Feature/system assignment group

crates/config/src/token.rs

@@ -34,17 +34,30 @@ pub struct TokenProvider {
     /// compromised token.
     #[serde(default = "default_token_expiration")]
     pub expiration: usize,
+    /// Controls whether token revocation is enabled for group role
+    /// assignments. When disabled (default), group role revocations do not
+    /// create revocation events since token validation rebuilds assignments
+    /// at validation time. Enabling this creates revocation events for group
+    /// assignments but may cause overly broad token invalidation.
+    /// Matches Python Keystone's [token] revoke_by_id option.
+    #[serde(default = "default_revoke_by_id")]
+    pub revoke_by_id: bool,
 }
 
 fn default_token_expiration() -> usize {
     3600
 }
 
+fn default_revoke_by_id() -> bool {
+    false
+}
+
 impl Default for TokenProvider {
     fn default() -> Self {
         Self {
             provider: TokenProviderDriver::Fernet,
             expiration: default_token_expiration(),
+            revoke_by_id: default_revoke_by_id(),
         }
     }
 }

crates/core-types/src/assignment/assignment.rs

@@ -176,6 +176,22 @@ impl AssignmentCreate {
         )
     }
 
+    /// Instantiate GroupSystem assignment.
+    pub fn group_system<A, T, R>(actor_id: A, target_id: T, role_id: R, inherited: bool) -> Self
+    where
+        A: Into<String>,
+        T: Into<String>,
+        R: Into<String>,
+    {
+        Self::new(
+            actor_id,
+            target_id,
+            role_id,
+            AssignmentType::GroupSystem,
+            inherited,
+        )
+    }
+
     /// Instantiate UserDomain assignment.
     pub fn user_domain<A, T, R>(actor_id: A, target_id: T, role_id: R, inherited: bool) -> Self
     where

crates/core/src/assignment/service.rs

@@ -813,17 +813,37 @@ impl AssignmentApi for AssignmentService {
             audit_chain_id: None,
             revoked_at: chrono::Utc::now(),
         };
-
-        // ADR 0034 §4: the central revocation event stays on the global revoke
-        // provider, unrouted — it is not an assignment-backend operation.
-        ctx.state()
-            .provider
-            .get_revoke_provider()
-            .create_revocation_event(ctx, revocation_event)
-            .await?;
-        // ADR 0031 "Tokens": revoking a grant cascades revocation of every
-        // token carrying that role - `"cascade"`, not a direct user request.
-        crate::token::TOKEN_METRICS.revoked_total.inc(["cascade"]);
+        // Only create revocation event for group assignments if revoke_by_id is enabled.
+        // By default group revocations do not create revocation events since token
+        // validation rebuilds assignments at validation time.
+        // Reference: Python Keystone bug #1662514
+        let is_group_assignment = matches!(
+            &grant.r#type,
+            AssignmentType::GroupDomain
+                | AssignmentType::GroupProject
+                | AssignmentType::GroupSystem
+        );
+
+        let revoke_by_id = ctx
+            .state()
+            .config_manager
+            .config
+            .read()
+            .await
+            .token
+            .revoke_by_id;
+        if !is_group_assignment || revoke_by_id {
+            // ADR 0034 §4: the central revocation event stays on the global revoke
+            // provider, unrouted — it is not an assignment-backend operation.
+            ctx.state()
+                .provider
+                .get_revoke_provider()
+                .create_revocation_event(ctx, revocation_event)
+                .await?;
+            // ADR 0031 "Tokens": revoking a grant cascades revocation of every
+            // token carrying that role - `"cascade"`, not a direct user request.
+            crate::token::TOKEN_METRICS.revoked_total.inc(["cascade"]);
+        }
 
         Ok(())
     }

crates/keystone/src/api/v3/role_assignment/system/group/mod.rs

@@ -0,0 +1,23 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! # System Group role API
+use utoipa_axum::router::OpenApiRouter;
+
+use crate::keystone::ServiceState;
+
+mod role;
+
+pub(crate) fn openapi_router() -> OpenApiRouter<ServiceState> {
+    OpenApiRouter::new().merge(role::openapi_router())
+}