refactor: no group list in an account's details, and no Microsoft Graph call for it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/azure/account.go

@@ -1,15 +1,10 @@
 package azure
 
 import (
-	"context"
-	"encoding/json"
 	"fmt"
-	"net/http"
 	"slices"
 	"strings"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
-
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -160,68 +155,3 @@ func directoryRoles(wids any) string {
 	slices.Sort(names)
 	return strings.Join(names, ", ")
 }
-
-// graphGroups lists the signed-in user's groups, nested ones too, from
-// Microsoft Graph with az's token for it.
-const graphGroups = "https://graph.microsoft.com/v1.0/me/transitiveMemberOf?$select=displayName&$top=999"
-
-var _ provider.AccountGroups = (*Provider)(nil)
-
-// Groups lists the groups the account is a member of, by name.
-func (p *Provider) Groups(ctx context.Context) ([]string, error) {
-	if p.account == nil || (p.account.cloud != "" && p.account.cloud != "AzureCloud") {
-		return nil, provider.ErrUnsupported
-	}
-	tok, err := p.cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{"https://graph.microsoft.com/.default"}})
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for next := graphGroups; next != ""; {
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, next, nil)
-		if err != nil {
-			return nil, err
-		}
-		req.Header.Set("Authorization", "Bearer "+tok.Token)
-		resp, err := p.http().Do(req)
-		if err != nil {
-			return nil, err
-		}
-		var page struct {
-			Value []struct {
-				Type string `json:"@odata.type"`
-				Name string `json:"displayName"`
-			} `json:"value"`
-			Next  string `json:"@odata.nextLink"`
-			Error *struct {
-				Message string `json:"message"`
-			} `json:"error"`
-		}
-		err = json.NewDecoder(resp.Body).Decode(&page)
-		resp.Body.Close()
-		switch {
-		case err != nil:
-			return nil, fmt.Errorf("listing groups from Microsoft Graph: %w", err)
-		case page.Error != nil:
-			return nil, fmt.Errorf("listing groups from Microsoft Graph: %s", page.Error.Message)
-		case resp.StatusCode != http.StatusOK:
-			return nil, fmt.Errorf("listing groups from Microsoft Graph: %s", resp.Status)
-		}
-		for _, v := range page.Value {
-			if v.Type == "#microsoft.graph.group" && v.Name != "" {
-				names = append(names, v.Name)
-			}
-		}
-		next = page.Next
-	}
-	slices.SortFunc(names, func(a, b string) int { return strings.Compare(strings.ToLower(a), strings.ToLower(b)) })
-	return names, nil
-}
-
-// http is the client for Microsoft Graph; tests replace it.
-func (p *Provider) http() *http.Client {
-	if p.graphClient != nil {
-		return p.graphClient
-	}
-	return http.DefaultClient
-}