From 07fe3dc3a963619d1cb56fa5e92bae0ccc826f51 Mon Sep 17 00:00:00 2001
From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com>
Date: Wed, 22 Apr 2026 13:29:38 +0000
Subject: [PATCH] Fix grant source attribution for group-based vs direct app
 assignments

Group-to-app grants now include a GrantExpandable annotation pointing to
the group's membership entitlement, enabling the SDK expansion algorithm
to create user-level grants with correct source tracking.

Direct user-to-app grants now filter out users whose Scope is "GROUP"
(assigned through a group), since those users will receive properly
attributed grants via the expansion mechanism instead.

This follows the same pattern used for role group grants in role.go.

Fixes: CXH-1394
---
 pkg/connector/app.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/connector/app.go b/pkg/connector/app.go
index 186f7fbe..c192eb22 100644
--- a/pkg/connector/app.go
+++ b/pkg/connector/app.go
@@ -192,6 +192,10 @@ func (o *appResourceType) listAppGroupGrants(
 					Id: fmtGrantIdV1(V1MembershipEntitlementID(resource.Id.Resource), groupID),
 				},
 			),
+			sdkGrant.WithAnnotation(&v2.GrantExpandable{
+				EntitlementIds: []string{fmt.Sprintf("group:%s:member", groupID)},
+				Shallow:        true,
+			}),
 		))
 	}
 
@@ -228,6 +232,10 @@ func (o *appResourceType) listAppUsersGrants(
 			continue
 		}
 
+		if strings.EqualFold(applicationUser.Scope, "GROUP") {
+			continue
+		}
+
 		userID := applicationUser.Id
 		principalID := &v2.ResourceId{ResourceType: resourceTypeUser.Id, Resource: userID}
 		rv = append(rv, sdkGrant.NewGrant(resource, "access", principalID,