Method SetOrganizationMemberUsergroupRole

admin/server/usergroups.go:324–367

(ctx context.Context, req *adminv1.SetOrganizationMemberUsergroupRoleRequest)

}

func (s *Server) SetOrganizationMemberUsergroupRole(ctx context.Context, req *adminv1.SetOrganizationMemberUsergroupRoleRequest) (*adminv1.SetOrganizationMemberUsergroupRoleResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.org", req.Org),
		attribute.String("args.usergroup", req.Usergroup),
		attribute.String("args.role", req.Role),
	)

	usergroup, err := s.admin.DB.FindUsergroupByName(ctx, req.Org, req.Usergroup)
	if err != nil {
		return nil, err
	}

	claims := auth.GetClaims(ctx)
	if !claims.OrganizationPermissions(ctx, usergroup.OrgID).ManageOrgMembers {
		return nil, status.Error(codes.PermissionDenied, "not allowed to set org user group role")
	}

	if usergroup.Managed {
		return nil, status.Error(codes.FailedPrecondition, "cannot edit managed user group")
	}

	role, err := s.admin.DB.FindOrganizationRole(ctx, req.Role)
	if err != nil {
		return nil, err
	}
	if role.Admin && !claims.OrganizationPermissions(ctx, usergroup.OrgID).ManageOrgAdmins {
		return nil, status.Error(codes.PermissionDenied, "as a non-admin you are not allowed to assign an admin role")
	}

	currentRole, err := s.admin.DB.FindOrganizationMemberUsergroupRole(ctx, usergroup.ID, usergroup.OrgID)
	if err != nil && !errors.Is(err, database.ErrNotFound) {
		return nil, err
	}
	if currentRole != nil && currentRole.Admin && !claims.OrganizationPermissions(ctx, usergroup.OrgID).ManageOrgAdmins {
		return nil, status.Error(codes.PermissionDenied, "as a non-admin you are not allowed to remove an admin role")
	}

	err = s.admin.DB.UpdateOrganizationMemberUsergroup(ctx, usergroup.ID, usergroup.OrgID, role.ID)
	if err != nil {
		return nil, err
	}

	return &adminv1.SetOrganizationMemberUsergroupRoleResponse{}, nil
}

func (s *Server) RemoveOrganizationMemberUsergroup(ctx context.Context, req *adminv1.RemoveOrganizationMemberUsergroupRequest) (*adminv1.RemoveOrganizationMemberUsergroupResponse, error) {
	observability.AddRequestAttributes(ctx,