feat: add user groups and inherited access policies

apps/aether-gateway/src/handlers/admin/users/lifecycle/create.rs

@@ -1,10 +1,12 @@
 use super::super::{
     admin_default_user_initial_gift, build_admin_users_read_only_response,
-    normalize_admin_optional_user_email, normalize_admin_user_api_formats,
-    normalize_admin_user_role, normalize_admin_user_string_list, normalize_admin_username,
-    validate_admin_user_password, AdminCreateUserRequest,
+    legacy_admin_list_policy_mode, legacy_admin_rate_limit_policy_mode,
+    normalize_admin_list_policy_mode, normalize_admin_optional_user_email,
+    normalize_admin_rate_limit_policy_mode, normalize_admin_user_api_formats,
+    normalize_admin_user_group_ids, normalize_admin_user_role, normalize_admin_user_string_list,
+    normalize_admin_username, validate_admin_user_password, AdminCreateUserRequest,
 };
-use super::support::{admin_user_password_policy, build_admin_user_payload};
+use super::support::{admin_user_password_policy, build_admin_user_payload_with_groups};
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::attach_admin_audit_response;
 use crate::GatewayError;
@@ -136,6 +138,72 @@ pub(in super::super) async fn build_admin_create_user_response(
                     .into_response())
             }
         };
+    let allowed_providers_mode = match payload.allowed_providers_mode.as_deref() {
+        Some(value) => match normalize_admin_list_policy_mode(value) {
+            Ok(value) => value,
+            Err(detail) => {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": detail })),
+                )
+                    .into_response())
+            }
+        },
+        None => legacy_admin_list_policy_mode(&allowed_providers),
+    };
+    let allowed_api_formats_mode = match payload.allowed_api_formats_mode.as_deref() {
+        Some(value) => match normalize_admin_list_policy_mode(value) {
+            Ok(value) => value,
+            Err(detail) => {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": detail })),
+                )
+                    .into_response())
+            }
+        },
+        None => legacy_admin_list_policy_mode(&allowed_api_formats),
+    };
+    let allowed_models_mode = match payload.allowed_models_mode.as_deref() {
+        Some(value) => match normalize_admin_list_policy_mode(value) {
+            Ok(value) => value,
+            Err(detail) => {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": detail })),
+                )
+                    .into_response())
+            }
+        },
+        None => legacy_admin_list_policy_mode(&allowed_models),
+    };
+    let rate_limit_mode = match payload.rate_limit_mode.as_deref() {
+        Some(value) => match normalize_admin_rate_limit_policy_mode(value) {
+            Ok(value) => value,
+            Err(detail) => {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": detail })),
+                )
+                    .into_response())
+            }
+        },
+        None => legacy_admin_rate_limit_policy_mode(payload.rate_limit),
+    };
+    let group_ids = normalize_admin_user_group_ids(payload.group_ids);
+    let groups = if group_ids.is_empty() {
+        Vec::new()
+    } else {
+        let groups = state.list_user_groups_by_ids(&group_ids).await?;
+        if groups.len() != group_ids.len() {
+            return Ok((
+                http::StatusCode::BAD_REQUEST,
+                Json(json!({ "detail": "用户分组不存在" })),
+            )
+                .into_response());
+        }
+        groups
+    };
 
     if let Some(email) = email.as_deref() {
         if state.find_user_auth_by_identifier(email).await?.is_some() {
@@ -209,12 +277,33 @@ pub(in super::super) async fn build_admin_create_user_response(
             "当前为只读模式，无法初始化用户钱包",
         ));
     }
+    let Some(user) = state
+        .update_local_auth_user_policy_modes(
+            &user.id,
+            Some(allowed_providers_mode.clone()),
+            Some(allowed_api_formats_mode.clone()),
+            Some(allowed_models_mode.clone()),
+            Some(rate_limit_mode.clone()),
+        )
+        .await?
+    else {
+        return Ok(build_admin_users_read_only_response(
+            "当前为只读模式，无法创建用户",
+        ));
+    };
+    if !group_ids.is_empty() {
+        state
+            .replace_user_groups_for_user(&user.id, &group_ids)
+            .await?;
+    }
 
