feat(portal): add SSR operations and exclusive groups

packages/auth/src/index.ts

@@ -111,8 +111,8 @@ export function hashToken(token: string) {
   return createHash("sha256").update(token).digest("hex");
 }
 
-export function enabledAccessGroup<T extends { accessEnabled: boolean }>(assignedGroups: T[]) {
-  return assignedGroups.find((group) => group.accessEnabled) ?? null;
+export function resolveEffectiveGroup<T>(explicitGroup: T | null, defaultGroup: T | null) {
+  return explicitGroup ?? defaultGroup;
 }
 
 export function verifyHashedToken(providedToken: string, expectedHash: string) {

packages/auth/test/group-access.test.ts

@@ -1,12 +1,20 @@
 import { describe, expect, it } from "vitest";
-import { enabledAccessGroup } from "../src/index";
+import { resolveEffectiveGroup } from "../src/index";
 
 describe("group-based admission", () => {
-  it("denies default-off users and allows access when any assigned group is enabled", () => {
-    expect(enabledAccessGroup([{ name: "everyone", accessEnabled: false }])).toBeNull();
-    expect(enabledAccessGroup([
-      { name: "everyone", accessEnabled: false },
-      { name: "ops", accessEnabled: true },
-    ])).toEqual({ name: "ops", accessEnabled: true });
+  const everyone = { name: "everyone", accessEnabled: false };
+
+  it("uses the default group only when a user has no explicit assignment", () => {
+    expect(resolveEffectiveGroup(null, everyone)).toEqual(everyone);
+    expect(resolveEffectiveGroup({ name: "limited", accessEnabled: true }, everyone)).toEqual({
+      name: "limited",
+      accessEnabled: true,
+    });
+  });
+
+  it("does not combine default and explicitly assigned group access", () => {
+    const enabledDefault = { name: "everyone", accessEnabled: true };
+    const limited = { name: "limited", accessEnabled: false };
+    expect(resolveEffectiveGroup(limited, enabledDefault)?.accessEnabled).toBe(false);
   });
 });