fix(security): prevent admin-to-owner privilege escalation in member tools

[0xcucumbersalad]

Summary

• Add role hierarchy enforcement to ORGANIZATION_MEMBER_ADD and ORGANIZATION_MEMBER_UPDATE_ROLE — both tools accepted arbitrary role strings (including "owner") with no validation. Better Auth's addMember / updateMemberRole also performs no role hierarchy check (parseRoles just joins the array into a string). An admin could assign "owner" to any user — including themselves — gaining full org control (SSO config, member management, org deletion).
• New canAssignRole() guard in auth/roles.ts: owners can assign any role; admins can assign anything except "owner". Applied to both tool handlers before the Better Auth call.

Files changed

File	Change
apps/mesh/src/auth/roles.ts	Add canAssignRole(callerRole, targetRole)
apps/mesh/src/auth/roles.test.ts	Unit tests for role hierarchy validation
apps/mesh/src/tools/organization/member-add.ts	Validate role before addMember()
apps/mesh/src/tools/organization/member-update-role.ts	Validate role before updateMemberRole()

Test plan

• bun run check — passes
• bun run fmt — passes
• bun run lint — passes (0 errors)
• bun test apps/mesh/src/auth/roles.test.ts — 5 pass, 0 fail
• Verify admin calling ORGANIZATION_MEMBER_ADD with role: ["owner"] gets error
• Verify owner calling ORGANIZATION_MEMBER_ADD with role: ["owner"] succeeds
• Verify admin calling ORGANIZATION_MEMBER_UPDATE_ROLE with role: ["owner"] gets error

🤖 Generated with Claude Code

---

Summary by cubic

Blocks admin-to-owner privilege escalation by enforcing role assignment rules in organization member tools. Owners can assign any role; admins can assign non-owner roles only.

• Bug Fixes
  • Added canAssignRole(callerRole, targetRole) in auth/roles.ts with unit tests.
  • Validated target role in ORGANIZATION_MEMBER_ADD and ORGANIZATION_MEMBER_UPDATE_ROLE before calling Better Auth.
  • Admin attempts to assign owner now fail; owner assignments by owners still succeed.

^{Written for commit 67526d6. Summary will update on new commits.}