dir-sim: members_transitive_within (walk an explicit group set)

[AdaWorldAPI]

Adds View::members_transitive_within(group, within): members_transitive restricted to an explicit set of groups. The private walk already takes an allowed-groups bitmap; members_transitive_through builds it from a property filter, this builds it from GUIDs.

Consumer: HubSPO-rs D-IAM-2 (HubSPO-rs #30, Codex P1). A HubSpot team's sub-teams are nested groups, but a security group nested in a team is not a sub-team; walking it would widen the team-owned scope to its members.

Test: nested_groups::members_transitive_within_walks_only_the_listed_groups (start group only; stop at an unlisted nested group; full list equals the unrestricted walk; start group unlisted gives nothing; a non-group GUID is ignored). clippy -D warnings clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PPcakjk7ioQsnasmNDtc5z

---

Generated by Claude Code

Summary by CodeRabbit

• New Features
  • Added a way to retrieve a group’s transitive members while restricting traversal to an explicit list of groups. The starting group must be included in that list; unknown group IDs are ignored.
  • When all relevant groups are allowed, the results match unrestricted traversal. Unlisted nested groups are not followed, and an unlisted starting group returns no members.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T12:33:58.973171Z	10e3c47	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 8e5f9595-1c30-45e0-9420-c9eff07471aa

---

📥 Commits

Reviewing files that changed from the base of the PR and between 31652c5 and 10e3c47.

---

📒 Files selected for processing (2)

• crates/lance-graph-dir-sim/src/view.rs
• crates/lance-graph-dir-sim/tests/nested_groups.rs

---

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

---

📝 Walkthrough

Walkthrough

View adds members_transitive_within to restrict transitive membership traversal to listed groups. Tests cover traversal limits, an unlisted starting group, and non-group GUIDs in the allowlist.

Changes

Restricted Membership Traversal

Layer / File(s)	Summary
Implement and test restricted traversal crates/lance-graph-dir-sim/src/view.rs, crates/lance-graph-dir-sim/tests/nested_groups.rs	View::members_transitive_within builds an allowlist from existing group GUIDs and uses it during traversal. Tests cover restricted traversal, all groups listed, an unlisted starting group, and non-group GUIDs. Imports were reordered, and an existing empty-junction assertion was reformatted.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: claude

---

Merge Risk: ⚪ Minimal · up to 10e3c

No actionable merge-blocking risk is identified; this change is mergeable after normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding members_transitive_within to walk an explicit group set.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{A rabbit checks the group list twice,
Then follows paths that meet the slice.
Unlisted branches stay out of sight,
The tests confirm each bounded flight.
Now carrots wait; the paths are right!}

_{Comment @coderabbitai help to get the list of available commands.}