> ## Documentation Index
> Fetch the complete documentation index at: https://docs.azalt.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization User Site

> Junction table that grants site-level access to an Organization User (with hierarchy awareness).

### Organization User Site

This junction links a membership (Organization User) to one or more Sites, enabling fine-grained, site-scoped access control.

```typescript theme={null}
// apps/azalt/src/server/db/types/organization.ts (simplified)
interface OrganizationUserSite {
  id: string;
  organizationUserId: string; // references OrganizationUser.id
  siteId: string;             // references Site.id
  createdAt: Date;
  updatedAt: Date;
}
```

#### At a Glance

* Stores direct site assignments for a membership
* Effective access = assigned sites + all descendants
* Root site assignment grants access to entire organization
* Unique per (organizationUserId, siteId); cascades on delete

#### How Access Is Calculated

* Direct assignments are stored here (`assignedSiteIds`).
* Effective access includes the descendants of assigned sites (computed via a recursive CTE).
* Assigning the root site gives access to the entire organization (root + all children).

#### Constraints & Integrity

* Unique pair: `(organizationUserId, siteId)` to prevent duplicates.
* Cascades on delete/update to keep relations clean.
* Soft-deleted sites are filtered out by queries that list assignments.

#### Typical Operations

* On invitation: assign initial sites to the invited user.
* Update a member’s site list (replace entire set).
* Bulk operations for multiple users: replace, add, or remove sites.

```typescript theme={null}
// tRPC (apps/azalt/src/server/api/routers/organization)
organizations.updateUserSites({ userId, assignedSiteIds })
organizations.bulkUpdateUserSites({ userIds, siteIds, operation: "replace" | "add" | "remove" })
```

#### Read Patterns

* User listings return `assignedSites` for each member for easy display.
* Access checks reference the calculated `accessibleSiteIds` (descendants included).
* Root site often appears as "Organization" in UI lists for clarity.

#### Security

* Only Managers and Owners can modify site assignments.
* All checks are further scoped to the acting user’s own accessible sites.

#### Tips & Edge Cases

* Users without any assignments will have no effective site access but may still appear in admin lists.
* Prefer `replace` for idempotent updates in bulk operations; use `add`/`remove` for incremental changes.

#### Related Concepts

* Organization User — membership and role
* Site — hierarchical locations inside an organization