chore: regenerate OpenAPI spec and TypeScript types for RBAC endpoints

Remove dead UserInfo type export, patch PositionedNode.children.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/schema.d.ts

@@ -4,23 +4,6 @@
  */
 
 export interface paths {
-    "/admin/users/{userId}/roles": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /** Update user roles */
-        put: operations["updateRoles"];
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/admin/thresholds": {
         parameters: {
             query?: never;
@@ -39,6 +22,25 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/roles/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get role by ID with effective principals */
+        get: operations["getRole"];
+        /** Update a custom role */
+        put: operations["updateRole"];
+        post?: never;
+        /** Delete a custom role */
+        delete: operations["deleteRole"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/oidc": {
         parameters: {
             query?: never;
@@ -58,6 +60,25 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/groups/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get group by ID with effective roles */
+        get: operations["getGroup"];
+        /** Update group name or parent */
+        put: operations["updateGroup"];
+        post?: never;
+        /** Delete group */
+        delete: operations["deleteGroup"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/search/executions": {
         parameters: {
             query?: never;
@@ -327,6 +348,60 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/users/{userId}/roles/{roleId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Assign a role to a user */
+        post: operations["assignRoleToUser"];
+        /** Remove a role from a user */
+        delete: operations["removeRoleFromUser"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{userId}/groups/{groupId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Add a user to a group */
+        post: operations["addUserToGroup"];
+        /** Remove a user from a group */
+        delete: operations["removeUserFromGroup"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List all roles (system and custom) */
+        get: operations["listRoles"];
+        put?: never;
+        /** Create a custom role */
+        post: operations["createRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/oidc/test": {
         parameters: {
             query?: never;
@@ -344,6 +419,42 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/groups": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List all groups with hierarchy and effective roles */
+        get: operations["listGroups"];
+        put?: never;
+        /** Create a new group */
+        post: operations["createGroup"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/groups/{id}/roles/{roleId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Assign a role to a group */
+        post: operations["assignRoleToGroup"];
+        /** Remove a role from a group */
+        delete: operations["removeRoleFromGroup"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/database/queries/{pid}/kill": {
         parameters: {
             query?: never;
@@ -533,7 +644,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List all users */
+        /** List all users with RBAC detail */
         get: operations["listUsers"];
         put?: never;
         post?: never;
@@ -550,7 +661,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Get user by ID */
+        /** Get user by ID with RBAC detail */
         get: operations["getUser"];
         put?: never;
         post?: never;
@@ -561,6 +672,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/rbac/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get RBAC statistics for the dashboard */
+        get: operations["getStats"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/opensearch/status": {
         parameters: {
             query?: never;
@@ -735,9 +863,6 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
-        RolesRequest: {
-            roles?: string[];
-        };
         /** @description Database monitoring thresholds */
         DatabaseThresholdsRequest: {
             /**
@@ -833,6 +958,11 @@ export interface components {
             database?: components["schemas"]["DatabaseThresholds"];
             opensearch?: components["schemas"]["OpenSearchThresholds"];
         };
+        UpdateRoleRequest: {
+            name?: string;
+            description?: string;
+            scope?: string;
+        };
         /** @description OIDC configuration update request */
         OidcAdminConfigRequest: {
             enabled?: boolean;
@@ -860,6 +990,11 @@ export interface components {
             autoSignup?: boolean;
             displayNameClaim?: string;
         };
+        UpdateGroupRequest: {
+            name?: string;
+            /** Format: uuid */
+            parentGroupId?: string;
+        };
         SearchRequest: {
             status?: string;
             /** Format: date-time */
@@ -978,11 +1113,21 @@ export interface components {
             /** Format: int32 */
             targetCount?: number;
         };
+        CreateRoleRequest: {
+            name?: string;
+            description?: string;
+            scope?: string;
+        };
         /** @description OIDC provider connectivity test result */
         OidcTestResult: {
             status: string;
             authorizationEndpoint: string;
         };
+        CreateGroupRequest: {
+            name?: string;
+            /** Format: uuid */
+            parentGroupId?: string;
+        };
         ExecutionStats: {
             /** Format: int64 */
             totalCount: number;
@@ -1107,14 +1252,59 @@ export interface components {
             /** Format: int64 */
             timeout?: number;
         };
-        UserInfo: {
+        GroupSummary: {
-            userId: string;
+            /** Format: uuid */
-            provider: string;
+            id?: string;
-            email: string;
+            name?: string;
-            displayName: string;
+        };
-            roles: string[];
+        RoleSummary: {
+            /** Format: uuid */
+            id?: string;
+            name?: string;
+            system?: boolean;
+            source?: string;
+        };
+        UserDetail: {
+            userId?: string;
+            provider?: string;
+            email?: string;
+            displayName?: string;
             /** Format: date-time */
-            createdAt: string;
+            createdAt?: string;
+            directRoles?: components["schemas"]["RoleSummary"][];
+            directGroups?: components["schemas"]["GroupSummary"][];
+            effectiveRoles?: components["schemas"]["RoleSummary"][];
+            effectiveGroups?: components["schemas"]["GroupSummary"][];
+        };
+        RoleDetail: {
+            /** Format: uuid */
+            id?: string;
+            name?: string;
+            description?: string;
+            scope?: string;
+            system?: boolean;
+            /** Format: date-time */
+            createdAt?: string;
+            assignedGroups?: components["schemas"]["GroupSummary"][];
+            directUsers?: components["schemas"]["UserSummary"][];
+            effectivePrincipals?: components["schemas"]["UserSummary"][];
+        };
+        UserSummary: {
+            userId?: string;
+            displayName?: string;
+            provider?: string;
+        };
+        RbacStats: {
+            /** Format: int32 */
+            userCount?: number;
+            /** Format: int32 */
+            activeUserCount?: number;
+            /** Format: int32 */
+            groupCount?: number;
+            /** Format: int32 */
+            maxGroupDepth?: number;
+            /** Format: int32 */
