The Groups column is already persisted on users.User (migration
202505141323) and populated from claims.Groups in FromClaim. This
makes the value visible through the gRPC/REST surface so external
tools (notably Headplane, which is the motivation for storing the
claim in the first place) can read group membership without
poking at the database.
- proto/headscale/v1/user.proto: add `repeated string groups = 9;`
with a doc comment describing where the value comes from.
- gen/go/headscale/v1/user.pb.go,
gen/openapiv2/headscale/v1/headscale.swagger.json: regenerated
via `buf generate --template ../buf.gen.yaml -o .. ../proto`.
- hscontrol/types/users.go: populate v1.User.Groups in Proto() by
decoding the JSON-encoded users.groups column via GetGroups().
- integration/oidc_groups_test.go: drop the sqlite3-via-Execute hack
and verify groups through headscale.ListUsers() like every other
user-state integration test.
Bugs found by running the real test suite after merging upstream:
- types/types_clone.go, types/types_view.go: extend the regeneration
guard struct literals to include the new Groups field, and add a
UserView.Groups() accessor. Generated files normally rebuilt via
cloner / viewer; touched by hand here pending make generate.
- db/db.go: the migration adding the groups column ran after
202505141324, which calls ListUsers() through the User struct that
now includes Groups. Move the column-add to 202505141323 so the
schema is in place before any migration loads users. Register the
new ID in the FK-disabled migration list.
- db/db.go: 202507021200 recreates all tables from inline SQL during
the SQLite schema migration; add groups to both the CREATE TABLE
users statement and the INSERT INTO users ... SELECT FROM users_old
so the column survives the recreation. Also fix a copy-paste bug
in the Rollback closure that referenced tx instead of db.
- db/schema.sql: add the groups column to the canonical schema so
squibble.Validate accepts databases produced by the new migration
chain. Verified against all 7 historical sqlite dumps in
hscontrol/db/testdata/sqlite.
- types/users_test.go: the casby-oidc-claim case now exercises group
storage; update the want to include the JSON-encoded groups column.
- integration/oidc_groups_test.go: replace the aspirational draft
(which referenced assertNoErr, scenario.usernames, hsic.WithTLS and
other symbols that do not exist) with a focused test that follows
the auth_oidc_test.go pattern. Verifies the groups column directly
via sqlite3 inside the headscale container since the gRPC User
message does not expose Groups.
- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing
