feat: granular RBAC with resource/operation bindings, users, groups

- Replace admin role with granular roles: view, create, delete, edit, run
- Two binding types: resource bindings (role+resource+optional name) and
  operation bindings (role:run + action like backup, logs, impersonate)
- Name-scoped resource bindings for per-instance access control
- Remove role from project members (all permissions via RBAC)
- Add users, groups, RBAC CRUD endpoints and CLI commands
- describe user/group shows all RBAC access (direct + inherited)
- create rbac supports --subject, --binding, --operation flags
- Backup/restore handles users, groups, RBAC definitions
- mcplocal project-based MCP endpoint discovery
- Full test coverage for all new functionality

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcpd/tests/backup.test.ts

@@ -6,6 +6,9 @@ import { encrypt, decrypt, isSensitiveKey } from '../src/services/backup/crypto.
 import { registerBackupRoutes } from '../src/routes/backup.js';
 import type { IMcpServerRepository, ISecretRepository } from '../src/repositories/interfaces.js';
 import type { IProjectRepository } from '../src/repositories/project.repository.js';
+import type { IUserRepository } from '../src/repositories/user.repository.js';
+import type { IGroupRepository } from '../src/repositories/group.repository.js';
+import type { IRbacDefinitionRepository } from '../src/repositories/rbac-definition.repository.js';
 
 // Mock data
 const mockServers = [
@@ -31,8 +34,33 @@ const mockSecrets = [
 
 const mockProjects = [
   {
-    id: 'proj1', name: 'my-project', description: 'Test project',
+    id: 'proj1', name: 'my-project', description: 'Test project', proxyMode: 'direct', llmProvider: null, llmModel: null,
     ownerId: 'user1', version: 1, createdAt: new Date(), updatedAt: new Date(),
+    servers: [{ id: 'ps1', server: { id: 's1', name: 'github' } }],
+    members: [{ id: 'pm1', user: { id: 'u1', email: 'alice@test.com', name: 'Alice' } }],
+  },
+];
+
+const mockUsers = [
+  { id: 'u1', email: 'alice@test.com', name: 'Alice', role: 'ADMIN', provider: null, externalId: null, version: 1, createdAt: new Date(), updatedAt: new Date() },
+  { id: 'u2', email: 'bob@test.com', name: null, role: 'USER', provider: 'oidc', externalId: null, version: 1, createdAt: new Date(), updatedAt: new Date() },
+];
+
+const mockGroups = [
+  {
+    id: 'g1', name: 'dev-team', description: 'Developers', version: 1, createdAt: new Date(), updatedAt: new Date(),
+    members: [
+      { id: 'gm1', user: { id: 'u1', email: 'alice@test.com', name: 'Alice' } },
+      { id: 'gm2', user: { id: 'u2', email: 'bob@test.com', name: null } },
+    ],
+  },
+];
+
+const mockRbacDefinitions = [
+  {
+    id: 'rbac1', name: 'admins', version: 1, createdAt: new Date(), updatedAt: new Date(),
+    subjects: [{ kind: 'User', name: 'alice@test.com' }],
+    roleBindings: [{ role: 'edit', resource: '*' }],
   },
 ];
 
