Module groups 

Local group membership: GroupGraph, the DB-backed store, and closure resolution Local group membership: the groups/group_members tables (migration v10, rust/ingestion/src/sql_migration.rs), a whole-table snapshot cache (crate::groups::DbGroupsSource) mirroring crate::db_audience_grants::DbAudienceGrantsSource, and crate::groups::GroupGraph, the in-memory closure resolver over a loaded snapshot.

A group_members.member row is a selector in exactly the vocabulary audience_grants.selector uses (*, user:<email>, group:<name>), so nesting is the group: arm of the same predicate rather than a special case – see crate::groups::GroupGraph::closure.

Structs

DbGroupsConfig

Cache-TTL knob for DbGroupsSource, read from env with a default.

GroupGraph

A loaded, in-memory snapshot of the groups/group_members tables, and the closure resolver over it. Sync and infallible once built: every method here is a walk over an already-loaded snapshot, never a query.

GroupsLoader

SnapshotLoader for the groups/group_members tables.

Constants

ADMINS_GROUP

The reserved group whose membership is admin-ness – AuthContext::is_admin is exactly “does this caller’s closure contain this name”.

Functions

is_valid_group_name

true if name is a valid group name: [A-Za-z0-9_-]{1,255} – the same charset is_valid_audience uses, checked in bytes, so a group name is URL-safe and a distinct kind of thing from an email.

Type Aliases

DbGroupsSource

The whole-table snapshot cache described in the module doc comment.