Documentation
¶
Overview ¶
Package organizations provides multi-tenancy and team management for Aegis.
This plugin enables SaaS applications to manage multiple organizations (workspaces, companies, tenants) with member roles and team hierarchies. It implements a complete RBAC (Role-Based Access Control) system for organizational resources.
Multi-Tenancy Architecture:
- Organization: Top-level tenant (e.g., "Acme Corp", "Tech Startup")
- Members: Users with roles in an organization (owner, admin, member)
- Teams: Groups within an organization (e.g., "Engineering", "Sales")
- Team Members: Users with roles in a team (lead, member)
Role Hierarchy:
Organization Roles: - owner: Full control, can delete organization, manage all members - admin: Can manage members, teams, but cannot delete organization - member: Read access to organization resources Team Roles: - lead: Can manage team members and settings - member: Participate in team activities
Common Use Cases:
- SaaS with company workspaces (Slack, Notion, GitHub)
- Project management tools with teams
- Enterprise apps with department hierarchies
- Multi-tenant platforms with access control
Database Schema:
- organization: Stores organization metadata (id, name, slug)
- members: Links users to organizations with roles
- team: Stores team metadata within organizations
- team_member: Links users to teams with roles
Example Setup:
// Create organization plugin orgPlugin := organizations.New(nil, plugins.DialectPostgres) // User creates organization org, _ := orgPlugin.CreateOrganization(ctx, "Acme Corp", "acme", user.ID) // User is automatically added as owner // Owner adds admin orgPlugin.AddOrganizationMember(ctx, org.ID, adminUserID, "admin") // Admin creates team team, _ := orgPlugin.CreateTeam(ctx, org.ID, "Engineering", "Dev team") // Admin adds team member orgPlugin.AddTeamMember(ctx, team.ID, devUserID, "member")
Security Features:
- All routes require authentication (RequireAuthMiddleware)
- Role-based middleware (RequireOrganizationMember, RequireOrganizationAdmin, RequireOrganizationOwner)
- Foreign key constraints prevent orphaned records
- Cascade deletes when organization is deleted
Index ¶
- Constants
- func GetMigrations(dialect plugins.Dialect) ([]plugins.Migration, error)
- func GetSchemaRequirements(dialect plugins.Dialect) []plugins.SchemaRequirement
- type AddOrganizationMemberRequest
- type AddTeamMemberRequest
- type CreateOrganizationRequest
- type CreateTeamRequest
- type Plugin
- func (p *Plugin) AddOrganizationMember(ctx context.Context, orgID, userID, role string) error
- func (p *Plugin) AddOrganizationMemberHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) AddTeamMember(ctx context.Context, teamID, userID, role string) error
- func (p *Plugin) AddTeamMemberHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) CreateOrganization(ctx context.Context, name, slug, ownerID string) (*orgtypes.Organization, error)
- func (p *Plugin) CreateOrganizationHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) CreateTeam(ctx context.Context, orgID, name, description string) (*orgtypes.Team, error)
- func (p *Plugin) CreateTeamHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) DeleteOrganization(ctx context.Context, id string) error
- func (p *Plugin) DeleteOrganizationHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) DeleteTeam(ctx context.Context, id string) error
- func (p *Plugin) DeleteTeamHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) Dependencies() []plugins.Dependency
- func (p *Plugin) Description() string
- func (p *Plugin) EnrichUser(ctx context.Context, user *core.EnrichedUser) error
- func (p *Plugin) GetMigrations() []plugins.Migration
- func (p *Plugin) GetOrganization(ctx context.Context, id string) (orgtypes.Organization, error)
- func (p *Plugin) GetOrganizationHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) GetTeam(ctx context.Context, id string) (*orgtypes.Team, error)
- func (p *Plugin) GetTeamHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) GetUserOrganizations(ctx context.Context, userID string, offset, limit int) ([]*orgtypes.Organization, int, error)
- func (p *Plugin) Init(ctx context.Context, aegis plugins.Aegis) error
- func (p *Plugin) IsOrganizationMember(ctx context.Context, userID, orgID string) bool
