feat: reserve administrative roles for staff email addresses

2026-09-17 18:13:52 +02:00
parent 725e32daab
commit 540cd8eeb7
11 changed files with 230 additions and 70 deletions
@@ -577,6 +577,10 @@ Known role mapping from the XML parser:
 - admin users also receive default hotel code `SSL`
 - no matched role means `ROLE_CUSTOMER`

+These are the CRM's claims. The portal filters them before storing anything (staff-only
+roles, approval markers), so a proxy must return the claims unfiltered — see
+`docs/buspronet-schema/crm-selection-queries.md#from-claim-to-role`.
+
 Candidate SQL for selected customer selections:

 ```sql