[amyjko]

Problem

RLS lets anyone read a public org's roles, assignments and processes, and lets members read them in any org. #36 hides role charts under that rule. The roles, role, processes and changes pages used a narrower one:

($user === null && org.visibility === 'public') || ($user !== null && member)

So people who are logged in but not members of a public org were told "You are not a member of this private organization…", "Only showing public processes of this private organization" and so on, even though the data had loaded.

Change

• Add visible to the org context (member || org.visibility === 'public'), with a comment tying it to the RLS policies.
• Use it on the roles, role, processes and changes pages, and in the two places Hide role assignments from viewers who can't see the org's roles #36 added.
• Changes.svelte had used the same flag to decide whether to show the status editor. That now has its own members-only check, so widening visibility doesn't give outsiders an editor whose saves would fail.
• OrgNav.svelte is unchanged. It also handles 'admin' org visibility and decides which nav links appear, which is a different question.

Testing

On the local stack, I visited roles, a role, processes, changes and a process page as each viewer:

Viewer	Private org	Public org, main	Public org, this change
Logged out	"private" notices, only public items	everything, no notices	unchanged
Logged in, not a member	"private" notices, only public items	"private" notices on every page	everything, no notices
Member	everything, status editor	everything, status editor	unchanged

Only members see the status editor in every case. No console warnings or hydration errors. The one console error is the expected 404 when an outsider opens a private org's role page. svelte-check: 0 errors. Unit tests: 288 passed.

🤖 Generated with Claude Code