From 3765adaf55655dfefeddb588f242401e4f9e69bf Mon Sep 17 00:00:00 2001
From: James <james@jongsma.me>
Date: Tue, 17 Mar 2026 21:29:43 -0400
Subject: [PATCH] fix: savePermissions preserves members; surface actual error
 message on failure

---
 portal/templates/app/project.html | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/portal/templates/app/project.html b/portal/templates/app/project.html
index 6d9e9db..d96158f 100644
--- a/portal/templates/app/project.html
+++ b/portal/templates/app/project.html
@@ -2171,17 +2171,32 @@
           ? 'all'
           : Array.from(document.querySelectorAll('.pm-list-check:checked')).map(cb => cb.value),
       };
+      // Preserve existing members and other fields — only update permissions
+      const o = _dealOrgsMap[dealOrgId] || {};
+      const raw = o._raw || {};
+      const updatedData = {
+        org_id: orgId,
+        role: raw.role || role,
+        domain_lock: raw.domain_lock || false,
+        members: raw.members || [],
+        permissions: perms,
+      };
+      const btn = document.querySelector('#permModal button[onclick="savePermissions()"]');
+      if (btn) { btn.disabled = true; btn.textContent = 'Saving...'; }
       try {
-        await fetchAPI('/api/projects/' + projectID + '/entries/' + dealOrgId, {
+        const res = await fetchAPI('/api/projects/' + projectID + '/entries/' + dealOrgId, {
           method: 'PUT',
-          body: JSON.stringify({
-            data: JSON.stringify({ org_id: orgId, role, domain_lock: false, permissions: perms }),
-            version
-          })
+          body: JSON.stringify({ data: JSON.stringify(updatedData), version })
         });
+        const d = await res.json();
+        if (!res.ok) throw new Error(d.error || 'Save failed (' + res.status + ')');
         closePermModal();
         loadOrgs();
-      } catch(e) { alert('Failed to save permissions'); }
+      } catch(e) {
+        alert('Failed to save permissions: ' + e.message);
+      } finally {
+        if (btn) { btn.disabled = false; btn.textContent = 'Save'; }
+      }
     }
 
     function openPermissionsTemplateModal() {