
 	log.Printf("  ✅ Admin user '%s' created", cfg.AdminUsername)
 }
 
 // SeedUsers creates or updates users from the SEED_USERS env var.
-// Format: "user:pass:role,user2:pass2:role2" where role is "admin" or "user".
-// Upsert: existing users get their password and role refreshed on every restart.
+// Format: "user:pass[:admin],user2:pass2" — third field "admin" adds to Admins group.
+// Upsert: existing users get their password refreshed on every restart.
 // Gated to non-production environments.
 func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache) {
 	if cfg.SeedUsers == "" {
@@ -561,16 +560,13 @@ func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache)
 
 		parts := strings.SplitN(entry, ":", 3)
 		if len(parts) < 2 {
-			log.Printf("⚠ Seed user skipped (bad format, want user:pass[:role]): %q", entry)
+			log.Printf("⚠ Seed user skipped (bad format, want user:pass[:admin]): %q", entry)
 			continue
 		}
 
 		username := strings.ToLower(strings.TrimSpace(parts[0]))
 		password := strings.TrimSpace(parts[1])
-		role := models.UserRoleUser
-		if len(parts) >= 3 && strings.TrimSpace(parts[2]) == "admin" {
-			role = models.UserRoleAdmin
-		}
+		isAdmin := len(parts) >= 3 && strings.TrimSpace(parts[2]) == "admin"
 
 		if username == "" || password == "" {
 			log.Printf("⚠ Seed user skipped (empty username or password)")
@@ -583,15 +579,13 @@ func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache)
 			continue
 		}
 
-		// Upsert: update password+role if user exists, create if not
+		// Upsert: update password if user exists, create if not
 		existing, _ := s.Users.GetByUsername(ctx, username)
 		if existing != nil {
 			s.Users.Update(ctx, existing.ID, map[string]interface{}{
 				"password_hash": string(hash),
-				"role":          role,
 				"is_active":     true,
 			})
-			// Probe vault with current password — only destroys if seal is stale
 			if existing.Handle == "" {
 				handle := auth.UniqueHandle(ctx, s.Users, models.HandleFromName(username))
 				s.Users.Update(ctx, existing.ID, map[string]interface{}{"handle": handle})
@@ -601,7 +595,11 @@ func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache)
 				cache = uekCache[0]
 			}
 			ProbeAndRepairVault(ctx, s, existing.ID, password, cache)
-			log.Printf("  🌱 Seed user '%s' updated (role=%s)", username, role)
+			auth.EnsureEveryoneGroup(ctx, s, existing.ID)
+			if isAdmin {
+				auth.AddToAdminsGroup(ctx, s, existing.ID)
+			}
+			log.Printf("  🌱 Seed user '%s' updated (admin=%v)", username, isAdmin)
 			continue
 		}
 
@@ -610,7 +608,6 @@ func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache)
 			Username:     username,
 			Email:        username + "@switchboard.local",
 			PasswordHash: string(hash),
-			Role:         role,
 			IsActive:     true,
 			AuthSource:   "builtin",
 			Handle:       handle,
@@ -620,7 +617,11 @@ func SeedUsers(cfg *config.Config, s store.Stores, uekCache ...*crypto.UEKCache)
 			log.Printf("⚠ Seed user '%s' failed: %v", username, err)
 			continue
 		}
-		log.Printf("  🌱 Seed user '%s' created (role=%s, active=true)", username, role)
+		auth.EnsureEveryoneGroup(ctx, s, user.ID)
+		if isAdmin {
+			auth.AddToAdminsGroup(ctx, s, user.ID)
+		}
+		log.Printf("  🌱 Seed user '%s' created (admin=%v, active=true)", username, isAdmin)
 	}
 }
 

server/handlers/auth_test.go

@@ -40,7 +40,6 @@ func TestJWTGeneration(t *testing.T) {
 	claims := Claims{
 		UserID: "550e8400-e29b-41d4-a716-446655440000",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(15 * time.Minute)),
@@ -75,9 +74,6 @@ func TestJWTGeneration(t *testing.T) {
 	if parsed.Email != claims.Email {
 		t.Errorf("Email mismatch: got %s, want %s", parsed.Email, claims.Email)
 	}
-	if parsed.Role != claims.Role {
-		t.Errorf("Role mismatch: got %s, want %s", parsed.Role, claims.Role)
-	}
 }
 
