Release 1.11.0: end-user catalog, access requests, nested groups

Closes the end-user half of the directory and adds nested LDAP groups.

The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:

  - GET /api/discovery/me resolved groups from req.user.groups, which does not
    exist (req.user carries memberOf), so it returned only isPublic resources
    for every human caller -- "My Services" was blank for everyone. The same
    read made isDirectoryAdmin() false for real admins.
  - The portal's "Discover More Services" called the admin-gated endpoint and
    swallowed the 403, so it never rendered for non-admins at all.
  - Services reported no address, because /me had reimplemented getMyAccess
    without its parent-walking resolution.

Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").

Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.

member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.

Full suite green in both resolution modes: 215 passed, 2 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nodejs/routes/access_request.js

@@ -0,0 +1,266 @@
+'use strict';
+
+// Self-service access requests. Mounted at /api/access-requests (app.js).
+//
+// The loop this closes: a user browses the catalog, finds something they cannot
+// reach, asks for it; the resource's owner (or a directory admin) approves; the
+// approval performs the LDAP group add. LDAP stays the access-control truth --
+// this router never invents a permission, it only automates the group add an
+// admin would otherwise do by hand, and records who decided.
+
+const router = require('express').Router();
+const { Resource, ResourceGroup } = require('../models/resource');
+const { AccessRequest, STATUS } = require('../models/access_request');
+const { Group } = require('../models/group_ldap');
+const { User } = require('../models/user_ldap');
+const { Mail } = require('../models/email');
+const { groupCns } = require('../utils/user_groups');
+const { envelope, projectResource } = require('@simpleworkjs/directory-schema');
+
+const DIRECTORY_ADMIN_GROUPS = ['app_sso_directory_admin', 'app_sso_admin', 'app_super_admin'];
+
+function httpError(status, message) {
+  const err = new Error(message);
+  err.status = status;
+  return err;
+}
+
+// May `user` decide requests against `resource`? The resource's own owner is
+// the primary approver -- that is the point of Resource.owner -- with directory
+// admins as the catch-all so an unowned or orphaned resource is never stuck.
+async function canDecide(user, resource, callerGroups) {
+  if (resource && resource.owner && resource.owner === user.uid) return true;
+  return callerGroups.some(g => DIRECTORY_ADMIN_GROUPS.includes(g));
+}
+
+// The group that satisfies a request for this resource. Prefers an explicit
+// choice, else the `member`-level link (the "just let me use it" group) over an
+// `owner`-level one -- requesting a resource should never silently escalate to
+// its admin group.
+async function resolveGroupCn(resourceId, requested) {
+  const links = await ResourceGroup.list({ where: { resourceId } });
+  if (!links.length) {
+    throw httpError(409, 'This resource has no access group linked, so it cannot be requested.');
+  }
+  if (requested) {
+    const match = links.find(l => l.groupCn === requested);
+    if (!match) throw httpError(400, `"${requested}" is not an access group for this resource.`);
+    return match.groupCn;
+  }
+  const member = links.find(l => l.accessLevel === 'member');
+  return (member || links[0]).groupCn;
+}
+
+// Best-effort notification. A mail failure must never fail the request itself --
+// the row is the source of truth and the approver can find it in the UI.
+async function notify(uid, subject, message) {
+  try {
+    const user = await User.get({ uid });
+    if (!user || !user.mail) return;
+    await Mail.sendTemplate(user.mail, 'notification', {
+      givenName: user.givenName || uid,
+      subject,
+      message,
+    });
+  } catch (err) {
+    console.error(`access-request: notification to ${uid} failed:`, err.message);
+  }
+}
+
+// POST /api/access-requests  { slug | resourceId, groupCn?, note? }
+router.post('/', async (req, res, next) => {
+  try {
+    if (req.user.isMachine) throw httpError(403, 'Machine accounts cannot request access.');
+
+    let resource;
+    if (req.body.slug) {
+      const found = await Resource.list({ where: { slug: req.body.slug } });
+      resource = found[0];
+    } else if (req.body.resourceId) {
+      resource = await Resource.get(req.body.resourceId);
+    }
+    if (!resource) throw httpError(404, 'Resource not found');
+
+    const md = resource.metadata || {};
+    // Opt-out, not opt-in: everything in the catalog is requestable unless an
+    // admin has explicitly marked it otherwise.
+    if (md.requestable === false) {
+      throw httpError(409, 'This resource is not available for self-service requests.');
+    }
+
+    const groupCn = await resolveGroupCn(resource.id, req.body.groupCn);
+
+    const callerGroups = await groupCns(req.user);
+    if (callerGroups.includes(groupCn)) {
+      throw httpError(409, 'You already have access to this resource.');
+    }
+
+    const existing = await AccessRequest.findOpen(req.user.uid, groupCn);
+    if (existing) throw httpError(409, 'You already have a pending request for this resource.');
+
+    const request = await AccessRequest.create({
+      uid: req.user.uid,
+      resourceId: resource.id,
+      groupCn,
+      status: STATUS.PENDING,
+      note: req.body.note || '',
+      requestedOn: Date.now(),
+    });
+
+    if (resource.owner) {
+      await notify(
+        resource.owner,
+        `Access request: ${resource.name}`,
+        `<p><strong>${req.user.uid}</strong> has requested access to <strong>${resource.name}</strong> (group <code>${groupCn}</code>).</p>` +
+        (req.body.note ? `<p>Their note: ${req.body.note}</p>` : '') +
