[AI] What to change: The dropdown menu, where one can pick user category. - #203

Automated PR

Task: What to change: The dropdown menu, where one can pick user category.
Description: What to change: The dropdown menu, where one can pick user category.
• When a new user register itself, only the user category that the person registered for, should be shown in the dropdown menu. If a user is registered for multiple user categories, all relevant user categories should be shown. If a helper receives an invite to join a project as a helper, and is not registered for Githelp prior, only the category “Helper” should be visible in the dropdown menu, when the person has completed his/hers registration. This goes for all user groups.
Do not change: Anything else than what is listed.
Acceptance criteria: When all points listed under “Description and specific values” are implemented the task is done.
Source: slack
Requested by: U04E9DZ5ELF
Classification: flow

Changes

The role dropdown in the top bar currently offers roles hierarchically (admin implies helper+user, helper implies user). Change it to list only the categories the signed-in profile is actually registered for (admin membership, helper registration, support/member user), so e.g. an invited helper sees only "Helper" and a project creator sees only "Admin".

Security Review

Status: warn
No high-severity issues: no secrets, injection, XSS, or CORS changes, and all Supabase queries are parameterized builder calls governed by RLS. Two low advisories: unscoped 'user-roles' cache key could leak the previous account's role set across sign-ins, and role state remains client-trusted (pre-existing).

Warnings:

• src/hooks/useProjectRole.ts: queryKey ["user-roles"] is not scoped to the user id and has a 30-minute staleTime. If a different account signs in within the same tab session without the React Query cache being cleared, the previous user's role set (e.g. admin) can be served from cache, briefly showing the wrong role options in the UI. Not a privilege escalation on its own (RLS/server enforces data access), but it's a UI/role-state leak across sessions.
• src/components/layout/top-bar.tsx: Role selection (and the auto-switch useEffect) is entirely client-derived and persisted to localStorage via switchRole; the UI 'role' is trust-on-client. This is pre-existing design, but the diff reinforces it — ensure no page/Edge Function treats user.role as authoritative.

🤖 Generated by githelp-support agent team