feat: implement group creation and management (US #28)

Backend:
- Add groups Django app with models: Group, GroupMember, GroupInvite, JoinRequest
- Create serializers with business rule validation
- Implement GroupViewSet with full CRUD + custom actions (members, invites, roles, leave, join requests)
- Add JoinGroupViewSet for invite-based joining flow
- Register app in Django config and URL routing

Frontend:
- Add shared types for groups to @cloud-reader/shared
- Create groups API client (groupsApi)
- Build GroupsListPage, GroupDetailPage (member mgmt, invites, role transfer)
- Build CreateGroupPage and JoinGroupPage
- Add lazy-loaded routes to App.tsx with ProtectedRoute
- Add navigation links to Library header

Ref: #28

backend/apps/groups/admin.py

@@ -0,0 +1,30 @@
+from django.contrib import admin
+
+from apps.groups.models import Group, GroupInvite, GroupMember, JoinRequest
+
+
+@admin.register(Group)
+class GroupAdmin(admin.ModelAdmin):
+    list_display = ["id", "name", "created_by", "created_at"]
+    search_fields = ["name", "created_by__email"]
+
+
+@admin.register(GroupMember)
+class GroupMemberAdmin(admin.ModelAdmin):
+    list_display = ["id", "group", "user", "role", "joined_at"]
+    list_filter = ["role"]
+    search_fields = ["group__name", "user__email"]
+
+
+@admin.register(GroupInvite)
+class GroupInviteAdmin(admin.ModelAdmin):
+    list_display = ["id", "group", "code", "created_by", "use_count", "is_active", "created_at"]
+    list_filter = ["is_active"]
+    search_fields = ["code", "group__name"]
+
+
+@admin.register(JoinRequest)
+class JoinRequestAdmin(admin.ModelAdmin):
+    list_display = ["id", "group", "user", "status", "created_at"]
+    list_filter = ["status"]
+    search_fields = ["group__name", "user__email"]

backend/apps/groups/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class GroupsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.groups"
+    verbose_name = "Groups"

backend/apps/groups/migrations/0001_initial.py

@@ -0,0 +1,88 @@
+# Generated by Django 5.x for groups app
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+import uuid
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Group",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("name", models.CharField(db_index=True, max_length=256)),
+                ("description", models.TextField(blank=True, default="")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("created_by", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="created_groups", to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                "db_table": "groups_group",
+                "verbose_name": "Group",
+                "verbose_name_plural": "Groups",
+                "ordering": ["-created_at"],
+            },
+        ),
+        migrations.CreateModel(
+            name="GroupMember",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("role", models.CharField(choices=[("admin", "Admin"), ("member", "Member")], default="member", max_length=16)),
+                ("joined_at", models.DateTimeField(auto_now_add=True)),
+                ("group", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="memberships", to="groups.group")),
+                ("user", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="group_memberships", to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                "db_table": "groups_member",
+                "verbose_name": "Group Member",
+                "verbose_name_plural": "Group Members",
+                "ordering": ["joined_at"],
+                "unique_together": {("group", "user")},
+            },
+        ),
+        migrations.CreateModel(
+            name="GroupInvite",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("code", models.UUIDField(db_index=True, default=uuid.uuid4, editable=False, unique=True)),
+                ("max_uses", models.PositiveIntegerField(default=0, help_text="0 = unlimited")),
+                ("use_count", models.PositiveIntegerField(default=0)),
+                ("is_active", models.BooleanField(db_index=True, default=True)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("created_by", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="created_invites", to=settings.AUTH_USER_MODEL)),
+                ("group", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="invites", to="groups.group")),
+            ],
+            options={
+                "db_table": "groups_invite",
+                "verbose_name": "Group Invite",
+                "verbose_name_plural": "Group Invites",
+                "ordering": ["-created_at"],
+            },
+        ),
+        migrations.CreateModel(
+            name="JoinRequest",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("status", models.CharField(choices=[("pending", "Pending"), ("approved", "Approved"), ("rejected", "Rejected")], db_index=True, default="pending", max_length=16)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("group", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="join_requests", to="groups.group")),
+                ("invite", models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name="join_requests", to="groups.groupinvite")),
+                ("user", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name="join_requests", to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                "db_table": "groups_join_request",
+                "verbose_name": "Join Request",
+                "verbose_name_plural": "Join Requests",
+                "ordering": ["-created_at"],
+                "unique_together": {("group", "user")},
+            },
+        ),
+    ]

backend/apps/groups/models.py

@@ -0,0 +1,129 @@
+import uuid
+
+from django.conf import settings
+from django.db import models
+
+
+class GroupRole(models.TextChoices):
+    ADMIN = "admin", "Admin"
+    MEMBER = "member", "Member"
+
+
+class JoinRequestStatus(models.TextChoices):
+    PENDING = "pending", "Pending"
+    APPROVED = "approved", "Approved"
+    REJECTED = "rejected", "Rejected"
+
+
+class Group(models.Model):
+    name = models.CharField(max_length=256, db_index=True)
+    description = models.TextField(blank=True, default="")
+    created_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="created_groups",
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "groups_group"
+        verbose_name = "Group"
+        verbose_name_plural = "Groups"
+        ordering = ["-created_at"]
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class GroupMember(models.Model):
+    group = models.ForeignKey(
+        Group,
+        on_delete=models.CASCADE,
+        related_name="memberships",
+    )
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="group_memberships",
+    )
+    role = models.CharField(
+        max_length=16,
+        choices=GroupRole.choices,
+        default=GroupRole.MEMBER,
+    )
+    joined_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        db_table = "groups_member"
+        verbose_name = "Group Member"
+        verbose_name_plural = "Group Members"
+        ordering = ["joined_at"]
+        unique_together = [("group", "user")]
+
+    def __str__(self) -> str:
+        return f"{self.user} in {self.group} ({self.role})"
+
+
+class GroupInvite(models.Model):
+    group = models.ForeignKey(
+        Group,
+        on_delete=models.CASCADE,
+        related_name="invites",
+    )
+    created_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="created_invites",
+    )
+    code = models.UUIDField(default=uuid.uuid4, unique=True, editable=False, db_index=True)
+    max_uses = models.PositiveIntegerField(default=0, help_text="0 = unlimited")
+    use_count = models.PositiveIntegerField(default=0)
+    is_active = models.BooleanField(default=True, db_index=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        db_table = "groups_invite"
+        verbose_name = "Group Invite"
+        verbose_name_plural = "Group Invites"
+        ordering = ["-created_at"]
+
+    def __str__(self) -> str:
+        return f"Invite for {self.group.name} ({self.code})"
+
+
+class JoinRequest(models.Model):
+    group = models.ForeignKey(
+        Group,
+        on_delete=models.CASCADE,
+        related_name="join_requests",
+    )
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="join_requests",
+    )
+    invite = models.ForeignKey(
+        GroupInvite,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="join_requests",
+    )
+    status = models.CharField(
+        max_length=16,
+        choices=JoinRequestStatus.choices,
+        default=JoinRequestStatus.PENDING,
+        db_index=True,
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        db_table = "groups_join_request"
+        verbose_name = "Join Request"
+        verbose_name_plural = "Join Requests"
+        ordering = ["-created_at"]
+        unique_together = [("group", "user")]
+
+    def __str__(self) -> str:
+        return f"{self.user} → {self.group.name} ({self.status})"

backend/apps/groups/permissions.py

@@ -0,0 +1,25 @@
+from rest_framework import permissions
+from rest_framework.request import Request
+
+from apps.groups.models import Group, GroupMember, GroupRole
+
+
+class IsGroupAdmin(permissions.BasePermission):
+    """Only group admins can perform the action."""
+
+    def has_object_permission(self, request: Request, view: object, obj: Group) -> bool:
+        return GroupMember.objects.filter(
+            group=obj,
+            user=request.user,
+            role=GroupRole.ADMIN,
+        ).exists()
+
+
+class IsGroupMember(permissions.BasePermission):
+    """Only group members (any role) can perform the action."""
+
+    def has_object_permission(self, request: Request, view: object, obj: Group) -> bool:
+        return GroupMember.objects.filter(
+            group=obj,
+            user=request.user,
+        ).exists()

