feat: add api for patching custom org roles (#13357)

* chore: implement patching custom organization roles

enterprise/coderd/coderd.go

@@ -327,22 +327,6 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 			})
 		})
 
-		r.Route("/users/roles", func(r chi.Router) {
-			r.Use(
-				apiKeyMiddleware,
-			)
-			r.Group(func(r chi.Router) {
-				r.Use(
-					api.customRolesEnabledMW,
-				)
-				r.Patch("/", api.patchRole)
-			})
-			// Unfortunate, but this r.Route overrides the AGPL roles route.
-			// The AGPL does not have the entitlements to block the licensed
-			// routes, so we need to duplicate the AGPL here.
-			r.Get("/", api.AGPL.AssignableSiteRoles)
-		})
-
 		r.Route("/users/{user}/quiet-hours", func(r chi.Router) {
 			r.Use(
 				api.autostopRequirementEnabledMW,
@@ -761,6 +745,11 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 		api.AGPL.PortSharer.Store(&ps)
 	}
 
+	if initial, changed, enabled := featureChanged(codersdk.FeatureCustomRoles); shouldUpdate(initial, changed, enabled) {
+		var handler coderd.CustomRoleHandler = &enterpriseCustomRoleHandler{Enabled: enabled}
+		api.AGPL.CustomRoleHandler.Store(&handler)
+	}
+
 	// External token encryption is soft-enforced
 	featureExternalTokenEncryption := entitlements.Features[codersdk.FeatureExternalTokenEncryption]
 	featureExternalTokenEncryption.Enabled = len(api.ExternalTokenEncryption) > 0