feat(roles): every mokosh user is an admin of their own instance

YousifShkara commented

2026-06-29 07:28:35 +02:00

Owner

MAPPS-330: collapse the mokosh role surface to admin / super_admin. The PMS-458 invite-respect carveout that preserved least-privilege grants into shared org tenants is removed: every signed-in Bunyip user is admin of their own world, even when joining via an invite. Cross-tenant bunyip_role = admin still rises to super_admin. The invitation default also flips from technician to admin so the rare admin-authored invite is consistent with the runtime.

Existing rows seeded under the old taxonomy (technician, manager, dispatcher, sales, finance) are backfilled in place by migration 084 so the DB matches runtime authorization on the first request after deploy, not whenever the user next signs in.

#MAPPS-330

MAPPS-330: collapse the mokosh role surface to admin / super_admin. The PMS-458 invite-respect carveout that preserved least-privilege grants into shared org tenants is removed: every signed-in Bunyip user is admin of their own world, even when joining via an invite. Cross-tenant `bunyip_role = admin` still rises to super_admin. The invitation default also flips from `technician` to `admin` so the rare admin-authored invite is consistent with the runtime. Existing rows seeded under the old taxonomy (technician, manager, dispatcher, sales, finance) are backfilled in place by migration 084 so the DB matches runtime authorization on the first request after deploy, not whenever the user next signs in. #MAPPS-330

YousifShkara self-assigned this

2026-06-29 07:28:35 +02:00

YousifShkara added 1 commit

2026-06-29 07:28:35 +02:00

feat(roles): every mokosh user is an admin of their own instance

E2E / Playwright against staging (pull_request) Failing after 7s

Details

Integration / integration tests (pull_request) Failing after 2m40s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 2m53s

Details

cf5860b206

MAPPS-330: collapse the mokosh role surface to admin / super_admin. The PMS-458 invite-respect carveout that preserved least-privilege grants into shared org tenants is removed: every signed-in Bunyip user is admin of their own world, even when joining via an invite. Cross-tenant `bunyip_role = admin` still rises to super_admin. The invitation default also flips from `technician` to `admin` so the rare admin-authored invite is consistent with the runtime.

Existing rows seeded under the old taxonomy (technician, manager, dispatcher, sales, finance) are backfilled in place by migration 084 so the DB matches runtime authorization on the first request after deploy, not whenever the user next signs in.

#MAPPS-330

YousifShkara referenced this pull request from a commit

2026-06-29 07:47:25 +02:00

fix(migration): drop nonexistent users.deleted_at guard from MAPPS-330 backfill

YousifShkara added 1 commit

2026-06-29 07:47:26 +02:00

fix(migration): drop nonexistent users.deleted_at guard from MAPPS-330 backfill

E2E / Playwright against staging (pull_request) Failing after 41s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 2m1s

Details

Integration / integration tests (pull_request) Successful in 5m43s

Details

9c49820d04

CI integration suite (#401) tripped on migration 084: `column "deleted_at" does not exist`. The users table has no soft-delete column - status flips active / inactive / pending in place, and there is no separate timestamp. The backfill UPDATE referenced a column that has never been on this schema.

Drop the guard. The runtime reconciliation runs against every user row regardless of status (an inactive user signing in still goes through the same place_bunyip_user path), so scoping the backfill on role alone is the correct surface.

#MAPPS-330

nrupard added 1 commit

2026-06-29 21:15:01 +02:00

chore(migrations): renumber MAPPS-330 backfill 084 -> 085

E2E / Playwright against staging (pull_request) Successful in 1m10s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 3m5s

Details

Integration / integration tests (pull_request) Successful in 10m10s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

0fb2d2112b

Migration 084 collided with PMS-502's 084_user_mfa_attempt_lockout.sql (PR #400): two migrations sharing version 084 make sqlx::migrate! fail at boot with a duplicate-version error. PMS-502 is a pure security fix and keeps 084; this role backfill renumbers to the next free slot. Content is unchanged (UPDATE users SET role = 'admin' for the legacy taxonomy rows); 084 never deployed anywhere since the PR is unmerged, so the renumber is safe.

#MAPPS-330