     Ok(attach_admin_audit_response(
-        Json(build_admin_user_payload(
+        Json(build_admin_user_payload_with_groups(
             &user,
             payload.rate_limit,
+            Some(rate_limit_mode.as_str()),
             payload.unlimited,
+            &groups,
         ))
         .into_response(),
         "admin_user_created",

apps/aether-gateway/src/handlers/admin/users/lifecycle/reads.rs

@@ -1,6 +1,7 @@
 use super::super::{build_admin_users_bad_request_response, format_optional_datetime_iso8601};
 use super::support::{
-    admin_user_id_from_detail_path, build_admin_user_payload, find_admin_export_user,
+    admin_user_id_from_detail_path, build_admin_user_export_payload,
+    build_admin_user_payload_with_groups, find_admin_export_user,
 };
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::{query_param_optional_bool, query_param_value};
@@ -32,6 +33,9 @@ pub(in super::super) async fn build_admin_list_users_response(
     let search = query_param_value(request_context.query_string(), "search")
         .map(|value| value.trim().to_string())
         .filter(|value| !value.is_empty());
+    let group_id = query_param_value(request_context.query_string(), "group_id")
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
 
     let paged_rows = state
         .list_export_users_page(&aether_data::repository::users::UserExportListQuery {
@@ -40,16 +44,25 @@ pub(in super::super) async fn build_admin_list_users_response(
             role: role.clone(),
             is_active,
             search,
+            group_id,
         })
         .await?;
     let user_ids = paged_rows
         .iter()
         .map(|row| row.id.clone())
         .collect::<Vec<_>>();
-    let (auth_rows_result, wallet_rows_result, usage_totals_result) = tokio::join!(
+    let (
+        auth_rows_result,
+        wallet_rows_result,
+        usage_totals_result,
+        memberships_result,
+        groups_result,
+    ) = tokio::join!(
         state.list_user_auth_by_ids(&user_ids),
         state.list_wallet_snapshots_by_user_ids(&user_ids),
         state.summarize_usage_totals_by_user_ids(&user_ids),
+        state.list_user_group_memberships_by_user_ids(&user_ids),
+        state.list_user_groups(),
     );
     let auth_by_user_id = auth_rows_result?
         .into_iter()
@@ -63,6 +76,17 @@ pub(in super::super) async fn build_admin_list_users_response(
         .into_iter()
         .map(|item| (item.user_id.clone(), item))
         .collect::<BTreeMap<_, _>>();
+    let groups_by_id = groups_result?
+        .into_iter()
+        .map(|group| (group.id.clone(), group))
+        .collect::<BTreeMap<_, _>>();
+    let mut group_ids_by_user_id = BTreeMap::<String, Vec<String>>::new();
+    for membership in memberships_result? {
+        group_ids_by_user_id
+            .entry(membership.user_id)
+            .or_default()
+            .push(membership.group_id);
+    }
 
     let mut payload = Vec::with_capacity(paged_rows.len());
     for row in paged_rows {
@@ -71,25 +95,25 @@ pub(in super::super) async fn build_admin_list_users_response(
             .get(&row.id)
             .is_some_and(|wallet| wallet.limit_mode.eq_ignore_ascii_case("unlimited"));
         let usage_totals = usage_totals_by_user_id.get(&row.id);
-        payload.push(json!({
-            "id": row.id,
-            "email": row.email,
-            "username": row.username,
-            "role": row.role,
-            "allowed_providers": row.allowed_providers,
-            "allowed_api_formats": row.allowed_api_formats,
-            "allowed_models": row.allowed_models,
-            "rate_limit": row.rate_limit,
-            "unlimited": unlimited,
-            "is_active": row.is_active,
-            "created_at": format_optional_datetime_iso8601(auth.as_ref().and_then(|user| user.created_at)),
-            "updated_at": serde_json::Value::Null,
-            "last_login_at": format_optional_datetime_iso8601(
-                auth.as_ref().and_then(|user| user.last_login_at),
-            ),
-            "request_count": usage_totals.map(|item| item.request_count).unwrap_or_default(),
-            "total_tokens": usage_totals.map(|item| item.total_tokens).unwrap_or_default(),
-        }));
+        let groups = group_ids_by_user_id
+            .get(&row.id)
+            .into_iter()
+            .flatten()
+            .filter_map(|group_id| groups_by_id.get(group_id).cloned())
+            .collect::<Vec<_>>();
+        payload.push(build_admin_user_export_payload(
+            &row,
+            unlimited,
+            auth.as_ref().and_then(|user| user.created_at),
+            auth.as_ref().and_then(|user| user.last_login_at),
+            usage_totals
+                .map(|item| item.request_count)
+                .unwrap_or_default(),
+            usage_totals
+                .map(|item| item.total_tokens)
+                .unwrap_or_default(),
+            &groups,
+        ));
     }
 
