fix(auth): recognize a comma-joined multi-role caller in canAssignRole

[pedrofrxncx]

Source: bug found while hardening apps/mesh/src/auth/roles.ts (Auth & role hardening sweep).

Why a maintainer wants this: Better Auth's organization plugin's parseRoles joins an assigned role array with "," before storing member.role (confirmed in the installed @decocms/better-auth dist: Array.isArray(roles) ? roles.join(",") : roles, used by both addMember and updateMemberRole). canAssignRole's caller-role check only handled callerRole === "owner" / === "admin", so a legitimate multi-role owner/admin — e.g. one whose member.role is stored as "owner,billing-manager" — was silently denied ANY role assignment, even though they hold owner/admin. This is the same multi-role-caller pattern the codebase already handles correctly elsewhere (see the comma-split fallback in builtin-role-permission.ts), just missing here.

Failure scenario: An org owner who also carries an extra custom role (assigned via ORGANIZATION_MEMBER_UPDATE_ROLE/ORGANIZATION_MEMBER_ADD with a multi-entry role array, which Better Auth stores comma-joined) calls ORGANIZATION_MEMBER_UPDATE_ROLE to promote another member. ctx.auth.user?.role for that owner is "owner,billing-manager", which fails the old === "owner" check, so canAssignRole incorrectly returns false and the tool throws "Insufficient privileges" for an actual owner.

Fix: split callerRole on "," and check membership (includes("owner") / includes("admin")) instead of exact equality — mirrors the existing multi-role handling pattern in builtin-role-permission.ts. Added a regression test (recognizes a multi-role caller from a comma-joined callerRole) covering multi-role owner, multi-role admin, an admin-with-extra-role still denied owner, and a caller with no owner/admin component still denied.

Reviewer command: bun test apps/mesh/src/auth/roles.test.ts

Local checks run: bun run fmt, cd apps/mesh && bunx tsc --noEmit (clean), bun test apps/mesh/src/auth/roles.test.ts (9 pass). Full CI validates the rest.

---

Summary by cubic

Fixes role assignment for multi‑role owners/admins when callerRole is comma-joined by @decocms/better-auth (e.g. owner,billing-manager). Owners/admins are now correctly recognized and no longer blocked.

• Bug Fixes
  • Update canAssignRole to split callerRole on commas and check for owner/admin.
  • Preserve admin rules: admin can’t assign owner.
  • Add tests for comma-joined multi‑role callers.

^{Written for commit c3f6965. Summary will update on new commits.}