+        `<p>Review it on the Directory page.</p>`
+      );
+    }
+
+    res.json(envelope(request));
+  } catch (err) { next(err); }
+});
+
+// GET /api/access-requests/mine — the caller's own request history.
+router.get('/mine', async (req, res, next) => {
+  try {
+    const rows = await AccessRequest.listForUser(req.user.uid);
+    res.json(envelope(await decorate(rows)));
+  } catch (err) { next(err); }
+});
+
+// GET /api/access-requests — pending requests the caller may decide.
+router.get('/', async (req, res, next) => {
+  try {
+    const callerGroups = await groupCns(req.user);
+    const isAdmin = callerGroups.some(g => DIRECTORY_ADMIN_GROUPS.includes(g));
+    const pending = await AccessRequest.listPending();
+
+    let visible = pending;
+    if (!isAdmin) {
+      // A plain resource owner sees only requests against resources they own.
+      const owned = await Resource.list({ where: { owner: req.user.uid } });
+      const ownedIds = new Set(owned.map(r => r.id));
+      visible = pending.filter(r => ownedIds.has(r.resourceId));
+    }
+    res.json(envelope(await decorate(visible)));
+  } catch (err) { next(err); }
+});
+
+// Attach the resource name/slug each row refers to. The UI needs it on every
+// list and would otherwise issue one lookup per row.
+async function decorate(rows) {
+  if (!rows.length) return [];
+  const resources = await Resource.list();
+  const byId = new Map(resources.map(r => [r.id, r]));
+  return rows.map(row => {
+    const data = row.toJSON ? row.toJSON() : { ...row };
+    const resource = byId.get(data.resourceId);
+    data.resource = resource
+      ? { id: resource.id, name: resource.name, slug: resource.slug, kind: resource.kind }
+      : null;
+    return data;
+  });
+}
+
+// POST /api/access-requests/:id/approve  { decisionNote? }
+router.post('/:id/approve', async (req, res, next) => {
+  try {
+    const request = await AccessRequest.get(req.params.id);
+    if (!request) throw httpError(404, 'Request not found');
+    if (request.status !== STATUS.PENDING) {
+      throw httpError(409, `This request was already ${request.status}.`);
+    }
+
+    const resource = await Resource.get(request.resourceId);
+    const callerGroups = await groupCns(req.user);
+    if (!(await canDecide(req.user, resource, callerGroups))) {
+      throw httpError(403, 'You do not have permission to decide this request.');
+    }
+
+    // The LDAP write happens FIRST and is allowed to throw. Marking a request
+    // approved without the group add would show the user a grant they do not
+    // actually have -- a pending row is recoverable, a lying one is not.
+    const group = await Group.get(request.groupCn);
+    const user = await User.get({ uid: request.uid });
+    try {
+      await group.addMember(user);
+    } catch (err) {
+      // "already a member" is the goal state, not a failure. This happens
+      // routinely: groupOfNames requires at least one member, so creating a
+      // resource seeds its auto-created groups with the creator's DN, and an
+      // admin may also grant access by hand while a request sits pending.
+      // Without this the request would 500 and stay pending forever.
+      const alreadyMember = err.name === 'TypeOrValueExistsError' || err.code === 20;
+      if (!alreadyMember) throw err;
+    }
+    User.clearCache(); // membership feeds cached isAdmin / group-gated nav
+
+    const updated = await request.update({
+      status: STATUS.APPROVED,
+      decidedBy: req.user.uid,
+      decidedOn: Date.now(),
+      decisionNote: req.body.decisionNote || '',
+    });
+
+    await notify(
+      request.uid,
+      `Access approved: ${resource ? resource.name : request.groupCn}`,
+      `<p>Your request for <strong>${resource ? resource.name : request.groupCn}</strong> was approved by ${req.user.uid}.</p>` +
+      `<p>You may need to sign out and back in for the change to take effect everywhere.</p>`
+    );
+
+    res.json(envelope(updated));
+  } catch (err) { next(err); }
+});
+
+// POST /api/access-requests/:id/deny  { decisionNote? }
+router.post('/:id/deny', async (req, res, next) => {
+  try {
+    const request = await AccessRequest.get(req.params.id);
+    if (!request) throw httpError(404, 'Request not found');
+    if (request.status !== STATUS.PENDING) {
+      throw httpError(409, `This request was already ${request.status}.`);
+    }
+
+    const resource = await Resource.get(request.resourceId);
+    const callerGroups = await groupCns(req.user);
+    if (!(await canDecide(req.user, resource, callerGroups))) {
+      throw httpError(403, 'You do not have permission to decide this request.');
+    }
+
+    const updated = await request.update({
+      status: STATUS.DENIED,
+      decidedBy: req.user.uid,
+      decidedOn: Date.now(),
+      decisionNote: req.body.decisionNote || '',
+    });
+
+    await notify(
+      request.uid,
+      `Access request declined: ${resource ? resource.name : request.groupCn}`,
+      `<p>Your request for <strong>${resource ? resource.name : request.groupCn}</strong> was declined.</p>` +
+      (req.body.decisionNote ? `<p>Reason: ${req.body.decisionNote}</p>` : '')
+    );
+
+    res.json(envelope(updated));
+  } catch (err) { next(err); }
+});
+
+// DELETE /api/access-requests/:id — requester withdraws their own pending request.
+router.delete('/:id', async (req, res, next) => {
+  try {
+    const request = await AccessRequest.get(req.params.id);
+    if (!request) throw httpError(404, 'Request not found');
+    if (request.uid !== req.user.uid) {
+      throw httpError(403, 'You can only withdraw your own requests.');
+    }
+    if (request.status !== STATUS.PENDING) {
+      throw httpError(409, `This request was already ${request.status}.`);
+    }
+    const updated = await request.update({ status: STATUS.CANCELLED, decidedOn: Date.now() });
+    res.json(envelope(updated));
+  } catch (err) { next(err); }
+});
+
+module.exports = router;

