Prefer canonical identity and organization directories

src/govoplan_access/backend/api/v1/admin_common.py

@@ -43,6 +43,7 @@ from govoplan_access.backend.db.models import (
     UserGroupMembership,
 )
 from govoplan_core.core.idm import OrganizationFunctionAssignmentRef
+from govoplan_core.core.organizations import OrganizationDirectory
 from govoplan_access.backend.permissions.catalog import effective_permission_count, expand_scopes
 
 
@@ -143,13 +144,22 @@ def _user_item(
     *,
     owner_ids: set[str] | None = None,
     idm_assignments: tuple[OrganizationFunctionAssignmentRef, ...] = (),
+    organization_directory: OrganizationDirectory | None = None,
 ) -> UserAdminItem:
     account = session.get(Account, user.account_id)
     if account is None:
         raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="User account is missing")
     groups = collect_user_groups(session, user)
     roles = collect_direct_user_roles(session, user)
-    external_roles = collect_external_function_roles(session, user, idm_assignments) if idm_assignments else []
+    external_roles = (
+        collect_external_function_roles(
+            session,
+            user,
+            idm_assignments,
+            organization_directory=organization_directory,
+        )
+        if idm_assignments else []
+    )
     effective_scopes = set(collect_user_scopes(session, user, include_system=False))
     for role in external_roles:
         effective_scopes.update(role.permissions or [])