fix(org): delegation follow-ups — operate-as button, real role, no personal actions while delegated

[hb-agent]

Three follow-ups to the merged org-delegation feature (#119).

1. "Operate as" action on the profile Groups tab

On your own profile's Groups tab, each group row gains an "Operate as" button that delegates into the group (switchOrg → /home). It's deliberately separate from the row link, which still goes to the group's profile. The currently-active group shows a disabled "Operating" state.

2. Operator's real role, not a hard-coded "admin"

The endorse delegation modal said "acting as an admin" regardless of the operator's actual role. operatorRole is now threaded from activeOrg.role (owner / admin / member); copy reads "acting as its <role>". The ActingAsBar already used the variable role — the modal was the only hard-coded instance (audited).

3. No personal endorsement actions while acting as a group

While delegated you could still give / revoke / accept / reject endorsements on your personal account, writing to your personal repo while the chrome says you're the org. That cross-identity action is now blocked everywhere it existed:

• Profile Endorsements tab: canManage = (owner && !activeOrg) || acting-as-this-group; personal endorsement lists hidden while delegated.
• /notifications: accept/reject controls hidden while delegated.
• /endorsements page: redirects to /home while delegated (it was already nav-hidden; this closes the direct-URL hole).

Test plan

• tsc --noEmit clean
• eslint — 0 new warnings (changed files clean)
• vitest 519/519 pass (added an org-context mock to the endorsements-page test)
• next build compiles
• Manual: from your profile Groups tab, "Operate as" a group → bar shows it, lands on /home; endorse modal names your real role; while delegated, your personal profile/notifications/endorsements show no personal accept/reject/give

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
certified-app	Ready	Preview, Comment	Jun 2, 2026 1:04pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 87ecc874-472e-4685-a0c1-c9d40ddc0e7e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/org-delegation-followups

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}