- func (p *Plugin) IsOwner(ctx context.Context, userID, orgID string) bool
- func (p *Plugin) IsOwnerOrAdmin(ctx context.Context, userID, orgID string) bool
- func (p *Plugin) ListOrganizationMembers(ctx context.Context, orgID string, offset, limit int) ([]*orgtypes.Member, int, error)
- func (p *Plugin) ListOrganizationMembersHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) ListOrganizationsHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) ListTeamMembers(ctx context.Context, teamID string, offset, limit int) ([]*orgtypes.TeamMember, int, error)
- func (p *Plugin) ListTeamMembersHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) ListTeams(ctx context.Context, orgID string, offset, limit int) ([]*orgtypes.Team, int, error)
- func (p *Plugin) ListTeamsHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) MountRoutes(r router.Router, prefix string)
- func (p *Plugin) Name() string
- func (p *Plugin) ProvidesAuthMethods() []string
- func (p *Plugin) RemoveOrganizationMember(ctx context.Context, userID, orgID string) error
- func (p *Plugin) RemoveOrganizationMemberHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) RemoveTeamMember(ctx context.Context, teamID, userID string) error
- func (p *Plugin) RemoveTeamMemberHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) RequireOrganizationAdminMiddleware() func(http.Handler) http.Handler
- func (p *Plugin) RequireOrganizationMemberMiddleware() func(http.Handler) http.Handler
- func (p *Plugin) RequireOrganizationOwnerMiddleware() func(http.Handler) http.Handler
- func (p *Plugin) RequiresTables() []string
- func (p *Plugin) UpdateMemberRole(ctx context.Context, orgID, userID, role string) error
- func (p *Plugin) UpdateMemberRoleHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) UpdateOrganization(ctx context.Context, id, name, slug string) error
- func (p *Plugin) UpdateOrganizationHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) UpdateTeam(ctx context.Context, id, name, description string) error
- func (p *Plugin) UpdateTeamHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) UpdateTeamMemberRole(ctx context.Context, teamID, userID, role string) error
- func (p *Plugin) UpdateTeamMemberRoleHandler(w http.ResponseWriter, r *http.Request)
- func (p *Plugin) Version() string
- type UpdateMemberRoleRequest
- type UpdateOrganizationRequest
- type UpdateTeamMemberRoleRequest
- type UpdateTeamRequest
Constants ¶
const ( // Request schemas SchemaCreateOrganizationRequest = "CreateOrganizationRequest" SchemaUpdateOrganizationRequest = "UpdateOrganizationRequest" SchemaAddOrganizationMemberRequest = "AddOrganizationMemberRequest" SchemaUpdateMemberRoleRequest = "UpdateMemberRoleRequest" SchemaCreateTeamRequest = "CreateTeamRequest" SchemaUpdateTeamRequest = "UpdateTeamRequest" SchemaAddTeamMemberRequest = "AddTeamMemberRequest" SchemaUpdateTeamMemberRoleRequest = "UpdateTeamMemberRoleRequest" // Response schemas SchemaOrganization = "Organization" SchemaOrganizationList = "OrganizationList" SchemaTeam = "Team" SchemaTeamList = "TeamList" SchemaMember = "Member" SchemaMemberList = "MemberList" SchemaTeamMember = "TeamMember" SchemaTeamMemberList = "TeamMemberList" )
Schema names for OpenAPI specification generation.
These constants define the OpenAPI schema names for organizations request/response types. They are used in route metadata to generate accurate API documentation with typed request/response examples.
Variables ¶
This section is empty.
Functions ¶
func GetMigrations ¶
GetMigrations returns all database migrations for the organizations plugin.
This function loads migrations from embedded SQL files and returns them in version order.
Version Numbering:
- Version 001+: Migrations from migrations/<dialect>/<version>_<description>.<up|down>.sql
Migration File Format:
- Up migration: 001_initial.up.sql
- Down migration: 001_initial.down.sql
Parameters:
- dialect: Database dialect (postgres, mysql, sqlite)
Returns:
- []plugins.Migration: Sorted list of migrations (oldest first)
- error: If migration files cannot be read or parsed
func GetSchemaRequirements ¶
func GetSchemaRequirements(dialect plugins.Dialect) []plugins.SchemaRequirement
GetSchemaRequirements returns schema validation requirements for the organizations plugin.