@@ -63,9 +91,46 @@ function mockProjectRepo(): IProjectRepository {
     findAll: vi.fn(async () => [...mockProjects]),
     findById: vi.fn(async (id: string) => mockProjects.find((p) => p.id === id) ?? null),
     findByName: vi.fn(async () => null),
-    create: vi.fn(async (data) => ({ id: 'new-proj', ...data, version: 1, createdAt: new Date(), updatedAt: new Date() } as typeof mockProjects[0])),
+    create: vi.fn(async (data) => ({ id: 'new-proj', ...data, servers: [], members: [], version: 1, createdAt: new Date(), updatedAt: new Date() } as typeof mockProjects[0])),
     update: vi.fn(async (id, data) => ({ ...mockProjects.find((p) => p.id === id)!, ...data })),
     delete: vi.fn(async () => {}),
+    setServers: vi.fn(async () => {}),
+    setMembers: vi.fn(async () => {}),
+  };
+}
+
+function mockUserRepo(): IUserRepository {
+  return {
+    findAll: vi.fn(async () => [...mockUsers]),
+    findById: vi.fn(async (id: string) => mockUsers.find((u) => u.id === id) ?? null),
+    findByEmail: vi.fn(async (email: string) => mockUsers.find((u) => u.email === email) ?? null),
+    create: vi.fn(async (data) => ({ id: 'new-u', ...data, provider: null, externalId: null, version: 1, createdAt: new Date(), updatedAt: new Date() } as typeof mockUsers[0])),
+    delete: vi.fn(async () => {}),
+    count: vi.fn(async () => mockUsers.length),
+  };
+}
+
+function mockGroupRepo(): IGroupRepository {
+  return {
+    findAll: vi.fn(async () => [...mockGroups]),
+    findById: vi.fn(async (id: string) => mockGroups.find((g) => g.id === id) ?? null),
+    findByName: vi.fn(async (name: string) => mockGroups.find((g) => g.name === name) ?? null),
+    create: vi.fn(async (data) => ({ id: 'new-g', ...data, version: 1, createdAt: new Date(), updatedAt: new Date() } as typeof mockGroups[0])),
+    update: vi.fn(async (id, data) => ({ ...mockGroups.find((g) => g.id === id)!, ...data })),
+    delete: vi.fn(async () => {}),
+    setMembers: vi.fn(async () => {}),
+    findGroupsForUser: vi.fn(async () => []),
+  };
+}
+
+function mockRbacRepo(): IRbacDefinitionRepository {
+  return {
+    findAll: vi.fn(async () => [...mockRbacDefinitions]),
+    findById: vi.fn(async (id: string) => mockRbacDefinitions.find((r) => r.id === id) ?? null),
+    findByName: vi.fn(async (name: string) => mockRbacDefinitions.find((r) => r.name === name) ?? null),
+    create: vi.fn(async (data) => ({ id: 'new-rbac', ...data, version: 1, createdAt: new Date(), updatedAt: new Date() } as typeof mockRbacDefinitions[0])),
+    update: vi.fn(async (id, data) => ({ ...mockRbacDefinitions.find((r) => r.id === id)!, ...data })),
+    delete: vi.fn(async () => {}),
   };
 }
 
@@ -110,7 +175,7 @@ describe('BackupService', () => {
   let backupService: BackupService;
 
   beforeEach(() => {
-    backupService = new BackupService(mockServerRepo(), mockProjectRepo(), mockSecretRepo());
+    backupService = new BackupService(mockServerRepo(), mockProjectRepo(), mockSecretRepo(), mockUserRepo(), mockGroupRepo(), mockRbacRepo());
   });
 
   it('creates backup with all resources', async () => {
@@ -126,11 +191,51 @@ describe('BackupService', () => {
     expect(bundle.projects[0]!.name).toBe('my-project');
   });
 
