fix: replace dead camelCase permission keys with OrgPermission enum in role seed (ISSUE-162)

[GitAddRemote]

Summary

• Replaces all invented camelCase permission keys in roles.seed.ts (e.g. canViewOrganization, canInviteUsers) with correct OrgPermission enum values (can_view_org_inventory, etc.) — the keys the backend actually enforces
• Makes seedRoles() upsert permissions on existing roles rather than skipping them, so re-running pnpm seed heals a broken database without data loss
• Fixes ISSUE-162

Root Cause

Two disconnected permission systems were never reconciled. roles.seed.ts used camelCase keys invented outside the OrgPermission enum; the backend only checks snake_case OrgPermission keys. Every user assigned Owner, Admin, Member, or Viewer had zero valid permissions, causing 403s on all inventory endpoints.

Permission Matrix (post-fix)

Role	can_view	can_edit	can_admin	can_view_shared
Owner	✓	✓	✓	✓
Admin	✓	✓	✓	✓
Inventory Manager	✓	✓	✓	✓
Member	✓	✗	✗	✓
Viewer	✓	✗	✗	✗

Test plan

• Run pnpm seed against an existing database — all four roles should log ✓ Updated permissions for role
• Verify database: SELECT name, permissions FROM role ORDER BY name — all roles show OrgPermission snake_case keys
• Log in as the demo user (Owner role) and switch to org view — inventory loads without 403
• Re-run pnpm seed a second time — idempotent, no errors

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes ISSUE-162 where default roles were seeded with invented camelCase permission keys that the backend never enforced, leaving Owner/Admin/Member/Viewer users with effectively zero valid permissions. The seed now uses the real OrgPermission enum values, and seedRoles() heals existing roles by upserting their permissions instead of skipping them.

Changes:

• Replace camelCase permission keys in defaultRoles with OrgPermission enum values across Owner/Admin/Member/Viewer.
• Make seedRoles() update permissions on already-existing roles instead of leaving them untouched.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
backend/src/database/seeds/roles.seed.ts	Imports OrgPermission and rewrites every role's permissions object using enum-keyed booleans.
backend/src/database/seeds/database-seeder.service.ts	Changes the "role already exists" branch to overwrite permissions from the seed and log an update.

Comments suppressed due to low confidence (1)

backend/src/database/seeds/roles.seed.ts:38

• Role description fields still reference organization/user/role/settings management (e.g., "Can delete organization and manage all settings", "Can manage users and settings"), but the actual permissions now only cover inventory-related capabilities. These descriptions are misleading to anyone reading them in the DB or UI; consider updating them to accurately reflect the inventory-focused permissions that are actually granted.

    description:
      'Full access to organization. Can delete organization and manage all settings.',
    permissions: {
      [OrgPermission.CAN_VIEW_ORG_INVENTORY]: true,
      [OrgPermission.CAN_EDIT_ORG_INVENTORY]: true,
      [OrgPermission.CAN_ADMIN_ORG_INVENTORY]: true,
      [OrgPermission.CAN_VIEW_MEMBER_SHARED_ITEMS]: true,
    },
  },
  {
    name: 'Admin',
    description: 'Administrative access. Can manage users and settings.',
    permissions: {
      [OrgPermission.CAN_VIEW_ORG_INVENTORY]: true,
      [OrgPermission.CAN_EDIT_ORG_INVENTORY]: true,
      [OrgPermission.CAN_ADMIN_ORG_INVENTORY]: true,
      [OrgPermission.CAN_VIEW_MEMBER_SHARED_ITEMS]: true,
    },
  },
  {
    name: 'Member',
    description: 'Standard member access. Can view and participate.',
    permissions: {
      [OrgPermission.CAN_VIEW_ORG_INVENTORY]: true,
      [OrgPermission.CAN_EDIT_ORG_INVENTORY]: false,
      [OrgPermission.CAN_ADMIN_ORG_INVENTORY]: false,
      [OrgPermission.CAN_VIEW_MEMBER_SHARED_ITEMS]: true,
    },
  },
  {
    name: 'Viewer',
    description: 'Read-only access. Can only view information.',

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.