Add full User and Groups lists to Access page

AGENTS.md

@@ -88,6 +88,7 @@
 - Breadcrumbs come from route `handle.crumb`; use `makeCrumb`/`titleCrumb` and provide a `path` when the parent route redirects (`app/hooks/use-crumbs.ts`). Use `titleCrumb` for side modal forms that should appear in page title but not nav breadcrumbs (check `Crumb.titleOnly` flag).
 - When adding tabs or redirects, wire the canonical link in the path builder (e.g., point to the default tab) and update the sidebar/quick actions as needed.
 - For tabs synced with the URL, use `QueryParamTabs` (`app/components/QueryParamTabs.tsx`).
+- Adding a new _top-level_ path segment (e.g., `/users`) requires a matching console page endpoint in Nexus, or direct navigation and refresh at that URL will 404. Nexus can't use a catchall route (it would overlap API routes), so each top-level console prefix is registered as an `unpublished` endpoint serving the console index: definitions in [`nexus/external-api/src/lib.rs`](https://github.com/oxidecomputer/omicron/blob/4b0ce4b/nexus/external-api/src/lib.rs#L8921-L8928), handlers in [`nexus/src/external_api/http_entrypoints.rs`](https://github.com/oxidecomputer/omicron/blob/4b0ce4b/nexus/src/external_api/http_entrypoints.rs#L8765-L8769). Routes nested under existing prefixes (`/projects/*`, `/system/*`, `/settings/*`, `/lookup/*`) need no Nexus change.
 
 # Forms
 

OMICRON_VERSION

@@ -1 +1 @@
-6d241a7d21d11cb7979122bde9a906d8d4837d09
+26f5e91524fe0ca6c61a8c90f2321d59f323f60e

app/api/__tests__/safety.spec.ts

@@ -89,7 +89,6 @@ it('mock-api is only referenced in test files', () => {
       "test/e2e/ip-pool-silo-config.e2e.ts",
       "test/e2e/profile.e2e.ts",
       "test/e2e/project-access.e2e.ts",
-      "test/e2e/silo-access.e2e.ts",
       "tsconfig.json",
     ]
   `)

app/api/roles.spec.ts

@@ -13,8 +13,9 @@ import {
   deleteRole,
   getEffectiveRole,
   roleOrder,
+  rolesByIdFromPolicy,
   updateRole,
-  userRoleFromPolicies,
+  userScopedRoleEntries,
   type Policy,
 } from './roles'
 
@@ -75,87 +76,76 @@ describe('deleteRole', () => {
   })
 })
 
-const user1 = {
-  id: 'user1',
-}
-
-const groups = [{ id: 'group1' }, { id: 'group2' }]
+test('byGroupThenName sorts as expected', () => {
+  const a = { identityType: 'silo_group' as const, name: 'a' }
+  const b = { identityType: 'silo_group' as const, name: 'b' }
+  const c = { identityType: 'silo_user' as const, name: 'c' }
+  const d = { identityType: 'silo_user' as const, name: 'd' }
+  const e = { identityType: 'silo_user' as const, name: 'e' }
 
-describe('getEffectiveRole', () => {
-  it('returns null when there are no policies', () => {
-    expect(userRoleFromPolicies(user1, groups, [])).toBe(null)
-  })
+  expect([c, e, b, d, a].sort(byGroupThenName)).toEqual([a, b, c, d, e])
+})
 
-  it('returns null when there are no roles', () => {
-    expect(userRoleFromPolicies(user1, groups, [{ roleAssignments: [] }])).toBe(null)
+describe('rolesByIdFromPolicy', () => {
+  it('maps each identity to its role', () => {
+    expect(rolesByIdFromPolicy(abcAdminPolicy)).toEqual(new Map([['abc', 'admin']]))
   })
 
-  it('returns role if user matches directly', () => {
-    expect(
-      userRoleFromPolicies(user1, groups, [
-        {
-          roleAssignments: [
-            { identityId: 'user1', identityType: 'silo_user', roleName: 'admin' },
-          ],
-        },
-      ])
-    ).toEqual('admin')
+  it('keeps the strongest role when an identity has multiple assignments', () => {
+    const policy: Policy = { roleAssignments: [abcViewer, abcAdmin] }
+    expect(rolesByIdFromPolicy(policy)).toEqual(new Map([['abc', 'admin']]))
+    const reversed: Policy = { roleAssignments: [abcAdmin, abcViewer] }
+    expect(rolesByIdFromPolicy(reversed)).toEqual(new Map([['abc', 'admin']]))
   })
+})
 