This function defines structural requirements that must be satisfied for the plugin to function correctly. The Init() method validates these requirements at startup.
Validation Checks:
- Table existence: organization, members, team, team_member
- Column existence: All required columns in each table
- Column properties: Data types, nullability (not implemented yet)
These checks help detect schema drift, incomplete migrations, or manual schema changes.
Parameters:
- dialect: Database dialect (postgres, mysql)
Returns:
- []plugins.SchemaRequirement: List of validation requirements
Types ¶
type AddOrganizationMemberRequest ¶
type AddOrganizationMemberRequest struct {
UserID string `json:"userId"` // User ID to add
Role string `json:"role"` // Member role ("admin" or "member")
}
AddOrganizationMemberRequest represents a request to add a member to an organization.
Validation Rules:
- userId: Required (must be a valid user ID in the system)
- role: Required, must be "admin" or "member" ("owner" cannot be assigned this way)
Example:
{
"userId": "user_xyz789",
"role": "admin"
}
Security Note: The "owner" role cannot be assigned via this endpoint to prevent privilege escalation. Ownership is assigned during organization creation or via explicit transfer (if implemented).
func (AddOrganizationMemberRequest) Validate ¶
func (r AddOrganizationMemberRequest) Validate() error
Validate validates the add organization member request.
type AddTeamMemberRequest ¶
AddTeamMemberRequest represents a request to add a member to a team.
func (AddTeamMemberRequest) Validate ¶
func (r AddTeamMemberRequest) Validate() error
Validate validates the add team member request.
type CreateOrganizationRequest ¶
type CreateOrganizationRequest struct {
Name string `json:"name"` // Organization display name
Slug string `json:"slug"` // URL-friendly identifier (must be unique)
}
CreateOrganizationRequest represents a request to create an organization.
Validation Rules:
- name: Required, 1-100 characters (organization display name)
- slug: Required, 3-50 characters, lowercase alphanumeric + hyphens only
Example:
{
"name": "Acme Corporation",
"slug": "acme-corp"
}
func (CreateOrganizationRequest) Validate ¶
func (r CreateOrganizationRequest) Validate() error
Validate validates the create organization request.
Returns:
- error: Validation error if name or slug is invalid
type CreateTeamRequest ¶
type CreateTeamRequest struct {
Name string `json:"name"` // Team display name
Description string `json:"description"` // Team purpose/description
}
CreateTeamRequest represents a request to create a team within an organization.
Validation Rules:
- name: Required, 1-100 characters (team display name)
- description: Optional, max 500 characters (team purpose)
Example:
{
"name": "Engineering",
"description": "Software development team"
}
func (CreateTeamRequest) Validate ¶
func (r CreateTeamRequest) Validate() error
Validate validates the create team request.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin implements multi-tenant organization and team management.
This plugin provides complete CRUD operations for organizations, members, teams, and team members with role-based access control.
Components:
- sessionService: User authentication for protected routes
- store: Database persistence for organizations, members, teams
- dialect: SQL dialect (PostgreSQL, MySQL, SQLite)
Endpoints Provided:
Organizations: POST, GET, PUT, DELETE /organizations Members: POST, GET, PATCH, DELETE /organizations/:id/members Teams: POST, GET, PUT, DELETE /teams, /organizations/:id/teams Team Members: POST, GET, PATCH, DELETE /teams/:teamId/members
func New ¶
func New(store orgtypes.OrganizationStore, dialect ...plugins.Dialect) *Plugin
New creates a new organizations plugin for multi-tenancy management.
Parameters:
- store: Organization storage implementation (nil = use DefaultOrganizationStore)
- dialect: Database dialect (defaults to PostgreSQL)
Returns:
- *Plugin: Initialized plugin ready for Init() call
Example:
plugin := organizations.New(nil, plugins.DialectPostgres)
func (*Plugin) AddOrganizationMember ¶ added in v1.2.1
AddOrganizationMember adds a user to an organization with a specified role.