backend/apps/groups/serializers.py

@@ -0,0 +1,198 @@
+from __future__ import annotations
+
+from rest_framework import serializers
+
+from apps.groups.models import Group, GroupInvite, GroupMember, GroupRole, JoinRequest, JoinRequestStatus
+
+
+class GroupMemberSerializer(serializers.ModelSerializer):
+    user_id = serializers.IntegerField(source="user.id", read_only=True)
+    user_email = serializers.CharField(source="user.email", read_only=True)
+    user_username = serializers.CharField(source="user.username", read_only=True)
+
+    class Meta:
+        model = GroupMember
+        fields = [
+            "id", "user_id", "user_email", "user_username",
+            "role", "joined_at",
+        ]
+
+
+class GroupListSerializer(serializers.ModelSerializer):
+    member_count = serializers.SerializerMethodField()
+    user_role = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Group
+        fields = [
+            "id", "name", "description", "created_by",
+            "member_count", "user_role", "created_at", "updated_at",
+        ]
+
+    def get_member_count(self, obj: Group) -> int:
+        return getattr(obj, "_member_count", obj.memberships.count())
+
+    def get_user_role(self, obj: Group) -> str | None:
+        request = self.context.get("request")
+        if not request or not request.user.is_authenticated:
+            return None
+        membership = getattr(obj, "_user_membership", None)
+        if membership is None:
+            try:
+                membership = obj.memberships.get(user=request.user)
+            except GroupMember.DoesNotExist:
+                return None
+        return membership.role
+
+
+class GroupDetailSerializer(serializers.ModelSerializer):
+    members = GroupMemberSerializer(source="memberships", many=True, read_only=True)
+    member_count = serializers.SerializerMethodField()
+    user_role = serializers.SerializerMethodField()
+    created_by_email = serializers.CharField(source="created_by.email", read_only=True)
+    created_by_username = serializers.CharField(source="created_by.username", read_only=True)
+
+    class Meta:
+        model = Group
+        fields = [
+            "id", "name", "description", "created_by", "created_by_email",
+            "created_by_username", "members", "member_count", "user_role",
+            "created_at", "updated_at",
+        ]
+
+    def get_member_count(self, obj: Group) -> int:
+        return getattr(obj, "_member_count", obj.memberships.count())
+
+    def get_user_role(self, obj: Group) -> str | None:
+        request = self.context.get("request")
+        if not request or not request.user.is_authenticated:
+            return None
+        membership = getattr(obj, "_user_membership", None)
+        if membership is None:
+            try:
+                membership = obj.memberships.get(user=request.user)
+            except GroupMember.DoesNotExist:
+                return None
+        return membership.role
+
+
+class GroupCreateSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Group
+        fields = ["name", "description"]
+
+    def validate_name(self, value: str) -> str:
+        if not value.strip():
+            raise serializers.ValidationError("Group name cannot be empty.")
+        if len(value.strip()) < 2:
+            raise serializers.ValidationError("Group name must be at least 2 characters.")
+        return value.strip()
+
+    def create(self, validated_data: dict) -> Group:
+        user = self.context["request"].user
+        group = Group.objects.create(created_by=user, **validated_data)
+        GroupMember.objects.create(group=group, user=user, role=GroupRole.ADMIN)
+        return group
+
+
+class GroupUpdateSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Group
+        fields = ["name", "description"]
+
+    def validate_name(self, value: str) -> str:
+        if not value.strip():
+            raise serializers.ValidationError("Group name cannot be empty.")
+        if len(value.strip()) < 2:
+            raise serializers.ValidationError("Group name must be at least 2 characters.")
+        return value.strip()
+
+
+class GroupInviteSerializer(serializers.ModelSerializer):
+    created_by_email = serializers.CharField(source="created_by.email", read_only=True)
+    group_name = serializers.CharField(source="group.name", read_only=True)
+    join_url = serializers.SerializerMethodField()
+
+    class Meta:
+        model = GroupInvite
+        fields = [
+            "id", "group", "group_name", "code", "created_by", "created_by_email",
+            "max_uses", "use_count", "is_active", "join_url", "created_at",
+        ]
+        read_only_fields = ["id", "group", "code", "created_by", "use_count", "created_at"]
+
+    def get_join_url(self, obj: GroupInvite) -> str:
+        request = self.context.get("request")
+        if request:
+            return f"{request.build_absolute_uri('/')[:-1]}/groups/join/{obj.code}"
+        return f"/groups/join/{obj.code}"
+
+
+class GroupInviteCreateSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = GroupInvite
+        fields = ["max_uses"]
+
+    def validate_max_uses(self, value: int) -> int:
+        if value < 0:
+            raise serializers.ValidationError("Max uses cannot be negative.")
+        return value
+
+    def create(self, validated_data: dict) -> GroupInvite:
+        group = self.context["group"]
+        user = self.context["request"].user
+        return GroupInvite.objects.create(
+            group=group,
+            created_by=user,
+            **validated_data,
+        )
+
+
+class JoinRequestSerializer(serializers.ModelSerializer):
+    user_id = serializers.IntegerField(source="user.id", read_only=True)
+    user_email = serializers.CharField(source="user.email", read_only=True)
+    user_username = serializers.CharField(source="user.username", read_only=True)
+    group_name = serializers.CharField(source="group.name", read_only=True)
+    invite_code = serializers.UUIDField(source="invite.code", read_only=True, default=None)
+
+    class Meta:
+        model = JoinRequest
+        fields = [
+            "id", "group", "group_name", "user", "user_id", "user_email",
+            "user_username", "invite", "invite_code", "status", "created_at",
+        ]
+        read_only_fields = ["id", "group", "user", "invite", "created_at"]
+
+
+class JoinViaInviteSerializer(serializers.Serializer):
+    """Validates and processes joining a group via an invite code."""
+
+    code = serializers.UUIDField()
+
+    def validate_code(self, value: str) -> str:
+        try:
+            invite = GroupInvite.objects.select_related("group").get(code=value)
+        except GroupInvite.DoesNotExist:
+            raise serializers.ValidationError("Invalid invite code.")
+
+        if not invite.is_active:
+            raise serializers.ValidationError("This invite is no longer active.")
+
+        if invite.max_uses > 0 and invite.use_count >= invite.max_uses:
+            raise serializers.ValidationError("This invite has reached its maximum uses.")
+
+        return value
+
+
+class RoleUpdateSerializer(serializers.Serializer):
+    role = serializers.ChoiceField(choices=GroupRole.choices)
+
+    def validate_role(self, value: str) -> str:
+        if value == GroupRole.MEMBER:
+            group = self.context["group"]
+            admin_count = group.memberships.filter(role=GroupRole.ADMIN).count()
+            if admin_count <= 1:
+                raise serializers.ValidationError(
+                    "Cannot remove the last admin. Transfer admin role first or dissolve the group."
+                )
+        return value

backend/apps/groups/urls.py

@@ -0,0 +1,12 @@
+from django.urls import include, path
+from rest_framework.routers import DefaultRouter
+
+from apps.groups.views import GroupViewSet, JoinGroupViewSet
+
+router = DefaultRouter()
+router.register(r"groups", GroupViewSet, basename="group")
+router.register(r"join", JoinGroupViewSet, basename="join-group")
+
+urlpatterns = [
+    path("", include(router.urls)),
+]

