diff --git a/migrations/1774658921003_user_role.ts b/migrations/1774658921003_user_role.ts
new file mode 100644
index 000000000..eaea7bb02
--- /dev/null
+++ b/migrations/1774658921003_user_role.ts
@@ -0,0 +1,15 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { type Kysely, sql } from "kysely";
+
+// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema.alterTable("user").addColumn("role", "text").execute();
+  await sql`UPDATE "user" SET role = 'Superadmin' WHERE email = 'hello@commonknowledge.coop'`.execute(
+    db,
+  );
+}
+
+// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.alterTable("user").dropColumn("role").execute();
+}
diff --git a/migrations/1774658921004_data_source_config_org_unique.ts b/migrations/1774658921004_data_source_config_org_unique.ts
new file mode 100644
index 000000000..4f7f667f6
--- /dev/null
+++ b/migrations/1774658921004_data_source_config_org_unique.ts
@@ -0,0 +1,29 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import type { Kysely } from "kysely";
+
+// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable("dataSource")
+    .dropConstraint("data_source_config_key")
+    .execute();
+  await db.schema
+    .alterTable("dataSource")
+    .addUniqueConstraint("data_source_config_organisation_id_key", [
+      "config",
+      "organisationId",
+    ])
+    .execute();
+}
+
+// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable("dataSource")
+    .dropConstraint("data_source_config_organisation_id_key")
+    .execute();
+  await db.schema
+    .alterTable("dataSource")
+    .addUniqueConstraint("data_source_config_key", ["config"])
+    .execute();
+}
diff --git a/modules.d.ts b/modules.d.ts
index 323f3ba29..e7421eb11 100644
--- a/modules.d.ts
+++ b/modules.d.ts
@@ -2,3 +2,4 @@ declare module "mapbox-gl/dist/style-spec/index.cjs" {
   export * from "mapbox-gl/dist/style-spec/index.d.ts";
 }
 declare module "pg-cursor";
+declare module "*.css";
diff --git a/src/app/(private)/(dashboards)/invite-organisation/CreateInvitationModal.tsx b/src/app/(private)/(dashboards)/invite-organisation/CreateInvitationModal.tsx
new file mode 100644
index 000000000..bfc07d7c2
--- /dev/null
+++ b/src/app/(private)/(dashboards)/invite-organisation/CreateInvitationModal.tsx
@@ -0,0 +1,369 @@
+"use client";
+
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { PlusIcon } from "lucide-react";
+import { type FormEvent, useMemo, useState } from "react";
+import { toast } from "sonner";
+import FormFieldWrapper from "@/components/forms/FormFieldWrapper";
+import { useTRPC } from "@/services/trpc/react";
+import { Button } from "@/shadcn/ui/button";
+import { Checkbox } from "@/shadcn/ui/checkbox";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from "@/shadcn/ui/dialog";
+import { Input } from "@/shadcn/ui/input";
+import { Label } from "@/shadcn/ui/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/shadcn/ui/select";
+
+interface MapSelection {
+  mapId: string;
+  dataSourceIds: string[];
+}
+
+export default function CreateInvitationModal() {
+  const [name, setName] = useState("");
+  const [email, setEmail] = useState("");
+  const [organisationId, setOrganisationId] = useState("");
+  const [organisationName, setOrganisationName] = useState("");
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [isCreatingNewOrg, setIsCreatingNewOrg] = useState(true);
+  const [selectedMapIds, setSelectedMapIds] = useState<Set<string>>(new Set());
+  const [selectedDataSourceIds, setSelectedDataSourceIds] = useState<
+    Set<string>
+  >(new Set());
+
+  const trpc = useTRPC();
+  const client = useQueryClient();
+
+  const { data: organisations } = useQuery(
+    trpc.organisation.listAll.queryOptions(),
+  );
+  const { data: mapData } = useQuery(trpc.map.listAll.queryOptions());
+
+  const { mutate: createInvitationMutate, isPending } = useMutation(
+    trpc.invitation.create.mutationOptions({
+      onSuccess: () => {
+        toast.success("Invitation created successfully", {
+          description: "An invite has been sent to the user",
+        });
+        resetForm();
+        setDialogOpen(false);
+        client.invalidateQueries({
+          queryKey: trpc.organisation.listAll.queryKey(),
+        });
+        client.invalidateQueries({
+          queryKey: trpc.invitation.list.queryKey(),
+        });
+      },
+      onError: (error) => {
+        toast.error("Failed to create invitation.", {
+          description: error.message,
+        });
+      },
+    }),
+  );
+
+  const resetForm = () => {
+    setName("");
+    setEmail("");
+    setOrganisationId("");
+    setOrganisationName("");
+    setIsCreatingNewOrg(true);
+    setSelectedMapIds(new Set());
+    setSelectedDataSourceIds(new Set());
+  };
+
+  // Collect data source IDs for each map
+  const dataSourceIdsByMap = useMemo(() => {
+    if (!mapData) return new Map<string, Set<string>>();
+    const result = new Map<string, Set<string>>();
+    for (const map of mapData.maps) {
+      const dsIds = new Set<string>();
+      for (const id of map.config.markerDataSourceIds) {
+        if (id) dsIds.add(id);
+      }
+      if (map.config.membersDataSourceId) {
+        dsIds.add(map.config.membersDataSourceId);
+      }
+      for (const view of map.views) {
+        if (view.config.areaDataSourceId) {
+          dsIds.add(view.config.areaDataSourceId);
+        }
+        for (const dsv of view.dataSourceViews) {
+          dsIds.add(dsv.dataSourceId);
+        }
+      }
+      result.set(map.id, dsIds);
+    }
+    return result;
+  }, [mapData]);
+
+  const toggleMap = (mapId: string) => {
+    setSelectedMapIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(mapId)) {
+        next.delete(mapId);
+        // Also deselect all data sources for this map
+        const dsIds = dataSourceIdsByMap.get(mapId);
+        if (dsIds) {
+          setSelectedDataSourceIds((prevDs) => {
+            const nextDs = new Set(prevDs);
+            for (const id of dsIds) nextDs.delete(id);
+            return nextDs;
+          });
+        }
+      } else {
+        next.add(mapId);
+        // Auto-select all data sources for this map
+        const dsIds = dataSourceIdsByMap.get(mapId);
+        if (dsIds) {
+          setSelectedDataSourceIds((prevDs) => {
+            const nextDs = new Set(prevDs);
+            for (const id of dsIds) nextDs.add(id);
+            return nextDs;
+          });
+        }
+      }
+      return next;
+    });
+  };
+
+  const toggleDataSource = (dsId: string) => {
+    setSelectedDataSourceIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(dsId)) {
+        next.delete(dsId);
+      } else {
+        next.add(dsId);
+      }
+      return next;
+    });
+  };
+
+  const onSubmit = (e: FormEvent<HTMLFormElement>) => {
+    e.preventDefault();
+    if (!organisationId && !organisationName) {
+      toast.error("Please select an organisation or create a new one");
+      return;
+    }
+
+    const mapSelections: MapSelection[] = [];
+    for (const mapId of selectedMapIds) {
+      const dsIds = dataSourceIdsByMap.get(mapId);
+      if (!dsIds) continue;
+      mapSelections.push({
+        mapId,
+        dataSourceIds: [...dsIds].filter((id) => selectedDataSourceIds.has(id)),
+      });
+    }
+
+    createInvitationMutate({
+      organisationId,
+      organisationName,
+      email,
+      name,
+      mapSelections: mapSelections.length > 0 ? mapSelections : undefined,
+    });
+  };
+
+  const toggleOrganisationMode = () => {
+    setIsCreatingNewOrg(!isCreatingNewOrg);
+    if (isCreatingNewOrg) {
+      setOrganisationName("");
+    } else {
+      setOrganisationId("");
+    }
+  };
+
+  // Group maps by organisation
+  const mapsByOrg = useMemo(() => {
+    if (!mapData) return [];
+    const groups = new Map<string, typeof mapData.maps>();
+    for (const map of mapData.maps) {
+      const orgName = map.organisationName;
+      const existing = groups.get(orgName);
+      if (existing) {
+        existing.push(map);
+      } else {
+        groups.set(orgName, [map]);
+      }
+    }
+    return [...groups.entries()].map(([orgName, maps]) => ({ orgName, maps }));
+  }, [mapData]);
+
+  return (
+    <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
+      <DialogTrigger asChild>
+        <Button>
+          <PlusIcon className="mr-2 h-4 w-4" />
+          Create Invitation
+        </Button>
+      </DialogTrigger>
+      <DialogContent className="sm:max-w-[500px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>Create Invitation</DialogTitle>
+          <DialogDescription>
+            Send an invitation to a new user to join the platform.
+          </DialogDescription>
+        </DialogHeader>
+        <form onSubmit={onSubmit} className="flex flex-col gap-4">
+          <FormFieldWrapper id="name" label="Name">
+            <Input
+              id="name"
+              name="name"
+              type="text"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              required
+            />
+          </FormFieldWrapper>
+
+          <FormFieldWrapper id="email" label="Email">
+            <Input
+              id="email"
+              name="email"
+              type="email"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              required
+            />
+          </FormFieldWrapper>
+
+          <FormFieldWrapper
+            id="organisation"
+            label={
+              <div className="flex items-center justify-between w-full">
+                <span>Organisation</span>
+                <Button
+                  type="button"
+                  variant="link"
+                  size="sm"
+                  onClick={toggleOrganisationMode}
+                  className="h-auto p-0 text-xs"
+                >
+                  {isCreatingNewOrg
+                    ? "or select existing"
+                    : "or create a new one"}
+                </Button>
+              </div>
+            }
+          >
+            {isCreatingNewOrg ? (
+              <Input
+                id="new-organisation"
+                name="new-organisation"
+                type="text"
+                autoFocus
+                placeholder="Enter new organisation name"
+                value={organisationName}
+                onChange={(e) => setOrganisationName(e.target.value)}
+                required
+              />
+            ) : (
+              <Select
+                value={organisationId}
+                onValueChange={(org) => setOrganisationId(org)}
+                required
+              >
+                <SelectTrigger className="w-full">
+                  <SelectValue placeholder="Select an existing organisation" />
+                </SelectTrigger>
+                <SelectContent>
+                  {organisations?.map((o) => (
+                    <SelectItem key={o.id} value={o.id.toString()}>
+                      {o.name || "Unknown"}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            )}
+          </FormFieldWrapper>
+
+          {mapData && mapsByOrg.length > 0 && (
+            <div className="flex flex-col gap-2 mt-4">
+              <Label>Maps to copy</Label>
+              <p className="text-xs text-muted-foreground">
+                Select maps to copy to the new organisation. Untick data sources
+                you do not want to include.
+              </p>
+              <div className="flex flex-col gap-3 max-h-60 overflow-y-auto border rounded p-3">
+                {mapsByOrg.map(({ orgName, maps }) => (
+                  <div key={orgName}>
+                    <p className="text-xs font-medium text-muted-foreground mb-1">
+                      {orgName}
+                    </p>
+                    <div className="flex flex-col gap-2 pl-2">
+                      {maps.map((map) => {
+                        const dsIds = dataSourceIdsByMap.get(map.id);
+                        return (
+                          <div key={map.id}>
+                            <div className="flex items-center gap-2">
+                              <Checkbox
+                                id={`map-${map.id}`}
+                                checked={selectedMapIds.has(map.id)}
+                                onCheckedChange={() => toggleMap(map.id)}
+                              />
+                              <Label
+                                htmlFor={`map-${map.id}`}
+                                className="text-sm font-normal cursor-pointer"
+                              >
+                                {map.name}
+                              </Label>
+                            </div>
+                            {selectedMapIds.has(map.id) &&
+                              dsIds &&
+                              dsIds.size > 0 && (
+                                <div className="flex flex-col gap-1 pl-6 mt-1">
+                                  {[...dsIds].map((dsId) => (
+                                    <div
+                                      key={dsId}
+                                      className="flex items-center gap-2"
+                                    >
+                                      <Checkbox
+                                        id={`ds-${dsId}-${map.id}`}
+                                        checked={selectedDataSourceIds.has(
+                                          dsId,
+                                        )}
+                                        onCheckedChange={() =>
+                                          toggleDataSource(dsId)
+                                        }
+                                      />
+                                      <Label
+                                        htmlFor={`ds-${dsId}-${map.id}`}
+                                        className="text-xs font-normal cursor-pointer text-muted-foreground"
+                                      >
+                                        {mapData.dataSourceNames[dsId] ?? dsId}
+                                      </Label>
+                                    </div>
+                                  ))}
+                                </div>
+                              )}
+                          </div>
+                        );
+                      })}
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+
+          <Button disabled={isPending} type="submit" size="sm" className="mt-2">
+            Send invitation
+          </Button>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/src/app/(private)/(dashboards)/invite-organisation/page.tsx b/src/app/(private)/(dashboards)/invite-organisation/page.tsx
new file mode 100644
index 000000000..eed957ca0
--- /dev/null
+++ b/src/app/(private)/(dashboards)/invite-organisation/page.tsx
@@ -0,0 +1,84 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { redirect } from "next/navigation";
+import { useCurrentUser } from "@/hooks";
+import { UserRole } from "@/models/User";
+import { useTRPC } from "@/services/trpc/react";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/shadcn/ui/table";
+import CreateInvitationModal from "./CreateInvitationModal";
+
+export default function InviteOrganisationPage() {
+  const { currentUser } = useCurrentUser();
+  const trpc = useTRPC();
+  const isAllowed =
+    currentUser?.role === UserRole.Advocate ||
+    currentUser?.role === UserRole.Superadmin;
+
+  const { data: invitations, isPending: invitationsLoading } = useQuery(
+    trpc.invitation.list.queryOptions(undefined, { enabled: isAllowed }),
+  );
+
+  if (!isAllowed) {
+    redirect("/");
+  }
+
+  if (invitationsLoading) {
+    return "Loading...";
+  }
+
+  return (
+    <div className="p-4 mx-auto max-w-7xl w-full">
+      <div className="flex items-center justify-between mb-4">
+        <h1 className="text-3xl font-medium tracking-tight">
+          Invite Organisation
+        </h1>
+        <CreateInvitationModal />
+      </div>
+
+      <h2 className="text-2xl font-medium mb-4">Pending invitations</h2>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Email</TableHead>
+            <TableHead>Name</TableHead>
+            <TableHead>Organisation</TableHead>
+            <TableHead>Created</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {invitations?.length === 0 ? (
+            <TableRow>
+              <TableCell
+                colSpan={4}
+                className="text-center text-muted-foreground"
+              >
+                No pending invitations
+              </TableCell>
+            </TableRow>
+          ) : (
+            invitations?.map((inv) => (
+              <TableRow key={inv.id}>
+                <TableCell>{inv.email}</TableCell>
+                <TableCell>{inv.name}</TableCell>
+                <TableCell>{inv.organisationName}</TableCell>
+                <TableCell>
+                  {inv.createdAt
+                    ? new Date(inv.createdAt).toLocaleDateString()
+                    : "-"}
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  );
+}
diff --git a/src/app/(private)/(dashboards)/superadmin/data-sources/[id]/page.tsx b/src/app/(private)/(dashboards)/superadmin/data-sources/[id]/page.tsx
index 8d0c86832..21139a699 100644
--- a/src/app/(private)/(dashboards)/superadmin/data-sources/[id]/page.tsx
+++ b/src/app/(private)/(dashboards)/superadmin/data-sources/[id]/page.tsx
@@ -10,9 +10,9 @@ import { toast } from "sonner";
 import EditColumnMetadataModal from "@/app/(private)/components/EditColumnMetadataModal/EditColumnMetadataModal";
 import { useDataSourceListCache } from "@/app/(private)/hooks/useDataSourceListCache";
 import { isSuperadminDataSourceRouteAtom } from "@/atoms/dataSourceAtoms";
-import { ADMIN_USER_EMAIL } from "@/constants";
 import { useCurrentUser } from "@/hooks";
 import { useDataSources } from "@/hooks/useDataSources";
+import { UserRole } from "@/models/User";
 import { useTRPC } from "@/services/trpc/react";
 import { uploadFile } from "@/services/uploads";
 import { DefaultChoroplethSection } from "./components/DefaultChoroplethSection";
@@ -41,7 +41,7 @@ export default function DataSourceConfigPage() {
 
