feat: support org-level role changes for service users
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 344
- Forks
- 47
- Avg merge
- 4d 4h
- Merged PRs (30d)
- 26
Description
Problem
Service users now get an app_organization_viewer role when created (#1570), but there's no way to change that role through the API. An admin who wants to promote a service user to app_organization_manager or app_organization_owner cannot do so — the SetOrganizationMemberRole RPC only accepts user_id, hardcoded to schema.UserPrincipal.
The service layer already supports service user role changes (validated in unit tests). Only the proto + handler need updating.
What needs to change
Proto (raystack/proton): Update SetOrganizationMemberRoleRequest to accept principal_id + principal_type instead of (or in addition to) user_id.
Handler (organization.go): Pass the principal type from the request instead of hardcoding schema.UserPrincipal.
How service user membership works today
For reference, here's the current state after the membership migration:
| Operation | How it works |
|---|---|
| Create | CreateServiceUser → AddOrganizationMember(viewer) — gets policy + relation + identity link |
| Delete | DeleteServiceUser → RemoveOrganizationMember (cascade) → bulk relation delete → DB delete |
| Role change | Not possible via RPC — this issue |
| Remove from org | RemoveOrganizationMember rejects app/serviceuser at the handler — callers must use DeleteServiceUser (SUs are bound to one org) |
| Add to org | Only via CreateServiceUser — SUs are created within an org, not added to one after the fact |
References
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SetOrganizationMemberRoleRequest in the raystack/proton proto and the SetOrganizationMemberRole handler in organization.go. Review the existing service-layer unit tests that validate service-user role changes, then update the request and handler so principal ID and type reach the service. Done means service users can change roles through the RPC without regressing regular user role changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 70/100