backend/apps/groups/views.py

@@ -0,0 +1,331 @@
+from __future__ import annotations
+
+from django.db.models import Count, Prefetch, QuerySet
+from rest_framework import status, viewsets
+from rest_framework.decorators import action
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+
+from apps.groups.models import Group, GroupInvite, GroupMember, GroupRole, JoinRequest, JoinRequestStatus
+from apps.groups.permissions import IsGroupAdmin, IsGroupMember
+from apps.groups.serializers import (
+    GroupCreateSerializer,
+    GroupDetailSerializer,
+    GroupInviteCreateSerializer,
+    GroupInviteSerializer,
+    GroupListSerializer,
+    GroupMemberSerializer,
+    GroupUpdateSerializer,
+    JoinRequestSerializer,
+    JoinViaInviteSerializer,
+    RoleUpdateSerializer,
+)
+
+
+class GroupViewSet(viewsets.ModelViewSet):
+    permission_classes = [IsAuthenticated]
+
+    def get_serializer_class(self):
+        if self.action == "create":
+            return GroupCreateSerializer
+        if self.action in ("update", "partial_update"):
+            return GroupUpdateSerializer
+        if self.action == "retrieve":
+            return GroupDetailSerializer
+        return GroupListSerializer
+
+    def get_queryset(self) -> QuerySet[Group]:
+        user = self.request.user
+        qs = Group.objects.filter(memberships__user=user).distinct()
+        qs = qs.annotate(_member_count=Count("memberships"))
+        if self.action in ("list", "retrieve"):
+            qs = qs.prefetch_related(
+                Prefetch(
+                    "memberships",
+                    queryset=GroupMember.objects.select_related("user").order_by("joined_at"),
+                )
+            )
+        return qs
+
+    def get_object(self) -> Group:
+        obj = super().get_object()
+        # Cache the requesting user's membership for serializers
+        try:
+            obj._user_membership = obj.memberships.get(user=self.request.user)
+        except GroupMember.DoesNotExist:
+            obj._user_membership = None
+        return obj
+
+    def perform_create(self, serializer: GroupCreateSerializer) -> Group:
+        return serializer.save()
+
+    def perform_destroy(self, instance: Group) -> None:
+        # Only admin can delete/dissolve the group
+        if not GroupMember.objects.filter(
+            group=instance, user=self.request.user, role=GroupRole.ADMIN
+        ).exists():
+            from rest_framework.exceptions import PermissionDenied
+
+            raise PermissionDenied("Only group admins can delete the group.")
+        instance.delete()
+
+    # ---- Members ----
+
+    @action(detail=True, methods=["get"], permission_classes=[IsAuthenticated, IsGroupMember])
+    def members(self, request: Request, pk: str | None = None) -> Response:
+        """List all members of the group."""
+        group = self.get_object()
+        memberships = group.memberships.select_related("user").order_by("joined_at")
+        serializer = GroupMemberSerializer(memberships, many=True)
+        return Response(serializer.data)
+
+    @action(
+        detail=True,
+        methods=["delete"],
+        url_path="members/(?P<user_id>[^/.]+)",
+        permission_classes=[IsAuthenticated, IsGroupAdmin],
+    )
+    def remove_member(self, request: Request, pk: str | None = None, user_id: str | None = None) -> Response:
+        """Admin removes a member from the group."""
+        group = self.get_object()
+        try:
+            membership = GroupMember.objects.get(group=group, user_id=user_id)
+        except GroupMember.DoesNotExist:
+            return Response({"error": "Member not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        if membership.user == request.user:
+            return Response(
+                {"error": "Admins cannot remove themselves. Use leave instead, or transfer admin first."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        membership.delete()
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+    @action(
+        detail=True,
+        methods=["patch"],
+        url_path="members/(?P<user_id>[^/.]+)/role",
+        permission_classes=[IsAuthenticated, IsGroupAdmin],
+    )
+    def update_member_role(self, request: Request, pk: str | None = None, user_id: str | None = None) -> Response:
+        """Admin transfers admin role or changes member role."""
+        group = self.get_object()
+        serializer = RoleUpdateSerializer(data=request.data, context={"group": group})
+        serializer.is_valid(raise_exception=True)
+
+        try:
+            membership = GroupMember.objects.get(group=group, user_id=user_id)
+        except GroupMember.DoesNotExist:
+            return Response({"error": "Member not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        membership.role = serializer.validated_data["role"]
+        membership.save(update_fields=["role"])
+
+        if serializer.validated_data["role"] == GroupRole.ADMIN and membership.user != request.user:
+            # Downgrade the current admin to member
+            GroupMember.objects.filter(group=group, user=request.user).update(role=GroupRole.MEMBER)
+
+        return Response(GroupMemberSerializer(membership).data)
+
+    @action(detail=True, methods=["post"], permission_classes=[IsAuthenticated, IsGroupMember])
+    def leave(self, request: Request, pk: str | None = None) -> Response:
+        """Member leaves the group. If admin is last admin, dissolve the group."""
+        group = self.get_object()
+        membership = GroupMember.objects.filter(group=group, user=request.user).first()
+
+        if not membership:
+            return Response({"error": "You are not a member of this group."}, status=status.HTTP_400_BAD_REQUEST)
+
+        if membership.role == GroupRole.ADMIN:
+            admin_count = GroupMember.objects.filter(group=group, role=GroupRole.ADMIN).count()
+            if admin_count <= 1:
+                # Last admin leaving — dissolve the group
+                group.delete()
+                return Response({"detail": "You were the last admin. The group has been dissolved."})
+
+        membership.delete()
+        return Response({"detail": "You have left the group."})
+
+    # ---- Invites ----
+
+    @action(detail=True, methods=["get", "post"], permission_classes=[IsAuthenticated, IsGroupAdmin])
+    def invites(self, request: Request, pk: str | None = None) -> Response:
+        """List or create invites for the group."""
+        group = self.get_object()
+
+        if request.method == "GET":
+            invites_qs = group.invites.select_related("created_by").order_by("-created_at")
+            serializer = GroupInviteSerializer(invites_qs, many=True, context={"request": request})
+            return Response(serializer.data)
+
+        serializer = GroupInviteCreateSerializer(
+            data=request.data,
+            context={"group": group, "request": request},
+        )
+        serializer.is_valid(raise_exception=True)
+        invite = serializer.save()
+        return Response(
+            GroupInviteSerializer(invite, context={"request": request}).data,
+            status=status.HTTP_201_CREATED,
+        )
+
+    @action(
+        detail=True,
+        methods=["delete"],
+        url_path="invites/(?P<invite_id>[^/.]+)",
+        permission_classes=[IsAuthenticated, IsGroupAdmin],
+    )
+    def revoke_invite(self, request: Request, pk: str | None = None, invite_id: str | None = None) -> Response:
+        """Revoke an invite by deactivating it."""
+        group = self.get_object()
+        try:
+            invite = GroupInvite.objects.get(id=invite_id, group=group)
+        except GroupInvite.DoesNotExist:
+            return Response({"error": "Invite not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        invite.is_active = False
+        invite.save(update_fields=["is_active"])
+        return Response(status=status.HTTP_204_NO_CONTENT)
+
+    # ---- Join Requests ----
+
+    @action(detail=True, methods=["get"], permission_classes=[IsAuthenticated, IsGroupAdmin])
+    def requests(self, request: Request, pk: str | None = None) -> Response:
+        """List pending join requests for the group (admin only)."""
+        group = self.get_object()
+        join_requests = group.join_requests.select_related("user", "invite").order_by("-created_at")
+        serializer = JoinRequestSerializer(join_requests, many=True)
+        return Response(serializer.data)
+
+    @action(
+        detail=True,
+        methods=["post"],
+        url_path="requests/(?P<request_id>[^/.]+)/approve",
+        permission_classes=[IsAuthenticated, IsGroupAdmin],
+    )
+    def approve_request(self, request: Request, pk: str | None = None, request_id: str | None = None) -> Response:
+        """Approve a pending join request."""
+        group = self.get_object()
+        try:
+            join_request = JoinRequest.objects.get(id=request_id, group=group, status=JoinRequestStatus.PENDING)
+        except JoinRequest.DoesNotExist:
+            return Response({"error": "Pending join request not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        join_request.status = JoinRequestStatus.APPROVED
+        join_request.save(update_fields=["status"])
+
+        GroupMember.objects.get_or_create(
+            group=group,
+            user=join_request.user,
+            defaults={"role": GroupRole.MEMBER},
+        )
+
+        # Increment invite use count
+        if join_request.invite:
+            join_request.invite.use_count += 1
+            join_request.invite.save(update_fields=["use_count"])
+
+        return Response(JoinRequestSerializer(join_request).data)
+
+    @action(
+        detail=True,
+        methods=["post"],
+        url_path="requests/(?P<request_id>[^/.]+)/reject",
+        permission_classes=[IsAuthenticated, IsGroupAdmin],
+    )
+    def reject_request(self, request: Request, pk: str | None = None, request_id: str | None = None) -> Response:
+        """Reject a pending join request."""
+        group = self.get_object()
+        try:
+            join_request = JoinRequest.objects.get(id=request_id, group=group, status=JoinRequestStatus.PENDING)
+        except JoinRequest.DoesNotExist:
+            return Response({"error": "Pending join request not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        join_request.status = JoinRequestStatus.REJECTED
+        join_request.save(update_fields=["status"])
+        return Response(JoinRequestSerializer(join_request).data)
+
+
+class JoinGroupViewSet(viewsets.GenericViewSet):
+    """Public(ish) endpoint for joining a group via an invite code."""
+
+    permission_classes = [IsAuthenticated]
+
+    @action(detail=False, methods=["get"], url_path="(?P<code>[^/.]+)")
+    def validate_invite(self, request: Request, code: str | None = None) -> Response:
+        """Check if an invite code is valid and show group info."""
+        try:
+            invite = GroupInvite.objects.select_related("group", "group__created_by").get(code=code)
+        except GroupInvite.DoesNotExist:
+            return Response({"error": "Invalid invite code."}, status=status.HTTP_404_NOT_FOUND)
+
+        if not invite.is_active:
+            return Response({"error": "This invite is no longer active."}, status=status.HTTP_410_GONE)
+
+        if invite.max_uses > 0 and invite.use_count >= invite.max_uses:
+            return Response({"error": "This invite has reached its maximum uses."}, status=status.HTTP_410_GONE)
+
+        return Response({
+            "group": {
+                "id": invite.group.id,
+                "name": invite.group.name,
+                "description": invite.group.description,
+                "created_by_email": invite.group.created_by.email,
+                "member_count": invite.group.memberships.count(),
+            },
+            "invite": {
+                "code": str(invite.code),
+                "created_by_email": invite.created_by.email,
+            },
+        })
+
+    @action(detail=False, methods=["post"], url_path="(?P<code>[^/.]+)")
+    def join(self, request: Request, code: str | None = None) -> Response:
+        """Join a group via invite code."""
+        try:
+            invite = GroupInvite.objects.select_related("group").get(code=code)
+        except GroupInvite.DoesNotExist:
+            return Response({"error": "Invalid invite code."}, status=status.HTTP_404_NOT_FOUND)
+
+        if not invite.is_active:
+            return Response({"error": "This invite is no longer active."}, status=status.HTTP_410_GONE)
+
+        if invite.max_uses > 0 and invite.use_count >= invite.max_uses:
+            return Response({"error": "This invite has reached its maximum uses."}, status=status.HTTP_410_GONE)
+
+        group = invite.group
+
+        # Check if already a member
+        if GroupMember.objects.filter(group=group, user=request.user).exists():
+            return Response(
+                {"detail": "You are already a member of this group.", "group_id": group.id},
+                status=status.HTTP_200_OK,
+            )
+
+        # Check for existing pending request
+        existing_request = JoinRequest.objects.filter(
+            group=group, user=request.user, status=JoinRequestStatus.PENDING
+        ).first()
+        if existing_request:
+            return Response(
+                JoinRequestSerializer(existing_request).data,
+                status=status.HTTP_200_OK,
+            )
+
+        # Create join request or add directly (direct join for now — simple invite flow)
+        member = GroupMember.objects.create(group=group, user=request.user, role=GroupRole.MEMBER)
+        invite.use_count += 1
+        invite.save(update_fields=["use_count"])
+
+        # Also create a join request record for tracking
+        JoinRequest.objects.create(
+            group=group,
+            user=request.user,
+            invite=invite,
+            status=JoinRequestStatus.APPROVED,
+        )
+
+        serializer = GroupDetailSerializer(group, context={"request": request})
+        return Response(serializer.data, status=status.HTTP_201_CREATED)