   const { data: dataSources, isPending, getDataSourceById } = useDataSources();
 
-  if (currentUser && currentUser.email !== ADMIN_USER_EMAIL) redirect("/");
+  if (currentUser && currentUser.role !== UserRole.Superadmin) redirect("/");
 
   const dataSource = dataSources?.find((ds) => ds.id === id);
 
diff --git a/src/app/(private)/(dashboards)/superadmin/page.tsx b/src/app/(private)/(dashboards)/superadmin/page.tsx
index e3d4f54de..abcc25af1 100644
--- a/src/app/(private)/(dashboards)/superadmin/page.tsx
+++ b/src/app/(private)/(dashboards)/superadmin/page.tsx
@@ -1,25 +1,13 @@
 "use client";
 
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { PlusIcon, Settings } from "lucide-react";
+import { Settings } from "lucide-react";
 import Link from "next/link";
 import { redirect } from "next/navigation";
-import { type FormEvent, useState } from "react";
 import { toast } from "sonner";
-import FormFieldWrapper from "@/components/forms/FormFieldWrapper";
-import { ADMIN_USER_EMAIL } from "@/constants";
 import { useCurrentUser } from "@/hooks";
+import { UserRole } from "@/models/User";
 import { useTRPC } from "@/services/trpc/react";
-import { Button } from "@/shadcn/ui/button";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle,
-  DialogTrigger,
-} from "@/shadcn/ui/dialog";
-import { Input } from "@/shadcn/ui/input";
 import {
   Select,
   SelectContent,
@@ -41,85 +29,30 @@ import { UserChart } from "./UserChart";
 
 export default function SuperadminPage() {
   const { currentUser } = useCurrentUser();
-  const [name, setName] = useState("");
-  const [email, setEmail] = useState("");
-  const [organisationId, setOrganisationId] = useState("");
-  const [organisationName, setOrganisationName] = useState("");
-  const [dialogOpen, setDialogOpen] = useState(false);
-  const [isCreatingNewOrg, setIsCreatingNewOrg] = useState(false);
 
   const trpc = useTRPC();
-  const { data: organisations, isPending: organisationsLoading } = useQuery(
-    trpc.organisation.listAll.queryOptions(),
-  );
   const { data: users, isPending: usersLoading } = useQuery(
     trpc.user.list.queryOptions(),
   );
-  const { data: invitations, isPending: invitationsLoading } = useQuery(
-    trpc.invitation.list.queryOptions(),
-  );
   const { data: publicDataSources, isPending: publicDataSourcesLoading } =
     useQuery(trpc.dataSource.listPublic.queryOptions());
 
   const client = useQueryClient();
-  const { mutate: createInvitationMutate, isPending } = useMutation(
-    trpc.invitation.create.mutationOptions({
+  const { mutate: updateRole } = useMutation(
+    trpc.user.updateRole.mutationOptions({
       onSuccess: () => {
-        toast.success("Invitation created successfully", {
-          description: "An invite has been sent to the user",
-        });
-        setName("");
-        setEmail("");
-        setOrganisationId("");
-        setOrganisationName("");
-        setIsCreatingNewOrg(false);
-        setDialogOpen(false);
-        client.invalidateQueries({
-          queryKey: trpc.organisation.listAll.queryKey(),
-        });
-        client.invalidateQueries({
-          queryKey: trpc.user.list.queryKey(),
-        });
-        client.invalidateQueries({
-          queryKey: trpc.invitation.list.queryKey(),
-        });
+        client.invalidateQueries({ queryKey: trpc.user.list.queryKey() });
+        toast.success("Role updated");
       },
       onError: (error) => {
-        toast.error("Failed to create invitation.", {
-          description: error.message,
-        });
+        toast.error("Failed to update role.", { description: error.message });
       },
     }),
   );
 
-  if (currentUser?.email !== ADMIN_USER_EMAIL) redirect("/");
-
-  const onSubmit = (e: FormEvent<HTMLFormElement>) => {
-    e.preventDefault();
-
-    if (!organisationId && !organisationName) {
-      toast.error("Please select an organisation or create a new one");
-      return;
-    }
-    createInvitationMutate({ organisationId, organisationName, email, name });
-  };
+  if (currentUser?.role !== UserRole.Superadmin) redirect("/");
 
-  const toggleOrganisationMode = () => {
-    setIsCreatingNewOrg(!isCreatingNewOrg);
-    // Clear the state of whichever mode we're leaving
-    if (isCreatingNewOrg) {
-      setOrganisationName("");
-    } else {
-      setOrganisationId("");
-    }
-  };
-
-  if (
-    organisationsLoading ||
-    usersLoading ||
-    invitationsLoading ||
-    publicDataSourcesLoading
-  ) {
+  if (usersLoading || publicDataSourcesLoading) {
     return "Loading...";
   }
 
