From 8fc6865e70d66dabeb04b9d53cb28c5d39678f20 Mon Sep 17 00:00:00 2001
From: Mary Zhong <mary@clerk.dev>
Date: Tue, 14 Nov 2023 14:12:29 -0500
Subject: [PATCH] feat: Add API endpoints to assign and remove a permission
 from an org role

---
 clerk/instance_organization_roles.go      | 22 +++++++++
 clerk/instance_organization_roles_test.go | 54 +++++++++++++++++++++++
 2 files changed, 76 insertions(+)

diff --git a/clerk/instance_organization_roles.go b/clerk/instance_organization_roles.go
index 69f0bc83..65485d62 100644
--- a/clerk/instance_organization_roles.go
+++ b/clerk/instance_organization_roles.go
@@ -86,3 +86,25 @@ func (s *InstanceService) DeleteOrganizationRole(orgRoleID string) (*DeleteRespo
 	}
 	return &deleteResponse, nil
 }
+
+func (s *InstanceService) AssignOrganizationRolePermission(orgRoleID, orgPermissionID string) (*Role, error) {
+	req, _ := s.client.NewRequest(http.MethodPost, fmt.Sprintf("%s/%s/permissions/%s", OrganizationRolesUrl, orgRoleID, orgPermissionID))
+
+	var orgRole Role
+	_, err := s.client.Do(req, &orgRole)
+	if err != nil {
+		return nil, err
+	}
+	return &orgRole, nil
+}
+
+func (s *InstanceService) RemoveOrganizationRolePermission(orgRoleID, orgPermissionID string) (*Role, error) {
+	req, _ := s.client.NewRequest(http.MethodDelete, fmt.Sprintf("%s/%s/permissions/%s", OrganizationRolesUrl, orgRoleID, orgPermissionID))
+
+	var orgRole Role
+	_, err := s.client.Do(req, &orgRole)
+	if err != nil {
+		return nil, err
+	}
+	return &orgRole, nil
+}
diff --git a/clerk/instance_organization_roles_test.go b/clerk/instance_organization_roles_test.go
index 794b7ca0..2a994b77 100644
--- a/clerk/instance_organization_roles_test.go
+++ b/clerk/instance_organization_roles_test.go
@@ -209,7 +209,61 @@ func TestOrganizationRolesService_Delete(t *testing.T) {
 	}
 }
 
+func TestOrganizationRolesService_AssignPermission(t *testing.T) {
+	client, mux, _, teardown := setup("token")
+	defer teardown()
+
+	expectedResponse := dummyOrgRoleJson
+	mux.HandleFunc(fmt.Sprintf("/organization_roles/%s/permissions/%s", dummyOrgRoleID, dummyOrgPermissionID), func(w http.ResponseWriter, req *http.Request) {
+		testHttpMethod(t, req, "POST")
+		testHeader(t, req, "Authorization", "Bearer token")
+		fmt.Fprint(w, expectedResponse)
+	})
+
+	got, err := client.Instances().AssignOrganizationRolePermission(dummyOrgRoleID, dummyOrgPermissionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var want Role
+	err = json.Unmarshal([]byte(expectedResponse), &want)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(got, &want) {
+		t.Errorf("Response = %v, want %v", got, &want)
+	}
+}
+
+func TestOrganizationRolesService_RemovePermission(t *testing.T) {
+	client, mux, _, teardown := setup("token")
+	defer teardown()
+
+	expectedResponse := dummyOrgRoleJson
+	mux.HandleFunc(fmt.Sprintf("/organization_roles/%s/permissions/%s", dummyOrgRoleID, dummyOrgPermissionID), func(w http.ResponseWriter, req *http.Request) {
+		testHttpMethod(t, req, "DELETE")
+		testHeader(t, req, "Authorization", "Bearer token")
+		fmt.Fprint(w, expectedResponse)
+	})
+	got, err := client.Instances().RemoveOrganizationRolePermission(dummyOrgRoleID, dummyOrgPermissionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var want Role
+	err = json.Unmarshal([]byte(expectedResponse), &want)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(got, &want) {
+		t.Errorf("Response = %v, want %v", got, &want)
+	}
+}
+
 const dummyOrgRoleID = "role_1mebQggrD3xO5JfuHk7clQ94ysA"
+const dummyOrgPermissionID = "perm_1mebQggrD3xO5JfuHk7clQ94ysA"
 
 const dummyOrgRoleJson = `{
 	"object": "role",