This method creates a membership record linking the user to the organization. The caller must verify admin/owner permissions before calling this method.
Valid Roles:
- "owner": Full control (only one owner per organization recommended)
- "admin": Can manage members and teams
- "member": Read-only access to organization resources
Parameters:
- ctx: Request context
- orgID: Organization ID
- userID: User ID to add
- role: Membership role ("owner", "admin", "member")
Returns:
- error: Database error or duplicate membership
func (*Plugin) AddOrganizationMemberHandler ¶
func (p *Plugin) AddOrganizationMemberHandler(w http.ResponseWriter, r *http.Request)
AddOrganizationMemberHandler adds a member to an organization
func (*Plugin) AddTeamMember ¶ added in v1.2.1
AddTeamMember adds a user to a team with a specified role.
func (*Plugin) AddTeamMemberHandler ¶
func (p *Plugin) AddTeamMemberHandler(w http.ResponseWriter, r *http.Request)
AddTeamMemberHandler adds a member to a team
func (*Plugin) CreateOrganization ¶ added in v1.2.1
func (p *Plugin) CreateOrganization(ctx context.Context, name, slug, ownerID string) (*orgtypes.Organization, error)
CreateOrganization creates a new organization and adds the creator as owner.
This method performs two database operations atomically:
- Create organization record
- Create member record with role="owner" for creator
Parameters:
- ctx: Request context
- name: Organization display name (e.g., "Acme Corporation")
- slug: URL-friendly identifier (e.g., "acme-corp")
- ownerID: User ID of the organization creator
Returns:
- *Organization: Created organization with metadata
- error: Database error or duplicate slug error
func (*Plugin) CreateOrganizationHandler ¶
func (p *Plugin) CreateOrganizationHandler(w http.ResponseWriter, r *http.Request)
CreateOrganizationHandler creates a new organization with the user as owner.
This endpoint allows any authenticated user to create an organization. The creator is automatically assigned the "owner" role with full administrative privileges.
Endpoint:
- Method: POST
- Path: /organizations
- Auth: Required (any authenticated user)
Request Body:
{
"name": "Acme Corporation",
"slug": "acme-corp"
}
Validation:
- name: Required, 1-100 characters
- slug: Required, 3-50 characters, lowercase alphanumeric with hyphens only
Response (201 Created):
{
"success": true,
"organization": {
"id": "org_abc123",
"name": "Acme Corporation",
"slug": "acme-corp",
"createdAt": "2024-01-01T00:00:00Z",
"updatedAt": "2024-01-01T00:00:00Z"
}
}
func (*Plugin) CreateTeam ¶ added in v1.2.1
func (p *Plugin) CreateTeam(ctx context.Context, orgID, name, description string) (*orgtypes.Team, error)
CreateTeam creates a new team within an organization.
func (*Plugin) CreateTeamHandler ¶
func (p *Plugin) CreateTeamHandler(w http.ResponseWriter, r *http.Request)
CreateTeamHandler creates a new team within an organization
func (*Plugin) DeleteOrganization ¶ added in v1.2.1
DeleteOrganization soft-deletes an organization.
func (*Plugin) DeleteOrganizationHandler ¶
func (p *Plugin) DeleteOrganizationHandler(w http.ResponseWriter, r *http.Request)
DeleteOrganizationHandler deletes an organization
func (*Plugin) DeleteTeam ¶ added in v1.2.1
DeleteTeam deletes a team.
func (*Plugin) DeleteTeamHandler ¶
func (p *Plugin) DeleteTeamHandler(w http.ResponseWriter, r *http.Request)
DeleteTeamHandler deletes a team
func (*Plugin) Dependencies ¶
func (p *Plugin) Dependencies() []plugins.Dependency
Dependencies returns plugin dependencies
func (*Plugin) Description ¶
Description returns the plugin description
func (*Plugin) EnrichUser ¶ added in v1.2.1
EnrichUser implements plugins.UserEnricher to add organization memberships.