     Ok(Json(payload).into_response())
@@ -116,13 +140,16 @@ pub(in super::super) async fn build_admin_get_user_response(
         ))
         .await?;
     let export_row = find_admin_export_user(state, &user_id).await?;
+    let groups = state.list_user_groups_for_user(&user_id).await?;
     let unlimited = wallet
         .as_ref()
         .is_some_and(|wallet| wallet.limit_mode.eq_ignore_ascii_case("unlimited"));
-    Ok(Json(build_admin_user_payload(
+    Ok(Json(build_admin_user_payload_with_groups(
         &user,
         export_row.as_ref().and_then(|row| row.rate_limit),
+        export_row.as_ref().map(|row| row.rate_limit_mode.as_str()),
         unlimited,
+        &groups,
     ))
     .into_response())
 }

apps/aether-gateway/src/handlers/admin/users/lifecycle/support.rs

@@ -36,6 +36,16 @@ pub(super) fn build_admin_user_payload(
     user: &aether_data::repository::users::StoredUserAuthRecord,
     rate_limit: Option<i32>,
     unlimited: bool,
+) -> serde_json::Value {
+    build_admin_user_payload_with_groups(user, rate_limit, None, unlimited, &[])
+}
+
+pub(super) fn build_admin_user_payload_with_groups(
+    user: &aether_data::repository::users::StoredUserAuthRecord,
+    rate_limit: Option<i32>,
+    rate_limit_mode: Option<&str>,
+    unlimited: bool,
+    groups: &[aether_data::repository::users::StoredUserGroup],
 ) -> serde_json::Value {
     json!({
         "id": user.id,
@@ -43,14 +53,233 @@ pub(super) fn build_admin_user_payload(
         "username": user.username,
         "role": user.role,
         "allowed_providers": user.allowed_providers,
+        "allowed_providers_mode": user.allowed_providers_mode,
         "allowed_api_formats": user.allowed_api_formats,
+        "allowed_api_formats_mode": user.allowed_api_formats_mode,
         "allowed_models": user.allowed_models,
+        "allowed_models_mode": user.allowed_models_mode,
         "rate_limit": rate_limit,
+        "rate_limit_mode": rate_limit_mode.unwrap_or("system"),
         "unlimited": unlimited,
         "is_active": user.is_active,
         "created_at": format_optional_datetime_iso8601(user.created_at),
         "updated_at": serde_json::Value::Null,
         "last_login_at": format_optional_datetime_iso8601(user.last_login_at),
+        "groups": groups.iter().map(user_group_badge_payload).collect::<Vec<_>>(),
+        "effective_policy": effective_policy_payload(
+            user.allowed_providers.as_ref(),
+            &user.allowed_providers_mode,
+            user.allowed_api_formats.as_ref(),
+            &user.allowed_api_formats_mode,
+            user.allowed_models.as_ref(),
+            &user.allowed_models_mode,
+            rate_limit,
+            rate_limit_mode.unwrap_or("system"),
+            groups,
+        ),
+    })
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(super) fn build_admin_user_export_payload(
+    row: &aether_data::repository::users::StoredUserExportRow,
+    unlimited: bool,
+    created_at: Option<chrono::DateTime<chrono::Utc>>,
+    last_login_at: Option<chrono::DateTime<chrono::Utc>>,
+    request_count: u64,
+    total_tokens: u64,
+    groups: &[aether_data::repository::users::StoredUserGroup],
+) -> serde_json::Value {
+    json!({
+        "id": row.id,
+        "email": row.email,
+        "username": row.username,
+        "role": row.role,
+        "allowed_providers": row.allowed_providers,
+        "allowed_providers_mode": row.allowed_providers_mode,
+        "allowed_api_formats": row.allowed_api_formats,
+        "allowed_api_formats_mode": row.allowed_api_formats_mode,
+        "allowed_models": row.allowed_models,
+        "allowed_models_mode": row.allowed_models_mode,
+        "rate_limit": row.rate_limit,
+        "rate_limit_mode": row.rate_limit_mode,
+        "unlimited": unlimited,
+        "is_active": row.is_active,
+        "created_at": format_optional_datetime_iso8601(created_at),
+        "updated_at": serde_json::Value::Null,
+        "last_login_at": format_optional_datetime_iso8601(last_login_at),
+        "request_count": request_count,
+        "total_tokens": total_tokens,
+        "groups": groups.iter().map(user_group_badge_payload).collect::<Vec<_>>(),
+        "effective_policy": effective_policy_payload(
+            row.allowed_providers.as_ref(),
+            &row.allowed_providers_mode,
+            row.allowed_api_formats.as_ref(),
+            &row.allowed_api_formats_mode,
+            row.allowed_models.as_ref(),
+            &row.allowed_models_mode,
+            row.rate_limit,
+            &row.rate_limit_mode,
+            groups,
+        ),
+    })
+}
+
+pub(super) fn user_group_badge_payload(
+    group: &aether_data::repository::users::StoredUserGroup,
+) -> serde_json::Value {
+    json!({
+        "id": group.id,
+        "name": group.name,
+        "priority": group.priority,
+    })
+}
+
+#[allow(clippy::too_many_arguments)]
+fn effective_policy_payload(
+    allowed_providers: Option<&Vec<String>>,
+    allowed_providers_mode: &str,
+    allowed_api_formats: Option<&Vec<String>>,
+    allowed_api_formats_mode: &str,
+    allowed_models: Option<&Vec<String>>,
+    allowed_models_mode: &str,
