Closes: #42597

This PR adds support for GROUPS.reset-password-members scope in Fine-Grained Admin Permissions (FGAP) v2, enabling administrators to set up password reset permissions for group members through a minimal, elegant solution leveraging the existing alias mechanism.

Related Issues

• Addresses group permission requirement from PR feat(FGAPv2): introduce RESET_PASSWORD scope and evaluation #41904 discussion

Motivation

Following the successful introduction of USERS.reset-password scope in PR #41904, administrators need the ability to manage password reset permissions at the group level rather than individual user level. This addresses the group permission requirement mentioned in the original PR discussion and provides a scalable approach to managing password reset policies.

What's Changed

AdminPermissionsSchema.java

• Added scope constant: RESET_PASSWORD_MEMBERS = "reset-password-members"
• Extended GROUPS resource type: Added RESET_PASSWORD_MEMBERS to the scopes set
• Created alias relationship: Mapped USERS.RESET_PASSWORD to GROUPS.RESET_PASSWORD_MEMBERS

Code Changes

// Added scope constant
public static final String RESET_PASSWORD_MEMBERS = "reset-password-members";

// Extended GROUPS resource type
public static final ResourceType GROUPS = new ResourceType(
    GROUPS_RESOURCE_TYPE, 
    Set.of(MANAGE, VIEW, MANAGE_MEMBERSHIP, MANAGE_MEMBERS, VIEW_MEMBERS, IMPERSONATE_MEMBERS, RESET_PASSWORD_MEMBERS)
);

// Added alias in USERS resource type
public static final ResourceType USERS = new ResourceType(
    USERS_RESOURCE_TYPE, 
    Set.of(MANAGE, VIEW, IMPERSONATE, MAP_ROLES, MANAGE_GROUP_MEMBERSHIP, RESET_PASSWORD), 
    Map.of(
        VIEW, Set.of(VIEW_MEMBERS), 
        MANAGE, Set.of(MANAGE_MEMBERS), 
        IMPERSONATE, Set.of(IMPERSONATE_MEMBERS), 
        RESET_PASSWORD, Set.of(RESET_PASSWORD_MEMBERS)  // ← New alias
    ), 
    GROUPS.getType()
);

How It Works

The solution leverages FGAP v2's built-in alias mechanism:

1. Scope Creation: The new reset-password-members scope automatically becomes available in Admin Console for group policies
2. Policy Creation: Administrators can create policies for GROUPS.reset-password-members on specific groups
3. Automatic Evaluation: When UserPermissionsV2.canResetPassword() is called, the existing alias mechanism automatically:
   • Checks if the user is a member of any group with reset-password-members policies
   • Applies deny-overrides and scope-first behavior
   • Returns the appropriate permission result

Configuration

No new configuration options required. The feature works immediately with existing FGAP v2 settings.