@@ -127,10 +60,9 @@ export default function SuperadminPage() {
     <div className="p-4 mx-auto max-w-7xl w-full">
       <Tabs defaultValue="users" className="w-full">
         <div className="flex items-center justify-between mb-4">
-          <h1 className="text-3xl font-medium tracking-tight ">Superadmin</h1>
+          <h1 className="text-3xl font-medium tracking-tight">Superadmin</h1>
           <TabsList>
             <TabsTrigger value="users">All Users</TabsTrigger>
-            <TabsTrigger value="invitations">Pending Invitations</TabsTrigger>
             <TabsTrigger value="public-library">Public Library</TabsTrigger>
             <TabsTrigger value="features">Feature Access</TabsTrigger>
           </TabsList>
@@ -147,6 +79,7 @@ export default function SuperadminPage() {
                 <TableHead>Email</TableHead>
                 <TableHead>Name</TableHead>
                 <TableHead>Organisation</TableHead>
+                <TableHead>Role</TableHead>
               </TableRow>
             </TableHeader>
             <TableBody>
@@ -155,149 +88,32 @@ export default function SuperadminPage() {
                   <TableCell>{u.email}</TableCell>
                   <TableCell>{u.name}</TableCell>
                   <TableCell>{u.organisations.join(", ")}</TableCell>
-                </TableRow>
-              ))}
-            </TableBody>
-          </Table>
-        </TabsContent>
-        <TabsContent value="invitations" className="mt-6">
-          <div className="flex items-center justify-between mb-4">
-            <h2 className="text-2xl font-medium">Pending Invitations</h2>
-
-            <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
-              <DialogTrigger asChild>
-                <Button>
-                  <PlusIcon className="mr-2 h-4 w-4" />
-                  Create Invitation
-                </Button>
-              </DialogTrigger>
-              <DialogContent className="sm:max-w-[500px]">
-                <DialogHeader>
-                  <DialogTitle>Create Invitation</DialogTitle>
-                  <DialogDescription>
-                    Send an invitation to a new user to join the platform.
-                  </DialogDescription>
-                </DialogHeader>
-                <form onSubmit={onSubmit} className="flex flex-col gap-4">
-                  <FormFieldWrapper id="name" label="Name">
-                    <Input
-                      id="name"
-                      name="name"
-                      type="name"
-                      value={name}
-                      onChange={(e) => setName(e.target.value)}
-                      required
-                    />
-                  </FormFieldWrapper>
-
-                  <FormFieldWrapper id="email" label="Email">
-                    <Input
-                      id="email"
-                      name="email"
-                      type="email"
-                      value={email}
-                      onChange={(e) => setEmail(e.target.value)}
-                      required
-                    />
-                  </FormFieldWrapper>
-
-                  <FormFieldWrapper
-                    id="organisation"
-                    label={
-                      <div className="flex items-center justify-between w-full">
-                        <span>Organisation</span>
-                        <Button
-                          type="button"
-                          variant="link"
-                          size="sm"
-                          onClick={toggleOrganisationMode}
-                          className="h-auto p-0 text-xs"
-                        >
-                          {isCreatingNewOrg
-                            ? "or select one"
-                            : "or create a new one"}
-                        </Button>
-                      </div>
-                    }
-                  >
-                    {isCreatingNewOrg ? (
-                      <Input
-                        id="new-organisation"
-                        name="new-organisation"
-                        type="text"
-                        autoFocus
-                        placeholder="Enter new organisation name"
-                        value={organisationName}
-                        onChange={(e) => setOrganisationName(e.target.value)}
-                        required
-                      />
-                    ) : (
-                      <Select
-                        value={organisationId}
-                        onValueChange={(org) => setOrganisationId(org)}
-                        required
-                      >
-                        <SelectTrigger className="w-full">
-                          <SelectValue placeholder="Select an existing organisation" />
-                        </SelectTrigger>
-                        <SelectContent>
-                          {organisations?.map((o) => {
-                            return (
-                              <SelectItem key={o.id} value={o.id.toString()}>
-                                {o.name || "Unknown"}
-                              </SelectItem>
-                            );
-                          })}
-                        </SelectContent>
-                      </Select>
-                    )}
-                  </FormFieldWrapper>
-
-                  <Button
-                    disabled={isPending}
-                    type="submit"
-                    size="sm"
-                    className="mt-2"
-                  >
-                    Send invitation
-                  </Button>
-                </form>
-              </DialogContent>
-            </Dialog>
-          </div>
-          <Table>
-            <TableHeader>
-              <TableRow>
-                <TableHead>Email</TableHead>
-                <TableHead>Name</TableHead>
-                <TableHead>Organisation</TableHead>
-                <TableHead>Created</TableHead>
-              </TableRow>
-            </TableHeader>
-            <TableBody>
-              {invitations?.length === 0 ? (
-                <TableRow>
-                  <TableCell
-                    colSpan={4}
-                    className="text-center text-muted-foreground"
-                  >
-                    No pending invitations
+                  <TableCell>
+                    <Select
+                      value={u.role ?? "none"}
+                      onValueChange={(value) =>
+                        updateRole({
+                          userId: u.id,
+                          role: value === "none" ? null : (value as UserRole),
+                        })
+                      }
+                    >
+                      <SelectTrigger className="w-32">
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="none">Regular</SelectItem>
+                        <SelectItem value={UserRole.Advocate}>
+                          Advocate
+                        </SelectItem>
+                        <SelectItem value={UserRole.Superadmin}>
+                          Superadmin
+                        </SelectItem>
+                      </SelectContent>
+                    </Select>
                   </TableCell>
                 </TableRow>
-              ) : (
-                invitations?.map((inv) => (
-                  <TableRow key={inv.id}>
-                    <TableCell>{inv.email}</TableCell>
-                    <TableCell>{inv.name}</TableCell>
-                    <TableCell>{inv.organisationName}</TableCell>
-                    <TableCell>
-                      {inv.createdAt
-                        ? new Date(inv.createdAt).toLocaleDateString()
-                        : "-"}
-                    </TableCell>
-                  </TableRow>
-                ))
-              )}
+              ))}
             </TableBody>
           </Table>
         </TabsContent>
diff --git a/src/app/(private)/map/[id]/components/Map.css b/src/app/(private)/map/[id]/components/Map.css
index 9b1a42146..e3202fbc2 100644
--- a/src/app/(private)/map/[id]/components/Map.css
+++ b/src/app/(private)/map/[id]/components/Map.css
@@ -12,7 +12,7 @@
   overflow: hidden;
 }
 
-/* search inout styles */
+/* search input styles */
 .map-wrapper .mapboxgl-ctrl-geocoder.mapboxgl-ctrl {
   background: transparent;
   box-shadow: none;
diff --git a/src/app/(private)/map/[id]/components/controls/VisualisationPanel/VisualisationPanel.tsx b/src/app/(private)/map/[id]/components/controls/VisualisationPanel/VisualisationPanel.tsx
index b01ba9cdb..07c6eb8ea 100644
--- a/src/app/(private)/map/[id]/components/controls/VisualisationPanel/VisualisationPanel.tsx
+++ b/src/app/(private)/map/[id]/components/controls/VisualisationPanel/VisualisationPanel.tsx
@@ -290,7 +290,9 @@ export default function VisualisationPanel({
                         </Label>
 
                         <Select
-                          value={viewConfig.colorScheme || ColorScheme.Sequential}
+                          value={
+                            viewConfig.colorScheme || ColorScheme.Sequential
+                          }
                           onValueChange={(value) =>
                             updateViewConfig({
                               colorScheme: value as ColorScheme,
diff --git a/src/auth/index.ts b/src/auth/index.ts
index efc3bd4df..15dd0cf5d 100644
--- a/src/auth/index.ts
+++ b/src/auth/index.ts
@@ -18,6 +18,7 @@ export const getServerSession = cache(async (): Promise<ServerSession> => {
         email: user.email,
         name: user.name,
         avatarUrl: user.avatarUrl,
+        role: user.role,
       },
     };
   }
diff --git a/src/authTypes.ts b/src/authTypes.ts
index c5dbc2382..1a021ee21 100644
--- a/src/authTypes.ts
+++ b/src/authTypes.ts
@@ -1,8 +1,11 @@
+import type { UserRole } from "@/models/User";
+
 export interface CurrentUser {
   id: string;
   email: string;
   name: string;
   avatarUrl?: string | null;
+  role?: UserRole | null;
 }
 
 export interface ServerSession {
diff --git a/src/components/Sidebar.tsx b/src/components/Sidebar.tsx
index ace0f78db..878611993 100644
--- a/src/components/Sidebar.tsx
+++ b/src/components/Sidebar.tsx
@@ -5,6 +5,7 @@ import {
   Clock2,
   DatabaseIcon,
   LockIcon,
+  MailPlusIcon,
   MapIcon,
   UserCogIcon,
 } from "lucide-react";
@@ -13,10 +14,10 @@ import { usePathname } from "next/navigation";
 import { useEffect, useState } from "react";
 import { Link } from "@/components/Link";
 import SidebarUserMenu from "@/components/SidebarUserMenu";
-import { ADMIN_USER_EMAIL } from "@/constants";
 import { useCurrentUser, useFeatureFlagEnabled } from "@/hooks";
 import { useOrganisations } from "@/hooks/useOrganisations";
 import { Feature } from "@/models/Organisation";
+import { UserRole } from "@/models/User";
 import { cn } from "@/shadcn/utils";
 
 export default function Sidebar() {
@@ -77,7 +78,18 @@ export default function Sidebar() {
     });
   }
 
-  if (currentUser?.email === ADMIN_USER_EMAIL) {
+  if (
+    currentUser?.role === UserRole.Advocate ||
+    currentUser?.role === UserRole.Superadmin
+  ) {
+    navItems.push({
+      label: "Invite organisation",
+      href: "/invite-organisation",
+      icon: <MailPlusIcon className="w-4 h-4" />,
+    });
+  }
+
+  if (currentUser?.role === UserRole.Superadmin) {
     navItems.push({
       label: "Superadmin",
       href: "/superadmin",
diff --git a/src/constants/index.ts b/src/constants/index.ts
index a773bedae..c32b67408 100644
--- a/src/constants/index.ts
+++ b/src/constants/index.ts
@@ -1,7 +1,6 @@
 export * from "./colors";
 
 export const ADMIN_ORGANISATION_NAME = "Common Knowledge";
-export const ADMIN_USER_EMAIL = "hello@commonknowledge.coop";
 
 export const DATA_RECORDS_PAGE_SIZE = 100;
 
diff --git a/src/models/User.ts b/src/models/User.ts
index 83bec5af0..09c98c495 100644
--- a/src/models/User.ts
+++ b/src/models/User.ts
@@ -1,5 +1,10 @@
 import z from "zod";
 