backend/config/django.py

@@ -41,6 +41,7 @@ INSTALLED_APPS = [
     "apps.books",
     "apps.annotations",
     "apps.reader",
+    "apps.groups",
 ]
 
 MIDDLEWARE = [

backend/config/urls.py

@@ -8,6 +8,7 @@ urlpatterns = [
     path("api/books/", include("apps.books.urls")),
     path("api/annotations/", include("apps.annotations.urls")),
     path("api/reader/", include("apps.reader.urls")),
+    path("api/", include("apps.groups.urls")),
 ]
 
 if settings.DEBUG:

frontend/src/App.tsx

@@ -12,6 +12,10 @@ const AddBookPage = lazy(() => import("./pages/AddBook").then((m) => ({ default:
 const SettingsPage = lazy(() => import("./pages/Settings").then((m) => ({ default: m.SettingsPage })));
 const BookmarksNotesPage = lazy(() => import("./components/annotations/BookmarksNotesPage").then((m) => ({ default: m.BookmarksNotesPage })));
 const ReadingPage = lazy(() => import("./pages/ReadingPage").then((m) => ({ default: m.default })));
+const GroupsListPage = lazy(() => import("./pages/GroupsListPage").then((m) => ({ default: m.GroupsListPage })));
+const GroupDetailPage = lazy(() => import("./pages/GroupDetailPage").then((m) => ({ default: m.GroupDetailPage })));
+const CreateGroupPage = lazy(() => import("./pages/CreateGroupPage").then((m) => ({ default: m.CreateGroupPage })));
+const JoinGroupPage = lazy(() => import("./pages/JoinGroupPage").then((m) => ({ default: m.JoinGroupPage })));
 
 const AuthPage = lazy(() => import("./pages/AuthPage"));
 
@@ -45,6 +49,10 @@ function AppRoutes() {
         <Route path="/add" element={<ProtectedRoute><AddBookPage /></ProtectedRoute>} />
         <Route path="/settings" element={<ProtectedRoute><SettingsPage /></ProtectedRoute>} />
         <Route path="/bookmarks-notes/:bookId?" element={<ProtectedRoute><BookmarksNotesPage /></ProtectedRoute>} />
+        <Route path="/groups" element={<ProtectedRoute><GroupsListPage /></ProtectedRoute>} />
+        <Route path="/groups/create" element={<ProtectedRoute><CreateGroupPage /></ProtectedRoute>} />
+        <Route path="/groups/join/:code" element={<ProtectedRoute><JoinGroupPage /></ProtectedRoute>} />
+        <Route path="/groups/:id" element={<ProtectedRoute><GroupDetailPage /></ProtectedRoute>} />
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>
     </Suspense>

frontend/src/api/groups.ts

@@ -0,0 +1,100 @@
+import api from "./client";
+import type {
+  CreateGroupPayload,
+  CreateInvitePayload,
+  GroupDetail,
+  GroupInvite,
+  GroupListItem,
+  InviteValidation,
+  JoinRequest,
+  UpdateGroupPayload,
+} from "../../packages/shared/src/types";
+
+export const groupsApi = {
+  // ---- Group CRUD ----
+
+  async listGroups(): Promise<GroupListItem[]> {
+    const { data } = await api.get<{ count: number; results: GroupListItem[] } | GroupListItem[]>("/groups/");
+    if (Array.isArray(data)) return data;
+    return data.results ?? [];
+  },
+
+  async getGroup(id: number): Promise<GroupDetail> {
+    const { data } = await api.get<GroupDetail>(`/groups/${id}/`);
+    return data;
+  },
+
+  async createGroup(payload: CreateGroupPayload): Promise<GroupDetail> {
+    const { data } = await api.post<GroupDetail>("/groups/", payload);
+    return data;
+  },
+
+  async updateGroup(id: number, payload: UpdateGroupPayload): Promise<GroupDetail> {
+    const { data } = await api.patch<GroupDetail>(`/groups/${id}/`, payload);
+    return data;
+  },
+
+  async deleteGroup(id: number): Promise<void> {
+    await api.delete(`/groups/${id}/`);
+  },
+
+  // ---- Members ----
+
+  async removeMember(groupId: number, userId: number): Promise<void> {
+    await api.delete(`/groups/${groupId}/members/${userId}/`);
+  },
+
+  async updateMemberRole(groupId: number, userId: number, role: "admin" | "member"): Promise<void> {
+    await api.patch(`/groups/${groupId}/members/${userId}/role/`, { role });
+  },
+
+  async leaveGroup(groupId: number): Promise<{ detail: string }> {
+    const { data } = await api.post<{ detail: string }>(`/groups/${groupId}/leave/`);
+    return data;
+  },
+
+  // ---- Invites ----
+
+  async listInvites(groupId: number): Promise<GroupInvite[]> {
+    const { data } = await api.get<GroupInvite[]>(`/groups/${groupId}/invites/`);
+    return data;
+  },
+
+  async createInvite(groupId: number, payload: CreateInvitePayload = {}): Promise<GroupInvite> {
+    const { data } = await api.post<GroupInvite>(`/groups/${groupId}/invites/`, payload);
+    return data;
+  },
+
+  async revokeInvite(groupId: number, inviteId: number): Promise<void> {
+    await api.delete(`/groups/${groupId}/invites/${inviteId}/`);
+  },
+
+  // ---- Join Requests ----
+
+  async listJoinRequests(groupId: number): Promise<JoinRequest[]> {
+    const { data } = await api.get<JoinRequest[]>(`/groups/${groupId}/requests/`);
+    return data;
+  },
+
+  async approveRequest(groupId: number, requestId: number): Promise<JoinRequest> {
+    const { data } = await api.post<JoinRequest>(`/groups/${groupId}/requests/${requestId}/approve/`);
+    return data;
+  },
+
+  async rejectRequest(groupId: number, requestId: number): Promise<JoinRequest> {
+    const { data } = await api.post<JoinRequest>(`/groups/${groupId}/requests/${requestId}/reject/`);
+    return data;
+  },
+
+  // ---- Join via Invite ----
+
+  async validateInvite(code: string): Promise<InviteValidation> {
+    const { data } = await api.get<InviteValidation>(`/join/${code}/`);
+    return data;
+  },
+
+  async joinViaInvite(code: string): Promise<GroupDetail> {
+    const { data } = await api.post<GroupDetail>(`/join/${code}/`);
+    return data;
+  },
+};

