update rooms.py and main.py

backend/main.py

@@ -35,6 +35,7 @@ from rooms import (
     change_room_name,
     regenerate_invite_code,
     remove_room_member,
+    update_member_role,
 )
 
 from events import (
@@ -56,6 +57,9 @@ from event_signups import (
 )
 
 
+class MemberRoleUpdate(BaseModel):
+    role: Literal["member", "admin"]
+
 class Login(BaseModel):
     username: str
     password: str
@@ -237,6 +241,55 @@ def api_get_user(
 
     return dict(user)
 
+@app.patch(
+    "/rooms/{room_id}/members/{user_id}",
+    summary="Edit a user's role",
+    description="Changes a user's role in a room. Only the room owner can edit member roles.",
+)
+def api_update_member_role(
+    room_id: int,
+    user_id: int,
+    data: MemberRoleUpdate,
+    current_user: int = Depends(get_current_user),
+):
+    current_role = get_member_role(room_id, current_user)
+    target_role = get_member_role(room_id, user_id)
+
+    if current_role is None:
+        raise HTTPException(
+            status_code=403,
+            detail="not a room member",
+        )
+
+    if target_role is None:
+        raise HTTPException(
+            status_code=404,
+            detail="user is not a member of this room",
+        )
+
+    if current_role < 3:
+        raise HTTPException(
+            status_code=403,
+            detail="owner permission required",
+        )
+
+    if target_role >= current_role:
+        raise HTTPException(
+            status_code=403,
+            detail="cannot edit a member with equal or higher role",
+        )
+
+    update_member_role(
+        room_id,
+        user_id,
+        data.role,
+    )
+
+    return {
+        "status": "updated",
+        "user_id": user_id,
+        "role": data.role,
+    }
 
 # rooms