+    rate_limit: Option<i32>,
+    rate_limit_mode: &str,
+    groups: &[aether_data::repository::users::StoredUserGroup],
+) -> serde_json::Value {
+    let mut sorted_groups = groups.to_vec();
+    sorted_groups.sort_by(|left, right| {
+        right
+            .priority
+            .cmp(&left.priority)
+            .then_with(|| left.name.cmp(&right.name))
+            .then_with(|| left.id.cmp(&right.id))
+    });
+    json!({
+        "allowed_providers": effective_list_policy_payload(
+            allowed_providers,
+            allowed_providers_mode,
+            &sorted_groups,
+            |group| (&group.allowed_providers_mode, group.allowed_providers.as_ref()),
+        ),
+        "allowed_api_formats": effective_list_policy_payload(
+            allowed_api_formats,
+            allowed_api_formats_mode,
+            &sorted_groups,
+            |group| (&group.allowed_api_formats_mode, group.allowed_api_formats.as_ref()),
+        ),
+        "allowed_models": effective_list_policy_payload(
+            allowed_models,
+            allowed_models_mode,
+            &sorted_groups,
+            |group| (&group.allowed_models_mode, group.allowed_models.as_ref()),
+        ),
+        "rate_limit": effective_rate_limit_policy_payload(rate_limit, rate_limit_mode, &sorted_groups),
+    })
+}
+
+fn effective_list_policy_payload(
+    user_values: Option<&Vec<String>>,
+    user_mode: &str,
+    groups: &[aether_data::repository::users::StoredUserGroup],
+    group_field: impl Fn(
+        &aether_data::repository::users::StoredUserGroup,
+    ) -> (&String, Option<&Vec<String>>),
+) -> serde_json::Value {
+    match user_mode {
+        "unrestricted" => policy_payload("unrestricted", serde_json::Value::Null, "user", None),
+        "specific" => policy_payload(
+            "specific",
+            json!(user_values.cloned().unwrap_or_default()),
+            "user",
+            None,
+        ),
+        "deny_all" => policy_payload("deny_all", json!(Vec::<String>::new()), "user", None),
+        "inherit" => {
+            for group in groups {
+                let (mode, values) = group_field(group);
+                match mode.as_str() {
+                    "unrestricted" => {
+                        return policy_payload(
+                            "unrestricted",
+                            serde_json::Value::Null,
+                            "group",
+                            Some(group),
+                        )
+                    }
+                    "specific" => {
+                        return policy_payload(
+                            "specific",
+                            json!(values.cloned().unwrap_or_default()),
+                            "group",
+                            Some(group),
+                        )
+                    }
+                    "deny_all" => {
+                        return policy_payload(
+                            "deny_all",
+                            json!(Vec::<String>::new()),
+                            "group",
+                            Some(group),
+                        )
+                    }
+                    _ => {}
+                }
+            }
+            policy_payload("unrestricted", serde_json::Value::Null, "fallback", None)
+        }
+        _ => policy_payload("unrestricted", serde_json::Value::Null, "fallback", None),
+    }
+}
+
+fn effective_rate_limit_policy_payload(
+    user_rate_limit: Option<i32>,
+    user_mode: &str,
+    groups: &[aether_data::repository::users::StoredUserGroup],
+) -> serde_json::Value {
+    match user_mode {
+        "custom" => policy_payload("custom", json!(user_rate_limit.unwrap_or(0)), "user", None),
+        "system" => policy_payload("system", serde_json::Value::Null, "user", None),
+        "inherit" => {
+            for group in groups {
+                match group.rate_limit_mode.as_str() {
+                    "custom" => {
+                        return policy_payload(
+                            "custom",
+                            json!(group.rate_limit.unwrap_or(0)),
+                            "group",
+                            Some(group),
+                        )
+                    }
+                    "system" => {
+                        return policy_payload(
+                            "system",
+                            serde_json::Value::Null,
+                            "group",
+                            Some(group),
+                        )
+                    }
+                    _ => {}
+                }
+            }
+            policy_payload("system", serde_json::Value::Null, "fallback", None)
+        }
+        _ => policy_payload("system", serde_json::Value::Null, "fallback", None),
+    }
+}
+
+fn policy_payload(
+    mode: &str,
+    value: serde_json::Value,
+    source: &str,
+    group: Option<&aether_data::repository::users::StoredUserGroup>,
+) -> serde_json::Value {
+    json!({
+        "mode": mode,
+        "value": value,
+        "source": source,
+        "group_id": group.map(|group| group.id.as_str()),
+        "group_name": group.map(|group| group.name.as_str()),
     })
 }
 

