feat: Add rbac to templateversion+orgmember endpoints (#1713)

coderd/members.go

@@ -17,27 +17,29 @@ import (
 )
 
 func (api *api) putMemberRoles(rw http.ResponseWriter, r *http.Request) {
-	// User is the user to modify
-	// TODO: Until rbac authorize is implemented, only be able to change your
-	//	own roles. This also means you can grant yourself whatever roles you want.
 	user := httpmw.UserParam(r)
-	apiKey := httpmw.APIKey(r)
 	organization := httpmw.OrganizationParam(r)
-	// TODO: @emyrk add proper `Authorize()` check here instead of a uuid match.
-	//	Proper authorize should check the granted roles are able to given within
-	//	the selected organization. Until then, allow anarchy
-	if apiKey.UserID != user.ID {
-		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
-			Message: "modifying other users is not supported at this time",
-		})
-		return
-	}
+	member := httpmw.OrganizationMemberParam(r)
 
 	var params codersdk.UpdateRoles
 	if !httpapi.Read(rw, r, &params) {
 		return
 	}
 
+	added, removed := rbac.ChangeRoleSet(member.Roles, params.Roles)
+	for _, roleName := range added {
+		// Assigning a role requires the create permission.
+		if !api.Authorize(rw, r, rbac.ActionCreate, rbac.ResourceOrgRoleAssignment.WithID(roleName).InOrg(organization.ID)) {
+			return
+		}
+	}
+	for _, roleName := range removed {
+		// Removing a role requires the delete permission.
+		if !api.Authorize(rw, r, rbac.ActionDelete, rbac.ResourceOrgRoleAssignment.WithID(roleName).InOrg(organization.ID)) {
+			return
+		}
+	}
+
 	updatedUser, err := api.updateOrganizationMemberRoles(r.Context(), database.UpdateMemberRolesParams{
 		GrantedRoles: params.Roles,
 		UserID:       user.ID,