nodejs/routes/api_directory_admin.js

@@ -3,8 +3,32 @@ const router = require('express').Router();
 const permission = require('../utils/permission');
 const { Resource, ResourceEdge, ResourceGroup } = require('../models/resource');
 const { Group } = require('../models/group_ldap');
+const { User } = require('../models/user_ldap');
+const { cnFromDn } = require('../utils/user_groups');
 const { projectResources } = require('@simpleworkjs/directory-schema');
 
+const SUPER_ADMIN_GROUP = permission.SUPER_ADMIN_GROUP;
+
+// Make `childCn` a member of `parentCn`, i.e. everyone in the child is
+// transitively in the parent. Idempotent and non-fatal: "already a member" is
+// the goal state, and a missing group (e.g. app_super_admin absent on a
+// directory seeded by an older entrypoint) is a reason to skip, not to fail the
+// caller's real work.
+async function nestGroup(childCn, parentCn) {
+  try {
+    const parent = await Group.get(parentCn);
+    const child = await Group.get(childCn);
+    if (await Group.wouldCycle(parentCn, child.dn)) {
+      console.error(`nestGroup: refusing ${childCn} -> ${parentCn} (would create a cycle)`);
+      return;
+    }
+    await parent.addMember({ dn: child.dn });
+  } catch (err) {
+    const benign = err.name === 'TypeOrValueExistsError' || err.code === 20 || err.name === 'GroupNotFound';
+    if (!benign) console.error(`nestGroup: ${childCn} -> ${parentCn} failed:`, err.message);
+  }
+}
+
 // Require the admin group
 router.use(async (req, res, next) => {
   try {
@@ -68,8 +92,10 @@ router.post('/resources', async (req, res, next) => {
 