frontend/src/pages/CreateGroupPage.tsx

@@ -0,0 +1,104 @@
+import React, { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { groupsApi } from "../api/groups";
+import { useToast } from "../hooks/useToast";
+
+const S = {
+  container: { maxWidth: 500, margin: "0 auto", padding: "24px 16px" } satisfies React.CSSProperties,
+  backBtn: {
+    background: "none", border: "none", color: "#3b82f6", fontSize: 14, cursor: "pointer",
+    padding: 0, marginBottom: 16, minHeight: 44, minWidth: 44,
+  } satisfies React.CSSProperties,
+  title: { fontSize: 24, fontWeight: 700, marginBottom: 24 } satisfies React.CSSProperties,
+  label: { display: "block", fontSize: 14, fontWeight: 500, marginBottom: 6 } satisfies React.CSSProperties,
+  input: {
+    width: "100%", padding: "10px 12px", border: "1px solid #d1d5db", borderRadius: 8,
+    fontSize: 14, marginBottom: 16, boxSizing: "border-box" as const,
+  } satisfies React.CSSProperties,
+  textarea: {
+    width: "100%", padding: "10px 12px", border: "1px solid #d1d5db", borderRadius: 8,
+    fontSize: 14, marginBottom: 16, minHeight: 80, resize: "vertical" as const,
+    boxSizing: "border-box" as const, fontFamily: "inherit",
+  } satisfies React.CSSProperties,
+  submitBtn: (disabled: boolean): React.CSSProperties => ({
+    width: "100%", padding: "12px", backgroundColor: disabled ? "#93c5fd" : "#3b82f6",
+    color: "#fff", border: "none", borderRadius: 8, fontSize: 15, fontWeight: 600,
+    cursor: disabled ? "not-allowed" : "pointer", minHeight: 44,
+  }),
+  errorText: { color: "#ef4444", fontSize: 13, marginBottom: 12 },
+};
+
+export function CreateGroupPage() {
+  const navigate = useNavigate();
+  const { showToast } = useToast();
+
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!name.trim()) {
+      setError("Group name is required.");
+      return;
+    }
+    if (name.trim().length < 2) {
+      setError("Group name must be at least 2 characters.");
+      return;
+    }
+    setSubmitting(true);
+    setError(null);
+    try {
+      const group = await groupsApi.createGroup({
+        name: name.trim(),
+        description: description.trim() || undefined,
+      });
+      showToast({ message: "Group created!", variant: "success" });
+      navigate(`/groups/${group.id}`);
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : "Failed to create group";
+      setError(msg);
+      showToast({ message: msg, variant: "error" });
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  return (
+    <div style={S.container}>
+      <button style={S.backBtn} onClick={() => navigate("/groups")}>
+        ← Back to Groups
+      </button>
+      <h1 style={S.title}>Create a Group</h1>
+
+      <form onSubmit={handleSubmit}>
+        {error && <div style={S.errorText}>{error}</div>}
+
+        <label style={S.label} htmlFor="group-name">Group Name *</label>
+        <input
+          id="group-name"
+          style={S.input}
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          placeholder="e.g., Sci-Fi Book Club"
+          maxLength={256}
+          autoFocus
+        />
+
+        <label style={S.label} htmlFor="group-desc">Description</label>
+        <textarea
+          id="group-desc"
+          style={S.textarea}
+          value={description}
+          onChange={(e) => setDescription(e.target.value)}
+          placeholder="What's this group about? (optional)"
+        />
+
+        <button type="submit" style={S.submitBtn(submitting || !name.trim())} disabled={submitting || !name.trim()}>
+          {submitting ? "Creating..." : "Create Group"}
+        </button>
+      </form>
+    </div>
+  );
+}

