Groups API#

CRUD over legacy aspmnx_Groups. First write-path module — proves the feature-flag + authorization-policy pattern used everywhere else.

Endpoints:
- GET /api/v1/groups
- GET /api/v1/groups/{groupId}
- POST /api/v1/groups
- PUT /api/v1/groups/{groupId}
- DELETE /api/v1/groups/{groupId}
Auth: [Authorize] for reads; [Authorize(Policy = "GroupWrite")] for writes
Feature flag: FeatureFlags:EnableGroupWrites (default false)
Jira: BFC-15
Legacy source: aspmnx_Groups

Flow — write path#

flowchart TD
    Req[POST or PUT or DELETE /groups] --> Flag{EnableGroupWrites?}
    Flag -->|false| R404[404 Not Found]
    Flag -->|true| Auth{JWT has mod_admin claim?}
    Auth -->|no| R403[403 Forbidden]
    Auth -->|yes| Svc[GroupService]
    Svc --> DB[aspmnx_Groups]
    DB --> Resp[200 or 201]

Rules#

Flag-off = 404, not 403: hides existence of the write path entirely when disabled. Reads always work.
GroupWrite policy = presence of any mod_admin claim. Follow-up BFC-32 will tighten this to a specific module (mod_admin=SGA for group setup, say).
No cascade delete in this release — deleting a group that still has aspmnx_groupUsers rows returns 409 Conflict.

BFC-32 — tighten GroupWrite policy (blocked on reviewer)