feat(rbac): Allow role to be edited in graphql

app/graphql/mutations/invites/revoke.rb

@@ -9,7 +9,7 @@ class Revoke < BaseMutation
       REQUIRED_PERMISSION = 'organization:members:delete'
 
       graphql_name 'RevokeInvite'
-      description 'Revokes a invite'
+      description 'Revokes an invite'
 
       argument :id, ID, required: true
 

app/graphql/mutations/invites/update.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Invites
+    class Update < BaseMutation
+      include AuthenticableApiUser
+      include RequiredOrganization
+
+      REQUIRED_PERMISSION = 'organization:members:update'
+
+      graphql_name 'UpdateInvite'
+      description 'Update an invite'
+
+      argument :id, ID, required: true
+      argument :role, Types::Memberships::RoleEnum, required: true
+
+      type Types::Invites::Object
+
+      def resolve(**args)
+        invite = current_organization.invites.pending.find_by(id: args[:id])
+        result = ::Invites::UpdateService.call(invite:, params: args)
+        result.success? ? result.invite : result_error(result)
+      end
+    end
+  end
+end

app/graphql/mutations/memberships/update.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Memberships
+    class Update < BaseMutation
+      include AuthenticableApiUser
+      include RequiredOrganization
+
+      REQUIRED_PERMISSION = 'organization:members:update'
+
+      graphql_name 'UpdateMembership'
+      description 'Update a membership'
+
+      argument :id, ID, required: true
+      argument :role, Types::Memberships::RoleEnum, required: true
+
+      type Types::MembershipType
+
+      def resolve(**args)
+        membership = current_organization.memberships.find_by(id: args[:id])
+        result = ::Memberships::UpdateService.call(membership:, params: args)
+        result.success? ? result.membership : result_error(result)
+      end
+    end
+  end
+end

app/graphql/types/mutation_type.rb

@@ -92,7 +92,10 @@ class MutationType < Types::BaseObject
     field :accept_invite, mutation: Mutations::Invites::Accept
     field :create_invite, mutation: Mutations::Invites::Create
     field :revoke_invite, mutation: Mutations::Invites::Revoke
+    field :update_invite, mutation: Mutations::Invites::Update
+
     field :revoke_membership, mutation: Mutations::Memberships::Revoke
+    field :update_membership, mutation: Mutations::Memberships::Update
 
     field :create_password_reset, mutation: Mutations::PasswordResets::Create
     field :reset_password, mutation: Mutations::PasswordResets::Reset

app/services/invites/update_service.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Invites
+  class UpdateService < BaseService
+    def initialize(invite:, params:)
+      @invite = invite
+      @params = params
+
+      super
+    end
+
+    def call
+      return result.not_found_failure!(resource: 'invite') unless invite
+      return result.forbidden_failure!(code: 'cannot_update_accepted_invite') if invite.accepted?
+      return result.forbidden_failure!(code: 'cannot_update_revoked_invite') if invite.revoked?
+
+      invite.update!(
+        role: params[:role],
+      )
+
+      result.invite = invite
+      result
+    rescue ActiveRecord::RecordInvalid => e
+      result.record_validation_failure!(record: e.record)
+    end
+
+    private
+
+    attr_reader :invite, :params
+  end
+end

app/services/memberships/update_service.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Memberships
+  class UpdateService < BaseService
+    def initialize(membership:, params:)
+      @membership = membership
+      @params = params
+
+      super
+    end
+
+    def call
+      return result.not_found_failure!(resource: 'membership') unless membership
+      return result.not_allowed_failure!(code: 'last_admin') if changing_role_of_last_admin?
+
+      membership.update!(
+        role: params[:role],
+      )
+
+      result.membership = membership
+      result
+    rescue ActiveRecord::RecordInvalid => e
+      result.record_validation_failure!(record: e.record)
+    end
+
+    private
+
+    attr_reader :membership, :params
+
+    def changing_role_of_last_admin?
+      membership.organization.memberships.admin.count == 1 &&
+        membership.admin? &&
+        params[:role] != 'admin'
+    end
+  end
+end