frontend/src/pages/GroupDetailPage.tsx

@@ -0,0 +1,334 @@
+import React, { useCallback, useEffect, useState } from "react";
+import { useNavigate, useParams } from "react-router-dom";
+import { groupsApi } from "../api/groups";
+import { useAuth } from "../context/AuthContext";
+import { useToast } from "../hooks/useToast";
+import type { GroupDetail, GroupInvite, GroupMember } from "../../packages/shared/src/types";
+
+const S = {
+  container: { maxWidth: 800, margin: "0 auto", padding: "24px 16px" } satisfies React.CSSProperties,
+  backBtn: {
+    background: "none", border: "none", color: "#3b82f6", fontSize: 14, cursor: "pointer",
+    padding: 0, marginBottom: 16, minHeight: 44, minWidth: 44,
+  } satisfies React.CSSProperties,
+  title: { fontSize: 28, fontWeight: 700, margin: "0 0 4px 0" } satisfies React.CSSProperties,
+  desc: { fontSize: 14, color: "#6b7280", margin: "0 0 20px 0" } satisfies React.CSSProperties,
+  section: { marginTop: 28 } satisfies React.CSSProperties,
+  sectionTitle: { fontSize: 18, fontWeight: 600, marginBottom: 12 } satisfies React.CSSProperties,
+  memberItem: {
+    display: "flex", justifyContent: "space-between", alignItems: "center",
+    padding: "10px 0", borderBottom: "1px solid #f3f4f6",
+  } satisfies React.CSSProperties,
+  memberInfo: { display: "flex", flexDirection: "column" as const },
+  memberName: { fontSize: 14, fontWeight: 500 } satisfies React.CSSProperties,
+  memberEmail: { fontSize: 12, color: "#9ca3af" } satisfies React.CSSProperties,
+  badge: (role: string): React.CSSProperties => ({
+    display: "inline-block", padding: "2px 8px", borderRadius: 6, fontSize: 11, fontWeight: 600,
+    backgroundColor: role === "admin" ? "#dbeafe" : "#f3f4f6",
+    color: role === "admin" ? "#1d4ed8" : "#6b7280",
+  }),
+  removeBtn: {
+    padding: "4px 12px", fontSize: 12, color: "#ef4444", background: "#fef2f2",
+    border: "1px solid #fecaca", borderRadius: 6, cursor: "pointer", minHeight: 32,
+  } satisfies React.CSSProperties,
+  transferBtn: {
+    padding: "4px 12px", fontSize: 12, color: "#3b82f6", background: "#eff6ff",
+    border: "1px solid #bfdbfe", borderRadius: 6, cursor: "pointer", minHeight: 32,
+    marginRight: 8,
+  } satisfies React.CSSProperties,
+  inviteCard: {
+    padding: "12px 16px", border: "1px solid #e5e7eb", borderRadius: 8, marginBottom: 8,
+  } satisfies React.CSSProperties,
+  inviteCode: { fontSize: 13, fontFamily: "monospace", marginBottom: 4 } satisfies React.CSSProperties,
+  inviteMeta: { fontSize: 12, color: "#9ca3af" } satisfies React.CSSProperties,
+  actionBtn: (color: string): React.CSSProperties => ({
+    padding: "8px 16px", backgroundColor: color, color: "#fff", border: "none",
+    borderRadius: 8, fontSize: 13, fontWeight: 600, cursor: "pointer",
+    minHeight: 44, minWidth: 44,
+  }),
+  dangerBtn: {
+    padding: "8px 16px", backgroundColor: "#ef4444", color: "#fff", border: "none",
+    borderRadius: 8, fontSize: 13, fontWeight: 600, cursor: "pointer",
+    minHeight: 44, minWidth: 44,
+  } satisfies React.CSSProperties,
+  leaveBtn: {
+    padding: "8px 16px", backgroundColor: "#fff", color: "#ef4444",
+    border: "1px solid #ef4444", borderRadius: 8, fontSize: 13, fontWeight: 600,
+    cursor: "pointer", minHeight: 44, minWidth: 44,
+  } satisfies React.CSSProperties,
+  inlineBtn: {
+    padding: "4px 10px", fontSize: 12, color: "#ef4444", background: "#fef2f2",
+    border: "1px solid #fecaca", borderRadius: 6, cursor: "pointer", minHeight: 28,
+  } satisfies React.CSSProperties,
+  copyRow: { display: "flex", gap: 8, alignItems: "center", marginBottom: 12 } satisfies React.CSSProperties,
+  input: {
+    flex: 1, padding: "10px 12px", border: "1px solid #d1d5db", borderRadius: 8, fontSize: 14,
+  } satisfies React.CSSProperties,
+  loading: { textAlign: "center" as const, padding: 60, color: "#9ca3af" },
+  error: { textAlign: "center" as const, padding: 40, color: "#ef4444" },
+};
+
+export function GroupDetailPage() {
+  const { id } = useParams<{ id: string }>();
+  const navigate = useNavigate();
+  const { user } = useAuth();
+  const { showToast } = useToast();
+
+  const [group, setGroup] = useState<GroupDetail | null>(null);
+  const [invites, setInvites] = useState<GroupInvite[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [editingName, setEditingName] = useState(false);
+  const [editName, setEditName] = useState("");
+  const [showInviteSection, setShowInviteSection] = useState(false);
+
+  const groupId = Number(id);
+  const isAdmin = group?.user_role === "admin";
+
+  const loadGroup = useCallback(async () => {
+    if (!groupId) return;
+    setLoading(true);
+    setError(null);
+    try {
+      const data = await groupsApi.getGroup(groupId);
+      setGroup(data);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to load group");
+    } finally {
+      setLoading(false);
+    }
+  }, [groupId]);
+
+  const loadInvites = useCallback(async () => {
+    if (!groupId || !isAdmin) return;
+    try {
+      const data = await groupsApi.listInvites(groupId);
+      setInvites(data);
+    } catch {
+      // Silently fail — invites are supplementary
+    }
+  }, [groupId, isAdmin]);
+
+  useEffect(() => {
+    loadGroup();
+  }, [loadGroup]);
+
+  useEffect(() => {
+    if (group && isAdmin) loadInvites();
+  }, [group, isAdmin, loadInvites]);
+
+  const handleRemoveMember = async (userId: number, memberEmail: string) => {
+    if (!confirm(`Remove ${memberEmail} from the group?`)) return;
+    try {
+      await groupsApi.removeMember(groupId, userId);
+      showToast({ message: "Member removed", variant: "success" });
+      loadGroup();
+    } catch (err: unknown) {
+      showToast({ message: "Failed to remove member", variant: "error" });
+    }
+  };
+
+  const handleTransferAdmin = async (userId: number, memberEmail: string) => {
+    if (!confirm(`Transfer admin role to ${memberEmail}? You will become a regular member.`)) return;
+    try {
+      await groupsApi.updateMemberRole(groupId, userId, "admin");
+      showToast({ message: "Admin role transferred", variant: "success" });
+      loadGroup();
+    } catch (err: unknown) {
+      showToast({ message: "Failed to transfer admin", variant: "error" });
+    }
+  };
+
+  const handleLeave = async () => {
+    if (!confirm("Are you sure you want to leave this group?")) return;
+    try {
+      const result = await groupsApi.leaveGroup(groupId);
+      showToast({ message: result.detail || "Left group", variant: "success" });
+      navigate("/groups");
+    } catch (err: unknown) {
+      showToast({ message: "Failed to leave group", variant: "error" });
+    }
+  };
+
+  const handleCreateInvite = async () => {
+    try {
+      const invite = await groupsApi.createInvite(groupId);
+      setInvites((prev) => [invite, ...prev]);
+      showToast({ message: "Invite link created!", variant: "success" });
+    } catch (err: unknown) {
+      showToast({ message: "Failed to create invite", variant: "error" });
+    }
+  };
+
+  const handleRevokeInvite = async (inviteId: number) => {
+    try {
+      await groupsApi.revokeInvite(groupId, inviteId);
+      setInvites((prev) => prev.map((i) => (i.id === inviteId ? { ...i, is_active: false } : i)));
+      showToast({ message: "Invite revoked", variant: "success" });
+    } catch (err: unknown) {
+      showToast({ message: "Failed to revoke invite", variant: "error" });
+    }
+  };
+
+  const handleSaveName = async () => {
+    if (!editName.trim()) return;
+    try {
+      const updated = await groupsApi.updateGroup(groupId, { name: editName.trim() });
+      setGroup(updated);
+      setEditingName(false);
+      showToast({ message: "Group name updated", variant: "success" });
+    } catch (err: unknown) {
+      showToast({ message: "Failed to update group", variant: "error" });
+    }
+  };
+
+  const handleDeleteGroup = async () => {
+    if (!confirm("Delete this group? This cannot be undone.")) return;
+    try {
+      await groupsApi.deleteGroup(groupId);
+      showToast({ message: "Group deleted", variant: "success" });
+      navigate("/groups");
+    } catch (err: unknown) {
+      showToast({ message: "Failed to delete group", variant: "error" });
+    }
+  };
+
+  const copyToClipboard = (text: string) => {
+    navigator.clipboard.writeText(text).then(
+      () => showToast({ message: "Link copied!" }),
+      () => showToast({ message: "Failed to copy", variant: "error" }),
+    );
+  };
+
+  if (loading) return <div style={S.loading}>Loading group...</div>;
+  if (error) return <div style={S.error}>{error} <br /><button onClick={loadGroup} style={{ marginTop: 12, padding: "8px 16px", cursor: "pointer", border: "1px solid #d1d5db", borderRadius: 6, background: "#fff" }}>Retry</button></div>;
+  if (!group) return <div style={S.error}>Group not found</div>;
+
+  return (
+    <div style={S.container}>
+      <button style={S.backBtn} onClick={() => navigate("/groups")}>
+        ← Back to Groups
+      </button>
+
+      {/* Group Header */}
+      {editingName ? (
+        <div style={{ display: "flex", gap: 8, marginBottom: 16 }}>
+          <input
+            style={S.input}
+            value={editName}
+            onChange={(e) => setEditName(e.target.value)}
+            onKeyDown={(e) => { if (e.key === "Enter") handleSaveName(); if (e.key === "Escape") setEditingName(false); }}
+            autoFocus
+          />
+          <button style={S.actionBtn("#3b82f6")} onClick={handleSaveName}>Save</button>
+          <button style={{ ...S.actionBtn("#6b7280"), padding: "8px 16px" }} onClick={() => setEditingName(false)}>Cancel</button>
+        </div>
+      ) : (
+        <h1
+          style={S.title}
+          onClick={() => {
+            if (isAdmin) { setEditName(group.name); setEditingName(true); }
+          }}
+          title={isAdmin ? "Click to edit name" : undefined}
+        >
+          {group.name}
+        </h1>
+      )}
+      <p style={S.desc}>{group.description || "No description"}</p>
+      <p style={{ fontSize: 12, color: "#9ca3af", marginBottom: 20 }}>
+        Created by {group.created_by_email} · {group.member_count} member{group.member_count !== 1 ? "s" : ""}
+      </p>
+
+      {/* Admin Actions */}
+      {isAdmin && (
+        <div style={{ display: "flex", gap: 8, flexWrap: "wrap", marginBottom: 20 }}>
+          <button
+            style={S.actionBtn("#3b82f6")}
+            onClick={() => setShowInviteSection((v) => !v)}
+          >
+            {showInviteSection ? "Hide Invites" : "Manage Invites"}
+          </button>
+          <button style={S.dangerBtn} onClick={handleDeleteGroup}>
+            Delete Group
+          </button>
+        </div>
+      )}
+
+      {/* Invites Section */}
+      {isAdmin && showInviteSection && (
+        <div style={S.section}>
+          <h2 style={S.sectionTitle}>Invite Links</h2>
+          <button style={S.actionBtn("#22c55e")} onClick={handleCreateInvite}>
+            + Generate Invite Link
+          </button>
+          {invites.length === 0 ? (
+            <p style={{ color: "#9ca3af", fontSize: 14, marginTop: 12 }}>No invites yet.</p>
+          ) : (
+            invites.map((inv) => (
+              <div key={inv.id} style={S.inviteCard}>
+                <div style={S.inviteCode}>{inv.code}</div>
+                <div style={S.inviteMeta}>
+                  {inv.is_active ? "Active" : "Revoked"} ·{" "}
+                  {inv.max_uses > 0 ? `${inv.use_count}/${inv.max_uses} uses` : `${inv.use_count} uses (unlimited)`}
+                </div>
+                <div style={{ marginTop: 8, display: "flex", gap: 8 }}>
+                  <button style={S.actionBtn("#3b82f6")} onClick={() => copyToClipboard(inv.join_url)}>
+                    Copy Link
+                  </button>
+                  {inv.is_active && (
+                    <button style={S.inlineBtn} onClick={() => handleRevokeInvite(inv.id)}>
+                      Revoke
+                    </button>
+                  )}
+                </div>
+              </div>
+            ))
+          )}
+        </div>
+      )}
+
+      {/* Members Section */}
+      <div style={S.section}>
+        <h2 style={S.sectionTitle}>Members ({group.member_count})</h2>
+        {group.members.map((member) => (
+          <div key={member.id} style={S.memberItem}>
+            <div style={S.memberInfo}>
+              <span style={S.memberName}>
+                {member.user_username || member.user_email}{" "}
+                <span style={S.badge(member.role)}>{member.role}</span>
+              </span>
+              <span style={S.memberEmail}>{member.user_email}</span>
+            </div>
+            {isAdmin && member.user_id !== Number(user?.email ? undefined : undefined) && (
+              <div style={{ display: "flex", gap: 8 }}>
+                {member.role === "member" && (
+                  <button
+                    style={S.transferBtn}
+                    onClick={() => handleTransferAdmin(member.user_id, member.user_email)}
+                  >
+                    Make Admin
+                  </button>
+                )}
+                <button
+                  style={S.removeBtn}
+                  onClick={() => handleRemoveMember(member.user_id, member.user_email)}
+                >
+                  Remove
+                </button>
+              </div>
+            )}
+          </div>
+        ))}
+      </div>
+
+      {/* Leave Group (non-admins only) */}
+      {!isAdmin && (
+        <div style={{ ...S.section, marginTop: 40 }}>
+          <button style={S.leaveBtn} onClick={handleLeave}>
+            Leave Group
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/pages/GroupsListPage.tsx