+            roleCount?: number;
         };
         /** @description OpenSearch cluster status */
         OpenSearchStatusResponse: {
@@ -1264,6 +1454,19 @@ export interface components {
              */
             totalPages?: number;
         };
+        GroupDetail: {
+            /** Format: uuid */
+            id?: string;
+            name?: string;
+            /** Format: uuid */
+            parentGroupId?: string;
+            /** Format: date-time */
+            createdAt?: string;
+            directRoles?: components["schemas"]["RoleSummary"][];
+            effectiveRoles?: components["schemas"]["RoleSummary"][];
+            members?: components["schemas"]["UserSummary"][];
+            childGroups?: components["schemas"]["GroupSummary"][];
+        };
         /** @description Table size and row count information */
         TableSizeResponse: {
             /** @description Table name */
@@ -1379,7 +1582,7 @@ export interface components {
             username?: string;
             action?: string;
             /** @enum {string} */
-            category?: "INFRA" | "AUTH" | "USER_MGMT" | "CONFIG";
+            category?: "INFRA" | "AUTH" | "USER_MGMT" | "CONFIG" | "RBAC";
             target?: string;
             detail?: {
                 [key: string]: Record<string, never>;
@@ -1398,37 +1601,6 @@ export interface components {
 }
 export type $defs = Record<string, never>;
 export interface operations {
-    updateRoles: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                userId: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["RolesRequest"];
-            };
-        };
-        responses: {
-            /** @description Roles updated */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description User not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
     getThresholds: {
         parameters: {
             query?: never;
@@ -1473,6 +1645,109 @@ export interface operations {
             };
         };
     };
+    getRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role found */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["RoleDetail"];
+                };
+            };
+            /** @description Role not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["RoleDetail"];
+                };
+            };
+        };
+    };
+    updateRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description Role updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Cannot modify system role */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Role not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    deleteRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Cannot delete system role */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Role not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     getConfig: {
         parameters: {
             query?: never;
@@ -1544,6 +1819,102 @@ export interface operations {
             };
         };
     };
+    getGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Group found */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["GroupDetail"];
+                };
+            };
+            /** @description Group not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["GroupDetail"];
+                };
+            };
+        };
+    };
+    updateGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateGroupRequest"];
+            };
+        };
+        responses: {
+            /** @description Group updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Group not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Cycle detected in group hierarchy */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    deleteGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Group deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Group not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     searchGet: {
         parameters: {
             query?: {
@@ -2045,6 +2416,143 @@ export interface operations {
             };
         };
     };
+    assignRoleToUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role assigned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description User or role not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    removeRoleFromUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    addUserToGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+                groupId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User added to group */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    removeUserFromGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+                groupId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User removed from group */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role list returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["RoleDetail"][];
+                };
+            };
+        };
+    };
+    createRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description Role created */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+    };
     testConnection: {
         parameters: {
             query?: never;
@@ -2074,6 +2582,108 @@ export interface operations {
             };
         };
     };
+    listGroups: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Group list returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["GroupDetail"][];
+                };
+            };
+        };
+    };
+    createGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateGroupRequest"];
+            };
+        };
+        responses: {
+            /** @description Group created */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+    };
+    assignRoleToGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role assigned to group */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Group not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    removeRoleFromGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role removed from group */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Group not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     killQuery: {
         parameters: {
             query?: never;
@@ -2395,7 +3005,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "*/*": components["schemas"]["UserInfo"][];
+                    "*/*": components["schemas"]["UserDetail"][];
                 };
             };
         };
@@ -2417,7 +3027,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "*/*": components["schemas"]["UserInfo"];
+                    "*/*": components["schemas"]["UserDetail"];
                 };
             };
             /** @description User not found */
@@ -2426,7 +3036,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "*/*": components["schemas"]["UserInfo"];
+                    "*/*": components["schemas"]["UserDetail"];
                 };
             };
         };
@@ -2451,6 +3061,26 @@ export interface operations {
             };
         };
     };
+    getStats: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description RBAC stats returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "*/*": components["schemas"]["RbacStats"];
+                };
+            };
+        };
+    };
     getStatus: {
         parameters: {
             query?: never;

ui/src/api/types.ts

@@ -6,7 +6,6 @@ export type ExecutionDetail = components['schemas']['ExecutionDetail'];
 export type ExecutionStats = components['schemas']['ExecutionStats'];
 export type StatsTimeseries = components['schemas']['StatsTimeseries'];
 export type TimeseriesBucket = components['schemas']['TimeseriesBucket'];
-export type UserInfo = components['schemas']['UserInfo'];
 export type ProcessorNode = components['schemas']['ProcessorNode'];
 export type AgentInstance = components['schemas']['AgentInstanceResponse'];
 export type OidcAdminConfigResponse = components['schemas']['OidcAdminConfigResponse'];