feat(groups): add fail-closed admission management

packages/auth/src/index.ts

@@ -111,6 +111,10 @@ export function hashToken(token: string) {
   return createHash("sha256").update(token).digest("hex");
 }
 
+export function enabledAccessGroup<T extends { accessEnabled: boolean }>(assignedGroups: T[]) {
+  return assignedGroups.find((group) => group.accessEnabled) ?? null;
+}
+
 export function verifyHashedToken(providedToken: string, expectedHash: string) {
   const provided = Buffer.from(hashToken(providedToken), "utf8");
   const expected = Buffer.from(expectedHash, "utf8");

packages/auth/test/group-access.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { enabledAccessGroup } from "../src/index";
+
+describe("group-based admission", () => {
+  it("denies default-off users and allows access when any assigned group is enabled", () => {
+    expect(enabledAccessGroup([{ name: "everyone", accessEnabled: false }])).toBeNull();
+    expect(enabledAccessGroup([
+      { name: "everyone", accessEnabled: false },
+      { name: "ops", accessEnabled: true },
+    ])).toEqual({ name: "ops", accessEnabled: true });
+  });
+});