Fix edit org member check

Looks like the resource needs to be organization_member, not user. Also we were not passing through the edit permission to the edit and delete buttons.
coder · code-asher · Aug 6, 2024 · Jul 30, 2024 · Jul 30, 2024 · Jul 30, 2024
commit 2a8c38b6d188268465e355057ec2005973a6776a
diff --git a/site/src/api/queries/organizations.ts b/site/src/api/queries/organizations.ts
@@ -122,16 +122,16 @@ export const organizationPermissions = (organizationId: string | undefined) => {
     queryFn: () =>
       API.checkAuthorization({
         checks: {
-          viewUsers: {
+          viewMembers: {
             object: {
-              resource_type: "user",
+              resource_type: "organization_member",
               organization_id: organizationId,
             },
             action: "read",
           },
-          editUsers: {
+          editMembers: {
             object: {
-              resource_type: "user",
+              resource_type: "organization_member",
               organization_id: organizationId,
             },
             action: "update",

diff --git a/site/src/pages/ManagementSettingsPage/OrganizationMembersPage.tsx b/site/src/pages/ManagementSettingsPage/OrganizationMembersPage.tsx
@@ -84,7 +84,7 @@ const OrganizationMembersPage: FC = () => {
       <Stack>
         {Boolean(error) && <ErrorAlert error={error} />}
 
-        {permissions.editUsers && (
+        {permissions.editMembers && (
           <AddOrganizationMember
             isLoading={addMemberMutation.isLoading}
             onSubmit={async (user) => {
@@ -129,7 +129,7 @@ const OrganizationMembersPage: FC = () => {
                     allAvailableRoles={organizationRolesQuery.data}
                     oidcRoleSyncEnabled={false}
                     isLoading={updateMemberRolesMutation.isLoading}
-                    canEditUsers
+                    canEditUsers={permissions.editMembers}
                     onEditRoles={async (newRoleNames) => {
                       try {
                         await updateMemberRolesMutation.mutateAsync({
@@ -145,7 +145,7 @@ const OrganizationMembersPage: FC = () => {
                     }}
                   />
                   <TableCell>
-                    {member.user_id !== me.id && (
+                    {member.user_id !== me.id && permissions.editMembers && (
                       <MoreMenu>
                         <MoreMenuTrigger>
                           <ThreeDotsButton />

diff --git a/site/src/pages/ManagementSettingsPage/OrganizationSettingsPage.tsx b/site/src/pages/ManagementSettingsPage/OrganizationSettingsPage.tsx
@@ -67,7 +67,7 @@ const OrganizationSettingsPage: FC = () => {
   //       shows on this page but disable the fields, although that could be
   //       confusing?
   if (!permissions.editOrganization) {
-    if (permissions.viewAllMembers) {
+    if (permissions.viewMembers) {
       return <Navigate to="members" replace />;
     } else if (permissions.viewGrousp) {
       return <Navigate to="groups" replace />;

diff --git a/site/src/pages/ManagementSettingsPage/Sidebar.tsx b/site/src/pages/ManagementSettingsPage/Sidebar.tsx
@@ -196,7 +196,7 @@ export const OrganizationSettingsNavigation: FC<
               Organization settings
             </SidebarNavSubItem>
           )}
-          {permissionsQuery.data.viewUsers && (
+          {permissionsQuery.data.viewMembers && (
             <SidebarNavSubItem
               href={urlForSubpage(organization.name, "members")}
             >