     if (r.kind === 'host' || r.kind === 'service') {
       const siteSlug = await Resource.findAncestorSiteSlug(r.id);
+      const groupCn = suffix => (siteSlug ? `${siteSlug}_${r.slug}_${suffix}` : `${r.slug}_${suffix}`);
+
       const createGroup = async (suffix, accessLevel) => {
-        const cn = siteSlug ? `${siteSlug}_${r.slug}_${suffix}` : `${r.slug}_${suffix}`;
+        const cn = groupCn(suffix);
         try {
           await Group.add({
             name: cn,
@@ -87,6 +113,21 @@ router.post('/resources', async (req, res, next) => {
       };
       await createGroup('access', 'member');
       await createGroup('admin', 'owner');
+
+      // Wire up the two standing relationships every resource has, as nesting
+      // rather than as membership that has to be maintained per resource:
+      //
+      //   app_super_admin -> <slug>_admin   cross-app super admins administer
+      //                                     every resource, automatically
+      //   <slug>_admin    -> <slug>_access  administering something implies
+      //                                     being able to use it
+      //
+      // Before nesting, both of these could only be expressed by adding every
+      // super admin to every new group by hand -- which nobody does, so the
+      // groups drifted. A failure here must not fail resource creation: the
+      // resource and its groups already exist and the nesting is repairable.
+      await nestGroup(groupCn('admin'), groupCn('access'));
+      await nestGroup(SUPER_ADMIN_GROUP, groupCn('admin'));
     }
     
     res.json({ results: r });
@@ -103,18 +144,8 @@ router.post('/resources', async (req, res, next) => {
 
 router.put('/resources/:id', async (req, res, next) => {
   try {
-    let r;
-    if (req.body.kind === 'oauth') {
-        const { OAuthClient } = require('../models/oauth_client');
-        r = await OAuthClient.get(req.params.id);
-    } else {
-        r = await Resource.get(req.params.id);
-    }
-    if (!r) return res.status(404).json({ error: 'Not found' });
-
-    req.body.updated_by = req.user.uid;
-    req.body.updated_on = Date.now();
-
+    // Validate before loading anything -- a rejected body should never have
+    // touched the store.
     if (req.body.kind === 'host' && !req.body.hostId) {
       return res.status(400).json({ error: 'Hosts must have a parent Site or Host' });
     }
@@ -124,14 +155,20 @@ router.put('/resources/:id', async (req, res, next) => {
     if (req.body.kind === 'oauth' && !req.body.hostId) {
       return res.status(400).json({ error: 'OAuth Integrations must have a parent Service' });
     }
-    
-    let updated;
-    if (req.body.kind === 'oauth') {
-        updated = await r.update(req.body);
-    } else {
-        updated = await r.update(req.body);
-    }
-    
+
+    // OAuthClient is a wrapper over the same `resource` row, but its .update()
+    // handles the oauth-specific body fields (redirect_uris, scopes,
+    // token_lifetime) that a bare Resource would drop into metadata unvalidated.
+    const { OAuthClient } = require('../models/oauth_client');
+    const model = req.body.kind === 'oauth' ? OAuthClient : Resource;
+    const r = await model.get(req.params.id);
+    if (!r) return res.status(404).json({ error: 'Not found' });
+
+    req.body.updated_by = req.user.uid;
+    req.body.updated_on = Date.now();
+
+    const updated = await r.update(req.body);
+
     if ((updated.kind === 'host' || updated.kind === 'service' || updated.kind === 'oauth') && req.body.hostId !== undefined) {
       const existingEdges = await ResourceEdge.list({ where: { childId: r.id } });
       for (const e of existingEdges) {
@@ -163,13 +200,18 @@ router.delete('/resources/:id', async (req, res, next) => {
   try {
     const r = await Resource.get(req.params.id);
     if (!r) return res.status(404).json({ error: 'Not found' });
-    await r.delete();
-    // Also delete edges and groups involving this resource
+    // Clear the dependents FIRST. There is no transaction here, so ordering is
+    // the only thing protecting us: if a dependent delete throws after the
+    // resource row is gone, the leftovers are edges/links pointing at a
+    // nonexistent id -- invisible in the UI and poisonous to getGraph(). Failing
+    // with the resource still present is the recoverable direction (retry the
+    // delete); the caller sees the error either way.
     const edgesParent = await ResourceEdge.list({ where: { parentId: req.params.id } });
     const edgesChild = await ResourceEdge.list({ where: { childId: req.params.id } });
     const groups = await ResourceGroup.list({ where: { resourceId: req.params.id } });
     for (const e of [...edgesParent, ...edgesChild]) await e.delete();
     for (const g of groups) await g.delete();
+    await r.delete();
     res.json({ results: true });
   } catch (err) { next(err); }
 });
@@ -222,19 +264,138 @@ router.delete('/groups/:id', async (req, res, next) => {
   } catch (err) { next(err); }
 });
 
