fix: Ensure admin panel is functional by linking the station manager role to admin permissions

[JacksonMeade]

Fix Admin Permissions for Station Managers

Problem

Users with stationManager role in the default organization were unable to access Better Auth Admin plugin endpoints (/admin/*). The Admin plugin checks the global user.role field (not organization membership) to authorize requests, but organization roles were not being synced to this field.

Solution

Implemented automatic synchronization of user.role to "admin" when users are promoted to stationManager, admin, or owner roles in the default organization.

Changes

shared/authentication/src/auth.definition.ts

• Added organizationHooks to the organization plugin:
  • afterAddMember: Sets user.role = "admin" when members are added with admin roles
  • afterUpdateMemberRole: Updates user.role on role changes (grants on promotion, removes on demotion)
  • afterRemoveMember: Removes admin role when members are removed from default organization
• Hooks only apply to the default organization (identified by DEFAULT_ORG_SLUG)

apps/auth/app.ts

• Updated createDefaultUser() to set user.role = "admin" immediately when creating a default user with stationManager role
• Added syncAdminRoles() function to ensure consistency for existing users created before hooks were implemented

Technical Details

The Better Auth Admin plugin requires user.role === "admin" in the database to authorize admin endpoints. Organization roles (stationManager, admin, owner) are stored in the member table and are separate from the global user.role field. This change bridges that gap by automatically maintaining user.role based on organization membership in the default organization.

Testing

• Verified existing stationManager users receive admin role on service startup
• Verified new users created with stationManager role receive admin role immediately
• Verified role changes (promotions/demotions) update user.role accordingly
• Confirmed admin endpoints are now accessible to station managers

[JacksonMeade]

Blocked, depends on #101