add safety check

Emyrk · Emyrk · commit 5bd12801e373 · 2024-06-04T15:55:35.000-05:00
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2851,6 +2851,13 @@ func (q *querier) UpdateMemberRoles(ctx context.Context, arg database.UpdateMemb
 	// Convert the argument roles for validation.
 	scopedGranted := make([]string, 0, len(arg.GrantedRoles))
 	for _, grantedRole := range arg.GrantedRoles {
+		// This check is a developer safety check. Old code might try to invoke this code path with
+		// organization id suffixes. Catch this and return a nice error so it can be fixed.
+		_, foundOrg, _ := rbac.RoleSplit(grantedRole)
+		if foundOrg != "" {
+			return database.OrganizationMember{}, xerrors.Errorf("attempt to assign a role %q, remove the ':<organization_id> suffix", grantedRole)
+		}
+
 		scopedGranted = append(scopedGranted, rbac.RoleName(grantedRole, arg.OrgID.String()))
 	}
 
