Changeset 0.28.0.3 (#175)

server/handlers/groups.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"database/sql"
+	"errors"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -191,16 +192,15 @@ func (h *GroupHandler) DeleteGroup(c *gin.Context) {
 	id := c.Param("id")
 
 	err := h.stores.Groups.Delete(c.Request.Context(), id)
-	if err == sql.ErrNoRows {
+	if errors.Is(err, sql.ErrNoRows) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "group not found"})
 		return
 	}
+	if errors.Is(err, store.ErrSystemGroup) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "system groups cannot be deleted"})
+		return
+	}
 	if err != nil {
-		// Store layer returns a plain error for system groups.
-		if err.Error() == "system groups cannot be deleted" {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "system groups cannot be deleted"})
-			return
-		}
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
 		return
 	}
@@ -428,8 +428,9 @@ func (h *GroupHandler) ListPermissions(c *gin.Context) {
 // GET /api/v1/admin/users/:id/permissions
 func (h *GroupHandler) GetUserPermissions(c *gin.Context) {
 	userID := c.Param("id")
+	ctx := c.Request.Context()
 
-	perms, err := auth.ResolvePermissions(c.Request.Context(), h.stores, userID)
+	perms, err := auth.ResolvePermissions(ctx, h.stores, userID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to resolve permissions"})
 		return
@@ -440,5 +441,14 @@ func (h *GroupHandler) GetUserPermissions(c *gin.Context) {
 	for p := range perms {
 		list = append(list, p)
 	}
-	c.JSON(http.StatusOK, gin.H{"permissions": list, "user_id": userID})
+
+	// Contributing groups: explicit membership + Everyone
+	groupIDs, _ := h.stores.Groups.GetUserGroupIDs(ctx, userID)
+	if groupIDs == nil {
+		groupIDs = []string{}
+	}
+	// Everyone group always contributes
+	groupIDs = append(groupIDs, auth.EveryoneGroupID)
+
+	c.JSON(http.StatusOK, gin.H{"permissions": list, "user_id": userID, "groups": groupIDs})
 }