assign role roles

pages/admin/users/edit($id).php

@@ -117,7 +117,12 @@ if (!$primaryTenantId && count($selectedTenantIds) === 1) {
 }
 
 $roles = $roleService->listActive();
+$assignableRoleService = app(\MintyPHP\Service\Access\AssignableRoleService::class);
+$assignableRoleIds = $assignableRoleService->listAssignableRoleIdsForActor($currentUserId);
+$assignableRoleIdMap = array_fill_keys($assignableRoleIds, true);
+$roles = array_values(array_filter($roles, static fn (array $r): bool => isset($assignableRoleIdMap[(int) ($r['id'] ?? 0)])));
 $selectedRoleIds = $userRoleRepository->listRoleIdsByUserId($userId);
+$visibleSelectedRoleIds = array_values(array_intersect($selectedRoleIds, $assignableRoleIds));
 $permissionRows = $canViewPermissionsTable
     ? $rolePermissionRepository->listPermissionsWithRolesByRoleIds($selectedRoleIds)
     : [];
@@ -233,7 +238,8 @@ if ($request->hasBody('email')) {
                 $userId,
                 $tenantIdsForSync,
                 $selectedRoleIds,
-                $selectedDepartmentIds
+                $selectedDepartmentIds,
+                $currentUserId
             );
             if (!$assignmentsSynced) {
                 $errorBag->addGlobal(t('User assignments can not be updated'));