caps and delete

backend/src/bin/admin.rs

@@ -10,6 +10,7 @@ use sha2::{Digest, Sha256};
 use uuid::Uuid;
 
 use papercrate::{
+    auth::capability_sets::{ensure_capability_set, owner_capabilities},
     config::AppConfig,
     db::{self, PgPool},
     documents::search::ensure_quickwit_index,
@@ -363,10 +364,15 @@ fn add_user_to_tenant(pool: &PgPool, username: &str, tenant_id: Uuid) -> Result<
         .optional()?
         .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;
 
+    let owner_capability_set_id = ensure_capability_set(&mut conn, tenant.id, owner_capabilities())
+        .map_err(|err| anyhow!("failed to ensure owner capability set: {:?}", err))?
+        .id;
+
     let membership = NewUserMembership {
         id: Uuid::new_v4(),
         user_id: user.id,
         tenant_id: tenant.id,
+        capability_set_id: Some(owner_capability_set_id),
     };
 
     diesel::insert_into(user_memberships::table)