This method is called automatically by the authentication system after user lookup. It adds the user's organization memberships to the EnrichedUser, making them available in API responses without requiring separate queries.
Fields Added:
- "organizations" ([]map[string]any): List of organizations the user belongs to, each containing id, name, and slug fields.
Parameters:
- ctx: Request context
- user: EnrichedUser to populate with organization data
Returns:
- error: Always nil (organization lookup failure is not an error)
func (*Plugin) GetMigrations ¶
GetMigrations returns the plugin migrations
func (*Plugin) GetOrganization ¶ added in v1.2.1
GetOrganization retrieves an organization by ID.
func (*Plugin) GetOrganizationHandler ¶
func (p *Plugin) GetOrganizationHandler(w http.ResponseWriter, r *http.Request)
GetOrganizationHandler retrieves details of a specific organization.
This endpoint returns organization metadata. Requires membership in the organization.
Endpoint:
- Method: GET
- Path: /organizations/:id
- Auth: Required (must be organization member)
Path Parameters:
- id: Organization ID
Response (200 OK):
{
"success": true,
"organization": {
"id": "org_abc123",
"name": "Acme Corporation",
"slug": "acme-corp",
"createdAt": "2024-01-01T00:00:00Z",
"updatedAt": "2024-01-01T00:00:00Z"
}
}
func (*Plugin) GetTeamHandler ¶
func (p *Plugin) GetTeamHandler(w http.ResponseWriter, r *http.Request)
GetTeamHandler gets a specific team
func (*Plugin) GetUserOrganizations ¶ added in v1.2.1
func (p *Plugin) GetUserOrganizations(ctx context.Context, userID string, offset, limit int) ([]*orgtypes.Organization, int, error)
GetUserOrganizations retrieves all organizations for a user.
func (*Plugin) Init ¶
Init initializes the organizations plugin with Aegis services.
This method validates database schema requirements and stores the session service for authentication middleware.
Initialization Steps:
- Initialize store if not provided (DefaultOrganizationStore)
- Build schema validation requirements (tables, foreign keys)
- Validate schema via Aegis
- Store session service for protected routes
Required Tables:
- organization: Organization metadata
- members: Organization membership with roles
- team: Team metadata within organizations
- team_member: Team membership with roles
Parameters:
- ctx: Initialization context
- aegis: Aegis interface providing services and DB
Returns:
- error: Schema validation error if tables don't exist
func (*Plugin) IsOrganizationMember ¶ added in v1.2.1
IsOrganizationMember checks if a user is a member of an organization.
This method is used by middleware to enforce organization access control. Returns true only if the user has any role (owner, admin, or member).
Parameters:
- ctx: Request context
- userID: User ID to check
- orgID: Organization ID
Returns:
- bool: true if user is a member with any role
func (*Plugin) IsOwner ¶ added in v1.2.1
IsOwner checks if a user is the owner of an organization.
This method enforces permission requirements for destructive actions:
- Deleting organization
- Transferring ownership
- Changing admin roles
Parameters:
- ctx: Request context
- userID: User ID to check
- orgID: Organization ID
Returns:
- bool: true if user has owner role
func (*Plugin) IsOwnerOrAdmin ¶ added in v1.2.1
IsOwnerOrAdmin checks if a user is an owner or admin of an organization.
This method enforces permission requirements for administrative actions:
- Updating organization settings
- Adding/removing members
- Creating/deleting teams
Parameters:
- ctx: Request context
- userID: User ID to check
- orgID: Organization ID
Returns:
- bool: true if user has owner or admin role
func (*Plugin) ListOrganizationMembers ¶ added in v1.2.1
func (p *Plugin) ListOrganizationMembers(ctx context.Context, orgID string, offset, limit int) ([]*orgtypes.Member, int, error)
ListOrganizationMembers lists all members of an organization.
func (*Plugin) ListOrganizationMembersHandler ¶
func (p *Plugin) ListOrganizationMembersHandler(w http.ResponseWriter, r *http.Request)
ListOrganizationMembersHandler lists organization members.
func (*Plugin) ListOrganizationsHandler ¶
func (p *Plugin) ListOrganizationsHandler(w http.ResponseWriter, r *http.Request)
ListOrganizationsHandler lists all organizations the user is a member of.