@@ -0,0 +1,195 @@
+import React, { useCallback, useEffect, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { groupsApi } from "../api/groups";
+import type { GroupListItem } from "../../packages/shared/src/types";
+import { useAuth } from "../context/AuthContext";
+
+const styles = {
+  container: {
+    maxWidth: 800,
+    margin: "0 auto",
+    padding: "24px 16px",
+  } satisfies React.CSSProperties,
+  header: {
+    display: "flex",
+    justifyContent: "space-between",
+    alignItems: "center",
+    marginBottom: 24,
+  } satisfies React.CSSProperties,
+  title: {
+    fontSize: 28,
+    fontWeight: 700,
+    margin: 0,
+  } satisfies React.CSSProperties,
+  createBtn: {
+    padding: "10px 20px",
+    backgroundColor: "#3b82f6",
+    color: "#fff",
+    border: "none",
+    borderRadius: 8,
+    fontSize: 14,
+    fontWeight: 600,
+    cursor: "pointer",
+    minHeight: 44,
+    minWidth: 44,
+  } satisfies React.CSSProperties,
+  groupCard: {
+    border: "1px solid #e5e7eb",
+    borderRadius: 12,
+    padding: 20,
+    marginBottom: 12,
+    cursor: "pointer",
+    transition: "box-shadow 0.15s",
+  } satisfies React.CSSProperties,
+  groupName: {
+    fontSize: 18,
+    fontWeight: 600,
+    margin: "0 0 4px 0",
+  } satisfies React.CSSProperties,
+  groupDesc: {
+    fontSize: 14,
+    color: "#6b7280",
+    margin: "0 0 8px 0",
+  } satisfies React.CSSProperties,
+  groupMeta: {
+    display: "flex",
+    gap: 12,
+    fontSize: 13,
+    color: "#9ca3af",
+  } satisfies React.CSSProperties,
+  badge: {
+    display: "inline-block",
+    padding: "2px 8px",
+    borderRadius: 6,
+    fontSize: 11,
+    fontWeight: 600,
+  } satisfies React.CSSProperties,
+  adminBadge: {
+    backgroundColor: "#dbeafe",
+    color: "#1d4ed8",
+  } satisfies React.CSSProperties,
+  memberBadge: {
+    backgroundColor: "#f3f4f6",
+    color: "#6b7280",
+  } satisfies React.CSSProperties,
+  empty: {
+    textAlign: "center" as const,
+    padding: 60,
+    color: "#9ca3af",
+  },
+  loadingText: {
+    textAlign: "center" as const,
+    padding: 60,
+    color: "#9ca3af",
+    fontSize: 16,
+  },
+  errorText: {
+    textAlign: "center" as const,
+    padding: 40,
+    color: "#ef4444",
+    fontSize: 14,
+  },
+};
+
+export function GroupsListPage() {
+  const navigate = useNavigate();
+  const { user } = useAuth();
+  const [groups, setGroups] = useState<GroupListItem[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const loadGroups = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const data = await groupsApi.listGroups();
+      setGroups(data);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to load groups");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    loadGroups();
+  }, [loadGroups]);
+
+  if (loading) {
+    return <div style={styles.loadingText}>Loading groups...</div>;
+  }
+
+  if (error) {
+    return (
+      <div style={styles.container}>
+        <div style={styles.errorText}>
+          {error}
+          <br />
+          <button
+            onClick={loadGroups}
+            style={{
+              marginTop: 12,
+              padding: "8px 16px",
+              cursor: "pointer",
+              border: "1px solid #d1d5db",
+              borderRadius: 6,
+              background: "#fff",
+            }}
+          >
+            Retry
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div style={styles.container}>
+      <div style={styles.header}>
+        <h1 style={styles.title}>Groups</h1>
+        <button
+          style={styles.createBtn}
+          onClick={() => navigate("/groups/create")}
+        >
+          + Create Group
+        </button>
+      </div>
+
+      {groups.length === 0 ? (
+        <div style={styles.empty}>
+          <p style={{ fontSize: 16, marginBottom: 8 }}>You're not in any groups yet.</p>
+          <p style={{ fontSize: 14 }}>Create a group to start reading together with friends!</p>
+        </div>
+      ) : (
+        groups.map((group) => (
+          <div
+            key={group.id}
+            style={styles.groupCard}
+            onClick={() => navigate(`/groups/${group.id}`)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter" || e.key === " ") {
+                e.preventDefault();
+                navigate(`/groups/${group.id}`);
+              }
+            }}
+            role="button"
+            tabIndex={0}
+          >
+            <h2 style={styles.groupName}>{group.name}</h2>
+            {group.description && (
+              <p style={styles.groupDesc}>{group.description}</p>
+            )}
+            <div style={styles.groupMeta}>
+              <span>{group.member_count} member{group.member_count !== 1 ? "s" : ""}</span>
+              {group.user_role === "admin" ? (
+                <span style={{ ...styles.badge, ...styles.adminBadge }}>Admin</span>
+              ) : group.user_role === "member" ? (
+                <span style={{ ...styles.badge, ...styles.memberBadge }}>Member</span>
+              ) : null}
+            </div>
+          </div>
+        ))
+      )}
+    </div>
+  );
+}