 func TestJWTExpired(t *testing.T) {
@@ -86,7 +82,6 @@ func TestJWTExpired(t *testing.T) {
 	claims := Claims{
 		UserID: "test-user",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(time.Now().Add(-1 * time.Hour)),
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(-30 * time.Minute)),
@@ -109,7 +104,6 @@ func TestJWTWrongSecret(t *testing.T) {
 	claims := Claims{
 		UserID: "test-user",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
 		},

server/handlers/extension_test.go

@@ -73,7 +73,7 @@ func setupExtensionHarness(t *testing.T) *extensionHarness {
 
 	// Admin extension endpoints
 	admin := api.Group("/admin")
-	admin.Use(middleware.Auth(cfg, stores.Users, userCache), middleware.RequireAdmin())
+	admin.Use(middleware.Auth(cfg, stores.Users, userCache), middleware.RequireAdmin(stores))
 	admin.GET("/extensions", extH.AdminListExtensions)
 	admin.POST("/extensions", extH.AdminInstallExtension)
 	admin.PUT("/extensions/:id", extH.AdminUpdateExtension)
@@ -81,16 +81,19 @@ func setupExtensionHarness(t *testing.T) *extensionHarness {
 
 	// Seed admin user
 	adminID := seedInsertReturningID(t,
-		`INSERT INTO users (username, email, password_hash, role, handle, auth_source) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
-		"ext-admin", "ext-admin@test.com", "$2a$10$test", "admin", "ext-admin", "builtin",
+		`INSERT INTO users (username, email, password_hash, handle, auth_source) VALUES ($1, $2, $3, $4, $5) RETURNING id`,
+		"ext-admin", "ext-admin@test.com", "$2a$10$test", "ext-admin", "builtin",
 	)
+	database.SeedEveryoneGroupMember(t, adminID)
+	database.SeedAdminsGroupMember(t, adminID)
 	adminToken := makeToken(adminID, "ext-admin@test.com", "admin")
 
 	// Seed regular user
 	userID := seedInsertReturningID(t,
-		`INSERT INTO users (username, email, password_hash, role, handle, auth_source) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
-		"ext-user", "ext-user@test.com", "$2a$10$test", "user", "ext-user", "builtin",
+		`INSERT INTO users (username, email, password_hash, handle, auth_source) VALUES ($1, $2, $3, $4, $5) RETURNING id`,
+		"ext-user", "ext-user@test.com", "$2a$10$test", "ext-user", "builtin",
 	)
+	database.SeedEveryoneGroupMember(t, userID)
 	userToken := makeToken(userID, "ext-user@test.com", "user")
 
 	return &extensionHarness{

server/handlers/groups.go

@@ -25,15 +25,9 @@ type createGroupRequest struct {
 }
 
 type updateGroupRequest struct {
-	Name               *string   `json:"name,omitempty"`
-	Description        *string   `json:"description,omitempty"`
-	Permissions        *[]string `json:"permissions,omitempty"`
-	TokenBudgetDaily   *int64    `json:"token_budget_daily,omitempty"`
-	TokenBudgetMonthly *int64    `json:"token_budget_monthly,omitempty"`
-	AllowedModels      *[]string `json:"allowed_models,omitempty"`
-	ClearBudgetDaily   bool      `json:"clear_budget_daily,omitempty"`
-	ClearBudgetMonthly bool      `json:"clear_budget_monthly,omitempty"`
-	ClearAllowedModels bool      `json:"clear_allowed_models,omitempty"`
+	Name        *string   `json:"name,omitempty"`
+	Description *string   `json:"description,omitempty"`
+	Permissions *[]string `json:"permissions,omitempty"`
 }
 
 type addGroupMemberRequest struct {
@@ -144,15 +138,9 @@ func (h *GroupHandler) UpdateGroup(c *gin.Context) {
 	}
 
 	patch := models.GroupPatch{
-		Name:               req.Name,
-		Description:        req.Description,
-		Permissions:        req.Permissions,
-		TokenBudgetDaily:   req.TokenBudgetDaily,
-		TokenBudgetMonthly: req.TokenBudgetMonthly,
-		AllowedModels:      req.AllowedModels,
-		ClearBudgetDaily:   req.ClearBudgetDaily,
-		ClearBudgetMonthly: req.ClearBudgetMonthly,
-		ClearAllowedModels: req.ClearAllowedModels,
+		Name:        req.Name,
+		Description: req.Description,
+		Permissions: req.Permissions,
 	}
 
