update rooms.py and main.py

backend/main.py

@@ -35,6 +35,7 @@ from rooms import (
     change_room_name,
     regenerate_invite_code,
     remove_room_member,
+    update_member_role,
 )
 
 from events import (
@@ -56,6 +57,9 @@ from event_signups import (
 )
 
 
+class MemberRoleUpdate(BaseModel):
+    role: Literal["member", "admin"]
+
 class Login(BaseModel):
     username: str
     password: str
@@ -237,6 +241,55 @@ def api_get_user(
 
     return dict(user)
 
+@app.patch(
+    "/rooms/{room_id}/members/{user_id}",
+    summary="Edit a user's role",
+    description="Changes a user's role in a room. Only the room owner can edit member roles.",
+)
+def api_update_member_role(
+    room_id: int,
+    user_id: int,
+    data: MemberRoleUpdate,
+    current_user: int = Depends(get_current_user),
+):
+    current_role = get_member_role(room_id, current_user)
+    target_role = get_member_role(room_id, user_id)
+
+    if current_role is None:
+        raise HTTPException(
+            status_code=403,
+            detail="not a room member",
+        )
+
+    if target_role is None:
+        raise HTTPException(
+            status_code=404,
+            detail="user is not a member of this room",
+        )
+
+    if current_role < 3:
+        raise HTTPException(
+            status_code=403,
+            detail="owner permission required",
+        )
+
+    if target_role >= current_role:
+        raise HTTPException(
+            status_code=403,
+            detail="cannot edit a member with equal or higher role",
+        )
+
+    update_member_role(
+        room_id,
+        user_id,
+        data.role,
+    )
+
+    return {
+        "status": "updated",
+        "user_id": user_id,
+        "role": data.role,
+    }
 
 # rooms
 

backend/rooms.py

@@ -325,4 +325,15 @@ def remove_room_member(room_id, user_id):
         (room_id, user_id)
     )
 
-    return True
+    return True
+
+def update_member_role(room_id, user_id, role):
+    execute(
+        """
+        UPDATE room_members
+        SET role = ?
+        WHERE room_id = ?
+        AND user_id = ?
+        """,
+        (role, room_id, user_id),
+    )