- Shipped
- April 19, 2026 at 7:36 PM UTC
- Author
- Kamo
- Commit
- 64db301
MemberSecurityController now enforces the three assignment invariants defined in the brainstorm spec: - saveMemberSecurity: before persisting the caller's requested roleIds, augments the set with the mandatory system role(s) based on member type: Member-typed members always get roleMemberID; Team-Member-typed members always get roleTeamMemberID; Team-Member owners additionally always get roleAdminID. LinkedHashSet preserves caller ordering while deduping. - updateMemberAccess: when the owner flag toggles, the Administrator role is added or removed on the team-member to keep role assignments in sync with ownership. Rights-applied recalculation runs in the same transaction so downstream reads see the updated effective permissions immediately.