+  it('includes users in backup', async () => {
+    const bundle = await backupService.createBackup();
+    expect(bundle.users).toHaveLength(2);
+    expect(bundle.users![0]!.email).toBe('alice@test.com');
+    expect(bundle.users![0]!.role).toBe('ADMIN');
+    expect(bundle.users![1]!.email).toBe('bob@test.com');
+    expect(bundle.users![1]!.provider).toBe('oidc');
+  });
+
+  it('includes groups in backup with member emails', async () => {
+    const bundle = await backupService.createBackup();
+    expect(bundle.groups).toHaveLength(1);
+    expect(bundle.groups![0]!.name).toBe('dev-team');
+    expect(bundle.groups![0]!.memberEmails).toEqual(['alice@test.com', 'bob@test.com']);
+  });
+
+  it('includes rbac bindings in backup', async () => {
+    const bundle = await backupService.createBackup();
+    expect(bundle.rbacBindings).toHaveLength(1);
+    expect(bundle.rbacBindings![0]!.name).toBe('admins');
+    expect(bundle.rbacBindings![0]!.subjects).toEqual([{ kind: 'User', name: 'alice@test.com' }]);
+  });
+
+  it('includes enriched projects with server names and members', async () => {
+    const bundle = await backupService.createBackup();
+    const proj = bundle.projects[0]!;
+    expect(proj.proxyMode).toBe('direct');
+    expect(proj.serverNames).toEqual(['github']);
+    expect(proj.members).toEqual(['alice@test.com']);
+  });
+
   it('filters resources', async () => {
     const bundle = await backupService.createBackup({ resources: ['servers'] });
     expect(bundle.servers).toHaveLength(2);
     expect(bundle.secrets).toHaveLength(0);
     expect(bundle.projects).toHaveLength(0);
+    expect(bundle.users).toHaveLength(0);
+    expect(bundle.groups).toHaveLength(0);
+    expect(bundle.rbacBindings).toHaveLength(0);
+  });
+
+  it('filters to only users', async () => {
+    const bundle = await backupService.createBackup({ resources: ['users'] });
+    expect(bundle.servers).toHaveLength(0);
+    expect(bundle.users).toHaveLength(2);
   });
 
   it('encrypts sensitive secret values when password provided', async () => {
@@ -150,13 +255,22 @@ describe('BackupService', () => {
     (emptySecretRepo.findAll as ReturnType<typeof vi.fn>).mockResolvedValue([]);
     const emptyProjectRepo = mockProjectRepo();
     (emptyProjectRepo.findAll as ReturnType<typeof vi.fn>).mockResolvedValue([]);
+    const emptyUserRepo = mockUserRepo();
+    (emptyUserRepo.findAll as ReturnType<typeof vi.fn>).mockResolvedValue([]);
+    const emptyGroupRepo = mockGroupRepo();
+    (emptyGroupRepo.findAll as ReturnType<typeof vi.fn>).mockResolvedValue([]);
+    const emptyRbacRepo = mockRbacRepo();
+    (emptyRbacRepo.findAll as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const service = new BackupService(emptyServerRepo, emptyProjectRepo, emptySecretRepo);
+    const service = new BackupService(emptyServerRepo, emptyProjectRepo, emptySecretRepo, emptyUserRepo, emptyGroupRepo, emptyRbacRepo);
     const bundle = await service.createBackup();
 
     expect(bundle.servers).toHaveLength(0);
     expect(bundle.secrets).toHaveLength(0);
     expect(bundle.projects).toHaveLength(0);
+    expect(bundle.users).toHaveLength(0);
+    expect(bundle.groups).toHaveLength(0);
+    expect(bundle.rbacBindings).toHaveLength(0);
   });
 });
 
@@ -165,16 +279,25 @@ describe('RestoreService', () => {
   let serverRepo: IMcpServerRepository;
   let secretRepo: ISecretRepository;
   let projectRepo: IProjectRepository;
+  let userRepo: IUserRepository;
+  let groupRepo: IGroupRepository;
+  let rbacRepo: IRbacDefinitionRepository;
 
   beforeEach(() => {
     serverRepo = mockServerRepo();
     secretRepo = mockSecretRepo();
     projectRepo = mockProjectRepo();
+    userRepo = mockUserRepo();
+    groupRepo = mockGroupRepo();
+    rbacRepo = mockRbacRepo();
     // Default: nothing exists yet
     (serverRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
     (secretRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
     (projectRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
-    restoreService = new RestoreService(serverRepo, projectRepo, secretRepo);
+    (userRepo.findByEmail as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    (groupRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    (rbacRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    restoreService = new RestoreService(serverRepo, projectRepo, secretRepo, userRepo, groupRepo, rbacRepo);
   });
 
   const validBundle = {
@@ -187,6 +310,23 @@ describe('RestoreService', () => {
     projects: [{ name: 'test-proj', description: 'Test' }],
   };
 
