fix(admin): pass verified identity role to code RPCs

frontend/src/lib/admin/codes.ts

@@ -91,14 +91,14 @@ export function mapCode(row: RpcCodeRow): RedemptionCodeRecord {
 
 export async function runCodeRpc<T extends keyof CodeRpcArgs>(
   functionName: T,
-  session: Pick<AdminSession, "user" | "roles">,
+  session: Pick<AdminSession, "user">,
   id: string,
   args: CodeRpcArgs[T],
 ): Promise<RedemptionCodeRecord[]> {
   const common = [
     session.user.id,
     session.user.email,
-    session.roles[0] ?? "admin",
+    "admin",
     id,
   ];
   let rows: RpcCodeRow[] = [];

frontend/tests/high-risk-billing-routes-contract.test.ts

@@ -106,6 +106,8 @@ test("redemption-code writes generate server audit reasons and encode JSONB for
   assert.match(codeRoute, /p_reason:\s*"admin_console_update_redemption_code"/);
   assert.match(codeRoute, /p_reason:\s*"admin_console_revoke_redemption_code"/);
   assert.match(codesHelper, /JSON\.stringify\(input\.p_codes\)/);
+  assert.match(codesHelper, /session\.user\.email,[\s\S]*"admin",/);
+  assert.doesNotMatch(codesHelper, /session\.roles\[0\]/);
   assert.match(codesHelper, /queryAdminRows<RpcCodeRow>/);
   assert.match(codesHelper, /public\.admin_create_redemption_codes\(/);
   assert.match(codesHelper, /public\.admin_update_redemption_code\(/);