getAdminRoleInfo picked a user's unit_admin role by role key alone —
a unit-admin grant carries only a unitId, no organizationId, so a user
who is unit-admin in one org and (say) org-admin in another had the
wrong unit attached to their row wherever both orgs share the viewer's
admin list. That wrong unitId then flowed into the remove action,
which deletes by exact {userId, roleId, unitId} match — a legitimate
0-match, surfaced as "user_role_not_found", removal silently failing.
Fetches the selected org's unit ids (same pattern as the position-type
form's org→units scoping) and requires the unit-admin grant's unitId
to be one of them before treating it as this org's grant.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was no UI to assign permissions to the Organization Admin role,
even though the backend's Role→Permission endpoints
(@tria-plc/iamapi-common's role-permissions routes) were already live
and unused. Adds a dedicated page — application picker + the existing
permission checklist — that assigns/reads permissions for the fixed
Organization Admin role, linked from the Organization Admins page.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