+export enum UserRole {
+  Advocate = "Advocate",
+  Superadmin = "Superadmin",
+}
+
 export const passwordSchema = z
   .string()
   .trim()
@@ -12,6 +17,7 @@ export const userSchema = z.object({
   name: z.string().trim(),
   avatarUrl: z.string().url().trim().nullish(),
   passwordHash: z.string(),
+  role: z.nativeEnum(UserRole).nullish(),
 });
 
 export type User = z.infer<typeof userSchema>;
diff --git a/src/server/commands/copyMapsToOrganisation.ts b/src/server/commands/copyMapsToOrganisation.ts
new file mode 100644
index 000000000..d64763d5d
--- /dev/null
+++ b/src/server/commands/copyMapsToOrganisation.ts
@@ -0,0 +1,178 @@
+import {
+  createDataSource,
+  findDataSourceById,
+} from "@/server/repositories/DataSource";
+import { createMap, updateMap } from "@/server/repositories/Map";
+import { findMapById } from "@/server/repositories/Map";
+import {
+  findMapViewsByMapId,
+  upsertMapView,
+} from "@/server/repositories/MapView";
+import logger from "@/server/services/logger";
+import { enqueue } from "@/server/services/queue";
+import type { MapConfig } from "@/models/Map";
+
+interface MapSelection {
+  mapId: string;
+  dataSourceIds: string[];
+}
+
+/**
+ * Copies selected maps (and optionally their data sources) to a target organisation.
+ * Data sources not included in the selection are stripped from the copied maps/views.
+ */
+const copyMapsToOrganisation = async (
+  mapSelections: MapSelection[],
+  targetOrgId: string,
+): Promise<void> => {
+  // Shared across all selections so a data source referenced by multiple
+  // maps is copied only once into the target org.
+  const dataSourceIdMap = new Map<string, string>();
+
+  for (const selection of mapSelections) {
+    const originalMap = await findMapById(selection.mapId);
+    if (!originalMap) {
+      logger.warn(`Map ${selection.mapId} not found, skipping`);
+      continue;
+    }
+
+    // Collect all data source IDs actually referenced by the source map,
+    // so callers can't smuggle arbitrary IDs from other organisations.
+    const views = await findMapViewsByMapId(originalMap.id);
+    const referencedDsIds = new Set<string>();
+    for (const id of originalMap.config.markerDataSourceIds) {
+      if (id) referencedDsIds.add(id);
+    }
+    if (originalMap.config.membersDataSourceId) {
+      referencedDsIds.add(originalMap.config.membersDataSourceId);
+    }
+    for (const view of views) {
+      if (view.config.areaDataSourceId) {
+        referencedDsIds.add(view.config.areaDataSourceId);
+      }
+      for (const dsv of view.dataSourceViews) {
+        referencedDsIds.add(dsv.dataSourceId);
+      }
+    }
+
+    // Copy selected data sources and build ID mapping
+    for (const dsId of selection.dataSourceIds) {
+      if (dataSourceIdMap.has(dsId)) continue;
+      if (!referencedDsIds.has(dsId)) {
+        logger.warn(
+          `Data source ${dsId} is not referenced by map ${selection.mapId}, skipping`,
+        );
+        continue;
+      }
+      const original = await findDataSourceById(dsId);
+      if (!original) {
+        logger.warn(`Data source ${dsId} not found, skipping`);
+        continue;
+      }
+      if (original.organisationId !== originalMap.organisationId) {
+        logger.warn(
+          `Data source ${dsId} does not belong to source map organisation, skipping`,
+        );
+        continue;
+      }
+
+      const copy = await createDataSource({
+        name: original.name,
+        organisationId: targetOrgId,
+        autoEnrich: original.autoEnrich,
+        autoImport: original.autoImport,
+        config: original.config,
+        columnRoles: original.columnRoles,
+        enrichments: original.enrichments,
+        geocodingConfig: original.geocodingConfig,
+        columnDefs: original.columnDefs,
+        columnMetadata: original.columnMetadata,
+        public: false,
+        recordType: original.recordType,
+        defaultInspectorConfig: original.defaultInspectorConfig,
+        defaultChoroplethConfig: original.defaultChoroplethConfig,
+        dateFormat: original.dateFormat,
+        naIsNull: original.naIsNull,
+        nullIsZero: original.nullIsZero,
+      });
+
+      dataSourceIdMap.set(dsId, copy.id);
+      await enqueue("importDataSource", copy.id, { dataSourceId: copy.id });
+    }
+
+    // Create the new map with remapped config
+    const newMap = await createMap(targetOrgId, originalMap.name);
+    const remappedConfig = remapMapConfig(originalMap.config, dataSourceIdMap);
+    await updateMap(newMap.id, { config: remappedConfig });
+
+    // Copy and remap views
+    for (const view of views) {
+      const remappedAreaDataSourceId = dataSourceIdMap.get(
+        view.config.areaDataSourceId,
+      );
+
+      // Skip views whose area data source was not copied
+      if (!remappedAreaDataSourceId) continue;
+
+      const remappedDataSourceViews: typeof view.dataSourceViews = [];
+      for (const dsv of view.dataSourceViews) {
+        const newId = dataSourceIdMap.get(dsv.dataSourceId);
+        if (newId)
+          remappedDataSourceViews.push({ ...dsv, dataSourceId: newId });
+      }
+
+      await upsertMapView({
+        name: view.name,
+        position: view.position,
+        mapId: newMap.id,
+        config: {
+          ...view.config,
+          areaDataSourceId: remappedAreaDataSourceId,
+        },
+        dataSourceViews: remappedDataSourceViews,
+      });
+    }
+  }
+};
+
+function remapMapConfig(
+  config: MapConfig,
+  dataSourceIdMap: Map<string, string>,
+): MapConfig {
+  const membersDataSourceId = config.membersDataSourceId
+    ? (dataSourceIdMap.get(config.membersDataSourceId) ?? null)
+    : null;
+
+  const markerDataSourceIds: string[] = [];
+  for (const id of config.markerDataSourceIds) {
+    const newId = dataSourceIdMap.get(id);
+    if (newId) markerDataSourceIds.push(newId);
+  }
+
+  return {
+    ...config,
+    membersDataSourceId,
+    markerDataSourceIds,
+    markerDisplayModes: remapRecord(config.markerDisplayModes, dataSourceIdMap),
+    markerColors: remapRecord(config.markerColors, dataSourceIdMap),
+    placedMarkerColors: undefined,
+    folderColors: undefined,
+  };
+}
+
+function remapRecord<T>(
+  record: Record<string, T> | undefined,
+  dataSourceIdMap: Map<string, string>,
+): Record<string, T> | undefined {
+  if (!record) return undefined;
+  const result: Record<string, T> = {};
+  for (const [key, value] of Object.entries(record)) {
+    const newKey = dataSourceIdMap.get(key);
+    if (newKey) {
+      result[newKey] = value;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : undefined;
+}
+
+export default copyMapsToOrganisation;
diff --git a/src/server/repositories/Invitation.ts b/src/server/repositories/Invitation.ts
index 30a7efa9e..2adc486a4 100644
--- a/src/server/repositories/Invitation.ts
+++ b/src/server/repositories/Invitation.ts
@@ -26,7 +26,8 @@ export function listPendingInvitations() {
       "invitation.createdAt",
       "organisation.name as organisationName",
     ])
-    .orderBy("invitation.createdAt", "desc")
+    .orderBy("organisation.name", "asc")
+    .orderBy("invitation.name", "asc")
     .execute();
 }
 
diff --git a/src/server/repositories/Map.ts b/src/server/repositories/Map.ts
index bb15240dc..203f4417b 100644
--- a/src/server/repositories/Map.ts
+++ b/src/server/repositories/Map.ts
@@ -46,6 +46,17 @@ export function findMapsByOrganisationId(organisationId: string) {
     .execute();
 }
 
+export function listAllMaps() {
+  return db
+    .selectFrom("map")
+    .innerJoin("organisation", "map.organisationId", "organisation.id")
+    .selectAll("map")
+    .select("organisation.name as organisationName")
+    .orderBy("organisation.name")
+    .orderBy("map.name")
+    .execute();
+}
+
 export function updateMap(id: string, map: MapUpdate) {
   return db
     .updateTable("map")
diff --git a/src/server/repositories/User.ts b/src/server/repositories/User.ts
index 4aa19536f..c6fe88b17 100644
--- a/src/server/repositories/User.ts
+++ b/src/server/repositories/User.ts
@@ -2,6 +2,7 @@ import { jwtVerify } from "jose";
 import { sql } from "kysely";
 import { db } from "@/server/services/database";
 import { hashPassword, verifyPassword } from "@/server/utils/auth";
+import type { UserRole } from "@/models/User";
 import type { NewUser, UserUpdate } from "@/server/models/User";
 
 export async function upsertUser(
@@ -82,6 +83,15 @@ export function listUsers() {
     .execute();
 }
 
+export async function updateUserRole(id: string, role: UserRole | null) {
+  return db
+    .updateTable("user")
+    .where("id", "=", id)
+    .set({ role })
+    .returning(["id", "email", "name", "avatarUrl", "role", "createdAt"])
+    .executeTakeFirstOrThrow();
+}
+
 export async function updateUser(
   id: string,
   {
diff --git a/src/server/services/database/schema.ts b/src/server/services/database/schema.ts
index 8c7033613..6a880cc77 100644
--- a/src/server/services/database/schema.ts
+++ b/src/server/services/database/schema.ts
@@ -65,6 +65,7 @@ export interface User {
   passwordHash: string; // text, NOT NULL
   name: string; // text, NOT NULL, DEFAULT ''
   avatarUrl: string | null; // text, NULL
+  role: string | null; // text, NULL — 'Advocate' or 'Superadmin'
   createdAt: string; // text, DEFAULT CURRENT_TIMESTAMP, NOT NULL
 }
 
diff --git a/src/server/trpc/index.ts b/src/server/trpc/index.ts
index 22932769f..eb3e51412 100644
--- a/src/server/trpc/index.ts
+++ b/src/server/trpc/index.ts
@@ -2,7 +2,7 @@ import { TRPCError, initTRPC } from "@trpc/server";
 import superjson from "superjson";
 import z, { ZodError } from "zod";
 import { getServerSession } from "@/auth";
-import { ADMIN_USER_EMAIL } from "@/constants";
+import { UserRole } from "@/models/User";
 import { getClientIp } from "@/server/services/ratelimit";
 import { canReadDataSource } from "@/server/utils/auth";
 import {
@@ -76,7 +76,7 @@ const enforceUserIsAuthed = t.middleware(({ ctx, next }) => {
 export const protectedProcedure = t.procedure.use(enforceUserIsAuthed);
 
 const enforceUserIsSuperadmin = t.middleware(({ ctx, next }) => {
-  if (ctx.user?.email !== ADMIN_USER_EMAIL)
+  if (ctx.user?.role !== UserRole.Superadmin)
     throw new TRPCError({
       code: "UNAUTHORIZED",
       message: "You must be a superadmin to perform this action.",
@@ -86,6 +86,20 @@ const enforceUserIsSuperadmin = t.middleware(({ ctx, next }) => {
 
 export const superadminProcedure = t.procedure.use(enforceUserIsSuperadmin);
 
+const enforceUserIsAdvocate = t.middleware(({ ctx, next }) => {
+  if (
+    ctx.user?.role !== UserRole.Advocate &&
+    ctx.user?.role !== UserRole.Superadmin
+  )
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You must be an advocate or superadmin to perform this action.",
+    });
+  return next({ ctx: { user: ctx.user } });
+});
+
+export const advocateProcedure = t.procedure.use(enforceUserIsAdvocate);
+
 export const organisationProcedure = protectedProcedure
   .input(z.object({ organisationId: z.string() }))
   .use(async ({ ctx, input, next }) => {
diff --git a/src/server/trpc/routers/auth.ts b/src/server/trpc/routers/auth.ts
index 573e205bb..63cf01d70 100644
--- a/src/server/trpc/routers/auth.ts
+++ b/src/server/trpc/routers/auth.ts
@@ -5,7 +5,6 @@ import { NoResultError } from "kysely";
 import z from "zod";
 import { setJWT } from "@/auth/jwt";
 import { passwordSchema } from "@/models/User";
-import ensureOrganisationMap from "@/server/commands/ensureOrganisationMap";
 import ForgotPassword from "@/server/emails/ForgotPassword";
 import {
   findAndUseInvitation,
@@ -55,9 +54,6 @@ export const authRouter = router({
 
         await updateInvitation(invitation.id, { userId: user.id });
 
