mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-27 20:10:56 +00:00
9c16579f54
getAdminRoleInfo picked a user's unit_admin role by role key alone —
a unit-admin grant carries only a unitId, no organizationId, so a user
who is unit-admin in one org and (say) org-admin in another had the
wrong unit attached to their row wherever both orgs share the viewer's
admin list. That wrong unitId then flowed into the remove action,
which deletes by exact {userId, roleId, unitId} match — a legitimate
0-match, surfaced as "user_role_not_found", removal silently failing.
Fetches the selected org's unit ids (same pattern as the position-type
form's org→units scoping) and requires the unit-admin grant's unitId
to be one of them before treating it as this org's grant.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>