fix: prevent self-hosted auto-enroll from downgrading admins/tutors to students

apps/api/src/services/account/profile.ts

@@ -4,6 +4,7 @@ import {
   createOrganizationMember,
   getFirstOrganization,
   getOrganizationByProfileId,
+  getUserOrgRolesMap,
   hasOrgMemberByProfileIdOrEmail
 } from '@cio/db/queries/organization';
 import { getPlanLimit, toResourceUsage } from '@cio/utils/plans';
@@ -50,21 +51,27 @@ export async function getAccountData(userId: string): Promise<GetAccountDataResu
 
   // Self-hosted: auto-add user as student to the single org if they are not a member.
   // Skip if they already have membership (by profileId) or a pending invite (by email).
+  // Also skip if the user is an admin/tutor in any org — they should not be downgraded to student.
   if (env.PUBLIC_IS_SELFHOSTED === 'true' && organizations.length === 0) {
-    const firstOrg = await getFirstOrganization();
-    if (firstOrg) {
-      const alreadyInOrg = await hasOrgMemberByProfileIdOrEmail(firstOrg.id, userId, profile.email ?? undefined);
+    const orgRoles = await getUserOrgRolesMap(userId);
+    const isTeamMember = Object.values(orgRoles).some((roleId) => roleId === ROLE.ADMIN || roleId === ROLE.TUTOR);
 
-      if (!alreadyInOrg) {
-        await createOrganizationMember({
-          organizationId: firstOrg.id,
-          profileId: userId,
-          roleId: ROLE.STUDENT,
-          verified: true
-        });
+    if (!isTeamMember) {
+      const firstOrg = await getFirstOrganization();
+      if (firstOrg) {
+        const alreadyInOrg = await hasOrgMemberByProfileIdOrEmail(firstOrg.id, userId, profile.email ?? undefined);
+
+        if (!alreadyInOrg) {
+          await createOrganizationMember({
+            organizationId: firstOrg.id,
+            profileId: userId,
+            roleId: ROLE.STUDENT,
+            verified: true
+          });
+        }
+
+        organizations = await getOrganizationByProfileId(userId);
       }
-
-      organizations = await getOrganizationByProfileId(userId);
     }
   }