-        // Ensure organisation map exists
-        await ensureOrganisationMap(invitation.organisationId);
-
         // Set JWT cookie and log user in
         await setJWT(user.id, user.email);
         return user;
diff --git a/src/server/trpc/routers/invitation.ts b/src/server/trpc/routers/invitation.ts
index f556911a5..c77a46722 100644
--- a/src/server/trpc/routers/invitation.ts
+++ b/src/server/trpc/routers/invitation.ts
@@ -1,6 +1,7 @@
 import { TRPCError } from "@trpc/server";
 import { SignJWT } from "jose";
 import z from "zod";
+import copyMapsToOrganisation from "@/server/commands/copyMapsToOrganisation";
 import ensureOrganisationMap from "@/server/commands/ensureOrganisationMap";
 import Invite from "@/server/emails/Invite";
 import {
@@ -14,10 +15,10 @@ import {
 } from "@/server/repositories/Organisation";
 import logger from "@/server/services/logger";
 import { sendEmail } from "@/server/services/mailer";
-import { protectedProcedure, router, superadminProcedure } from "..";
+import { advocateProcedure, protectedProcedure, router } from "..";
 
 export const invitationRouter = router({
-  create: superadminProcedure
+  create: advocateProcedure
     .input(
       z
         .object({
@@ -25,6 +26,14 @@ export const invitationRouter = router({
           email: z.string().email(),
           organisationId: z.string().nullish(),
           organisationName: z.string().nullish(),
+          mapSelections: z
+            .array(
+              z.object({
+                mapId: z.string(),
+                dataSourceIds: z.array(z.string()),
+              }),
+            )
+            .optional(),
         })
         .refine((data) => data.organisationId || data.organisationName, {
           message: "Either organisationId or organisationName must be provided",
@@ -47,7 +56,11 @@ export const invitationRouter = router({
           });
         }
 
-        await ensureOrganisationMap(org.id);
+        if (input.mapSelections && input.mapSelections.length > 0) {
+          await copyMapsToOrganisation(input.mapSelections, org.id);
+        } else {
+          await ensureOrganisationMap(org.id);
+        }
 
         const invitation = await createInvitation({
           email: input.email.toLowerCase().trim(),
@@ -66,6 +79,7 @@ export const invitationRouter = router({
           `Created invitation for ${input.email}, ID ${invitation.id}`,
         );
       } catch (error) {
+        if (error instanceof TRPCError) throw error;
         logger.error("Could not create invitation", { error });
         throw new TRPCError({
           code: "INTERNAL_SERVER_ERROR",
@@ -73,7 +87,7 @@ export const invitationRouter = router({
         });
       }
     }),
-  list: superadminProcedure.query(() => listPendingInvitations()),
+  list: advocateProcedure.query(() => listPendingInvitations()),
   listForUser: protectedProcedure.query(async ({ ctx }) => {
     return findPendingInvitationsByEmail(ctx.user.email);
   }),
diff --git a/src/server/trpc/routers/map.ts b/src/server/trpc/routers/map.ts
index 0b9ba098a..1eaed9c0b 100644
--- a/src/server/trpc/routers/map.ts
+++ b/src/server/trpc/routers/map.ts
@@ -5,12 +5,16 @@ import { DataSourceRecordType } from "@/models/DataSource";
 import { mapConfigSchema, mapSchema } from "@/models/Map";
 import { MapStyleName, mapViewSchema } from "@/models/MapView";
 import { DEFAULT_CALCULATION_TYPE } from "@/models/shared";
-import { findDataSourceById } from "@/server/repositories/DataSource";
+import {
+  findDataSourceById,
+  findDataSourcesByIds,
+} from "@/server/repositories/DataSource";
 import { findFoldersByMapId } from "@/server/repositories/Folder";
 import {
   createMap,
   deleteMap,
   findMapsByOrganisationId,
+  listAllMaps,
   updateMap,
 } from "@/server/repositories/Map";
 import {
@@ -21,6 +25,7 @@ import { findPlacedMarkersByMapId } from "@/server/repositories/PlacedMarker";
 import { findTurfsByMapId } from "@/server/repositories/Turf";
 import { deleteFile } from "@/server/services/minio";
 import {
+  advocateProcedure,
   mapReadProcedure,
   mapWriteProcedure,
   organisationProcedure,
@@ -28,6 +33,44 @@ import {
 } from "../index";
 
 export const mapRouter = router({
+  listAll: advocateProcedure.query(async () => {
+    const maps = await listAllMaps();
+    const allViews = await Promise.all(
+      maps.map((map) => findMapViewsByMapId(map.id)),
+    );
+
+    // Collect all data source IDs referenced by maps and views
+    const allDataSourceIds = new Set<string>();
+    for (let i = 0; i < maps.length; i++) {
+      const map = maps[i];
+      for (const id of map.config.markerDataSourceIds) {
+        if (id) allDataSourceIds.add(id);
+      }
+      if (map.config.membersDataSourceId) {
+        allDataSourceIds.add(map.config.membersDataSourceId);
+      }
+      for (const view of allViews[i]) {
+        if (view.config.areaDataSourceId) {
+          allDataSourceIds.add(view.config.areaDataSourceId);
+        }
+        for (const dsv of view.dataSourceViews) {
+          allDataSourceIds.add(dsv.dataSourceId);
+        }
+      }
+    }
+
+    // Resolve data source names
+    const dataSources = await findDataSourcesByIds([...allDataSourceIds]);
+    const dataSourceNames: Record<string, string> = {};
+    for (const ds of dataSources) {
+      dataSourceNames[ds.id] = ds.name;
+    }
+
+    return {
+      maps: maps.map((map, i) => ({ ...map, views: allViews[i] })),
+      dataSourceNames,
+    };
+  }),
   list: organisationProcedure.query(async ({ ctx }) => {
     return findMapsByOrganisationId(ctx.organisation.id);
   }),
diff --git a/src/server/trpc/routers/organisation.ts b/src/server/trpc/routers/organisation.ts
index 645713f34..d036cb302 100644
--- a/src/server/trpc/routers/organisation.ts
+++ b/src/server/trpc/routers/organisation.ts
@@ -26,6 +26,7 @@ import { findUserByEmail } from "@/server/repositories/User";
 import logger from "@/server/services/logger";
 import { sendEmail } from "@/server/services/mailer";
 import {
+  advocateProcedure,
   organisationProcedure,
   protectedProcedure,
   router,
@@ -36,7 +37,7 @@ export const organisationRouter = router({
   list: protectedProcedure.query(async ({ ctx }) => {
     return findOrganisationsByUserId(ctx.user.id);
   }),
-  listAll: superadminProcedure.query(() => {
+  listAll: advocateProcedure.query(() => {
     return listOrganisations();
   }),
   listUsers: organisationProcedure.query(async ({ ctx }) => {
diff --git a/src/server/trpc/routers/user.ts b/src/server/trpc/routers/user.ts
index 855b580c9..2db07431f 100644
--- a/src/server/trpc/routers/user.ts
+++ b/src/server/trpc/routers/user.ts
@@ -1,12 +1,26 @@
 import { TRPCError } from "@trpc/server";
 import z from "zod";
-import { passwordSchema, userSchema } from "@/models/User";
-import { listUsers, updateUser } from "@/server/repositories/User";
+import { UserRole, passwordSchema, userSchema } from "@/models/User";
+import {
+  listUsers,
+  updateUser,
+  updateUserRole,
+} from "@/server/repositories/User";
 import { verifyPassword } from "@/server/utils/auth";
 import { protectedProcedure, router, superadminProcedure } from "../index";
 