frontend/src/pages/JoinGroupPage.tsx

@@ -0,0 +1,138 @@
+import React, { useCallback, useEffect, useState } from "react";
+import { useNavigate, useParams } from "react-router-dom";
+import { groupsApi } from "../api/groups";
+import { useToast } from "../hooks/useToast";
+import type { InviteValidation } from "../../packages/shared/src/types";
+
+const S = {
+  container: { maxWidth: 500, margin: "0 auto", padding: "24px 16px" } satisfies React.CSSProperties,
+  backBtn: {
+    background: "none", border: "none", color: "#3b82f6", fontSize: 14, cursor: "pointer",
+    padding: 0, marginBottom: 16, minHeight: 44, minWidth: 44,
+  } satisfies React.CSSProperties,
+  card: {
+    padding: 24, border: "1px solid #e5e7eb", borderRadius: 12, textAlign: "center" as const,
+  } satisfies React.CSSProperties,
+  groupIcon: {
+    width: 64, height: 64, borderRadius: "50%", backgroundColor: "#dbeafe",
+    display: "flex", alignItems: "center", justifyContent: "center",
+    margin: "0 auto 16px auto", fontSize: 28, color: "#3b82f6", fontWeight: 700,
+  } satisfies React.CSSProperties,
+  groupName: { fontSize: 22, fontWeight: 700, marginBottom: 4 } satisfies React.CSSProperties,
+  groupDesc: { fontSize: 14, color: "#6b7280", marginBottom: 8 } satisfies React.CSSProperties,
+  groupMeta: { fontSize: 13, color: "#9ca3af", marginBottom: 20 } satisfies React.CSSProperties,
+  joinBtn: {
+    padding: "12px 32px", backgroundColor: "#3b82f6", color: "#fff",
+    border: "none", borderRadius: 8, fontSize: 16, fontWeight: 600,
+    cursor: "pointer", minHeight: 44,
+  } satisfies React.CSSProperties,
+  joinBtnDisabled: {
+    padding: "12px 32px", backgroundColor: "#93c5fd", color: "#fff",
+    border: "none", borderRadius: 8, fontSize: 16, fontWeight: 600,
+    cursor: "not-allowed", minHeight: 44,
+  } satisfies React.CSSProperties,
+  loading: { textAlign: "center" as const, padding: 60, color: "#9ca3af" },
+  error: { textAlign: "center" as const, padding: 40, color: "#ef4444" },
+  errorCard: {
+    padding: 24, border: "1px solid #fecaca", borderRadius: 12, textAlign: "center" as const,
+    backgroundColor: "#fef2f2",
+  } satisfies React.CSSProperties,
+  errorTitle: { fontSize: 18, fontWeight: 600, color: "#dc2626", marginBottom: 8 } satisfies React.CSSProperties,
+  errorMsg: { fontSize: 14, color: "#ef4444" } satisfies React.CSSProperties,
+};
+
+export function JoinGroupPage() {
+  const { code } = useParams<{ code: string }>();
+  const navigate = useNavigate();
+  const { showToast } = useToast();
+
+  const [inviteInfo, setInviteInfo] = useState<InviteValidation | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [joining, setJoining] = useState(false);
+
+  const validateInvite = useCallback(async () => {
+    if (!code) return;
+    setLoading(true);
+    setError(null);
+    try {
+      const data = await groupsApi.validateInvite(code);
+      setInviteInfo(data);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Invalid invite");
+    } finally {
+      setLoading(false);
+    }
+  }, [code]);
+
+  useEffect(() => {
+    validateInvite();
+  }, [validateInvite]);
+
+  const handleJoin = async () => {
+    if (!code) return;
+    setJoining(true);
+    try {
+      const group = await groupsApi.joinViaInvite(code);
+      showToast({ message: `You've joined ${group.name}!`, variant: "success" });
+      navigate(`/groups/${group.id}`);
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : "Failed to join group";
+      showToast({ message: msg, variant: "error" });
+      setError(msg);
+    } finally {
+      setJoining(false);
+    }
+  };
+
+  if (loading) return <div style={S.loading}>Validating invite...</div>;
+
+  if (error && !inviteInfo) {
+    return (
+      <div style={S.container}>
+        <div style={S.errorCard}>
+          <div style={S.errorTitle}>Invalid Invite</div>
+          <div style={S.errorMsg}>{error}</div>
+          <button
+            style={{ ...S.backBtn, marginTop: 16, display: "inline-block" }}
+            onClick={() => navigate("/groups")}
+          >
+            Go to Groups
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  if (!inviteInfo) return null;
+
+  return (
+    <div style={S.container}>
+      <button style={S.backBtn} onClick={() => navigate("/groups")}>
+        ← Back to Groups
+      </button>
+
+      <div style={S.card}>
+        <div style={S.groupIcon}>
+          {inviteInfo.group.name.charAt(0).toUpperCase()}
+        </div>
+        <h1 style={S.groupName}>{inviteInfo.group.name}</h1>
+        {inviteInfo.group.description && (
+          <p style={S.groupDesc}>{inviteInfo.group.description}</p>
+        )}
+        <p style={S.groupMeta}>
+          {inviteInfo.group.member_count} member{inviteInfo.group.member_count !== 1 ? "s" : ""} ·{" "}
+          Created by {inviteInfo.invite.created_by_email}
+        </p>
+
+        <button
+          style={joining ? S.joinBtnDisabled : S.joinBtn}
+          onClick={handleJoin}
+          disabled={joining}
+        >
+          {joining ? "Joining..." : "Join Group"}
+        </button>
+      </div>
+    </div>
+  );
+}

frontend/src/pages/Library.tsx

@@ -241,6 +241,7 @@ export function LibraryPage() {
           {isMobile ? (
             <>
               <button onClick={() => navigate("/add")} style={{ ...TOUCH_TARGET, fontSize: 20, background: "none", border: "none", cursor: "pointer", padding: 8 }} title={t("library.addBook")}>➕</button>
+              <button onClick={() => navigate("/groups")} style={{ ...TOUCH_TARGET, fontSize: 20, background: "none", border: "none", cursor: "pointer", padding: 8 }} title="Groups">👥</button>
               <button onClick={() => navigate("/bookmarks-notes")} style={{ ...TOUCH_TARGET, fontSize: 20, background: "none", border: "none", cursor: "pointer", padding: 8 }} title={t("library.bookmarks")}>🔖</button>
               <button onClick={() => navigate("/settings")} style={{ ...TOUCH_TARGET, fontSize: 20, background: "none", border: "none", cursor: "pointer", padding: 8 }} title={t("library.settings")}>⚙️</button>
               <button onClick={logout} style={{ ...TOUCH_TARGET, fontSize: 20, background: "none", border: "none", cursor: "pointer", padding: 8 }} title={t("library.logout")}>🚪</button>
@@ -248,6 +249,7 @@ export function LibraryPage() {
           ) : (
             <>
               <button onClick={() => navigate("/add")} className="btn">+ {t("library.addBook")}</button>
+              <button onClick={() => navigate("/groups")} className="btn btn-secondary">Groups</button>
               <button onClick={() => navigate("/bookmarks-notes")} className="btn btn-secondary">{t("library.bookmarks")}</button>
               <button onClick={() => navigate("/settings")} className="btn btn-secondary">{t("library.settings")}</button>
               <button onClick={logout} className="btn btn-danger">{t("library.logout")}</button>

packages/shared/src/types.ts

@@ -215,4 +215,100 @@ export interface PaginatedResponse<T> {
 export interface ApiError {
   detail?: string;
   [key: string]: unknown;
+}
+
+// ---- Groups ----
+
+export type GroupRole = "admin" | "member";
+
+export type JoinRequestStatus = "pending" | "approved" | "rejected";
+
+export interface GroupListItem {
+  id: number;
+  name: string;
+  description: string;
+  created_by: number;
+  member_count: number;
+  user_role: GroupRole | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface GroupMember {
+  id: number;
+  user_id: number;
+  user_email: string;
+  user_username: string;
+  role: GroupRole;
+  joined_at: string;
+}
+
+export interface GroupDetail {
+  id: number;
+  name: string;
+  description: string;
+  created_by: number;
+  created_by_email: string;
+  created_by_username: string;
+  members: GroupMember[];
+  member_count: number;
+  user_role: GroupRole | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreateGroupPayload {
+  name: string;
+  description?: string;
+}
+
+export interface UpdateGroupPayload {
+  name?: string;
+  description?: string;
+}
+
+export interface GroupInvite {
+  id: number;
+  group: number;
+  group_name: string;
+  code: string;
+  created_by: number;
+  created_by_email: string;
+  max_uses: number;
+  use_count: number;
+  is_active: boolean;
+  join_url: string;
+  created_at: string;
+}
+
+export interface CreateInvitePayload {
+  max_uses?: number;
+}
+
+export interface JoinRequest {
+  id: number;
+  group: number;
+  group_name: string;
+  user: number;
+  user_id: number;
+  user_email: string;
+  user_username: string;
+  invite: number | null;
+  invite_code: string | null;
+  status: JoinRequestStatus;
+  created_at: string;
+}
+
+export interface InviteValidation {
+  group: {
+    id: number;
+    name: string;
+    description: string;
+    created_by_email: string;
+    member_count: number;
+  };
+  invite: {
+    code: string;
+    created_by_email: string;
+  };
 }

packages/shared/src/utils.ts

@@ -114,4 +114,18 @@ export const API_ENDPOINTS = {
     bookmarkDetail: (id: string) => `/api/annotations/bookmarks/${id}/`,
     noteDetail: (id: string) => `/api/annotations/notes/${id}/`,
   },
+  groups: {
+    list: "/api/groups/",
+    detail: (id: number) => `/api/groups/${id}/`,
+    members: (id: number) => `/api/groups/${id}/members/`,
+    removeMember: (id: number, userId: number) => `/api/groups/${id}/members/${userId}/`,
+    updateRole: (id: number, userId: number) => `/api/groups/${id}/members/${userId}/role/`,
+    leave: (id: number) => `/api/groups/${id}/leave/`,
+    invites: (id: number) => `/api/groups/${id}/invites/`,
+    revokeInvite: (id: number, inviteId: number) => `/api/groups/${id}/invites/${inviteId}/`,
+    requests: (id: number) => `/api/groups/${id}/requests/`,
+    approveRequest: (id: number, requestId: number) => `/api/groups/${id}/requests/${requestId}/approve/`,
+    rejectRequest: (id: number, requestId: number) => `/api/groups/${id}/requests/${requestId}/reject/`,
+    join: (code: string) => `/api/join/${code}/`,
+  },
 } as const;