apps/aether-gateway/src/handlers/admin/users/lifecycle/update.rs

@@ -1,12 +1,14 @@
 use super::super::{
     build_admin_users_bad_request_response, build_admin_users_data_unavailable_response,
-    build_admin_users_read_only_response, normalize_admin_optional_user_email,
-    normalize_admin_user_api_formats, normalize_admin_user_role, normalize_admin_user_string_list,
-    normalize_admin_username, validate_admin_user_password, AdminUpdateUserPatch,
+    build_admin_users_read_only_response, normalize_admin_list_policy_mode,
+    normalize_admin_optional_user_email, normalize_admin_rate_limit_policy_mode,
+    normalize_admin_user_api_formats, normalize_admin_user_group_ids, normalize_admin_user_role,
+    normalize_admin_user_string_list, normalize_admin_username, validate_admin_user_password,
+    AdminUpdateUserPatch,
 };
 use super::support::{
-    admin_user_id_from_detail_path, admin_user_password_policy, build_admin_user_payload,
-    find_admin_export_user,
+    admin_user_id_from_detail_path, admin_user_password_policy,
+    build_admin_user_payload_with_groups, find_admin_export_user,
 };
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::attach_admin_audit_response;
@@ -177,15 +179,105 @@ pub(in super::super) async fn build_admin_update_user_response(
     } else {
         None
     };
+    let allowed_providers_mode = if field_presence.contains("allowed_providers_mode") {
+        match payload.allowed_providers_mode.as_deref() {
+            Some(value) => match normalize_admin_list_policy_mode(value) {
+                Ok(value) => Some(value),
+                Err(detail) => {
+                    return Ok((
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": detail })),
+                    )
+                        .into_response())
+                }
+            },
+            None => None,
+        }
+    } else {
+        None
+    };
+    let allowed_api_formats_mode = if field_presence.contains("allowed_api_formats_mode") {
+        match payload.allowed_api_formats_mode.as_deref() {
+            Some(value) => match normalize_admin_list_policy_mode(value) {
+                Ok(value) => Some(value),
+                Err(detail) => {
+                    return Ok((
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": detail })),
+                    )
+                        .into_response())
+                }
+            },
+            None => None,
+        }
+    } else {
+        None
+    };
+    let allowed_models_mode = if field_presence.contains("allowed_models_mode") {
+        match payload.allowed_models_mode.as_deref() {
+            Some(value) => match normalize_admin_list_policy_mode(value) {
+                Ok(value) => Some(value),
+                Err(detail) => {
+                    return Ok((
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": detail })),
+                    )
+                        .into_response())
+                }
+            },
+            None => None,
+        }
+    } else {
+        None
+    };
+    let rate_limit_mode = if field_presence.contains("rate_limit_mode") {
+        match payload.rate_limit_mode.as_deref() {
+            Some(value) => match normalize_admin_rate_limit_policy_mode(value) {
+                Ok(value) => Some(value),
+                Err(detail) => {
+                    return Ok((
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": detail })),
+                    )
+                        .into_response())