-  it('returns strongest role if both group and user match', () => {
-    expect(
-      userRoleFromPolicies(user1, groups, [
-        {
-          roleAssignments: [
-            { identityId: 'user1', identityType: 'silo_user', roleName: 'viewer' },
-            { identityId: 'group1', identityType: 'silo_group', roleName: 'collaborator' },
-          ],
-        },
-      ])
-    ).toEqual('collaborator')
+describe('userScopedRoleEntries', () => {
+  it('collapses multiple assignments for the same identity to the strongest role', () => {
+    // API permits multiple assignments for one identity in a single policy
+    const policy: Policy = {
+      roleAssignments: [
+        { identityId: 'u', identityType: 'silo_user', roleName: 'viewer' },
+        { identityId: 'u', identityType: 'silo_user', roleName: 'admin' },
+      ],
+    }
+    expect(userScopedRoleEntries('u', [], policy)).toEqual([
+      { roleName: 'admin', scope: 'silo', source: { type: 'direct' } },
+    ])
   })
 
-  it('ignores groups and users that do not match', () => {
-    expect(
-      userRoleFromPolicies(user1, groups, [
-        {
-          roleAssignments: [
-            { identityId: 'other', identityType: 'silo_user', roleName: 'viewer' },
-            { identityId: 'group3', identityType: 'silo_group', roleName: 'viewer' },
-          ],
-        },
-      ])
-    ).toEqual(null)
+  it('emits one entry per direct assignment and per group, tagged by scope', () => {
+    const group = { id: 'g', displayName: 'g' }
+    const silo: Policy = {
+      roleAssignments: [
+        { identityId: 'g', identityType: 'silo_group', roleName: 'viewer' },
+      ],
+    }
+    const project: Policy = {
+      roleAssignments: [{ identityId: 'u', identityType: 'silo_user', roleName: 'admin' }],
+    }
+    expect(userScopedRoleEntries('u', [group], silo, project)).toEqual([
+      { roleName: 'viewer', scope: 'silo', source: { type: 'group', group } },
+      { roleName: 'admin', scope: 'project', source: { type: 'direct' } },
+    ])
   })
 
-  it('resolves multiple policies', () => {
-    expect(
-      userRoleFromPolicies(user1, groups, [
-        {
-          roleAssignments: [
-            { identityId: 'user1', identityType: 'silo_user', roleName: 'viewer' },
-          ],
-        },
-        {
-          roleAssignments: [
-            { identityId: 'group1', identityType: 'silo_group', roleName: 'admin' },
-          ],
-        },
-      ])
-    ).toEqual('admin')
+  it('keeps a separate entry per group even when the role is identical', () => {
+    const groupA = { id: 'a', displayName: 'a' }
+    const groupB = { id: 'b', displayName: 'b' }
+    const silo: Policy = {
+      roleAssignments: [
+        { identityId: 'a', identityType: 'silo_group', roleName: 'collaborator' },
+        { identityId: 'b', identityType: 'silo_group', roleName: 'collaborator' },
+      ],
+    }
+    // same role via two groups must not collapse — each source is shown separately
+    expect(userScopedRoleEntries('u', [groupA, groupB], silo)).toEqual([
+      { roleName: 'collaborator', scope: 'silo', source: { type: 'group', group: groupA } },
+      { roleName: 'collaborator', scope: 'silo', source: { type: 'group', group: groupB } },
+    ])
   })
 })
 
-test('byGroupThenName sorts as expected', () => {
-  const a = { identityType: 'silo_group' as const, name: 'a' }
-  const b = { identityType: 'silo_group' as const, name: 'b' }
-  const c = { identityType: 'silo_user' as const, name: 'c' }
-  const d = { identityType: 'silo_user' as const, name: 'd' }
-  const e = { identityType: 'silo_user' as const, name: 'e' }
-
-  expect([c, e, b, d, a].sort(byGroupThenName)).toEqual([a, b, c, d, e])
-})
-
 test('allRoles', () => {
   expect(allRoles).toEqual(['admin', 'collaborator', 'limited_collaborator', 'viewer'])
 })