fix(apollo-vertex): gate group membership via checkGroupMembership

[frankkluijtmans]

Reworks the group-membership gate (useIsGroupMember) to resolve membership through vs-core's checkGroupMembership (one server-side call) instead of enumerating the full groupMembers collection and matching users by email. This fixes AAD customers whose members are inherited via an assigned Azure AD group being wrongly denied, since the check endpoint resolves membership transitively. It also removes the brittle client-side email matching (and its null-email crash risk), fails closed when the check is unavailable, and adds the checkGroupMembership type to the vs-core stub.

👨 Generated with Kluijt Code

[github-actions]

Apollo Coded App preview deployments are ready.

Project	Status	Preview	Updated (PT)
apollo-design	Ready	Preview · Logs	Aug 27, 2026, 09:46:26 AM
apollo-docs	Ready	Preview · Logs	Aug 27, 2026, 09:46:26 AM
apollo-landing	Ready	Preview · Logs	Aug 27, 2026, 09:46:26 AM
apollo-vertex	Ready	Preview · Logs	Aug 27, 2026, 09:46:26 AM

[Copilot]

Pull request overview

Updates the apollo-vertex group-membership gate to use @uipath/vs-core’s server-side checkGroupMembership endpoint (supports transitive/AAD-inherited membership) instead of enumerating groupMembers and matching by email.

Changes:

• Replaced the useIsGroupMember implementation to query membership via checkGroupMembership(userId, groupIds) using @tanstack/react-query.
• Extended the local @uipath/vs-core optional dependency type stub to include checkGroupMembership.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
apps/apollo-vertex/types/optional-deps.d.ts	Adds a typed checkGroupMembership API entry to the vs-core stub.
apps/apollo-vertex/registry/shell/use-is-group-member.ts	Switches membership resolution to a server-side membership check via React Query and userId.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Dependency License Review

• ✅ 1951 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1722
ISC	88
Apache-2.0	55
BSD-3-Clause	27
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[github-actions]

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	—	—	—	—	—
@uipath/apollo-react	—	—	—	—	—
@uipath/apollo-ui-icons	—	—	—	—	—
@uipath/apollo-wind	—	—	—	—	—
@uipath/ap-chat	—	—	—	—	—

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[github-actions]

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Aug 27, 2026, 09:47:40 AM