Function validate_user_group_vec_access 

pub async fn validate_user_group_vec_access(
    infra: &InfraContext<'_>,
    token: &str,
    group_vec: &[String],
) -> Result<(), Error>

Validate that every label in group_vec is in the set the token can access.

Admin tokens (carrying the PA_ADMIN role) short-circuit to Ok without touching the backend. Otherwise the available-group list is fetched once and matched against group_vec. Use the single-group variant validate_user_group_access when you only need to check one label.