+  const fullBundle = {
+    ...validBundle,
+    users: [
+      { email: 'alice@test.com', name: 'Alice', role: 'ADMIN', provider: null },
+      { email: 'bob@test.com', name: null, role: 'USER', provider: 'oidc' },
+    ],
+    groups: [
+      { name: 'dev-team', description: 'Developers', memberEmails: ['alice@test.com', 'bob@test.com'] },
+    ],
+    rbacBindings: [
+      { name: 'admins', subjects: [{ kind: 'User', name: 'alice@test.com' }], roleBindings: [{ role: 'edit', resource: '*' }] },
+    ],
+    projects: [
+      { name: 'test-proj', description: 'Test', proxyMode: 'filtered', llmProvider: 'openai', llmModel: 'gpt-4', serverNames: ['github'], members: ['alice@test.com'] },
+    ],
+  };
+
   it('validates valid bundle', () => {
     expect(restoreService.validateBundle(validBundle)).toBe(true);
   });
@@ -197,6 +337,11 @@ describe('RestoreService', () => {
     expect(restoreService.validateBundle({ version: '1' })).toBe(false);
   });
 
+  it('validates old bundles without new fields (backwards compatibility)', () => {
+    expect(restoreService.validateBundle(validBundle)).toBe(true);
+    // Old bundle has no users/groups/rbacBindings — should still validate
+  });
+
   it('restores all resources', async () => {
     const result = await restoreService.restore(validBundle);
 
@@ -209,6 +354,104 @@ describe('RestoreService', () => {
     expect(projectRepo.create).toHaveBeenCalled();
   });
 
+  it('restores users', async () => {
+    const result = await restoreService.restore(fullBundle);
+
+    expect(result.usersCreated).toBe(2);
+    expect(userRepo.create).toHaveBeenCalledWith(expect.objectContaining({
+      email: 'alice@test.com',
+      name: 'Alice',
+      role: 'ADMIN',
+      passwordHash: '__RESTORED_MUST_RESET__',
+    }));
+    expect(userRepo.create).toHaveBeenCalledWith(expect.objectContaining({
+      email: 'bob@test.com',
+      role: 'USER',
+    }));
+  });
+
+  it('restores groups with member resolution', async () => {
+    // After users are created, simulate they can be found by email
+    let callCount = 0;
+    (userRepo.findByEmail as ReturnType<typeof vi.fn>).mockImplementation(async (email: string) => {
+      // First calls during user restore return null (user doesn't exist yet)
+      // Later calls during group member resolution return the created user
+      callCount++;
+      if (callCount > 2) {
+        // After user creation phase, simulate finding created users
+        if (email === 'alice@test.com') return { id: 'new-u-alice', email };
+        if (email === 'bob@test.com') return { id: 'new-u-bob', email };
+      }
+      return null;
+    });
+
+    const result = await restoreService.restore(fullBundle);
+
+    expect(result.groupsCreated).toBe(1);
+    expect(groupRepo.create).toHaveBeenCalledWith(expect.objectContaining({
+      name: 'dev-team',
+      description: 'Developers',
+    }));
+    expect(groupRepo.setMembers).toHaveBeenCalled();
+  });
+
+  it('restores rbac bindings', async () => {
+    const result = await restoreService.restore(fullBundle);
+
+    expect(result.rbacCreated).toBe(1);
+    expect(rbacRepo.create).toHaveBeenCalledWith(expect.objectContaining({
+      name: 'admins',
+      subjects: [{ kind: 'User', name: 'alice@test.com' }],
+      roleBindings: [{ role: 'edit', resource: '*' }],
+    }));
+  });
+
+  it('restores enriched projects with server and member linking', async () => {
+    // Simulate servers exist (restored in prior step)
+    (serverRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    // After server restore, we can find them
+    let serverCallCount = 0;
+    (serverRepo.findByName as ReturnType<typeof vi.fn>).mockImplementation(async (name: string) => {
+      serverCallCount++;
+      // During server restore phase, first call returns null (server doesn't exist)
+      // During project restore phase, server should be found
+      if (serverCallCount > 1 && name === 'github') return { id: 'restored-s1', name: 'github' };
+      return null;
+    });
+
+    // Simulate users exist for member resolution
+    let userCallCount = 0;
+    (userRepo.findByEmail as ReturnType<typeof vi.fn>).mockImplementation(async (email: string) => {
+      userCallCount++;
+      if (userCallCount > 2 && email === 'alice@test.com') return { id: 'restored-u1', email };
+      return null;
+    });
+
+    const result = await restoreService.restore(fullBundle);
+
+    expect(result.projectsCreated).toBe(1);
+    expect(projectRepo.create).toHaveBeenCalledWith(expect.objectContaining({
+      name: 'test-proj',
+      proxyMode: 'filtered',
+      llmProvider: 'openai',
+      llmModel: 'gpt-4',
+    }));
+    expect(projectRepo.setServers).toHaveBeenCalled();
+    expect(projectRepo.setMembers).toHaveBeenCalled();
+  });
+
+  it('restores old bundle without users/groups/rbac', async () => {
+    const result = await restoreService.restore(validBundle);
+
+    expect(result.serversCreated).toBe(1);
+    expect(result.secretsCreated).toBe(1);
+    expect(result.projectsCreated).toBe(1);
+    expect(result.usersCreated).toBe(0);
+    expect(result.groupsCreated).toBe(0);
+    expect(result.rbacCreated).toBe(0);
+    expect(result.errors).toHaveLength(0);
+  });
+
   it('skips existing resources with skip strategy', async () => {
     (serverRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(mockServers[0]);
     const result = await restoreService.restore(validBundle, { conflictStrategy: 'skip' });
@@ -218,6 +461,33 @@ describe('RestoreService', () => {
     expect(serverRepo.create).not.toHaveBeenCalled();
   });
 