+// --- Access visibility ---
+//
+// The two questions an access-control pane has to answer, neither of which the
+// directory could answer before: "who can reach this resource" (a column on the
+// table, rather than three clicks into a modal) and "what can this user reach"
+// (which had no UI at all). Both are joins of the same two sets, so both are
+// served from one cached Group.listDetail() rather than a lookup per row.
+
+// dn -> uid, so member DNs can be reported as the uids admins actually think in.
+async function dnToUidMap() {
+  const users = await User.listDetail();
+  return new Map(users.map(u => [String(u.dn).toLowerCase(), u.uid]));
+}
+
+// GET /access-summary — { resourceId: { groups: [...], memberCount } }
+router.get('/access-summary', async (req, res, next) => {
+  try {
+    const [links, groups, uidByDn] = await Promise.all([
+      ResourceGroup.list(),
+      Group.listDetail(),
+      dnToUidMap(),
+    ]);
+
+    const groupByCn = new Map(groups.map(g => [g.cn, g]));
+    const summary = {};
+
+    for (const link of links) {
+      const group = groupByCn.get(link.groupCn);
+      // A link whose LDAP group has been deleted out from under it: report it
+      // rather than skipping, since a dangling link grants nothing and the
+      // admin needs to see that it is dead.
+      //
+      // Counts come from the transitive closure, not from `member`. Reading the
+      // attribute would report only who is listed on the group, missing anyone
+      // who reaches it through a nested group -- and since app_super_admin is
+      // nested into every resource's _admin group, that is not an edge case.
+      let members = [];
+      if (group) {
+        const eff = await Group.effectiveMembers(link.groupCn);
+        members = eff.effective.map(dn => uidByDn.get(String(dn).toLowerCase()) || cnFromDn(dn));
+      }
+
+      const entry = summary[link.resourceId] || (summary[link.resourceId] = { groups: [], members: [] });
+      entry.groups.push({
+        cn: link.groupCn,
+        accessLevel: link.accessLevel,
+        exists: !!group,
+        memberCount: members.length,
+      });
+      for (const uid of members) {
+        if (!entry.members.includes(uid)) entry.members.push(uid);
+      }
+    }
+
+    for (const id of Object.keys(summary)) {
+      summary[id].memberCount = summary[id].members.length;
+    }
+
+    res.json({ results: summary });
+  } catch (err) { next(err); }
+});
+
+// GET /user-access/:uid — every resource a given user can reach, and via which
+// group. This is the reverse lookup; previously an admin could only see their
+// own access, via /api/discovery/me.
+router.get('/user-access/:uid', async (req, res, next) => {
+  try {
+    const user = await User.get({ uid: req.params.uid });
+    if (!user) return res.status(404).json({ error: 'User not found' });
+
+    const dn = String(user.dn).toLowerCase();
+    const groups = await Group.listDetail();
+    const memberOf = groups
+      .filter(g => [].concat(g.member || []).some(m => String(m).toLowerCase() === dn))
+      .map(g => g.cn);
+
+    const [links, resources] = await Promise.all([ResourceGroup.list(), Resource.list()]);
+    const byId = new Map(resources.map(r => [r.id, r]));
+
+    const results = [];
+    for (const link of links) {
+      if (!memberOf.includes(link.groupCn)) continue;
+      const resource = byId.get(link.resourceId);
+      if (!resource) continue;
+      results.push({
+        id: resource.id,
+        name: resource.name,
+        slug: resource.slug,
+        kind: resource.kind,
+        groupCn: link.groupCn,
+        accessLevel: link.accessLevel,
+      });
+    }
+
+    res.json({ results: { uid: user.uid, groups: memberOf, resources: results } });
+  } catch (err) { next(err); }
+});
+
+// Tail the last `lines` lines of a log file without shelling out. Reads at most
+// the trailing MAX_TAIL_BYTES so an unrotated multi-GB log can't blow up the
+// heap. A missing/unreadable file is normal (the log only exists once slapd has
+// written to it), so it yields '' rather than an error.
+const MAX_TAIL_BYTES = 256 * 1024;
+
+async function tailFile(filePath, lines = 100) {
+  const fs = require('fs/promises');
+  let fh;
+  try {
+    fh = await fs.open(filePath, 'r');
+    const { size } = await fh.stat();
+    const start = Math.max(0, size - MAX_TAIL_BYTES);
+    const buf = Buffer.alloc(Math.min(size, MAX_TAIL_BYTES));
+    await fh.read(buf, 0, buf.length, start);
+    const text = buf.toString('utf8');
+    // A partial first line when we started mid-file; drop it.
+    const rows = (start > 0 ? text.slice(text.indexOf('\n') + 1) : text).split('\n');
+    return rows.slice(-lines).join('\n');
+  } catch (err) {
+    return '';
+  } finally {
+    if (fh) await fh.close().catch(() => {});
+  }
+}
+
 router.get('/audit-logs', async (req, res, next) => {
   try {
-    const fs = require('fs');
-    const { execSync } = require('child_process');
-    let ldapLogs = '';
-    let oauthLogs = '';
-    let auditLogs = '';
-    
-    try { ldapLogs = execSync('tail -n 100 /var/lib/ldap/slapd.log 2>/dev/null').toString(); } catch(e){}
-    try { oauthLogs = execSync('tail -n 100 /var/lib/ldap/oauth.log 2>/dev/null').toString(); } catch(e){}
-    try { auditLogs = execSync('tail -n 100 /var/lib/ldap/auditlog.ldif 2>/dev/null').toString(); } catch(e){}
-    
-    res.json({ results: { ldap: ldapLogs, oauth: oauthLogs, audit: auditLogs } });
+    const [ldap, oauth, audit] = await Promise.all([
+      tailFile('/var/lib/ldap/slapd.log'),
+      tailFile('/var/lib/ldap/oauth.log'),
+      tailFile('/var/lib/ldap/auditlog.ldif'),
+    ]);
+    res.json({ results: { ldap, oauth, audit } });
   } catch (err) { next(err); }
 });
 

