* Fallback to org admin
* Prevent accidental privilege escalation as code changes in the future
* When org admin, we don't actually need to do the db query
* Use findMany and Map to drill down permission adjustments
* Exclude .MEMBER from overriding role, we likely don't want to demote
* refactor logic
* Add tests for services/factories + removeHandler
* fix type check
---------
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Sean Brydon <sean@cal.com>
