prepare user grouping#161
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces the first end-to-end “user grouping” feature slice: new DB tables + repository functions, a server-side service, and survey-scoped REST endpoints to create/read/update/delete groups and manage members, along with an authorization middleware hook.
Changes:
- Added
user_group/user_group_usertables via db-migrator migration, plus corresponding DB table classes and exports. - Implemented
UserGroupRepository(CRUD + membership ops) andUserGroupServiceServer, then registered it in the Arena server service registry. - Added
UserGroupApiendpoints and a newrequireUserGroupManagePermissionmiddleware guard.
Reviewed changes
Copilot reviewed 32 out of 32 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/service/userGroup/index.ts | Adds UserGroupService interface + server implementation delegating to repository |
| src/service/index.ts | Re-exports user group service type/server |
| src/server/arenaServer/serverServiceType.ts | Adds userGroup service type |
| src/server/arenaServer/registerServices.ts | Registers UserGroupServiceServer in the service registry |
| src/repository/userGroup/update.ts | Implements full props replace and partial props merge updates |
| src/repository/userGroup/types.ts | Defines UserGroup domain types |
| src/repository/userGroup/read.ts | Adds count/list/get-by-uuid queries |
| src/repository/userGroup/members.ts | Adds add/remove/list group members queries |
| src/repository/userGroup/insert.ts | Adds insert logic for user groups |
| src/repository/userGroup/index.ts | Repository barrel export + type exports |
| src/repository/userGroup/getUserGroupsByUser.ts | Adds “list groups by user” query |
| src/repository/userGroup/delete.ts | Adds delete-by-uuid with returning |
| src/repository/index.ts | Exposes UserGroupRepository + user group types |
| src/index.ts | Exposes TableUserGroup and TableUserGroupUser from top-level entry |
| src/db/table/schemaPublic/userGroupUser.ts | Defines user_group_user table mapping |
| src/db/table/schemaPublic/userGroup.ts | Defines user_group table mapping |
| src/db/table/schemaPublic/index.ts | Re-exports the new table classes |
| src/db/table/index.ts | Re-exports the new table classes via db table barrel |
| src/db/index.ts | Re-exports the new table classes via db barrel |
| src/db/dbMigrator/migration/public/migrations/sqls/20260713124754-create-user-group-tables-up.sql | Creates user_group / user_group_user tables and indexes |
| src/db/dbMigrator/migration/public/migrations/sqls/20260713124754-create-user-group-tables-down.sql | Drops the two user-group tables |
| src/db/dbMigrator/migration/public/migrations/20260713124754-create-user-group-tables.js | db-migrator JS wrapper for the migration SQL |
| src/api/userGroup/update.ts | Adds PUT endpoint to update group props |
| src/api/userGroup/read.ts | Adds GET endpoints for count/list/get group/get members |
| src/api/userGroup/index.ts | Wires user group route initializers |
| src/api/userGroup/delete.ts | Adds DELETE group and DELETE member endpoints |
| src/api/userGroup/create.ts | Adds POST group and POST add-member endpoints |
| src/api/middleware/auth.ts | Adds requireUserGroupManagePermission (survey-admin-only) |
| src/api/endpoint/userGroup.ts | Defines user-group endpoint path builders |
| src/api/endpoint/index.ts | Exposes userGroup endpoints in the endpoint registry |
| src/api/api.ts | Registers UserGroupApi into the main API initializer |
Comments suppressed due to low confidence (2)
src/api/userGroup/read.ts:84
- This endpoint ignores
surveyIdand returns group members bygroupUuidalone. Because authorization is based onsurveyId, a user with view permission on one survey could retrieve members of a group from another survey if they know the UUID. ResolvesurveyUuidfromsurveyIdand ensure the group belongs to that survey before returning members.
}
src/api/userGroup/create.ts:55
- This handler authorizes based on
surveyIdbut adds a member to a group by UUID without verifying the group belongs to that survey. A survey admin could add members to a group in another survey if they know the UUID. ResolvesurveyUuidfromsurveyIdand validate the group before callingaddMember.
)
},
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.