fix(backstage,beacon,types): board-seat delegation audit — one regression, the email hole, and a rules-parity test

apps/backstage/src/components/member-home.tsx

@@ -15,6 +15,7 @@ import { useActivitiesByTerm } from "../features/activities/hooks/use-activities
 import { useInitiativesByTerm } from "../features/initiatives/hooks/use-initiatives-by-term";
 import { usePositions } from "../features/positions/hooks/use-positions";
 import { joinYear } from "../features/members/lib/member-display";
+import { isSelfMember } from "../features/members/lib/member-permissions";
 import { summarizeParticipations } from "../features/members/lib/participation-summary";
 import { MemberPointsSummary } from "../features/members/components/member-points-summary";
 import { MemberCredentialCard } from "../features/members/components/member-credential-card";
@@ -92,7 +93,7 @@ export function MemberHome() {
   // at a role, so the honest mirror is doc ownership — NOT the CASL own-doc grant, which
   // only members carrying the built-in Member role hold (a roles:["Treasury"] principal
   // would lose a self-edit the rules would have accepted).
-  const canEditSelf = member.uid !== undefined && member.uid === uid;
+  const canEditSelf = isSelfMember(member, uid);
 
   const cargoId = member.positions?.[termId]?.cargoId ?? null;
   const cargo = cargoId ? positionsById.get(cargoId) : null;

apps/backstage/src/features/members/components/member-drawer.test.tsx

@@ -10,6 +10,15 @@ vi.mock("@tanstack/react-router", () => ({
   Link: ({ children }: { children: React.ReactNode }) => <a href="#">{children}</a>,
 }));
 
+// The drawer now reads the caller's uid to decide whether the row it opened is the caller's
+// OWN (the members table lists it too), which makes the edit a SELF-assignment. Mocked as a
+// factory with no `importOriginal`: lib/auth/auth builds its store from getFirebase().auth at
+// module scope, so merely evaluating the real module initializes Firebase and the whole file
+// fails to collect. uid "someone-else" keeps every case below a non-self edit.
+vi.mock("../../../lib/auth/auth", () => ({
+  useAuth: () => ({ user: { uid: "someone-else" }, claims: { roles: ["Admin"] } }),
+}));
+
 const m: Member = {
   id: "1",
   name: "Ana Gómez",

apps/backstage/src/features/members/components/member-drawer.tsx

@@ -14,7 +14,9 @@ import { MemberForm } from "./member-form";
 import { joinYear, memberPositionLabel } from "../lib/member-display";
 import { memberFormDefaults } from "../lib/member-form-defaults";
 import { useMemberPhoto } from "../hooks/use-member-photo";
+import { isSelfMember } from "../lib/member-permissions";
 import { Can } from "../../../lib/authz/ability-context";
+import { useAuth } from "../../../lib/auth/auth";
 import { useCan } from "../../../lib/authz/use-can";
 
 interface MemberDrawerProps {
@@ -136,7 +138,9 @@ function EditBody({
   onSubmit: (data: MemberInput) => Promise<void>;
 }) {
   const { onUpload, onRemove } = useMemberPhoto(member.id);
-  const { canAssignBoardSeat } = useCan();
+  const { canAssignBoardSeat, isAdmin } = useCan();
+  // The table lists the caller's own row too, so this drawer can be a self-assignment.
+  const uid = useAuth().user?.uid;
   return (
     <div className="flex flex-col gap-6">
       <ImageUploader
@@ -151,6 +155,9 @@ function EditBody({
         defaultValues={memberFormDefaults(member)}
         submitLabel="Guardar"
         allowPowerGrants={canAssignBoardSeat}
+        allowReplacePowerCargo={isAdmin}
+        assignerIsAdmin={isAdmin}
+        isSelfAssignment={isSelfMember(member, uid)}
         onSubmit={onSubmit}
       />
     </div>