Relationships
#4187 swamp serve --groups-field help says group/collective memberships; it names only the collectives field
Opened by skunk-ape · 10/30/2026
The --groups-field option of swamp serve (src/cli/commands/serve.ts, both definitions near lines 2054 and 2871) is described as: Userinfo field name for group/collective memberships (default: collectives).
That reads as if it chooses where IdP groups come from. It does not. In src/serve/oauth_client.ts getUserInfo, the field named by --groups-field is read into collectives only; IdP groups always come from the userinfo groups field, and swamp#4159 (swamp-club#4159) removed the fallback that could copy collectives into groups. Collectives decide admission (--allowed-collectives) and feed CEL principal.collectives; they never match idp-group: grants.
Suggested help text: Userinfo field the collectives are read from (default: collectives). The swamp-club manual was corrected to this wording in swamp-club#4173 (serve-flags.md and daemon.md). Check whether serve_config.ts or swamp help JSON carries the same description, and the skill reference in .claude/skills/swamp/references/serve/.
Open
No activity in this phase yet.
Sign in to post a ripple.