discourse/app/controllers/admin/groups_controller.rb

class Admin::GroupsController < Admin::AdminController
  def index
    groups = Group.order(:name)
    if search = params[:search]
      search = search.to_s
      groups = groups.where("name ilike ?", "%#{search}%")
    end
    if params[:ignore_automatic].to_s == "true"
      groups = groups.where(automatic: false)
    end
    render_serialized(groups, BasicGroupSerializer)
  end

  def show
    render nothing: true
  end

  def refresh_automatic_groups
    Group.refresh_automatic_groups!
    render json: success_json
  end

  def update_patch(group)
    raise Discourse::InvalidAccess.new("automatic groups do not permit membership changes") if group.automatic

    if actions = params[:changes]
      Array(actions[:add]).each do |username|
        if user = User.find_by_username(username)
          group.add(user)
        end
      end
      Array(actions[:delete]).each do |username|
        if user = User.find_by_username(username)
          group.remove(user)
        end
      end
    end

    render json: success_json
  end

  def update_put(group)
    payload = params[:group]

    group.alias_level = payload[:alias_level].to_i if payload[:alias_level].present?
    group.visible = payload[:visible] == "true"

    if group.automatic
      # group rename & membership changes are ignored/prohibited for automatic groups
    else
      group.usernames = payload[:usernames] if payload[:usernames]
      group.name = payload[:name] if payload[:name]
    end

    if group.save
      render json: success_json
    else
      render_json_error group
    end
  end

  def update
    group = Group.find(params[:id].to_i)

    if request.patch?
      update_patch(group)
    else
      update_put(group)
    end
  end

  def create
    group = Group.new
    group.name = (params[:group][:name] || '').strip
    group.usernames = params[:group][:usernames] if params[:group][:usernames]
    group.visible = params[:group][:visible] == "true"
    if group.save
      render_serialized(group, BasicGroupSerializer)
    else
      render_json_error group
    end
  end

  def destroy
    group = Group.find(params[:id].to_i)
    if group.automatic
      can_not_modify_automatic
    else
      group.destroy
      render json: success_json
    end
  end

  protected

  def can_not_modify_automatic
    render json: {errors: I18n.t('groups.errors.can_not_modify_automatic')}, status: 422
  end
end