small change and temp logging

pb_hooks/team_members.pb.js

@@ -17,15 +17,15 @@
 //
 // Keep this logic in sync with src/lib/azureAuth.js (resolveRole / parseAdminEmails),
 // which carries the canonical, unit-tested version for the frontend/tests.
-
-function resolveRole(email) {
-  const raw = ($os.getenv("ENTRA_ADMIN_EMAILS") || "").toLowerCase();
-  const allow = raw.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
-  return allow.indexOf((email || "").toLowerCase()) !== -1 ? "admin" : "user";
-}
+//
+// resolveRole itself lives in pb_hooks/utils.js and is pulled in per-callback
+// via require() — PocketBase's JSVM runs each hook callback below as its own
+// isolated program, so a shared top-level function here would not be in
+// scope at call time. See pb_hooks/utils.js for details.
 
 // On creation (first login): set defaults before the record is persisted.
 onRecordCreate(function (e) {
+  const { resolveRole } = require(`${__hooks}/utils.js`);
   const email = e.record.get("email") || "";
 
   e.record.set("role", resolveRole(email));
@@ -45,6 +45,7 @@ onRecordCreate(function (e) {
 // On every successful auth (incl. OIDC): keep the admin role in sync with the
 // allow-list, so promoting/demoting an admin only requires an env change.
 onRecordAuthRequest(function (e) {
+  const { resolveRole } = require(`${__hooks}/utils.js`);
   const email = e.record.get("email") || "";
   const want = resolveRole(email);
   if (e.record.get("role") !== want) {