tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java:102

• This parent is top-level, so the regression test only exercises one hierarchy iteration and does not verify the stated requirement that traversal continues through multiple non-viewable ancestors. Add a grandparent (or deeper chain) and assert that every hidden ancestor is retained as a stripped representation around the visible descendant.

        GroupRepresentation parentGroup = realm.admin().groups().groups("group-0", -1, -1).get(0);

js/apps/admin-ui/src/groups/GroupsSection.tsx:116

• Group names may contain / (see GroupSearchTest.testGroupsWithSlashes), and group paths are ambiguous when slash escaping is disabled by default. Splitting the leaf path positionally can therefore label an ancestor incorrectly—for example, /parent/slash/child assigns parent instead of parent/slash; obtain ancestor names from group representations keyed by the route IDs rather than parsing path.

          const segments = lastGroup.path.split("/").filter(Boolean);

js/apps/admin-ui/src/groups/components/GroupTree.tsx:351

• This also blocks navigation for organization groups because their representations do not contain access; organization authorization is enforced separately by OrganizationGroupsResource. Include isOrgGroups in the allow condition, as GroupTable.tsx:212 already does for the same reason.

    const path = findGroup(data, item.id!, []);
    if (!(canViewDetails || path.at(-1)?.access?.view)) {
      return;

services/src/main/java/org/keycloak/utils/GroupUtils.java:134

• groupIdToGroups.values().forEach(...) will re-traverse the same subtrees many times (once per node) because each call recursively walks descendants. This can become O(n²) for larger hierarchies. A more scalable approach is to derive counts starting only from the root nodes (the same set you ultimately return), or to add a visited/memoization set so each node’s count is derived at most once.

        if (subGroupsCount) {
            groupIdToGroups.values().forEach(GroupUtils::deriveSubGroupCountFromChildren);
        }

services/src/main/java/org/keycloak/utils/GroupUtils.java:192

• groupIdToGroups.values().forEach(...) will re-traverse the same subtrees many times (once per node) because each call recursively walks descendants. This can become O(n²) for larger hierarchies. A more scalable approach is to derive counts starting only from the root nodes (the same set you ultimately return), or to add a visited/memoization set so each node’s count is derived at most once.

    private static void deriveSubGroupCountFromChildren(GroupRepresentation group) {
        if (group.getSubGroups() != null) {
            group.getSubGroups().forEach(GroupUtils::deriveSubGroupCountFromChildren);
            if (group.getSubGroupCount() == null && !group.getSubGroups().isEmpty()) {
                group.setSubGroupCount((long) group.getSubGroups().size());
            }
        }
    }

js/apps/admin-ui/src/groups/GroupsSection.tsx:139

• This positional mapping breaks when groups includes non-hierarchy entries like the "search" breadcrumb (which is explicitly pushed earlier). In that case, segments[idx] no longer corresponds to the same logical group index, so hidden ancestors can be assigned the wrong name (off-by-one). Consider deriving an index mapping that skips "search" (and any other non-group sentinel IDs), or build a separate array of “group crumbs” and map segments onto that instead.

        // Derive ancestor names from the last group's path.
        // Path is like "/grandparent/parent/child" — segments map
        // positionally to the groups array.
        const lastGroup = groups.at(-1);
        if (lastGroup?.path) {
          const segments = lastGroup.path.split("/").filter(Boolean);
          for (let idx = 0; idx < groups.length - 1; idx++) {
            if (groups[idx].id === groups[idx].name && segments[idx]) {
              groups[idx] = { ...groups[idx], name: segments[idx] };
            }
          }
        }

js/apps/admin-ui/src/groups/components/GroupTree.tsx:217

• Styling non-viewable nodes as greyed out is helpful, but these nodes can still appear interactive to keyboard/screen-reader users unless they are programmatically marked as disabled. PatternFly TreeView items support disabled semantics (e.g., an isDisabled/disabled flag on the item model, depending on the component API). Consider setting the disabled flag for non-viewable items so they’re removed from the interactive navigation flow and correctly announced as disabled.

          <span
            className={
              !canViewDetails && !isOrgGroups && !group.access?.view
                ? "keycloak-groups-tree__non-viewable"
                : undefined
            }
          >
            {group.name}
          </span>

js/apps/admin-ui/src/groups/components/GroupTree.tsx:352

• The guard only excludes the "next" pagination item. If the tree includes non-navigable placeholder nodes (e.g., the LOADING_TREE entry), item.id! can still be navigated, producing an invalid id path and route. Add an explicit early return for the loading placeholder IDs (or, more robustly, for items that don’t have an underlying group attached) before calling findGroup(...) / navigate(...).

  const nav = (item: TreeViewDataItem, data: ExtendedTreeViewDataItem[]) => {
    if (item.id === "next") return;

    const path = findGroup(data, item.id!, []);
    if (!(canViewDetails || isOrgGroups || path.at(-1)?.access?.view)) {
      return;
    }