[santiagomed]

Stacked on #35.

Adds a signer for admin actions on an existing group, available in every binding:

Action	Fields	Event signed (for_key_rotation unset)
add_admins / remove_admins	user_ids	GroupChangeEvent.GroupAdminAddChange / GroupAdminRemoveChange
remove_members	user_ids	GroupChangeEvent.GroupMemberRemoveChange
reject_join_requests	user_ids	GroupChangeEvent.GroupJoinReject
enable_invite_link	invite_url, optional expires_at_msec, affiliate_id	GroupChangeEvent.GroupInviteEnable
disable_invite_link	none (the disabling member is the sender)	GroupChangeEvent.GroupInviteDisable

Each call returns one ActionSignature. Field numbers and names come from the repo's thrift schema, and the payloads match the existing verifier. Every action round-trips through it in the tests.

API (builder pattern, additive only):

• Rust: GroupAdminChangeParams::new(group_id, GroupAdminAction::AddAdmins { user_ids }) with with_identity. GroupAdminAction::from_parts builds an action from the flat form.
• Python: prepare_group_admin_change(conversation_id, action, *, user_ids=None, invite_url=None, expires_at_msec=None, affiliate_id=None, sender_id=None, signing_key_version=None)
• JS: prepareGroupAdminChange({ conversationId, action, userIds, inviteUrl, expiresAtMsec, affiliateId })
• Go: PrepareGroupAdminChange(GroupAdminChangeParams{…}) with AdminAction… constants
• .NET / JVM: a GroupAdminAction enum plus optional fields

Input is rejected with an error that says what to pass when:

• a field the chosen action doesn't use is set
• a required field is missing
• the conversation id is empty or not a group id (g…)
• user_ids is empty or has empty, duplicate, or comma-containing entries
• invite_url is empty or contains a comma (percent-encode it as %2C)
• expires_at_msec is not positive
• affiliate_id is empty
• expiresAtMsec is not a whole number (JS), or the action is an undefined enum value or null (.NET / JVM)

The docs and the method doc comments say that removing members does not rotate the conversation key. Callers follow up with prepare_conversation_key_change.

Not included:

• Admin settings changes: the verifier doesn't cover their payload.
• Title and avatar edits: they need the conversation key and are a separate feature.

Docs: docs/API.md gets a table row and a prepare_group_admin_change section with Rust/JS/Python snippets. The example ChatCore wrappers in all six languages get a prepare_admin_change helper.

Tests

• make ci (fmt, clippy -D warnings, license check, workspace tests): 568 core tests pass, 6 of them new.
• Bindings: Python 70, JS all suites, Go pass, .NET 88, JVM 71.
• Examples: Rust 14, Python 15, JS 16, Go pass, .NET 15, JVM 14.

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ santiagomed
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}