- Ya
- 11 Mei 2026, 19:23 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 66d3580
When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically the registration-time Team Members role with no Administrator role — and stays that way after the child org is created. That leaves them admin on the child's domain but demoted on the parent's domain: /settings/account redirects them back to /settings because their parent *** lacks CONFIGURE_SYSTEM, and they can't administer their own org tree from the parent. After createOrganizationOwner, look up the creator's existing parent-org Member row (if any) and call **************** with the parent org's roleAdminID. ensureRoleAssigned is idempotent (no-ops if the role is already there) and recomputes member_rights_applied so a subsequent /api/security/session/refresh picks up the new rights immediately. Wrapped in try/catch + warn-and-continue so a hiccup in the parent propagation doesn't roll back the whole new-org creation.