This endpoint returns all organizations where the user has any membership (owner, admin, or member role).
Endpoint:
- Method: GET
- Path: /organizations
- Auth: Required
Response (200 OK):
{
"success": true,
"organizations": [
{"id": "org_1", "name": "Acme Corp", "slug": "acme", ...},
{"id": "org_2", "name": "Tech Inc", "slug": "tech", ...}
]
}
func (*Plugin) ListTeamMembers ¶ added in v1.2.1
func (p *Plugin) ListTeamMembers(ctx context.Context, teamID string, offset, limit int) ([]*orgtypes.TeamMember, int, error)
ListTeamMembers lists all members of a team.
func (*Plugin) ListTeamMembersHandler ¶
func (p *Plugin) ListTeamMembersHandler(w http.ResponseWriter, r *http.Request)
ListTeamMembersHandler lists team members
func (*Plugin) ListTeams ¶ added in v1.2.1
func (p *Plugin) ListTeams(ctx context.Context, orgID string, offset, limit int) ([]*orgtypes.Team, int, error)
ListTeams lists all teams in an organization.
func (*Plugin) ListTeamsHandler ¶
func (p *Plugin) ListTeamsHandler(w http.ResponseWriter, r *http.Request)
ListTeamsHandler lists teams in an organization.
func (*Plugin) MountRoutes ¶
MountRoutes registers HTTP routes for the organizations plugin
func (*Plugin) ProvidesAuthMethods ¶
ProvidesAuthMethods returns the provided auth methods
func (*Plugin) RemoveOrganizationMember ¶ added in v1.2.1
RemoveOrganizationMember removes a user from an organization.
func (*Plugin) RemoveOrganizationMemberHandler ¶
func (p *Plugin) RemoveOrganizationMemberHandler(w http.ResponseWriter, r *http.Request)
RemoveOrganizationMemberHandler removes a member from an organization
func (*Plugin) RemoveTeamMember ¶ added in v1.2.1
RemoveTeamMember removes a user from a team.
func (*Plugin) RemoveTeamMemberHandler ¶
func (p *Plugin) RemoveTeamMemberHandler(w http.ResponseWriter, r *http.Request)
RemoveTeamMemberHandler removes a member from a team
func (*Plugin) RequireOrganizationAdminMiddleware ¶
RequireOrganizationAdminMiddleware enforces admin or owner privileges.
This middleware ensures the authenticated user has administrative privileges (owner or admin role) in the organization. Regular members are denied access.
Use Cases:
- Adding/removing organization members
- Creating/deleting teams
- Updating organization settings
Permission Requirements:
- Owner role: Allowed ✓
- Admin role: Allowed ✓
- Member role: Denied ✗
Request Flow:
- Get authenticated user from context
- Extract organization ID from path parameter ":id"
- Check if user has owner OR admin role
- If yes → continue, if no → 403 Forbidden
func (*Plugin) RequireOrganizationMemberMiddleware ¶
RequireOrganizationMemberMiddleware enforces organization membership.
This middleware ensures the authenticated user is a member of the organization specified in the URL path parameter ":id". It allows any role (owner, admin, member).
Use Cases:
- Viewing organization details
- Listing organization members
- Viewing teams
Request Flow:
- Get authenticated user from context (set by RequireAuthMiddleware)
- Extract organization ID from path parameter ":id"
- Check if user is a member (any role)
- If yes → continue to handler, if no → 403 Forbidden
Example:
r.GET("/organizations/:id",
requireAuth(
plugin.RequireOrganizationMemberMiddleware()(
http.HandlerFunc(handler),
),
),
)
func (*Plugin) RequireOrganizationOwnerMiddleware ¶
RequireOrganizationOwnerMiddleware enforces owner-only access.
This middleware ensures the authenticated user is the organization owner. This is the highest privilege level and is required for destructive operations.
