diff --git a/lib/towerops_web/controllers/api/v1/organization_controller.ex b/lib/towerops_web/controllers/api/v1/organization_controller.ex index 8e10cb08..6dc9547a 100644 --- a/lib/towerops_web/controllers/api/v1/organization_controller.ex +++ b/lib/towerops_web/controllers/api/v1/organization_controller.ex @@ -3,7 +3,6 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do use ToweropsWeb, :controller import ToweropsWeb.Api.ErrorHelpers, only: [translate_errors: 1] - import ToweropsWeb.Permissions, only: [owner?: 1] alias Towerops.Organizations @@ -15,10 +14,14 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do def update(conn, %{"organization" => attrs}) do # Only organization owners can update organization settings - if owner?(conn.assigns.current_scope) do - organization_id = conn.assigns.current_organization_id - org = Organizations.get_organization!(organization_id) + user = conn.assigns.current_user + organization_id = conn.assigns.current_organization_id + org = Organizations.get_organization!(organization_id) + # Check if user is owner (or superuser) + membership = Organizations.get_membership(org.id, user.id) + + if user.is_superuser || (membership && membership.role == :owner) do case Organizations.update_organization(org, attrs) do {:ok, updated} -> json(conn, %{data: format_org(updated)})