Roles assignable on user_entities.role_id. Superadmin is intentionally NOT
a role_id — it lives as profiles.is_superadmin. Anywhere you store or assign
a role, use BaseUserRole. UserRole is the read-side projection that folds
the superadmin flag back in for display / hierarchy checks.
Role IDs: 1 = individual, 2 = supervisor, 3 = admin, 5 = org_supervisor.
(role_id 4 is a legacy super_user seed row and is intentionally not mapped here.)
org_supervisor is an operational role that sits just BELOW admin (rank 2). It
clears supervisor-level gates but not admin-level ones, so admin-only routes and
the shared-template edit rule exclude it for free via the hierarchy. On the
server it is NOT in adminProcedure (default-deny); the specific endpoints it
retains opt it in via orgSupervisorProcedure.
Roles assignable on user_entities.role_id. Superadmin is intentionally NOT a role_id — it lives as profiles.is_superadmin. Anywhere you store or assign a role, use BaseUserRole. UserRole is the read-side projection that folds the superadmin flag back in for display / hierarchy checks.
Role IDs: 1 = individual, 2 = supervisor, 3 = admin, 5 = org_supervisor. (role_id 4 is a legacy
super_userseed row and is intentionally not mapped here.)org_supervisor is an operational role that sits just BELOW admin (rank 2). It clears supervisor-level gates but not admin-level ones, so admin-only routes and the shared-template edit rule exclude it for free via the hierarchy. On the server it is NOT in
adminProcedure(default-deny); the specific endpoints it retains opt it in viaorgSupervisorProcedure.