multiple groups per user

shared/src/models.ts

@@ -1,13 +1,22 @@
 import type { CodeType } from './codeTypes.js';
 
+/** Effective role of a user in a group: superadmin (global flag) > group admin > member. */
 export const ROLES = ['user', 'admin', 'superadmin'] as const;
 export type Role = (typeof ROLES)[number];
 
+/** Role of a membership in one group. A user belongs to one or more groups. */
+export const GROUP_ROLES = ['user', 'admin'] as const;
+export type GroupRole = (typeof GROUP_ROLES)[number];
+
 export interface Group {
   id: string;
   name: string;
 }
 
+export interface GroupMembership extends Group {
+  role: GroupRole;
+}
+
 export interface ImageRef {
   id: string;
   file: string;
@@ -41,22 +50,31 @@ export interface AccessKeyView {
   deepLink: string;
 }
 
+/** A member of the current group, as shown to its admins. */
 export interface UserView {
   email: string;
-  groupId: string;
-  role: Role;
+  superadmin: boolean;
+  /** Role in the current group. */
+  role: GroupRole;
+  /** All groups of the user. */
+  groups: GroupMembership[];
   keys: AccessKeyView[];
 }
 
 export interface MeResponse {
   email: string;
+  superadmin: boolean;
+  /** Effective role in the current group. */
   role: Role;
-  group: Group;
+  groups: GroupMembership[];
   currentGroup: Group;
 }
 
 export interface ApiAuthResponse {
   email: string;
+  /** All groups of the key's owner (one or more). */
+  groups: Group[];
+  /** First group: the one served by the group-less /cards routes (apps from before multi-group). */
   group: Group;
 }
 

shared/src/schemas.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { CODE_TYPES } from './codeTypes.js';
-import { ROLES } from './models.js';
+import { GROUP_ROLES } from './models.js';
 
 export const colorSchema = z.string().regex(/^#[0-9a-fA-F]{6}$/, 'Color must be #RRGGBB');
 
@@ -63,15 +63,16 @@ export const groupInputSchema = z.object({
   name: z.string().trim().min(1, 'Name is required').max(100),
 });
 
+/** Adds a user to the current group (creates the user when the email is new). */
 export const userCreateSchema = z.object({
   email: emailSchema,
-  role: z.enum(ROLES).default('user'),
-  groupId: z.string().optional(),
+  role: z.enum(GROUP_ROLES).default('user'),
 });
 
+/** Role in the current group; `superadmin` is the global flag (superadmins only). */
 export const userPatchSchema = z.object({
-  role: z.enum(ROLES).optional(),
-  groupId: z.string().optional(),
+  role: z.enum(GROUP_ROLES).optional(),
+  superadmin: z.boolean().optional(),
 });
 
 export const keyCreateSchema = z.object({