Use Cases:
- Deleting organization (permanent)
- Transferring ownership
- Changing other members' roles to admin
Permission Requirements:
- Owner role: Allowed ✓
- Admin role: Denied ✗
- Member role: Denied ✗
Request Flow:
- Get authenticated user from context
- Extract organization ID from path parameter ":id"
- Check if user has owner role (exact match)
- If yes → continue, if no → 403 Forbidden
Best Practice: Only one owner per organization is recommended. Multiple owners complicate permission management and deletion workflows.
func (*Plugin) RequiresTables ¶
RequiresTables returns required tables
func (*Plugin) UpdateMemberRole ¶ added in v1.2.1
UpdateMemberRole updates a user's role in an organization.
func (*Plugin) UpdateMemberRoleHandler ¶
func (p *Plugin) UpdateMemberRoleHandler(w http.ResponseWriter, r *http.Request)
UpdateMemberRoleHandler updates a member's role
func (*Plugin) UpdateOrganization ¶ added in v1.2.1
UpdateOrganization updates an organization's name and slug.
func (*Plugin) UpdateOrganizationHandler ¶
func (p *Plugin) UpdateOrganizationHandler(w http.ResponseWriter, r *http.Request)
UpdateOrganizationHandler updates an organization
func (*Plugin) UpdateTeam ¶ added in v1.2.1
UpdateTeam updates a team's name and description.
func (*Plugin) UpdateTeamHandler ¶
func (p *Plugin) UpdateTeamHandler(w http.ResponseWriter, r *http.Request)
UpdateTeamHandler updates a team
func (*Plugin) UpdateTeamMemberRole ¶ added in v1.2.1
UpdateTeamMemberRole updates a user's role in a team.
func (*Plugin) UpdateTeamMemberRoleHandler ¶
func (p *Plugin) UpdateTeamMemberRoleHandler(w http.ResponseWriter, r *http.Request)
UpdateTeamMemberRoleHandler updates a team member's role
type UpdateMemberRoleRequest ¶
type UpdateMemberRoleRequest struct {
Role string `json:"role"` // New role ("admin" or "member")
}
UpdateMemberRoleRequest represents a request to update a member's role.
Validation Rules:
- role: Required, must be "admin" or "member"
Example:
{
"role": "admin"
}
Security Note: Cannot update to "owner" role via this endpoint. Ownership transfer requires a separate flow with additional safeguards.
func (UpdateMemberRoleRequest) Validate ¶
func (r UpdateMemberRoleRequest) Validate() error
Validate validates the update member role request.
type UpdateOrganizationRequest ¶
type UpdateOrganizationRequest struct {
Name string `json:"name"` // Updated organization name
Slug string `json:"slug"` // Updated URL-friendly identifier
}
UpdateOrganizationRequest represents a request to update an organization.
Validation Rules:
- name: Required, 1-100 characters
- slug: Required, 3-50 characters, lowercase alphanumeric + hyphens only
Note: Both fields must be provided even if only updating one. The handler will apply the new values.
func (UpdateOrganizationRequest) Validate ¶
func (r UpdateOrganizationRequest) Validate() error
Validate validates the update organization request.
type UpdateTeamMemberRoleRequest ¶
type UpdateTeamMemberRoleRequest struct {
Role string `json:"role"`
}
UpdateTeamMemberRoleRequest represents a request to update a team member's role.
func (UpdateTeamMemberRoleRequest) Validate ¶
func (r UpdateTeamMemberRoleRequest) Validate() error
Validate validates the update team member role request.
type UpdateTeamRequest ¶
UpdateTeamRequest represents a request to update a team.
func (UpdateTeamRequest) Validate ¶
func (r UpdateTeamRequest) Validate() error
Validate validates the update team request.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package defaultstore implements the SQL-backed default store for the organizations plugin.
|
Package defaultstore implements the SQL-backed default store for the organizations plugin. |
|
internal
|
|
|
Package types defines the domain models and types used by the organizations plugin.
|
Package types defines the domain models and types used by the organizations plugin. |