coder · jakehwll · Apr 23, 2026 · Jun 22, 2026 · Jun 22, 2026 · Jun 23, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -1588,6 +1588,7 @@ func New(options *Options) *API {
 				r.Get("/paginated-members", api.paginatedMembers)
 				r.Route("/members", func(r chi.Router) {
 					r.Get("/", api.listMembers)
+					r.Post("/", api.postOrganizationMembers)
 					r.Route("/roles", func(r chi.Router) {
 						r.Get("/", api.assignableOrgRoles)
 					})

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -1697,6 +1697,38 @@ func scopedOrgRoleIdentifiers(names []string, orgID uuid.UUID) []rbac.RoleIdenti
 	return out
 }
 
+// authorizeOrganizationMemberRoleAssignment authorizes granting the given roles
+// when adding a member to an organization. It does not authorize the member
+// insert itself; callers must separately authorize ActionCreate on the
+// organization_member object. The org's default_org_member_roles are implied at
+// request time by GetAuthorizationUserRoles, so canAssignRoles must cover the
+// full effective set (the explicit roles, organization-member, plus the
+// defaults). Both the single-member and batch insert wrappers share this
+// preamble so the role-assignment check cannot drift between them.
+func (q *querier) authorizeOrganizationMemberRoleAssignment(ctx context.Context, organizationID uuid.UUID, roles []string) error {
+	orgRoles, err := q.convertToOrganizationRoles(organizationID, roles)
+	if err != nil {
+		return xerrors.Errorf("converting to organization roles: %w", err)
+	}
+
+	org, err := q.db.GetOrganizationByID(ctx, organizationID)
+	if err != nil {
+		return xerrors.Errorf("get organization: %w", err)
+	}
+	defaultRoles, err := q.convertToOrganizationRoles(organizationID, org.DefaultOrgMemberRoles)
+	if err != nil {
+		return xerrors.Errorf("convert default member roles: %w", err)
+	}
+
+	// All roles are added roles. Org member is always implied.
+	addedRoles := slices.Concat(
+		orgRoles,
+		[]rbac.RoleIdentifier{rbac.ScopedRoleOrgMember(organizationID)},
+		defaultRoles,
+	)
+	return q.canAssignRoles(ctx, organizationID, addedRoles, []rbac.RoleIdentifier{})
+}
+
 func (q *querier) AcquireLock(ctx context.Context, id int64) error {
 	return q.db.AcquireLock(ctx, id)
 }
@@ -6201,35 +6233,28 @@ func (q *querier) InsertOrganization(ctx context.Context, arg database.InsertOrg
 }
 
 func (q *querier) InsertOrganizationMember(ctx context.Context, arg database.InsertOrganizationMemberParams) (database.OrganizationMember, error) {
-	orgRoles, err := q.convertToOrganizationRoles(arg.OrganizationID, arg.Roles)
-	if err != nil {
-		return database.OrganizationMember{}, xerrors.Errorf("converting to organization roles: %w", err)
+	if err := q.authorizeOrganizationMemberRoleAssignment(ctx, arg.OrganizationID, arg.Roles); err != nil {
+		return database.OrganizationMember{}, err
 	}
 
-	// The org's default_org_member_roles are implied at request time by
-	// GetAuthorizationUserRoles. Include them in canAssignRoles so the
-	// caller is required to be authorized to grant the full effective set
-	// (the explicit roles, organization-member, plus the defaults).
-	org, err := q.db.GetOrganizationByID(ctx, arg.OrganizationID)
-	if err != nil {
-		return database.OrganizationMember{}, xerrors.Errorf("get organization: %w", err)
-	}
-	defaultRoles, err := q.convertToOrganizationRoles(arg.OrganizationID, org.DefaultOrgMemberRoles)
-	if err != nil {
-		return database.OrganizationMember{}, xerrors.Errorf("convert default member roles: %w", err)
+	// Scope the create authorization to the specific user being added.
+	obj := rbac.ResourceOrganizationMember.InOrg(arg.OrganizationID).WithID(arg.UserID)
+	return insert(q.log, q.auth, obj, q.db.InsertOrganizationMember)(ctx, arg)
+}
+
+func (q *querier) InsertOrganizationMembersBatch(ctx context.Context, arg database.InsertOrganizationMembersBatchParams) ([]database.OrganizationMember, error) {
+	if err := q.authorizeOrganizationMemberRoleAssignment(ctx, arg.OrganizationID, arg.Roles); err != nil {
+		return nil, err
 	}
 
-	// All roles are added roles. Org member is always implied.
-	//nolint:gocritic
-	addedRoles := append(orgRoles, rbac.ScopedRoleOrgMember(arg.OrganizationID))
-	addedRoles = append(addedRoles, defaultRoles...)
-	err = q.canAssignRoles(ctx, arg.OrganizationID, addedRoles, []rbac.RoleIdentifier{})
-	if err != nil {
-		return database.OrganizationMember{}, err
+	// The batch inserts multiple users, so the create permission is authorized
+	// at the organization scope rather than a single user ID.
+	obj := rbac.ResourceOrganizationMember.InOrg(arg.OrganizationID)
+	if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
+		return nil, err
 	}
 
-	obj := rbac.ResourceOrganizationMember.InOrg(arg.OrganizationID).WithID(arg.UserID)
-	return insert(q.log, q.auth, obj, q.db.InsertOrganizationMember)(ctx, arg)
+	return q.db.InsertOrganizationMembersBatch(ctx, arg)
 }
 
 func (q *querier) InsertPreset(ctx context.Context, arg database.InsertPresetParams) (database.TemplateVersionPreset, error) {

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -2509,6 +2509,25 @@ func (s *MethodTestSuite) TestOrganization() {
 			rbac.ResourceOrganizationMember.InOrg(o.ID).WithID(u.ID), policy.ActionCreate,
 		)
 	}))
+	s.Run("InsertOrganizationMembersBatch", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		o := testutil.Fake(s.T(), faker, database.Organization{DefaultOrgMemberRoles: []string{codersdk.RoleOrganizationAdmin}})
+		u1 := testutil.Fake(s.T(), faker, database.User{})
+		u2 := testutil.Fake(s.T(), faker, database.User{})
+		arg := database.InsertOrganizationMembersBatchParams{
+			OrganizationID: o.ID,
+			UserIds:        []uuid.UUID{u1.ID, u2.ID},
+			Roles:          []string{codersdk.RoleOrganizationAdmin},
+		}
+		dbm.EXPECT().GetOrganizationByID(gomock.Any(), o.ID).Return(o, nil).AnyTimes()
+		dbm.EXPECT().InsertOrganizationMembersBatch(gomock.Any(), arg).Return([]database.OrganizationMember{
+			{OrganizationID: o.ID, UserID: u1.ID, Roles: arg.Roles},
+			{OrganizationID: o.ID, UserID: u2.ID, Roles: arg.Roles},
+		}, nil).AnyTimes()
+		check.Args(arg).Asserts(
+			rbac.ResourceAssignOrgRole.InOrg(o.ID), policy.ActionAssign,
+			rbac.ResourceOrganizationMember.InOrg(o.ID), policy.ActionCreate,
+		)
+	}))
 	s.Run("InsertPreset", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		arg := database.InsertPresetParams{TemplateVersionID: uuid.New(), Name: "test"}
 		dbm.EXPECT().InsertPreset(gomock.Any(), arg).Return(database.TemplateVersionPreset{}, nil).AnyTimes()

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go