 	// Validate permissions if provided

server/handlers/notification_test.go

@@ -65,7 +65,7 @@ func setupNotifHarness(t *testing.T) *notifHarness {
 	// Admin broadcast route (v0.28.6)
 	admin := api.Group("/admin")
 	admin.Use(middleware.Auth(cfg, stores.Users, userCache))
-	admin.Use(middleware.RequireAdmin())
+	admin.Use(middleware.RequireAdmin(stores))
 	admin.POST("/notifications/broadcast", notifH.Broadcast)
 
 	// Set up notification service singleton for Broadcast handler
@@ -74,7 +74,8 @@ func setupNotifHarness(t *testing.T) *notifHarness {
 
 	// Seed admin
 	adminID := database.SeedTestUser(t, "notif-admin", "notif-admin@test.com")
-	database.TestDB.Exec(dialectSQL("UPDATE users SET role = 'admin', is_active = true WHERE id = $1"), adminID)
+	database.TestDB.Exec(dialectSQL("UPDATE users SET is_active = true WHERE id = $1"), adminID)
+	database.SeedAdminsGroupMember(t, adminID)
 	adminToken := makeToken(adminID, "notif-admin@test.com", "admin")
 
 	// Seed regular user

server/handlers/profile_bootstrap.go

@@ -33,7 +33,6 @@ func NewProfileBootstrapHandler(s store.Stores) *ProfileBootstrapHandler {
 // GET /api/v1/profile/bootstrap
 func (h *ProfileBootstrapHandler) GetBootstrap(c *gin.Context) {
 	userID := getUserID(c)
-	role, _ := c.Get("role")
 	ctx := c.Request.Context()
 
 	// ── User profile ────────────────────────
@@ -48,27 +47,20 @@ func (h *ProfileBootstrapHandler) GetBootstrap(c *gin.Context) {
 		"username":     user.Username,
 		"display_name": user.DisplayName,
 		"email":        user.Email,
-		"role":         user.Role,
 	}
 	if user.AvatarURL != "" {
 		userPayload["avatar"] = user.AvatarURL
 	}
 
 	// ── Permissions ─────────────────────────
-	var permList []string
-	if role == "admin" {
-		permList = make([]string, len(auth.AllPermissions))
-		copy(permList, auth.AllPermissions)
-	} else {
-		perms, err := auth.ResolvePermissions(ctx, h.stores, userID)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to resolve permissions"})
-			return
-		}
-		permList = make([]string, 0, len(perms))
-		for p := range perms {
-			permList = append(permList, p)
-		}
+	perms, err := auth.ResolvePermissions(ctx, h.stores, userID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to resolve permissions"})
+		return
+	}
+	permList := make([]string, 0, len(perms))
+	for p := range perms {
+		permList = append(permList, p)
 	}
 	sort.Strings(permList)
 
@@ -77,7 +69,6 @@ func (h *ProfileBootstrapHandler) GetBootstrap(c *gin.Context) {
 	if groupIDs == nil {
 		groupIDs = []string{}
 	}
-	groupIDs = append(groupIDs, auth.EveryoneGroupID)
 
 	// ── Teams ───────────────────────────────
 	teams, _ := h.stores.Teams.ListForUser(ctx, userID)

server/handlers/settings.go

@@ -36,7 +36,6 @@ type profileResponse struct {
 	Username    string                 `json:"username"`
 	Email       string                 `json:"email"`
 	DisplayName *string                `json:"display_name"`
-	Role        string                 `json:"role"`
 	Avatar      *string                `json:"avatar,omitempty"`
 	Settings    map[string]interface{} `json:"settings"`
 	CreatedAt   time.Time              `json:"created_at"`
@@ -84,7 +83,6 @@ func (h *SettingsHandler) GetProfile(c *gin.Context) {
 		Username:    user.Username,
 		Email:       user.Email,
 		DisplayName: dn,
-		Role:        user.Role,
 		Avatar:      avatar,
 		Settings:    settings,
 		CreatedAt:   user.CreatedAt,

server/handlers/test_helpers_test.go

@@ -41,11 +41,10 @@ func (h *testHarness) request(method, path, token string, body interface{}) *htt
 	return w
 }
 
-func makeToken(userID, email, role string) string {
+func makeToken(userID, email, _ string) string {
 	claims := Claims{
 		UserID: userID,
 		Email:  email,
-		Role:   role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),