- Shipped
- May 11, 2026 at 7:23 PM UTC
- Author
- Kamo
- Commit
- 69f5979
Adds a public, transactional ensureRoleAssigned(memberId, roleId) that: - No-ops if the role is already on the member. - Looks up the OrgRole and saves a new MemberRole join row. - Recomputes member_rights_applied so the persisted snapshot picks up the role's rights immediately. Used by the child-org-creation flow in SecurityService to propagate the creator's admin status from the new child up into their parent-org membership — keeps a user's admin reach consistent across the child's domain (where the createOrganizationOwner-minted *** already gives them owner+admin) and the parent's domain (where their existing registration-time TeamMember session would otherwise lack CONFIGURE_SYSTEM and bounce them off /settings/account).