feat(apollo-vertex): support external directory groups in membership gate

[frankkluijtmans]

Adds support for external directory groups (e.g. Entra ID) to the shell's group membership gate. The local Group API doesn't return these groups, so users who only get access through one were denied. The check uses checkExternalGroupMembership from @uipath/vs-core 4.4.0 (https://github.com/UiPath/vertical-solutions/pull/289). This backports the fix made in the fins qaqc and loan-setup webapps. This fix was verified in a test environment with an Entra ID group.

[github-actions]

Apollo Coded App preview deployments are ready.

Project	Status	Preview	Updated (PT)
apollo-design	Ready	Preview · Logs	Oct 01, 2026, 12:34:06 AM
apollo-docs	Ready	Preview · Logs	Oct 01, 2026, 12:34:06 AM
apollo-landing	Ready	Preview · Logs	Oct 01, 2026, 12:34:06 AM
apollo-vertex	Ready	Preview · Logs	Oct 01, 2026, 12:34:06 AM

[Copilot]

Copilot review overview

🔵 Needs a closer look

The authorization-critical behavior lacks completed manual validation against an external-group tenant.

Review effort: Balanced
Findings: None

What changed in this PR

Adds external directory group support to Apollo Vertex’s shell membership gate.

Changes:

• Checks local and external group membership in parallel.
• Adds external fallback handling to useGroupId.
• Updates dependency metadata, type declarations, and documentation.

File	Description
apps/​apollo-vertex/​types/​optional-deps.d.ts	Declares the external membership API.
apps/​apollo-vertex/​registry/​shell/​use-is-group-member.ts	Checks local and external memberships.
apps/​apollo-vertex/​registry/​shell/​use-group-id.ts	Returns an external group fallback.
apps/​apollo-vertex/​registry/​shell/​group-membership-guard.tsx	Accepts external group names.
apps/​apollo-vertex/​registry.json	Requires vs-core 4.4.0.
apps/​apollo-vertex/​app/​patterns/​shell/​page.mdx	Documents external group usage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Dependency License Review

• ✅ 1937 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1708
ISC	88
Apache-2.0	55
BSD-3-Clause	27
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.3	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[github-actions]

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	—	—	—	—	—
@uipath/apollo-react	—	—	—	—	—
@uipath/apollo-ui-icons	—	—	—	—	—
@uipath/apollo-wind	—	—	—	—	—
@uipath/ap-chat	—	—	—	—	—

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[github-actions]

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Oct 01, 2026, 12:35:05 AM

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation, typings, dependency requirement, and documentation consistently support the intended external-group fallback.

Review effort: Balanced
Findings: None