+  it('skips existing users', async () => {
+    (userRepo.findByEmail as ReturnType<typeof vi.fn>).mockResolvedValue(mockUsers[0]);
+    const bundle = { ...validBundle, users: [{ email: 'alice@test.com', name: 'Alice', role: 'ADMIN', provider: null }] };
+    const result = await restoreService.restore(bundle, { conflictStrategy: 'skip' });
+
+    expect(result.usersSkipped).toBe(1);
+    expect(result.usersCreated).toBe(0);
+  });
+
+  it('skips existing groups', async () => {
+    (groupRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(mockGroups[0]);
+    const bundle = { ...validBundle, groups: [{ name: 'dev-team', description: 'Devs', memberEmails: [] }] };
+    const result = await restoreService.restore(bundle, { conflictStrategy: 'skip' });
+
+    expect(result.groupsSkipped).toBe(1);
+    expect(result.groupsCreated).toBe(0);
+  });
+
+  it('skips existing rbac bindings', async () => {
+    (rbacRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(mockRbacDefinitions[0]);
+    const bundle = { ...validBundle, rbacBindings: [{ name: 'admins', subjects: [], roleBindings: [] }] };
+    const result = await restoreService.restore(bundle, { conflictStrategy: 'skip' });
+
+    expect(result.rbacSkipped).toBe(1);
+    expect(result.rbacCreated).toBe(0);
+  });
+
   it('aborts on conflict with fail strategy', async () => {
     (serverRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(mockServers[0]);
     const result = await restoreService.restore(validBundle, { conflictStrategy: 'fail' });
@@ -233,6 +503,18 @@ describe('RestoreService', () => {
     expect(serverRepo.update).toHaveBeenCalled();
   });
 
