fix(users): allow clearing explicit admin group memberships

apps/aether-gateway/src/handlers/admin/users/lifecycle/update.rs

@@ -152,12 +152,7 @@ pub(in super::super) async fn build_admin_update_user_response(
     };
     let effective_role = role.as_deref().unwrap_or(existing_user.role.as_str());
     let group_ids = if field_presence.contains("group_ids") {
-        let requested_group_ids = normalize_admin_user_group_ids(payload.group_ids);
-        Some(
-            state
-                .include_default_user_group_ids_for_role(&requested_group_ids, effective_role)
-                .await?,
-        )
+        Some(normalize_admin_user_group_ids(payload.group_ids))
     } else if role.is_some() {
         let requested_group_ids = state
             .list_user_groups_for_user(&user_id)

apps/aether-gateway/src/tests/control/admin/users.rs

@@ -1698,6 +1698,83 @@ async fn gateway_returns_conflict_for_admin_lock_user_api_key_when_writer_unavai
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_allows_admin_update_user_to_clear_explicit_groups() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().fallback(any(move |_request: Request| {
+        let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+        async move {
+            *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+            (StatusCode::OK, Body::from("unexpected upstream hit"))
+        }
+    }));
+
+    let user_repository = Arc::new(
+        InMemoryUserReadRepository::seed_auth_users(vec![sample_admin_user("user-1")])
+            .with_export_users(vec![sample_admin_export_user("user-1")]),
+    );
+    let default_group = user_repository
+        .create_user_group(UpsertUserGroupRecord {
+            name: "GPT Adapt".to_string(),
+            description: None,
+            priority: 0,
+            allowed_providers: None,
+            allowed_providers_mode: "unrestricted".to_string(),
+            allowed_api_formats: None,
+            allowed_api_formats_mode: "unrestricted".to_string(),
+            allowed_models: None,
+            allowed_models_mode: "unrestricted".to_string(),
+            rate_limit: None,
+            rate_limit_mode: "system".to_string(),
+        })
+        .await
+        .expect("default group should create")
+        .expect("default group should exist");
+    user_repository
+        .add_user_to_group(&default_group.id, "user-1")
+        .await
+        .expect("default membership should create");
+
+    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(
+                GatewayDataState::with_user_reader_for_tests(user_repository.clone())
+                    .with_system_config_values_for_tests(vec![(
+                        crate::constants::DEFAULT_USER_GROUP_CONFIG_KEY.to_string(),
+                        json!(default_group.id),
+                    )]),
+            ),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .put(format!("{gateway_url}/api/admin/users/user-1"))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({ "group_ids": [] }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["groups"], json!([]));
+    assert!(user_repository
+        .list_user_groups_for_user("user-1")
+        .await
+        .expect("memberships should load")
+        .is_empty());
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_returns_conflict_for_admin_update_user_when_writer_unavailable() {
     let upstream_hits = Arc::new(Mutex::new(0usize));