Add AppAPI Notifications and Users and Groups reads.

ExApps can Send/SendTo a bell for one Recipient and read group membership and directory OCS as the Requesting user, with Access Gate using UserGroups.

Co-authored-by: Cursor <cursoragent@cursor.com>

access_gate.go

@@ -1,10 +1,7 @@
 package gonexapp
 
 import (
-	"encoding/json"
-	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -113,39 +110,7 @@ func (g *AccessGate) cacheKey(userID string) string {
 }
 
 func (g *AccessGate) fetchUserGroups(userID string) ([]string, error) {
-	ocs := g.ocsClient(userID)
-	path := "cloud/users/" + url.PathEscape(userID) + "/groups"
-	raw, err := ocs.Call(http.MethodGet, path, nil)
-	if err != nil {
-		return nil, err
-	}
-	return decodeUserGroups(raw)
-}
-
-func (g *AccessGate) ocsClient(userID string) OCSClient {
-	c := g.OCS
-	if c.Cred.BaseURL == "" {
-		c.Cred = g.Cred
-	}
-	c.Cred = c.Cred.WithUser(userID)
-	if c.Client == nil {
-		c.Client = g.Client
-	}
-	return c
-}
-
-func decodeUserGroups(raw []byte) ([]string, error) {
-	var parsed struct {
-		OCS struct {
-			Data struct {
-				Groups []string `json:"groups"`
-			} `json:"data"`
-		} `json:"ocs"`
-	}
-	if err := json.Unmarshal(raw, &parsed); err != nil {
-		return nil, fmt.Errorf("user groups decode: %w", err)
-	}
-	return parsed.OCS.Data.Groups, nil
+	return Groups{Cred: g.Cred, Client: g.Client, OCS: g.OCS}.UserGroups(userID)
 }
 
 func (g *AccessGate) cachedAllowed(key string) bool {