Update comment

Emyrk · Emyrk · commit 9d47b74ac39c · 2022-04-29T08:26:58.000-05:00
diff --git a/coderd/members.go b/coderd/members.go
@@ -20,10 +20,13 @@ import (
 func (api *api) putMemberRoles(rw http.ResponseWriter, r *http.Request) {
 	// User is the user to modify
 	// TODO: Until rbac authorize is implemented, only be able to change your
-	//		own roles. This also means you can grant yourself whatever roles you want.
+	//	own roles. This also means you can grant yourself whatever roles you want.
 	user := httpmw.UserParam(r)
 	apiKey := httpmw.APIKey(r)
 	organization := httpmw.OrganizationParam(r)
+	// TODO: @emyrk add proper `Authorize()` check here instead of a uuid match.
+	//	Proper authorize should check the granted roles are able to given within
+	//	the selected organization. Until then, allow anarchy
 	if apiKey.UserID != user.ID {
 		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
 			Message: fmt.Sprintf("modifying other users is not supported at this time"),
