[Makisuo]

Fourth layer of the Analyst role, on top of #2547. The Members page now offers it.

What changed

• Analyst joins the roles the Members page assigns, lowest first. The invite picker, the role picker on each row and the role change prompt all read that list, so they pick it up without page changes.
• Member stays the default role for a new invite.
• A role key the page does not know now shows as Analyst, the same way the API reads it. It showed as Member.

Screenshots

Role picker, before and after:

Before	After

The confirm strip says what the role is for:

Verified

• packages/domain: policy tests, 16 passed.
• apps/web: org-membership.test.ts, 9 passed. Cases: an unknown role key shows as Analyst, root still shows as Member, and the role change prompt names the analyst role and says it builds dashboards.
• The /lab/members page driven in a headless browser for the screenshots above.
• The development auth instance has org:analyst in its default role set, created through the provider's API.

Before merge

Create org:analyst (name "Analyst", no system permissions, in the default role set) on the production auth instance. Until it exists, assigning Analyst there fails. Also confirm production has no role keys beyond admin, member and engineer: any other key now reads as analyst.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e7ce423-6d50-4316-851a-8bee68fef34c

Commits

Reviewing files that changed from the base of the PR and between ee977ef and 6a35f17.

Files selected for processing: 4

• apps/web/src/page/settings/kit/org-membership.test.ts
• apps/web/src/page/settings/kit/org-membership.ts
• packages/domain/src/policy/policy.test.ts
• packages/domain/src/policy/roles.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. Analyst joins the one list every picker reads, and the invite default stays org:member; the earlier memberEntry position note is untouched.
_{1 note · tests covered · risk medium}

Adds the analyst role to Policy.assignableRoles, so the Members page's invite, row and confirm-strip pickers offer it, and unknown role keys now read as analyst. roleOf is unchanged in behavior because the merged list is the same lookup. Safe to merge once the role exists in Clerk.

• assignableRoles gains an org:analyst entry first, replacing the private clerkRoles list
• Unknown Clerk role keys now display as Analyst instead of Member
• memberEntry moves to assignableRoles[1] since member is no longer first

Before merge

• Manual · Create org:analyst (name "Analyst", no system permissions, in the default role set) on the production auth instance before this deploys
• Manual · Confirm production Clerk has no role keys other than admin, member and engineer: any other key now shows as Analyst

Still open from earlier reviews

• 🔵 Note · F1 · memberEntry is looked up by array position, not by role · apps/web/src/page/settings/kit/org-membership.ts:11

_{6a35f17 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[maple-review-bot]

Merged with 2 steps from "Before merge" still open. If they are done, tick them on the review comment; if not, now is the time.

• Manual · Confirm production Clerk has no role keys other than admin, member and engineer: any other key now shows as Analyst
• Manual · Create org:analyst (name "Analyst", no system permissions, in the default role set) on the production auth instance before this deploys