fix(server): project role updates after workspace role/seat changes (#4599)

* fix(workspaces): workspace role sync

* role changes fixed + validated

* seat changes validated

* fix tests

---------

Co-authored-by: Charles Driesler <chuck@speckle.systems>

packages/server/modules/workspaces/services/management.ts

@@ -349,6 +349,7 @@ export const deleteWorkspaceFactory =
 type WorkspaceRoleDeleteArgs = {
   userId: string
   workspaceId: string
+  deletedByUserId: string
 }
 
 export const deleteWorkspaceRoleFactory =
@@ -363,7 +364,8 @@ export const deleteWorkspaceRoleFactory =
   }) =>
   async ({
     workspaceId,
-    userId
+    userId,
+    deletedByUserId
   }: WorkspaceRoleDeleteArgs): Promise<WorkspaceAcl | null> => {
     // Protect against removing last admin
     const workspaceRoles = await getWorkspaceRoles({ workspaceId })
@@ -380,7 +382,7 @@ export const deleteWorkspaceRoleFactory =
     // Emit deleted role
     await emitWorkspaceEvent({
       eventName: WorkspaceEvents.RoleDeleted,
-      payload: { acl: deletedRole }
+      payload: { acl: deletedRole, updatedByUserId: deletedByUserId }
     })
 
     return deletedRole
@@ -420,9 +422,9 @@ export const updateWorkspaceRoleFactory =
     workspaceId,
     userId,
     role: nextWorkspaceRole,
-    skipProjectRoleUpdatesFor,
     preventRoleDowngrade,
-    updatedByUserId
+    updatedByUserId,
+    skipProjectRoleUpdatesFor
   }): Promise<void> => {
     const workspaceRoles = await getWorkspaceRoles({ workspaceId })
 
@@ -493,10 +495,10 @@ export const updateWorkspaceRoleFactory =
           workspaceId,
           role: nextWorkspaceRole
         },
+        updatedByUserId,
         flags: {
           skipProjectRoleUpdatesFor: skipProjectRoleUpdatesFor ?? []
-        },
-        updatedByUserId
+        }
       }
     })
   }

packages/server/modules/workspaces/services/projects.ts

@@ -356,7 +356,7 @@ export const validateWorkspaceMemberProjectRoleFactory =
       // User's workspace role does not allow the requested project role
       throw new WorkspaceInvalidRoleError(
         isNewPlan
-          ? `User's workspace seat type '${seatType}' does not allow project role '${projectRole}'.`
+          ? `User's workspace seat type '${seatType}' and workspace role '${workspaceRole}' does not allow project role '${projectRole}'.`
           : `User's workspace role '${workspaceRole}' does not allow project role '${projectRole}'.`
       )
     }