 export const userRouter = router({
   list: superadminProcedure.query(() => listUsers()),
+  updateRole: superadminProcedure
+    .input(
+      z.object({
+        userId: z.string(),
+        role: z.nativeEnum(UserRole).nullable(),
+      }),
+    )
+    .mutation(async ({ input }) => {
+      return updateUserRole(input.userId, input.role);
+    }),
   update: protectedProcedure
     .input(
       userSchema.pick({ email: true, name: true, avatarUrl: true }).partial(),
diff --git a/tests/unit/app/api/login/route.test.ts b/tests/unit/app/api/login/route.test.ts
index cda00c8c9..bd890a794 100644
--- a/tests/unit/app/api/login/route.test.ts
+++ b/tests/unit/app/api/login/route.test.ts
@@ -117,6 +117,7 @@ describe("POST /api/login", () => {
         createdAt: new Date(),
         passwordHash: "",
         avatarUrl: undefined,
+        role: undefined,
       });
       const request = makeRequest(
         { email: "user@example.com", password: "correctpassword" },
diff --git a/tests/unit/server/commands/copyMapsToOrganisation.test.ts b/tests/unit/server/commands/copyMapsToOrganisation.test.ts
new file mode 100644
index 000000000..021a8a2d0
--- /dev/null
+++ b/tests/unit/server/commands/copyMapsToOrganisation.test.ts
@@ -0,0 +1,531 @@
+import { v4 as uuidv4 } from "uuid";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import {
+  DataSourceRecordType,
+  DataSourceType,
+  GeocodingType,
+  JobStatus,
+} from "@/models/DataSource";
+import { MarkerDisplayMode } from "@/models/Map";
+import { FilterType, MapStyleName } from "@/models/MapView";
+import { CalculationType } from "@/models/shared";
+import copyMapsToOrganisation from "@/server/commands/copyMapsToOrganisation";
+import {
+  createDataSource,
+  deleteDataSource,
+  findDataSourceById,
+  getJobInfo,
+} from "@/server/repositories/DataSource";
+import {
+  createMap,
+  deleteMap,
+  findMapsByOrganisationId,
+  updateMap,
+} from "@/server/repositories/Map";
+import {
+  findMapViewsByMapId,
+  upsertMapView,
+} from "@/server/repositories/MapView";
+import { upsertOrganisation } from "@/server/repositories/Organisation";
+import type { Map } from "@/models/Map";
+import type { MapView } from "@/models/MapView";
+
+const cleanup = {
+  dataSourceIds: [] as string[],
+  mapIds: [] as string[],
+};
+
+async function createTestDataSource(organisationId: string, name: string) {
+  const ds = await createDataSource({
+    name,
+    organisationId,
+    autoEnrich: false,
+    autoImport: false,
+    config: {
+      type: DataSourceType.CSV,
+      url: `file://tests/resources/stats.csv?${uuidv4()}`,
+    },
+    columnDefs: [],
+    columnMetadata: [],
+    columnRoles: { nameColumns: ["Name"] },
+    enrichments: [],
+    geocodingConfig: { type: GeocodingType.None },
+    public: false,
+    recordType: DataSourceRecordType.Data,
+  });
+  cleanup.dataSourceIds.push(ds.id);
+  return ds;
+}
+
+async function createTestOrg(name: string) {
+  return upsertOrganisation({ name });
+}
+
+async function createTestMap(organisationId: string, name: string) {
+  const map = await createMap(organisationId, name);
+  cleanup.mapIds.push(map.id);
+  return map;
+}
+
+describe("copyMapsToOrganisation", () => {
+  describe("with included and excluded data sources", () => {
+    let sourceOrg: Awaited<ReturnType<typeof createTestOrg>>;
+    let targetOrg: Awaited<ReturnType<typeof createTestOrg>>;
+    let includedDs: Awaited<ReturnType<typeof createTestDataSource>>;
+    let excludedDs: Awaited<ReturnType<typeof createTestDataSource>>;
+    let membersDs: Awaited<ReturnType<typeof createTestDataSource>>;
+    let sourceMap: Awaited<ReturnType<typeof createTestMap>>;
+    let copiedMap: Map;
+    let copiedViews: MapView[];
+
+    beforeAll(async () => {
+      sourceOrg = await createTestOrg(`Source Org ${uuidv4()}`);
+      targetOrg = await createTestOrg(`Target Org ${uuidv4()}`);
+
+      includedDs = await createTestDataSource(sourceOrg.id, "Included DS");
+      excludedDs = await createTestDataSource(sourceOrg.id, "Excluded DS");
+      membersDs = await createTestDataSource(sourceOrg.id, "Members DS");
+
+      sourceMap = await createTestMap(sourceOrg.id, "Test Map");
+      await updateMap(sourceMap.id, {
+        config: {
+          markerDataSourceIds: [includedDs.id, excludedDs.id],
+          membersDataSourceId: membersDs.id,
+          markerColors: {
+            [includedDs.id]: "#ff0000",
+            [excludedDs.id]: "#00ff00",
+          },
+          markerDisplayModes: {
+            [includedDs.id]: MarkerDisplayMode.Clusters,
+            [excludedDs.id]: MarkerDisplayMode.Heatmap,
+          },
+        },
+      });
+
+      // View referencing the included DS as areaDataSource, with both DS in dataSourceViews
+      await upsertMapView({
+        mapId: sourceMap.id,
+        name: "Included View",
+        position: 0,
+        config: {
+          areaDataSourceId: includedDs.id,
+          areaDataColumn: "Lab %",
+          mapStyleName: MapStyleName.Light,
+          showBoundaryOutline: true,
+          showLabels: true,
+          showLocations: true,
+          showMembers: true,
+          showTurf: true,
+          calculationType: CalculationType.Avg,
+        },
+        dataSourceViews: [
+          {
+            dataSourceId: includedDs.id,
+            filter: { type: FilterType.MULTI },
+            search: "",
+            sort: [],
+          },
+          {
+            dataSourceId: excludedDs.id,
+            filter: { type: FilterType.MULTI },
+            search: "",
+            sort: [],
+          },
+        ],
+      });
+
+      // View referencing only the excluded DS
+      await upsertMapView({
+        mapId: sourceMap.id,
+        name: "Excluded View",
+        position: 1,
+        config: {
+          areaDataSourceId: excludedDs.id,
+          areaDataColumn: "Con %",
+          mapStyleName: MapStyleName.Light,
+          showBoundaryOutline: true,
+          showLabels: true,
+          showLocations: true,
+          showMembers: true,
+          showTurf: true,
+          calculationType: CalculationType.Avg,
+        },
+        dataSourceViews: [],
+      });
+
+      // Run the copy — include only includedDs and membersDs
+      await copyMapsToOrganisation(
+        [
+          {
+            mapId: sourceMap.id,
+            dataSourceIds: [includedDs.id, membersDs.id],
+          },
+        ],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      copiedMap = targetMaps[0];
+      cleanup.mapIds.push(copiedMap.id);
+
+      // Track copied data source IDs for cleanup
+      for (const dsId of copiedMap.config.markerDataSourceIds) {
+        cleanup.dataSourceIds.push(dsId);
+      }
+      if (copiedMap.config.membersDataSourceId) {
+        cleanup.dataSourceIds.push(copiedMap.config.membersDataSourceId);
+      }
+
+      copiedViews = await findMapViewsByMapId(copiedMap.id);
+    });
+
+    test("creates exactly one map in the target org", async () => {
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(1);
+      expect(targetMaps[0].name).toBe("Test Map");
+    });
+
+    test("copies included data sources to target org", async () => {
+      for (const dsId of copiedMap.config.markerDataSourceIds) {
+        const ds = await findDataSourceById(dsId);
+        expect(ds?.organisationId).toBe(targetOrg.id);
+      }
+      if (copiedMap.config.membersDataSourceId) {
+        const ds = await findDataSourceById(
+          copiedMap.config.membersDataSourceId,
+        );
+        expect(ds?.organisationId).toBe(targetOrg.id);
+      }
+    });
+
+    test("only includes the selected marker data source (not the excluded one)", () => {
+      expect(copiedMap.config.markerDataSourceIds.length).toBe(1);
+    });
+
+    test("does not reference any original data source IDs anywhere in copied map", () => {
+      const originalDsIds = [includedDs.id, excludedDs.id, membersDs.id];
+
+      // Map config
+      for (const originalId of originalDsIds) {
+        expect(copiedMap.config.markerDataSourceIds).not.toContain(originalId);
+        expect(copiedMap.config.membersDataSourceId).not.toBe(originalId);
+      }
+
+      // Config keyed records
+      if (copiedMap.config.markerColors) {
+        for (const originalId of originalDsIds) {
+          expect(copiedMap.config.markerColors).not.toHaveProperty(originalId);
+        }
+      }
+      if (copiedMap.config.markerDisplayModes) {
+        for (const originalId of originalDsIds) {
+          expect(copiedMap.config.markerDisplayModes).not.toHaveProperty(
+            originalId,
+          );
+        }
+      }
+
+      // Views
+      for (const view of copiedViews) {
+        expect(originalDsIds).not.toContain(view.config.areaDataSourceId);
+        for (const dsv of view.dataSourceViews) {
+          expect(originalDsIds).not.toContain(dsv.dataSourceId);
+        }
+      }
+    });
+
+    test("remaps markerColors only for included data sources", () => {
+      const markerColors = copiedMap.config.markerColors;
+      expect(markerColors).toBeDefined();
+      if (!markerColors) return;
+
+      const colorKeys = Object.keys(markerColors);
+      expect(colorKeys.length).toBe(1);
+
+      const copiedIncludedDsId = copiedMap.config.markerDataSourceIds[0];
+      expect(markerColors[copiedIncludedDsId]).toBe("#ff0000");
+    });
+
+    test("remaps markerDisplayModes only for included data sources", () => {
+      const displayModes = copiedMap.config.markerDisplayModes;
+      expect(displayModes).toBeDefined();
+      if (!displayModes) return;
+
+      const modeKeys = Object.keys(displayModes);
+      expect(modeKeys.length).toBe(1);
+    });
+
+    test("drops views whose areaDataSourceId was not included", () => {
+      // Source had 2 views; only the one referencing includedDs should be copied
+      expect(copiedViews.length).toBe(1);
+      expect(copiedViews[0].name).toBe("Included View");
+    });
+
+    test("strips excluded data source views from copied views", () => {
+      const view = copiedViews[0];
+      // Original had 2 dataSourceViews (included + excluded); copy should have 1
+      expect(view.dataSourceViews.length).toBe(1);
+      expect(view.dataSourceViews[0].dataSourceId).not.toBe(includedDs.id);
+      expect(view.dataSourceViews[0].dataSourceId).not.toBe(excludedDs.id);
+    });
+
+    test("enqueues an importDataSource job for each copied data source", async () => {
+      const copiedDsIds = [...copiedMap.config.markerDataSourceIds];
+      if (copiedMap.config.membersDataSourceId) {
+        copiedDsIds.push(copiedMap.config.membersDataSourceId);
+      }
+      expect(copiedDsIds.length).toBeGreaterThan(0);
+      for (const dsId of copiedDsIds) {
+        const jobInfo = await getJobInfo(dsId, "importDataSource");
+        expect(jobInfo.status).not.toBe(JobStatus.None);
+      }
+    });
+
+    test("remaining data source view references a data source in the target org", async () => {
+      const ds = await findDataSourceById(
+        copiedViews[0].dataSourceViews[0].dataSourceId,
+      );
+      expect(ds?.organisationId).toBe(targetOrg.id);
+    });
+  });
+
+  describe("with members DS excluded", () => {
+    test("sets membersDataSourceId to null", async () => {
+      const sourceOrg = await createTestOrg(`MembersExcl Source ${uuidv4()}`);
+      const targetOrg = await createTestOrg(`MembersExcl Target ${uuidv4()}`);
+
+      const includedDs = await createTestDataSource(sourceOrg.id, "Marker DS");
+      const membersDs = await createTestDataSource(sourceOrg.id, "Members DS");
+
+      const sourceMap = await createTestMap(sourceOrg.id, "Map With Members");