+                }
+            },
+            None => None,
+        }
+    } else {
+        None
+    };
+    let group_ids = if field_presence.contains("group_ids") {
+        Some(normalize_admin_user_group_ids(payload.group_ids))
+    } else {
+        None
+    };
+    if let Some(group_ids) = group_ids.as_ref() {
+        if !group_ids.is_empty() {
+            let groups = state.list_user_groups_by_ids(group_ids).await?;
+            if groups.len() != group_ids.len() {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "用户分组不存在" })),
+                )
+                    .into_response());
+            }
+        }
+    }
     let needs_auth_user_write = email.is_some()
         || username.is_some()
         || payload.password.is_some()
         || role.is_some()
         || field_presence.contains("allowed_providers")
+        || allowed_providers_mode.is_some()
         || field_presence.contains("allowed_api_formats")
+        || allowed_api_formats_mode.is_some()
         || field_presence.contains("allowed_models")
+        || allowed_models_mode.is_some()
         || field_presence.contains("rate_limit")
-        || payload.is_active.is_some();
+        || rate_limit_mode.is_some()
+        || payload.is_active.is_some()
+        || group_ids.is_some();
     if needs_auth_user_write && !state.has_auth_user_write_capability() {
         return Ok(build_admin_users_read_only_response(
             "当前为只读模式，无法更新用户",
@@ -210,6 +302,34 @@ pub(in super::super) async fn build_admin_update_user_response(
                 .into_response());
         }
     }
+    if allowed_providers_mode.is_some()
+        || allowed_api_formats_mode.is_some()
+        || allowed_models_mode.is_some()
+        || rate_limit_mode.is_some()
+    {
+        if state
+            .update_local_auth_user_policy_modes(
+                &user_id,
+                allowed_providers_mode,
+                allowed_api_formats_mode,
+                allowed_models_mode,
+                rate_limit_mode,
+            )
+            .await?
+            .is_none()
+        {
+            return Ok((
+                http::StatusCode::NOT_FOUND,
+                Json(json!({ "detail": "用户不存在" })),
+            )
+                .into_response());
+        }
+    }
+    if let Some(group_ids) = group_ids.as_ref() {
+        state
+            .replace_user_groups_for_user(&user_id, group_ids)
+            .await?;
+    }
 
     if let Some(password) = payload.password.as_deref() {
         let password_policy = admin_user_password_policy(state).await?;
@@ -322,13 +442,21 @@ pub(in super::super) async fn build_admin_update_user_response(
         .as_ref()
         .is_some_and(|wallet| wallet.limit_mode.eq_ignore_ascii_case("unlimited"));
     let export_row = find_admin_export_user(state, &user_id).await?;
+    let groups = state.list_user_groups_for_user(&user_id).await?;
     let rate_limit = export_row
         .as_ref()
         .and_then(|row| row.rate_limit)
         .or(payload.rate_limit);
 
     Ok(attach_admin_audit_response(
-        Json(build_admin_user_payload(&user, rate_limit, unlimited)).into_response(),
+        Json(build_admin_user_payload_with_groups(
+            &user,
+            rate_limit,
+            export_row.as_ref().map(|row| row.rate_limit_mode.as_str()),
+            unlimited,
+            &groups,
+        ))
+        .into_response(),
         "admin_user_updated",
         "update_user",
         "user",