Method UpdateMemberRoles

coderd/database/dbauthz/dbauthz.go:6944–6979

(ctx context.Context, arg database.UpdateMemberRolesParams)

}

func (q *querier) UpdateMemberRoles(ctx context.Context, arg database.UpdateMemberRolesParams) (database.OrganizationMember, error) {
	// Authorized fetch will check that the actor has read access to the org member since the org member is returned.
	member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
		OrganizationID: arg.OrgID,
		UserID:         arg.UserID,
		IncludeSystem:  false,
		GithubUserID:   0,
	}))
	if err != nil {
		return database.OrganizationMember{}, err
	}

	originalRoles, err := q.convertToOrganizationRoles(member.OrganizationMember.OrganizationID, member.OrganizationMember.Roles)
	if err != nil {
		return database.OrganizationMember{}, xerrors.Errorf("convert original roles: %w", err)
	}

	// The 'rbac' package expects role names to be scoped.
	// Convert the argument roles for validation.
	scopedGranted, err := q.convertToOrganizationRoles(arg.OrgID, arg.GrantedRoles)
	if err != nil {
		return database.OrganizationMember{}, err
	}

	// The org member role is always implied.
	//nolint:gocritic
	impliedTypes := append(scopedGranted, rbac.ScopedRoleOrgMember(arg.OrgID))

	added, removed := rbac.ChangeRoleSet(originalRoles, impliedTypes)
	err = q.canAssignRoles(ctx, arg.OrgID, added, removed)
	if err != nil {
		return database.OrganizationMember{}, err
	}

	return q.db.UpdateMemberRoles(ctx, arg)
}

func (q *querier) UpdateMemoryResourceMonitor(ctx context.Context, arg database.UpdateMemoryResourceMonitorParams) error {
	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {