feat(portal): add SSR operations and exclusive groups

packages/auth/test/group-access.test.ts

@@ -1,12 +1,20 @@
 import { describe, expect, it } from "vitest";
-import { enabledAccessGroup } from "../src/index";
+import { resolveEffectiveGroup } from "../src/index";
 
 describe("group-based admission", () => {
-  it("denies default-off users and allows access when any assigned group is enabled", () => {
-    expect(enabledAccessGroup([{ name: "everyone", accessEnabled: false }])).toBeNull();
-    expect(enabledAccessGroup([
-      { name: "everyone", accessEnabled: false },
-      { name: "ops", accessEnabled: true },
-    ])).toEqual({ name: "ops", accessEnabled: true });
+  const everyone = { name: "everyone", accessEnabled: false };
+
+  it("uses the default group only when a user has no explicit assignment", () => {
+    expect(resolveEffectiveGroup(null, everyone)).toEqual(everyone);
+    expect(resolveEffectiveGroup({ name: "limited", accessEnabled: true }, everyone)).toEqual({
+      name: "limited",
+      accessEnabled: true,
+    });
+  });
+
+  it("does not combine default and explicitly assigned group access", () => {
+    const enabledDefault = { name: "everyone", accessEnabled: true };
+    const limited = { name: "limited", accessEnabled: false };
+    expect(resolveEffectiveGroup(limited, enabledDefault)?.accessEnabled).toBe(false);
   });
 });