From bc1ac21f1e6281e0b2256d13a13d45c9d7fd3808 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Tue, 10 Mar 2026 13:41:38 -0500 Subject: [PATCH] fix: use correct auth check for API organization updates - API auth uses current_user, not current_scope - Check membership role directly instead of using owner?/1 helper - Allow superusers to update organization settings - Fixes KeyError: key :current_scope not found Previous code assumed LiveView context with current_scope, but API requests only have current_user and current_organization_id assigned. --- .../controllers/api/v1/organization_controller.ex | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/towerops_web/controllers/api/v1/organization_controller.ex b/lib/towerops_web/controllers/api/v1/organization_controller.ex index 8e10cb08..6dc9547a 100644 --- a/lib/towerops_web/controllers/api/v1/organization_controller.ex +++ b/lib/towerops_web/controllers/api/v1/organization_controller.ex @@ -3,7 +3,6 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do use ToweropsWeb, :controller import ToweropsWeb.Api.ErrorHelpers, only: [translate_errors: 1] - import ToweropsWeb.Permissions, only: [owner?: 1] alias Towerops.Organizations @@ -15,10 +14,14 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do def update(conn, %{"organization" => attrs}) do # Only organization owners can update organization settings - if owner?(conn.assigns.current_scope) do - organization_id = conn.assigns.current_organization_id - org = Organizations.get_organization!(organization_id) + user = conn.assigns.current_user + organization_id = conn.assigns.current_organization_id + org = Organizations.get_organization!(organization_id) + # Check if user is owner (or superuser) + membership = Organizations.get_membership(org.id, user.id) + + if user.is_superuser || (membership && membership.role == :owner) do case Organizations.update_organization(org, attrs) do {:ok, updated} -> json(conn, %{data: format_org(updated)})