feat(users): classify batch admin routes

apps/aether-gateway/src/control/route/admin/operations_families.rs

@@ -490,6 +490,32 @@ pub(super) fn classify_admin_operations_family_route(
             "admin:users",
             false,
         ))
+    } else if method == http::Method::POST
+        && matches!(
+            normalized_path,
+            "/api/admin/users/resolve-selection" | "/api/admin/users/resolve-selection/"
+        )
+    {
+        Some(classified(
+            "admin_proxy",
+            "users_manage",
+            "resolve_user_selection",
+            "admin:users",
+            false,
+        ))
+    } else if method == http::Method::POST
+        && matches!(
+            normalized_path,
+            "/api/admin/users/batch-action" | "/api/admin/users/batch-action/"
+        )
+    {
+        Some(classified(
+            "admin_proxy",
+            "users_manage",
+            "batch_action_users",
+            "admin:users",
+            false,
+        ))
     } else if method == http::Method::GET
         && normalized_path.starts_with("/api/admin/users/")
         && normalized_path.ends_with("/sessions")

apps/aether-gateway/src/control/tests/admin_users.rs

@@ -36,6 +36,38 @@ fn classifies_admin_users_create_as_admin_proxy_route() {
     assert!(!decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn classifies_admin_user_batch_routes_as_admin_proxy_route() {
+    let headers = headers(&[]);
+
+    let resolve_uri: Uri = "/api/admin/users/resolve-selection"
+        .parse()
+        .expect("uri should parse");
+    let resolve = classify_control_route(&http::Method::POST, &resolve_uri, &headers)
+        .expect("route should classify");
+    assert_eq!(resolve.route_family.as_deref(), Some("users_manage"));
+    assert_eq!(
+        resolve.route_kind.as_deref(),
+        Some("resolve_user_selection")
+    );
+    assert_eq!(
+        resolve.auth_endpoint_signature.as_deref(),
+        Some("admin:users")
+    );
+
+    let batch_uri: Uri = "/api/admin/users/batch-action"
+        .parse()
+        .expect("uri should parse");
+    let batch = classify_control_route(&http::Method::POST, &batch_uri, &headers)
+        .expect("route should classify");
+    assert_eq!(batch.route_family.as_deref(), Some("users_manage"));
+    assert_eq!(batch.route_kind.as_deref(), Some("batch_action_users"));
+    assert_eq!(
+        batch.auth_endpoint_signature.as_deref(),
+        Some("admin:users")
+    );
+}
+
 #[test]
 fn classifies_admin_user_detail_routes_as_admin_proxy_route() {
     let headers = headers(&[]);

apps/aether-gateway/src/handlers/shared/request_utils.rs

@@ -320,6 +320,8 @@ pub(crate) fn admin_proxy_local_requires_buffered_body(
                 | (Some("security_manage"), http::Method::POST, Some("blacklist_add"))
                 | (Some("security_manage"), http::Method::POST, Some("whitelist_add"))
                 | (Some("users_manage"), http::Method::POST, Some("create_user"))
+                | (Some("users_manage"), http::Method::POST, Some("resolve_user_selection"))
+                | (Some("users_manage"), http::Method::POST, Some("batch_action_users"))
                 | (Some("users_manage"), http::Method::PUT, Some("update_user"))
                 | (Some("users_manage"), http::Method::POST, Some("create_user_api_key"))
                 | (Some("users_manage"), http::Method::PUT, Some("update_user_api_key"))