Method UpdateCustomRole

coderd/database/dbauthz/dbauthz.go:6812–6861

(ctx context.Context, arg database.UpdateCustomRoleParams)

}

func (q *querier) UpdateCustomRole(ctx context.Context, arg database.UpdateCustomRoleParams) (database.CustomRole, error) {
	if !arg.OrganizationID.Valid || arg.OrganizationID.UUID == uuid.Nil {
		return database.CustomRole{}, NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")}
	}

	rbacObj := rbac.ResourceAssignOrgRole.InOrg(arg.OrganizationID.UUID)

	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbacObj); err != nil {
		return database.CustomRole{}, err
	}

	existing, err := database.ExpectOne(q.db.CustomRoles(ctx, database.CustomRolesParams{
		LookupRoles: []database.NameOrganizationPair{
			{
				Name:           arg.Name,
				OrganizationID: arg.OrganizationID.UUID,
			},
		},
		ExcludeOrgRoles:    false,
		OrganizationID:     uuid.Nil,
		IncludeSystemRoles: true,
	}))
	if err != nil {
		return database.CustomRole{}, err
	}

	if existing.IsSystem {
		err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem)
		if err != nil {
			return database.CustomRole{}, err
		}
	}

	if err := q.customRoleCheck(ctx, database.CustomRole{
		Name:              arg.Name,
		DisplayName:       arg.DisplayName,
		SitePermissions:   arg.SitePermissions,
		OrgPermissions:    arg.OrgPermissions,
		UserPermissions:   arg.UserPermissions,
		MemberPermissions: arg.MemberPermissions,
		CreatedAt:         time.Now(),
		UpdatedAt:         time.Now(),
		OrganizationID:    arg.OrganizationID,
		ID:                uuid.New(),
		IsSystem:          existing.IsSystem,
	}, policy.ActionUpdate); err != nil {
		return database.CustomRole{}, err
	}
	return q.db.UpdateCustomRole(ctx, arg)
}

func (q *querier) UpdateEncryptedAIProviderKey(ctx context.Context, arg database.UpdateEncryptedAIProviderKeyParams) (database.AIProviderKey, error) {
	// Encrypted columns can be rewritten on any row, including those