+      await updateMap(sourceMap.id, {
+        config: {
+          markerDataSourceIds: [includedDs.id],
+          membersDataSourceId: membersDs.id,
+        },
+      });
+
+      // Copy with only the marker DS, not the members DS
+      await copyMapsToOrganisation(
+        [{ mapId: sourceMap.id, dataSourceIds: [includedDs.id] }],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(1);
+      cleanup.mapIds.push(targetMaps[0].id);
+
+      expect(targetMaps[0].config.membersDataSourceId).toBeNull();
+      expect(targetMaps[0].config.markerDataSourceIds.length).toBe(1);
+
+      for (const dsId of targetMaps[0].config.markerDataSourceIds) {
+        cleanup.dataSourceIds.push(dsId);
+      }
+    });
+  });
+
+  describe("with empty dataSourceIds", () => {
+    test("copies map with no data sources and no views", async () => {
+      const sourceOrg = await createTestOrg(`Empty Source ${uuidv4()}`);
+      const targetOrg = await createTestOrg(`Empty Target ${uuidv4()}`);
+
+      const ds = await createTestDataSource(sourceOrg.id, "Some DS");
+      const sourceMap = await createTestMap(sourceOrg.id, "Map Empty Copy");
+      await updateMap(sourceMap.id, {
+        config: {
+          markerDataSourceIds: [ds.id],
+          membersDataSourceId: null,
+        },
+      });
+
+      await upsertMapView({
+        mapId: sourceMap.id,
+        name: "View",
+        position: 0,
+        config: {
+          areaDataSourceId: ds.id,
+          areaDataColumn: "Lab %",
+          mapStyleName: MapStyleName.Light,
+          showBoundaryOutline: true,
+          showLabels: true,
+          showLocations: true,
+          showMembers: true,
+          showTurf: true,
+          calculationType: CalculationType.Avg,
+        },
+        dataSourceViews: [],
+      });
+
+      await copyMapsToOrganisation(
+        [{ mapId: sourceMap.id, dataSourceIds: [] }],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(1);
+      cleanup.mapIds.push(targetMaps[0].id);
+
+      expect(targetMaps[0].config.markerDataSourceIds).toEqual([]);
+      expect(targetMaps[0].config.membersDataSourceId).toBeNull();
+
+      const views = await findMapViewsByMapId(targetMaps[0].id);
+      expect(views.length).toBe(0);
+    });
+  });
+
+  describe("with a data source shared across multiple maps", () => {
+    test("copies the shared data source only once and reuses the copy", async () => {
+      const sourceOrg = await createTestOrg(`Shared Source ${uuidv4()}`);
+      const targetOrg = await createTestOrg(`Shared Target ${uuidv4()}`);
+
+      const sharedDs = await createTestDataSource(sourceOrg.id, "Shared DS");
+
+      const sourceMapA = await createTestMap(sourceOrg.id, "Map A");
+      const sourceMapB = await createTestMap(sourceOrg.id, "Map B");
+      await updateMap(sourceMapA.id, {
+        config: {
+          markerDataSourceIds: [sharedDs.id],
+          membersDataSourceId: null,
+        },
+      });
+      await updateMap(sourceMapB.id, {
+        config: {
+          markerDataSourceIds: [sharedDs.id],
+          membersDataSourceId: null,
+        },
+      });
+
+      await copyMapsToOrganisation(
+        [
+          { mapId: sourceMapA.id, dataSourceIds: [sharedDs.id] },
+          { mapId: sourceMapB.id, dataSourceIds: [sharedDs.id] },
+        ],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(2);
+      for (const m of targetMaps) {
+        cleanup.mapIds.push(m.id);
+      }
+
+      const [copiedA] = targetMaps.filter((m) => m.name === "Map A");
+      const [copiedB] = targetMaps.filter((m) => m.name === "Map B");
+      expect(copiedA.config.markerDataSourceIds.length).toBe(1);
+      expect(copiedB.config.markerDataSourceIds.length).toBe(1);
+
+      const copiedDsIdA = copiedA.config.markerDataSourceIds[0];
+      const copiedDsIdB = copiedB.config.markerDataSourceIds[0];
+      expect(copiedDsIdA).toBe(copiedDsIdB);
+      cleanup.dataSourceIds.push(copiedDsIdA);
+
+      const copiedDs = await findDataSourceById(copiedDsIdA);
+      expect(copiedDs?.organisationId).toBe(targetOrg.id);
+      expect(copiedDs?.name).toBe("Shared DS");
+
+      const jobInfo = await getJobInfo(copiedDsIdA, "importDataSource");
+      expect(jobInfo.status).not.toBe(JobStatus.None);
+    });
+  });
+
+  describe("with data source not referenced by map", () => {
+    test("does not copy a data source that the source map does not reference", async () => {
+      const sourceOrg = await createTestOrg(`Unrelated Source ${uuidv4()}`);
+      const otherOrg = await createTestOrg(`Unrelated Other ${uuidv4()}`);
+      const targetOrg = await createTestOrg(`Unrelated Target ${uuidv4()}`);
+
+      const mapDs = await createTestDataSource(sourceOrg.id, "Map DS");
+      // A data source the caller should NOT be able to smuggle in
+      const unrelatedDs = await createTestDataSource(
+        otherOrg.id,
+        "Unrelated DS",
+      );
+
+      const sourceMap = await createTestMap(sourceOrg.id, "Protected Map");
+      await updateMap(sourceMap.id, {
+        config: {
+          markerDataSourceIds: [mapDs.id],
+          membersDataSourceId: null,
+        },
+      });
+
+      await copyMapsToOrganisation(
+        [
+          {
+            mapId: sourceMap.id,
+            dataSourceIds: [mapDs.id, unrelatedDs.id],
+          },
+        ],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(1);
+      cleanup.mapIds.push(targetMaps[0].id);
+
+      // The referenced DS was copied
+      expect(targetMaps[0].config.markerDataSourceIds.length).toBe(1);
+      const copiedDsId = targetMaps[0].config.markerDataSourceIds[0];
+      cleanup.dataSourceIds.push(copiedDsId);
+
+      // No other data source from either org was copied to target
+      const copiedDs = await findDataSourceById(copiedDsId);
+      expect(copiedDs?.name).toBe("Map DS");
+
+      // The unrelated DS should still belong to its original org only —
+      // nothing in the target org should reference it or a copy of it
+      const unrelated = await findDataSourceById(unrelatedDs.id);
+      expect(unrelated?.organisationId).toBe(otherOrg.id);
+    });
+  });
+
+  describe("with non-existent IDs", () => {
+    test("skips non-existent maps gracefully", async () => {
+      const targetOrg = await createTestOrg(`FakeMap Target ${uuidv4()}`);
+
+      await copyMapsToOrganisation(
+        [{ mapId: uuidv4(), dataSourceIds: ["fake-ds-id"] }],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(0);
+    });
+
+    test("skips non-existent data sources gracefully", async () => {
+      const sourceOrg = await createTestOrg(`FakeDS Source ${uuidv4()}`);
+      const targetOrg = await createTestOrg(`FakeDS Target ${uuidv4()}`);
+
+      const sourceMap = await createTestMap(sourceOrg.id, "Map Fake DS");
+
+      await copyMapsToOrganisation(
+        [{ mapId: sourceMap.id, dataSourceIds: [uuidv4()] }],
+        targetOrg.id,
+      );
+
+      const targetMaps = await findMapsByOrganisationId(targetOrg.id);
+      expect(targetMaps.length).toBe(1);
+      cleanup.mapIds.push(targetMaps[0].id);
+
+      expect(targetMaps[0].config.markerDataSourceIds).toEqual([]);
+      expect(targetMaps[0].config.membersDataSourceId).toBeNull();
+    });
+  });
+
+  afterAll(async () => {
+    for (const id of cleanup.mapIds) {
+      try {
+        await deleteMap(id);
+      } catch {
+        // already deleted
+      }
+    }
+    for (const id of cleanup.dataSourceIds) {
+      try {
+        await deleteDataSource(id);
+      } catch {
+        // already deleted
+      }
+    }
+  });
+});
diff --git a/tests/unit/server/trpc/routers/invitation.test.ts b/tests/unit/server/trpc/routers/invitation.test.ts
new file mode 100644
index 000000000..70ac99776
--- /dev/null
+++ b/tests/unit/server/trpc/routers/invitation.test.ts
@@ -0,0 +1,240 @@
+import { v4 as uuidv4 } from "uuid";
+import { afterAll, describe, expect, test } from "vitest";
+import {
+  DataSourceRecordType,
+  DataSourceType,
+  GeocodingType,
+} from "@/models/DataSource";
+import { UserRole } from "@/models/User";
+import {
+  createDataSource,
+  deleteDataSource,
+  findDataSourceById,
+} from "@/server/repositories/DataSource";
+import { findPendingInvitationsByEmail } from "@/server/repositories/Invitation";
+import {
+  createMap,
+  deleteMap,
+  findMapsByOrganisationId,
+  updateMap,
+} from "@/server/repositories/Map";
+import { findMapViewsByMapId } from "@/server/repositories/MapView";
+import { upsertOrganisation } from "@/server/repositories/Organisation";
+import {
+  deleteUser,
+  findUserById,
+  updateUserRole,
+  upsertUser,
+} from "@/server/repositories/User";
+import { invitationRouter } from "@/server/trpc/routers/invitation";
+
+const userIds: string[] = [];
+const mapIds: string[] = [];
+const dataSourceIds: string[] = [];
+
+async function createTestUser(role?: UserRole | null) {
+  const user = await upsertUser({
+    email: `test-${uuidv4()}@example.com`,
+    password: "test-password-123",
+    name: "Test User",
+    avatarUrl: null,
+  });
+  userIds.push(user.id);
+  if (role) {
+    await updateUserRole(user.id, role);
+    const updated = await findUserById(user.id);
+    if (!updated) throw new Error("User not found after role update");
+    return updated;
+  }
+  return user;
+}
+
+function makeCaller(user: Awaited<ReturnType<typeof createTestUser>> | null) {
+  return invitationRouter.createCaller({ user, ip: "127.0.0.1" });
+}
+
+describe("invitation.list", () => {
+  test("superadmin can list invitations", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const caller = makeCaller(superadmin);
+
+    const result = await caller.list();
+    expect(Array.isArray(result)).toBe(true);
+  });
+
+  test("advocate can list invitations", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(advocate);
+
+    const result = await caller.list();
+    expect(Array.isArray(result)).toBe(true);
+  });
+
+  test("regular user cannot list invitations", async () => {
+    const regular = await createTestUser();
+    const caller = makeCaller(regular);
+
+    await expect(caller.list()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+
+  test("unauthenticated user cannot list invitations", async () => {
+    const caller = makeCaller(null);
+
+    await expect(caller.list()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+});
+
+describe("invitation.create", () => {
+  test("advocate can create an invitation with a new organisation", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(advocate);
+
+    const email = `invitee-${uuidv4()}@example.com`;
+    await caller.create({
+      name: "Invitee",
+      email,
+      organisationName: `New Org ${uuidv4()}`,
+    });
+
+    const pending = await findPendingInvitationsByEmail(email);
+    expect(pending.length).toBe(1);
+    expect(pending[0].name).toBe("Invitee");
+  });
+
+  test("superadmin can create an invitation with a new organisation", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const caller = makeCaller(superadmin);
+
+    const email = `invitee-${uuidv4()}@example.com`;
+    await caller.create({
+      name: "Invitee",
+      email,
+      organisationName: `New Org ${uuidv4()}`,
+    });
+
+    const pending = await findPendingInvitationsByEmail(email);
+    expect(pending.length).toBe(1);
+  });
+
+  test("advocate can create an invitation with mapSelections (copies the map + DS)", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(advocate);
+
+    const sourceOrg = await upsertOrganisation({
+      name: `Src Org ${uuidv4()}`,
+    });
+    const sourceDs = await createDataSource({
+      name: "Src DS",
+      organisationId: sourceOrg.id,
+      autoEnrich: false,
+      autoImport: false,