nodejs/routes/discovery.js

@@ -10,9 +10,14 @@
 // jump-host's `data.results || []` silently collapsed to `[]`, so no user could
 // bridge) and absorbs the dead /me handler that used to live in
 // routes/api_discovery.js (mounted after the 404, so unreachable).
+//
+// Group CNs come from utils/user_groups — `req.user` has `memberOf` (DNs) and
+// no `.groups`, so reading `.groups` off it directly yields [] for every human
+// caller. See that file for what that silently broke.
 
 const router = require('express').Router();
 const { Resource, ResourceGroup } = require('../models/resource');
+const { withGroups } = require('../utils/user_groups');
 const {
 	envelope,
 	projectResource,
@@ -20,20 +25,29 @@ const {
 	isDirectoryAdmin,
 } = require('@simpleworkjs/directory-schema');
 
+// Resolve the caller's groups once per request and hand back the projection
+// flag. Every handler needs both, and both are wrong if taken off req.user raw.
+async function callerView(req) {
+	const user = await withGroups(req.user);
+	return { user, fullMetadata: isDirectoryAdmin(user) };
+}
+
 // GET /api/discovery/resources[?kind=&group=&parent=]
 router.get('/resources', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const resources = await Resource.search(req.query);
-		res.json(envelope(projectResources(resources, { fullMetadata: isDirectoryAdmin(req.user) })));
+		res.json(envelope(projectResources(resources, { fullMetadata })));
 	} catch (err) { next(err); }
 });
 