+  it('overwrites existing rbac bindings', async () => {
+    (rbacRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(mockRbacDefinitions[0]);
+    const bundle = {
+      ...validBundle,
+      rbacBindings: [{ name: 'admins', subjects: [{ kind: 'User', name: 'new@test.com' }], roleBindings: [{ role: 'view', resource: 'servers' }] }],
+    };
+    const result = await restoreService.restore(bundle, { conflictStrategy: 'overwrite' });
+
+    expect(result.rbacCreated).toBe(1);
+    expect(rbacRepo.update).toHaveBeenCalled();
+  });
+
   it('fails restore with encrypted bundle and no password', async () => {
     const encBundle = { ...validBundle, encrypted: true, encryptedSecrets: encrypt('{}', 'pw') };
     const result = await restoreService.restore(encBundle);
@@ -262,6 +544,26 @@ describe('RestoreService', () => {
     const result = await restoreService.restore(encBundle, { password: 'wrong' });
     expect(result.errors[0]).toContain('Failed to decrypt');
   });
+
+  it('restores in correct order: secrets → servers → users → groups → projects → rbac', async () => {
+    const callOrder: string[] = [];
+    (secretRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('secret'); return { id: 'sec' }; });
+    (serverRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('server'); return { id: 'srv' }; });
+    (userRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('user'); return { id: 'usr' }; });
+    (groupRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('group'); return { id: 'grp' }; });
+    (projectRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('project'); return { id: 'proj', servers: [], members: [] }; });
+    (rbacRepo.create as ReturnType<typeof vi.fn>).mockImplementation(async () => { callOrder.push('rbac'); return { id: 'rbac' }; });
+
+    await restoreService.restore(fullBundle);
+
+    expect(callOrder[0]).toBe('secret');
+    expect(callOrder[1]).toBe('server');
+    expect(callOrder[2]).toBe('user');
+    expect(callOrder[3]).toBe('user'); // second user
+    expect(callOrder[4]).toBe('group');
+    expect(callOrder[5]).toBe('project');
+    expect(callOrder[6]).toBe('rbac');
+  });
 });
 
 describe('Backup Routes', () => {
@@ -272,7 +574,7 @@ describe('Backup Routes', () => {
     const sRepo = mockServerRepo();
     const secRepo = mockSecretRepo();
     const prRepo = mockProjectRepo();
-    backupService = new BackupService(sRepo, prRepo, secRepo);
+    backupService = new BackupService(sRepo, prRepo, secRepo, mockUserRepo(), mockGroupRepo(), mockRbacRepo());
 
     const rSRepo = mockServerRepo();
     (rSRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
@@ -280,7 +582,13 @@ describe('Backup Routes', () => {
     (rSecRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
     const rPrRepo = mockProjectRepo();
     (rPrRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
-    restoreService = new RestoreService(rSRepo, rPrRepo, rSecRepo);
+    const rUserRepo = mockUserRepo();
+    (rUserRepo.findByEmail as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    const rGroupRepo = mockGroupRepo();
+    (rGroupRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    const rRbacRepo = mockRbacRepo();
+    (rRbacRepo.findByName as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    restoreService = new RestoreService(rSRepo, rPrRepo, rSecRepo, rUserRepo, rGroupRepo, rRbacRepo);
   });
 
   async function buildApp() {
@@ -289,7 +597,7 @@ describe('Backup Routes', () => {
     return app;
   }
 
-  it('POST /api/v1/backup returns bundle', async () => {
+  it('POST /api/v1/backup returns bundle with new resource types', async () => {
     const app = await buildApp();
     const res = await app.inject({
       method: 'POST',
@@ -303,6 +611,9 @@ describe('Backup Routes', () => {
     expect(body.servers).toBeDefined();
     expect(body.secrets).toBeDefined();
     expect(body.projects).toBeDefined();
+    expect(body.users).toBeDefined();
+    expect(body.groups).toBeDefined();
+    expect(body.rbacBindings).toBeDefined();
   });
 
   it('POST /api/v1/restore imports bundle', async () => {
@@ -318,6 +629,9 @@ describe('Backup Routes', () => {
     expect(res.statusCode).toBe(200);
     const body = res.json();
     expect(body.serversCreated).toBeDefined();
+    expect(body.usersCreated).toBeDefined();
+    expect(body.groupsCreated).toBeDefined();
+    expect(body.rbacCreated).toBeDefined();
   });
 
   it('POST /api/v1/restore rejects invalid bundle', async () => {