Plugin: getUserRoles(userIds, orgId) batch lookup

Adds a batch variant of getUserRole that returns a Map<userId, Role | null>
in one round-trip. Used by TeamPresenter to drop the N+1 it had been
documenting as a future optimisation. Org-scoped only — project-scoped
reads still go through getUserRole (less common, not worth complicating
the API for).

Author: matt-aitken

apps/webapp/app/presenters/TeamPresenter.server.ts

@@ -14,7 +14,7 @@ export class TeamPresenter extends BasePresenter {
       return;
     }
 
-    const [baseLimit, currentPlan, plans, roles, assignableRoleIds, memberRoles] =
+    const [baseLimit, currentPlan, plans, roles, assignableRoleIds, memberRoleMap] =
       await Promise.all([
         getLimit(organizationId, "teamMembers", 100_000_000),
         getCurrentPlan(organizationId),
@@ -27,21 +27,18 @@ export class TeamPresenter extends BasePresenter {
         // in this set. Server-side enforcement is independent (setUserRole
         // rejects a plan-gated assignment regardless of UI state).
         rbac.getAssignableRoleIds(organizationId),
-        // Per-member current role. N+1 by design: this page is rendered
-        // for admins on a low-traffic settings screen, and the rbac plugin
-        // doesn't currently expose a batched lookup. Switching to a single
-        // Drizzle query keyed on (orgId, userIds[]) is a future optimisation.
-        Promise.all(
-          result.members.map(async (m) => ({
-            userId: m.user.id,
-            role: await rbac.getUserRole({
-              userId: m.user.id,
-              organizationId,
-            }),
-          }))
+        // Per-member current role in a single round-trip.
+        rbac.getUserRoles(
+          result.members.map((m) => m.user.id),
+          organizationId
         ),
       ]);
 
+    const memberRoles = result.members.map((m) => ({
+      userId: m.user.id,
+      role: memberRoleMap.get(m.user.id) ?? null,
+    }));
+
     const canPurchaseSeats =
       currentPlan?.v3Subscription?.plan?.limits.teamMembers.canExceed === true;
     const extraSeats = currentPlan?.v3Subscription?.addOns?.seats?.purchased ?? 0;

internal-packages/rbac/src/fallback.ts

@@ -195,6 +195,10 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
     return null;
   }
 
+  async getUserRoles(userIds: string[]): Promise<Map<string, Role | null>> {
+    return new Map(userIds.map((id) => [id, null]));
+  }
+
   async setUserRole(): Promise<RoleAssignmentResult> {
     return { ok: false, error: "RBAC plugin not installed" };
   }

internal-packages/rbac/src/index.ts

@@ -193,6 +193,12 @@ class LazyController implements RoleBaseAccessController {
     return (await this.c()).getUserRole(...args);
   }
 
+  async getUserRoles(
+    ...args: Parameters<RoleBaseAccessController["getUserRoles"]>
+  ): Promise<Map<string, Role | null>> {
+    return (await this.c()).getUserRoles(...args);
+  }
+
   async setUserRole(
     ...args: Parameters<RoleBaseAccessController["setUserRole"]>
   ): Promise<RoleAssignmentResult> {

packages/plugins/src/rbac.ts

@@ -182,6 +182,16 @@ export interface RoleBaseAccessController {
     projectId?: string;
   }): Promise<Role | null>;
 
+  // Batch variant for callers that need per-user roles for many users
+  // in one round-trip (e.g. the Team page rendering N members).
+  // Org-scoped only — project-scoped reads still go through getUserRole.
+  // Returns a Map keyed by userId; users with no resolvable role map to
+  // null. The default fallback returns a Map of all userIds → null.
+  getUserRoles(
+    userIds: string[],
+    organizationId: string
+  ): Promise<Map<string, Role | null>>;
+
   setUserRole(params: {
     userId: string;
     organizationId: string;