 // GET /api/discovery/resources/:slug
 router.get('/resources/:slug', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const resource = await Resource.getBySlug(req.params.slug);
 		// parents/children are edges (no secrets); project only the resource body.
-		const projected = projectResource(resource, { fullMetadata: isDirectoryAdmin(req.user) });
+		const projected = projectResource(resource, { fullMetadata });
 		projected.parents = resource.parents;
 		projected.children = resource.children;
 		res.json(envelope(projected));
@@ -43,9 +57,10 @@ router.get('/resources/:slug', async (req, res, next) => {
 // GET /api/discovery/graph
 router.get('/graph', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const graph = await Resource.getGraph();
 		res.json(envelope({
-			resources: projectResources(graph.resources, { fullMetadata: isDirectoryAdmin(req.user) }),
+			resources: projectResources(graph.resources, { fullMetadata }),
 			edges: graph.edges,
 		}));
 	} catch (err) { next(err); }
@@ -54,26 +69,28 @@ router.get('/graph', async (req, res, next) => {
 // GET /api/discovery/me
 // Returns the resources the current caller can reach. Machines see only their
 // own resource; humans get the union of their LDAP groups' resources plus
-// anything flagged isPublic. Uses req.user.groups (populated by the auth
-// middleware for session/PAT callers) rather than re-querying LDAP by DN, so it
-// works for every auth transport without assuming a .dn is present.
+// anything flagged isPublic.
 router.get('/me', async (req, res, next) => {
 	try {
+		const { user, fullMetadata } = await callerView(req);
 		let accessible;
 		if (req.user && req.user.isMachine) {
 			accessible = await Resource.list({ where: { id: req.resourceId } });
 		} else {
-			const userGroups = (req.user && req.user.groups) || [];
 			const ids = new Set();
-			if (userGroups.length) {
-				const rgs = await ResourceGroup.list({ where: { groupCn: { in: userGroups } } });
+			if (user.groups.length) {
+				const rgs = await ResourceGroup.list({ where: { groupCn: { in: user.groups } } });
 				for (const rg of rgs) ids.add(rg.resourceId);
 			}
 			const all = await Resource.list();
 			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
 		}
-		res.json(envelope(projectResources(accessible, { fullMetadata: isDirectoryAdmin(req.user) })));
+		// resolvedAddress is the whole point of /me ("how do I reach it") and a
+		// service inherits it from its host, so it must be computed here rather
+		// than left to each caller to guess at address || ip.
+		accessible = await Resource.withResolvedAddress(accessible);
+		res.json(envelope(projectResources(accessible, { fullMetadata })));
 	} catch (err) { next(err); }
 });
 
-module.exports = router;
+module.exports = router;

nodejs/routes/group.js

@@ -43,6 +43,87 @@ router.get('/:name', async function(req, res, next){
 	}
 });
 
+// ── Nested groups ───────────────────────────────────────────────────────────
+// A groupOfNames `member` may be any DN, including another group's, which is
+// how nesting is stored. These routes are mounted before /:group/:uid so the
+// literal "nested"/"effective" path segments are not swallowed by that
+// wildcard, which would otherwise try to resolve them as a uid.
+
+// GET /api/group/:group/effective — who this group actually grants, split into
+// directly-listed users, the groups nested into it, and the full transitive set
+// of users. The UI shows "3 direct, 12 effective"; a plain member read cannot
+// answer that, and on a server with nestgroup it silently returns the expanded
+// list with no indication which entries are direct.
+router.get('/:group/effective', async function(req, res, next){
+	try{
+		return res.json({ results: await Group.effectiveMembers(req.params.group) });
+	}catch(error){
+		next(error);
+	}
+});
+
+// PUT /api/group/:group/nested/:child — nest :child inside :group.
+router.put('/:group/nested/:child', async function(req, res, next){
+	try{
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
+
+		const parent = await Group.get(req.params.group);
+		const child  = await Group.get(req.params.child);
+
+		if(parent.dn === child.dn){
+			return res.status(400).json({message: 'A group cannot contain itself.'});
+		}
+		// Refuse rather than rely on the resolver's depth cap: a cycle makes
+		// "who is in this group" unanswerable, and the cap would quietly return
+		// a truncated answer instead of an error anyone would notice.
+		if(await Group.wouldCycle(req.params.group, child.dn)){
+			return res.status(409).json({
+				message: `"${req.params.child}" already contains "${req.params.group}" — nesting them would create a loop.`
+			});
+		}
+
+		const results = await parent.addMember({dn: child.dn});
+		User.clearCache();
+		return res.json({
+			results,
+			message: `Nested ${req.params.child} inside ${req.params.group}.`
+		});
+	}catch(error){
+		if(error.name === 'TypeOrValueExistsError' || error.code === 20){
+			return res.status(409).json({message: `"${req.params.child}" is already nested in "${req.params.group}".`});
+		}
+		next(error);
+	}
+});
+
+// DELETE /api/group/:group/nested/:child — un-nest.
+router.delete('/:group/nested/:child', async function(req, res, next){
+	try{
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
+
+		const parent = await Group.get(req.params.group);
+		const child  = await Group.get(req.params.child);
+		const results = await parent.removeMember({dn: child.dn});
+		User.clearCache();
+		return res.json({
+			results,
+			message: `Removed ${req.params.child} from ${req.params.group}.`
+		});
+	}catch(error){
+		// groupOfNames requires at least one member, so emptying a group is a
+		// schema violation rather than a permission problem. Surfacing the raw
+		// error as a 500 makes it look like a bug in the server; it is really a
+		// "you cannot do that, and here is why" -- the same reason the last user
+		// cannot be removed from a group either.
+		if(error.name === 'ObjectClassViolationError' || error.code === 65){
+			return res.status(409).json({
+				message: `"${req.params.child}" is the only member of "${req.params.group}". A group must keep at least one member — add another first.`
+			});
+		}
+		next(error);
+	}
+});
+
 router.put('/owner/:group/:uid', async function(req, res, next){
 	try{
 
