extract method into it's own funciton

coder · Emyrk · Sep 17, 2024 · Sep 10, 2024 · Sep 10, 2024 · Sep 10, 2024
commit 88576606c62f9c0ce4f7301e21b3150119ffd860
diff --git a/coderd/members.go b/coderd/members.go
@@ -216,31 +216,9 @@
 	aReq.Old = member.OrganizationMember.Auditable(member.Username)
 	defer commitAudit()
 
-	// Keep this block scoping to prevent accidental use of the user variable.
-	{
-		// nolint:gocritic // The caller could be an org admin without this perm.
-		// We need to disable manual role assignment if role sync is enabled for
-		// the given organization.
-		user, err := api.Database.GetUserByID(dbauthz.AsSystemRestricted(ctx), member.UserID)
-		if err != nil {
-			httpapi.InternalServerError(rw, err)
-			return
-		}
-		if user.LoginType == database.LoginTypeOIDC {
-			// nolint:gocritic // fetching settings
-			orgSync, err := api.IDPSync.OrganizationRoleSyncEnabled(dbauthz.AsSystemRestricted(ctx), api.Database, organization.ID)
-			if err != nil {
-				httpapi.InternalServerError(rw, err)
-				return
-			}
-			if orgSync {
-				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-					Message: "Cannot modify roles for OIDC users when role sync is enabled. This organization member's roles are managed by the identity provider.",
-					Detail:  "'User Role Field' is set in the organization settings. Ask an administrator to adjust or disable these settings.",
-				})
-				return
-			}
-		}
+	// Check if changing roles is allowed
+	if !api.allowChangingMemberRoles(rw, ctx, member, organization) {
+		return
 	}
 
 	if apiKey.UserID == member.OrganizationMember.UserID {
@@ -287,6 +265,35 @@
 	httpapi.Write(ctx, rw, http.StatusOK, resp[0])
 }
 
+func (api *API) allowChangingMemberRoles(rw http.ResponseWriter, ctx context.Context, member httpmw.OrganizationMember, organization database.Organization) bool {
+	// nolint:gocritic // The caller could be an org admin without this perm.
+	// We need to disable manual role assignment if role sync is enabled for
+	// the given organization.
+	user, err := api.Database.GetUserByID(dbauthz.AsSystemRestricted(ctx), member.UserID)
+	if err != nil {
+		httpapi.InternalServerError(rw, err)
+		return false
+	}
+
+	if user.LoginType == database.LoginTypeOIDC {
+		// nolint:gocritic // fetching settings
+		orgSync, err := api.IDPSync.OrganizationRoleSyncEnabled(dbauthz.AsSystemRestricted(ctx), api.Database, organization.ID)
+		if err != nil {
+			httpapi.InternalServerError(rw, err)
+			return false
+		}
+		if orgSync {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Cannot modify roles for OIDC users when role sync is enabled. This organization member's roles are managed by the identity provider.",
+				Detail:  "'User Role Field' is set in the organization settings. Ask an administrator to adjust or disable these settings.",
+			})
+			return false
+		}
+	}
+
+	return true
+}
+
 // convertOrganizationMembers batches the role lookup to make only 1 sql call
 // We
 func convertOrganizationMembers(ctx context.Context, db database.Store, mems []database.OrganizationMember) ([]codersdk.OrganizationMember, error) {