V0.7.0 shell contract (#54)

server/handlers/groups.go

@@ -4,11 +4,13 @@ import (
 	"database/sql"
 	"errors"
 	"net/http"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"armature/auth"
 	"armature/database"
+	"armature/events"
 	"armature/models"
 	"armature/notifications"
 	"armature/store"
@@ -43,12 +45,30 @@ type setResourceGrantRequest struct {
 
 type GroupHandler struct {
 	stores store.Stores
+	hub    *events.Hub
 }
 
 func NewGroupHandler(s store.Stores) *GroupHandler {
 	return &GroupHandler{stores: s}
 }
 
+// SetHub attaches the event hub for auth change notifications.
+func (h *GroupHandler) SetHub(hub *events.Hub) {
+	h.hub = hub
+}
+
+// notifyAuthChanged sends an auth.changed event to a specific user.
+func (h *GroupHandler) notifyAuthChanged(userID, reason string) {
+	if h.hub == nil {
+		return
+	}
+	h.hub.PublishToUser(userID, events.Event{
+		Label:   "auth.changed",
+		Payload: events.MustJSON(map[string]string{"reason": reason}),
+		Ts:      time.Now().UnixMilli(),
+	})
+}
+
 // ── Admin: List All Groups ──────────────────
 
 func (h *GroupHandler) ListGroups(c *gin.Context) {
@@ -249,6 +269,7 @@ func (h *GroupHandler) AddMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	h.notifyAuthChanged(req.UserID, "group_member_added")
 	AuditLog(h.stores.Audit, c, "group.member.add", "group", groupID, map[string]interface{}{
 		"user_id": req.UserID,
 	})
@@ -279,6 +300,7 @@ func (h *GroupHandler) RemoveMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	h.notifyAuthChanged(userID, "group_member_removed")
 	AuditLog(h.stores.Audit, c, "group.member.remove", "group", groupID, map[string]interface{}{
 		"user_id": userID,
 	})