departments

Org-wide viewing — any authenticated member, not just admins (see this router's own module docstring).

Every (user_id -> department_id) assignment in this org, org-wide viewing same as list_departments above — lets the settings UI render "who's in which department" in one call instead of one request per member.

Delete a department and cancel invitations that still target it.

Admin-only — a head cannot appoint themselves or anyone else (see this router's own module docstring on why that stays an admin-level power). Validates the target is genuinely a member of this org via Better Auth's own "member" table, same live-existence-check pattern custom_roles.py's assign_member already uses — a fabricated user_id silently "heading" a department is a worse failure mode than a loud 404 here.

Assigns one member to this department — (org_id, user_id) is unique on member_departments, so re-assigning just moves them out of whatever department they were previously in. require_admin OR "you are this department's own head" (see this router's own module docstring) — checked against the target department, not the member's current one, so a head can pull any org member into their own department but can't reach into another department's roster to do it.

Reverts a member back to having no department — safe to call even if they were never assigned to this one (a no-op, not a 404, matching custom_roles.py's unassign_member). require_admin OR "you are this department's own head", checked the same way assign_member above does — a head removing someone from their own department is exactly the "edit" the founder's own ask described; removing someone from a DIFFERENT department they don't head is refused with a 403 before this ever looks at whether user_id is even assigned there.