feat(frontend): org member role dropdown + roles/access chart

[ntindle]

Why

SECRT-2474 (org walkthrough feedback, item 3): org member management surfaces two independent switches — Admin and Billing — and testers found the pairing confusing. Product direction: one role dropdown per member, extensible to more roles later, plus a first roles→access chart so it's discoverable what each role actually grants.

What

• OrgRoleSelect (shared component): design-system Select with an info tooltip listing the selected role's capabilities. Used in member rows and the invite form.
• Role ladder — one dropdown, four selectable states mapping to the two backend flags (is_admin, is_billing_manager): Member, Billing manager, Admin, Admin & billing. All four combinations are real because admin and billing are disjoint in the enforced matrix (MANAGE_BILLING = owner + billing_manager only — admins don't get it). Owner renders as a static badge, never editable.
• Roles→access chart (roleAccess.ts): pure constants deriving each role's capability list directly from _ORG_PERMISSIONS in autogpt_libs/auth/permissions.py, surfaced in the tooltip.
• Invite form default is Member; role changes PATCH both flags atomically (the old billing switch PATCHed only one, which can't express the disjoint combinations consistently).

How

Stacked on the org-UI fleet (base: recut/tabs). Uses the existing generated hooks (usePatchV2UpdateMemberRole, usePostV2CreateInvitation) — no backend changes.

Testing

6 scenario tests added/updated in the org settings page suite (role rendering for every flag pair, both-flag PATCH payloads, Owner badge lock, read-only badge for non-admins, invite payload). 51 pass in the touched suites; format/lint/types clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jm3mCG9okfdGtAXtFaDF9A

---

Note

Medium Risk
Changes how org admin and billing flags are set in the UI (atomic dual-flag PATCHs); incorrect mapping could grant or revoke billing/admin access, though existing API hooks are unchanged.

Overview
Org member and invite role UX is consolidated from a member/admin select plus a separate billing switch into a single OrgRoleSelect (Member, Billing manager, Admin, Admin & billing), backed by new roleAccess helpers that map each role to both backend flags and capability text for an info tooltip.

Members show the dropdown only when an admin can manage the row; owners keep a static Owner badge; non-admins see read-only role badges. Role updates now send roleToFlags in one PATCH instead of toggling billing independently.

Invitations use the same role picker (default Member), send is_admin / is_billing_manager on create, and show non-member roles on pending rows via roleLabel.

Tests in the org settings page suite were expanded for every flag pair, atomic PATCH payloads, invite payloads, and read-only/owner behavior.

^{Reviewed by Cursor Bugbot for commit 8718b3c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ntindle]

/batch

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• dev

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 44310b59-8de9-4d05-8133-b8bc8a86d857

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/org-role-dropdown

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[autogpt-batch-bot]

🤖 Added #13604 to the batch. Current batch (7): #13599, #13574, #13541, #13540, #13532, #13530, #13604.

Deploying the combined preview (#13537); /batch-merge lands them together.

[codecov]

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 76.15%. Comparing base (98d04ad) to head (8718b3c).

Additional details and impacted files

@@              Coverage Diff               @@
##           recut/tabs   #13604      +/-   ##
==============================================
+ Coverage       76.13%   76.15%   +0.01%     
==============================================
  Files            2731     2733       +2     
  Lines          202160   202181      +21     
  Branches        19655    19659       +4     
==============================================
+ Hits           153912   153962      +50     
+ Misses          43968    43940      -28     
+ Partials         4280     4279       -1     

Flag	Coverage Δ
platform-frontend	49.60% <96.55%> (+0.04%)	⬆️
platform-frontend-e2e	31.18% <ø> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Platform Backend	82.68% <ø> (ø)
Platform Frontend	53.13% <96.55%> (+0.10%)	⬆️
AutoGPT Libs	∅ <ø> (∅)
Classic AutoGPT	28.43% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[0ubbe]

Screenshots or preview please 📸 🙏🏽

[ntindle]

/batch orgs

[autogpt-batch-bot]

🤖 Added #13604 to batch orgs. Batch orgs (5): #13574, #13540, #13530, #13496, #13604.

Deploying the combined preview (#13651); /batch-merge lands them together.