+      config: {
+        type: DataSourceType.CSV,
+        url: `file://tests/resources/stats.csv?${uuidv4()}`,
+      },
+      columnDefs: [],
+      columnMetadata: [],
+      columnRoles: { nameColumns: ["Name"] },
+      enrichments: [],
+      geocodingConfig: { type: GeocodingType.None },
+      public: false,
+      recordType: DataSourceRecordType.Data,
+    });
+    dataSourceIds.push(sourceDs.id);
+
+    const sourceMap = await createMap(sourceOrg.id, "Map To Copy");
+    mapIds.push(sourceMap.id);
+    await updateMap(sourceMap.id, {
+      config: {
+        markerDataSourceIds: [sourceDs.id],
+        membersDataSourceId: null,
+      },
+    });
+
+    const email = `invitee-${uuidv4()}@example.com`;
+    const targetOrgName = `Target Org ${uuidv4()}`;
+    await caller.create({
+      name: "Invitee",
+      email,
+      organisationName: targetOrgName,
+      mapSelections: [{ mapId: sourceMap.id, dataSourceIds: [sourceDs.id] }],
+    });
+
+    const pending = await findPendingInvitationsByEmail(email);
+    expect(pending.length).toBe(1);
+    const targetOrgId = pending[0].organisationId;
+    expect(targetOrgId).toBeTruthy();
+    if (!targetOrgId) return;
+
+    const targetMaps = await findMapsByOrganisationId(targetOrgId);
+    expect(targetMaps.length).toBe(1);
+    expect(targetMaps[0].name).toBe("Map To Copy");
+    mapIds.push(targetMaps[0].id);
+
+    const copiedDsIds = targetMaps[0].config.markerDataSourceIds;
+    expect(copiedDsIds.length).toBe(1);
+    expect(copiedDsIds[0]).not.toBe(sourceDs.id);
+    dataSourceIds.push(copiedDsIds[0]);
+
+    const copiedDs = await findDataSourceById(copiedDsIds[0]);
+    expect(copiedDs?.organisationId).toBe(targetOrgId);
+
+    // ensureOrganisationMap would have created an additional default map —
+    // confirm only the copied map exists in the new org
+    const views = await findMapViewsByMapId(targetMaps[0].id);
+    expect(Array.isArray(views)).toBe(true);
+  });
+
+  test("regular user cannot create invitations", async () => {
+    const regular = await createTestUser();
+    const caller = makeCaller(regular);
+
+    await expect(
+      caller.create({
+        name: "Test",
+        email: "test@example.com",
+        organisationName: "Test Org",
+      }),
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+
+  test("unauthenticated user cannot create invitations", async () => {
+    const caller = makeCaller(null);
+
+    await expect(
+      caller.create({
+        name: "Test",
+        email: "test@example.com",
+        organisationName: "Test Org",
+      }),
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+});
+
+afterAll(async () => {
+  for (const id of mapIds) {
+    try {
+      await deleteMap(id);
+    } catch {
+      // already deleted
+    }
+  }
+  for (const id of dataSourceIds) {
+    try {
+      await deleteDataSource(id);
+    } catch {
+      // already deleted
+    }
+  }
+  for (const id of userIds) {
+    try {
+      await deleteUser(id);
+    } catch {
+      // already deleted
+    }
+  }
+});
diff --git a/tests/unit/server/trpc/routers/map.test.ts b/tests/unit/server/trpc/routers/map.test.ts
new file mode 100644
index 000000000..0a4e0b370
--- /dev/null
+++ b/tests/unit/server/trpc/routers/map.test.ts
@@ -0,0 +1,141 @@
+import { v4 as uuidv4 } from "uuid";
+import { afterAll, describe, expect, test } from "vitest";
+import {
+  DataSourceRecordType,
+  DataSourceType,
+  GeocodingType,
+} from "@/models/DataSource";
+import { UserRole } from "@/models/User";
+import {
+  createDataSource,
+  deleteDataSource,
+} from "@/server/repositories/DataSource";
+import { createMap, deleteMap, updateMap } from "@/server/repositories/Map";
+import { upsertOrganisation } from "@/server/repositories/Organisation";
+import {
+  deleteUser,
+  findUserById,
+  updateUserRole,
+  upsertUser,
+} from "@/server/repositories/User";
+import { mapRouter } from "@/server/trpc/routers/map";
+
+const userIds: string[] = [];
+const mapIds: string[] = [];
+const dataSourceIds: string[] = [];
+
+async function createTestUser(role?: UserRole | null) {
+  const user = await upsertUser({
+    email: `test-${uuidv4()}@example.com`,
+    password: "test-password-123",
+    name: "Test User",
+    avatarUrl: null,
+  });
+  userIds.push(user.id);
+  if (role) {
+    await updateUserRole(user.id, role);
+    const updated = await findUserById(user.id);
+    if (!updated) throw new Error("User not found after role update");
+    return updated;
+  }
+  return user;
+}
+
+function makeCaller(user: Awaited<ReturnType<typeof createTestUser>> | null) {
+  return mapRouter.createCaller({ user, ip: "127.0.0.1" });
+}
+
+describe("map.listAll", () => {
+  test("regular user cannot list all maps", async () => {
+    const regular = await createTestUser();
+    const caller = makeCaller(regular);
+
+    await expect(caller.listAll()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+
+  test("unauthenticated user cannot list all maps", async () => {
+    const caller = makeCaller(null);
+
+    await expect(caller.listAll()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+
+  test("advocate can list all maps and response includes views and dataSourceNames", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(advocate);
+
+    const org = await upsertOrganisation({ name: `ListAll Org ${uuidv4()}` });
+    const ds = await createDataSource({
+      name: `Marker DS ${uuidv4()}`,
+      organisationId: org.id,
+      autoEnrich: false,
+      autoImport: false,
+      config: {
+        type: DataSourceType.CSV,
+        url: `file://tests/resources/stats.csv?${uuidv4()}`,
+      },
+      columnDefs: [],
+      columnMetadata: [],
+      columnRoles: { nameColumns: ["Name"] },
+      enrichments: [],
+      geocodingConfig: { type: GeocodingType.None },
+      public: false,
+      recordType: DataSourceRecordType.Data,
+    });
+    dataSourceIds.push(ds.id);
+
+    const map = await createMap(org.id, `ListAll Map ${uuidv4()}`);
+    mapIds.push(map.id);
+    await updateMap(map.id, {
+      config: {
+        markerDataSourceIds: [ds.id],
+        membersDataSourceId: null,
+      },
+    });
+
+    const result = await caller.listAll();
+    expect(Array.isArray(result.maps)).toBe(true);
+    const ours = result.maps.find((m) => m.id === map.id);
+    expect(ours).toBeDefined();
+    if (!ours) return;
+    expect(Array.isArray(ours.views)).toBe(true);
+    expect(ours.config.markerDataSourceIds).toContain(ds.id);
+    expect(result.dataSourceNames[ds.id]).toBe(ds.name);
+  });
+
+  test("superadmin can list all maps", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const caller = makeCaller(superadmin);
+
+    const result = await caller.listAll();
+    expect(Array.isArray(result.maps)).toBe(true);
+    expect(typeof result.dataSourceNames).toBe("object");
+  });
+});
+
+afterAll(async () => {
+  for (const id of mapIds) {
+    try {
+      await deleteMap(id);
+    } catch {
+      // already deleted
+    }
+  }
+  for (const id of dataSourceIds) {
+    try {
+      await deleteDataSource(id);
+    } catch {
+      // already deleted
+    }
+  }
+  for (const id of userIds) {
+    try {
+      await deleteUser(id);
+    } catch {
+      // already deleted
+    }
+  }
+});
diff --git a/tests/unit/server/trpc/routers/user.test.ts b/tests/unit/server/trpc/routers/user.test.ts
new file mode 100644
index 000000000..fdfaa900d
--- /dev/null
+++ b/tests/unit/server/trpc/routers/user.test.ts
@@ -0,0 +1,138 @@
+import { v4 as uuidv4 } from "uuid";
+import { afterAll, describe, expect, test } from "vitest";
+import { UserRole } from "@/models/User";
+import {
+  deleteUser,
+  findUserById,
+  updateUserRole,
+  upsertUser,
+} from "@/server/repositories/User";
+import { userRouter } from "@/server/trpc/routers/user";
+
+const userIds: string[] = [];
+
+async function createTestUser(role?: UserRole | null) {
+  const user = await upsertUser({
+    email: `test-${uuidv4()}@example.com`,
+    password: "test-password-123",
+    name: "Test User",
+    avatarUrl: null,
+  });
+  userIds.push(user.id);
+  if (role) {
+    await updateUserRole(user.id, role);
+    const updated = await findUserById(user.id);
+    if (!updated) throw new Error("User not found after role update");
+    return updated;
+  }
+  return user;
+}
+
+function makeCaller(user: Awaited<ReturnType<typeof createTestUser>> | null) {
+  return userRouter.createCaller({ user, ip: "127.0.0.1" });
+}
+
+describe("user.updateRole", () => {
+  test("superadmin can set a user's role to Advocate", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const target = await createTestUser();
+    const caller = makeCaller(superadmin);
+
+    await caller.updateRole({ userId: target.id, role: UserRole.Advocate });
+
+    const users = await caller.list();
+    const updated = users.find((u) => u.id === target.id);
+    expect(updated?.role).toBe(UserRole.Advocate);
+  });
+
+  test("superadmin can set a user's role to Superadmin", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const target = await createTestUser();
+    const caller = makeCaller(superadmin);
+
+    await caller.updateRole({ userId: target.id, role: UserRole.Superadmin });
+
+    const users = await caller.list();
+    const updated = users.find((u) => u.id === target.id);
+    expect(updated?.role).toBe(UserRole.Superadmin);
+  });
+
+  test("superadmin can clear a user's role to null", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const target = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(superadmin);
+
+    await caller.updateRole({ userId: target.id, role: null });
+
+    const users = await caller.list();
+    const updated = users.find((u) => u.id === target.id);
+    expect(updated?.role).toBeNull();
+  });
+
+  test("advocate cannot update roles", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const target = await createTestUser();
+    const caller = makeCaller(advocate);
+
+    await expect(
+      caller.updateRole({ userId: target.id, role: UserRole.Advocate }),
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+
+  test("regular user cannot update roles", async () => {
+    const regular = await createTestUser();
+    const target = await createTestUser();
+    const caller = makeCaller(regular);
+
+    await expect(
+      caller.updateRole({ userId: target.id, role: UserRole.Advocate }),
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+
+  test("unauthenticated user cannot update roles", async () => {
+    const target = await createTestUser();
+    const caller = makeCaller(null);
+
+    await expect(
+      caller.updateRole({ userId: target.id, role: UserRole.Advocate }),
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+});
+
+describe("user.list", () => {
+  test("superadmin can list users", async () => {
+    const superadmin = await createTestUser(UserRole.Superadmin);
+    const caller = makeCaller(superadmin);
+
+    const users = await caller.list();
+    expect(Array.isArray(users)).toBe(true);
+  });
+
+  test("advocate cannot list users", async () => {
+    const advocate = await createTestUser(UserRole.Advocate);
+    const caller = makeCaller(advocate);
+
+    await expect(caller.list()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+
+  test("regular user cannot list users", async () => {
+    const regular = await createTestUser();
+    const caller = makeCaller(regular);
+
+    await expect(caller.list()).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+    });
+  });
+});
+
+afterAll(async () => {
+  for (const id of userIds) {
+    try {
+      await deleteUser(id);
+    } catch {
+      // already deleted
+    }
+  }
+});