@@ -92,6 +173,15 @@ router.put('/:group/:uid', async function(req, res, next){
 			message: `Added user ${req.params.uid} to ${req.params.group} group.`
 		});
 	}catch(error){
+		// Already a member -- surfaced as a plain 500 before, which read as a
+		// server fault for what is really a no-op. Common in practice because
+		// groupOfNames needs at least one member, so whoever creates a group is
+		// seeded into it and is then "added" again by the obvious next click.
+		if(error.name === 'TypeOrValueExistsError' || error.code === 20){
+			return res.status(409).json({
+				message: `"${req.params.uid}" is already a member of "${req.params.group}".`
+			});
+		}
 		next(error);
 	}
 });

nodejs/routes/index.js

@@ -17,6 +17,13 @@ const values ={
   titleIcon: conf.environment !== 'production' ? `<i class="fa-brands fa-dev"></i>` : '',
   name: conf.name,
   logo: conf.logo,
+  // Connection conventions the catalog needs to render "how to reach this"
+  // (conf/base.js `directory`). Safe to expose: a jump-host name and a default
+  // port are public connection info, not credentials.
+  directoryConf: {
+    jumpHost: (conf.directory && conf.directory.jumpHost) || '',
+    defaultSshPort: (conf.directory && conf.directory.defaultSshPort) || 22,
+  },
   ...buildInfo,
 }
 

nodejs/routes/user.js

@@ -4,6 +4,7 @@ const router = require('express').Router();
 const {User} = require('../models/user');
 const {Group} = require('../models/group_ldap');
 const permission = require('../utils/permission');
+const {groupCns} = require('../utils/user_groups');
 const {UserVerification} = require('../models/verification');
 const {InviteToken} = require('../models/token');
 
@@ -78,11 +79,17 @@ router.get('/me', async function(req, res, next){
 
 		// The shared client framework gates the UI on a single effective-rights
 		// flag (the OIDC-client apps send the same key). Here "admin" means
-		// membership in app_sso_admin or the cross-app app_super_admin group;
-		// group-level gating still reads memberOf.
-		const groups = (user.memberOf || []).map(function(dn){
-			return String(dn).split(',')[0].replace(/^cn=/i, '');
-		});
+		// membership in app_sso_admin or the cross-app app_super_admin group.
+		//
+		// Resolved via groupCns rather than read off `memberOf` directly: with
+		// nested groups, memberOf is only transitive when the directory carries
+		// the nestgroup overlay. Against a server without it, an admin who holds
+		// the group through nesting would get isAdmin=false here and silently
+		// lose the whole admin UI -- while still passing every server-side
+		// permission check, which resolves nesting properly. groupCns gives the
+		// same answer in both modes.
+		const groups = await groupCns(user);
+		user.groups = groups;
 		user.isAdmin = groups.includes('app_sso_admin') || groups.includes(permission.SUPER_ADMIN_GROUP);
 
 		return res.json(user);