From a38678f30d6ba7984e175e81380f551cb0dd09c8 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Wed, 12 May 2021 19:14:41 +0530
Subject: [PATCH 01/11] feat: adding update membership role

---
 app/config/events.php                        |   5 +
 app/controllers/api/teams.php                | 106 ++++++-
 tests/e2e/Services/Teams/TeamsBaseClient.php | 280 +++++++++++--------
 3 files changed, 270 insertions(+), 121 deletions(-)

diff --git a/app/config/events.php b/app/config/events.php
index bbccb62de9..b27a5eafb9 100644
--- a/app/config/events.php
+++ b/app/config/events.php
@@ -197,6 +197,11 @@ return [
         'model' => Response::MODEL_MEMBERSHIP,
         'note' => 'version >= 0.7',
     ],
+    'teams.memberships.update' => [
+        'description' => 'This event triggers when a team membership is updated.',
+        'model' => Response::MODEL_MEMBERSHIP,
+        'note' => 'version >= 0.8',
+    ],
     'teams.memberships.update.status' => [
         'description' => 'This event triggers when a team memberships status is updated.',
         'model' => Response::MODEL_MEMBERSHIP,
diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 62836ea428..79c8b502c6 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -444,7 +444,7 @@ App::post('/v1/teams/:teamId/memberships')
             ->setParam('{{text-cta}}', '#ffffff')
         ;
 
-        if (!$isPrivilegedUser && !$isAppUser) { // No need in comfirmation when in admin or app mode
+        if (!$isPrivilegedUser && !$isAppUser) { // No need of confirmation when in admin or app mode
             $mails
                 ->setParam('event', 'teams.membership.create')
                 ->setParam('from', ($project->getId() === 'console') ? '' : \sprintf($locale->getText('account.emails.team'), $project->getAttribute('name')))
@@ -471,6 +471,110 @@ App::post('/v1/teams/:teamId/memberships')
         ;
     });
 
+App::patch('/v1/teams/:teamId/memberships/:membershipId')
+    ->desc('Update Membership Roles')
+    ->groups(['api', 'teams'])
+    ->label('event', 'teams.memberships.update')
+    ->label('scope', 'public')
+    ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY])
+    ->label('sdk.namespace', 'teams')
+    ->label('sdk.method', 'updateMembershipRoles')
+    ->label('sdk.description', '/docs/references/teams/update-team-membership-roles.md')
+    ->label('sdk.response.code', Response::STATUS_CODE_OK)
+    ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
+    ->label('sdk.response.model', Response::MODEL_MEMBERSHIP)
+    ->param('teamId', '', new UID(), 'Team unique ID.')
+    ->param('membershipId', '', new UID(), 'Membership ID.')
+    ->param('roles', [], new ArrayList(new Key()), 'Array of strings. Use this param to set the user roles in the team. A role can be any string. Learn more about [roles and permissions](/docs/permissions). Max length for each role is 32 chars.')
+    ->inject('request')
+    ->inject('response')
+    ->inject('user')
+    ->inject('projectDB')
+    ->inject('audits')
+    ->action(function ($teamId, $membershipId, $roles, $request, $response, $user, $projectDB,$audits) {
+        /** @var Utopia\Swoole\Request $request */
+        /** @var Appwrite\Utopia\Response $response */
+        /** @var Appwrite\Database\Document $user */
+        /** @var Appwrite\Database\Database $projectDB */
+        /** @var Appwrite\Event\Event $audits */
+
+        $membership = $projectDB->getDocument($membershipId);
+        if (empty($membership->getId()) || Database::SYSTEM_COLLECTION_MEMBERSHIPS != $membership->getCollection()) {
+            throw new Exception('Membership not found', 404);
+        }
+
+        if ($membership->getAttribute('teamId') !== $teamId) {
+            throw new Exception('Team IDs don\'t match', 404);
+        }
+
+        $team = $projectDB->getDocument($teamId);
+        if (empty($team->getId()) || Database::SYSTEM_COLLECTION_TEAMS != $team->getCollection()) {
+            throw new Exception('Team not found', 404);
+        }
+
+        $userId = $membership->getAttribute('userId', '');
+        $user = $projectDB->getCollectionFirst([ // Get user
+            'limit' => 1,
+            'filters' => [
+                '$collection='.Database::SYSTEM_COLLECTION_USERS,
+                '$id='.$userId,
+            ],
+        ]);
+
+        if (empty($user) || $user->getId() === null) {
+            throw new Exception("User associated with Membership Id not found", 404);
+        }
+
+        $membership // Update the roles
+            ->setAttribute('roles', $roles)
+        ;
+
+        $user
+            ->setAttribute('memberships', $membership, Document::SET_TYPE_APPEND)
+        ;
+
+        $user = $projectDB->updateDocument($user->getArrayCopy());
+
+        if (false === $user) {
+            throw new Exception('Failed saving user to DB', 500);
+        }
+
+        Authorization::disable();
+
+        $team = $projectDB->updateDocument(\array_merge($team->getArrayCopy(), [
+            'sum' => $team->getAttribute('sum', 0) + 1,
+        ]));
+
+        Authorization::reset();
+
+        if (false === $team) {
+            throw new Exception('Failed saving team to DB', 500);
+        }
+
+        $audits
+            ->setParam('userId', $user->getId())
+            ->setParam('event', 'teams.membership.update')
+            ->setParam('resource', 'teams/'.$teamId)
+        ;
+
+        if (!Config::getParam('domainVerification')) {
+            $response
+                ->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $secret)]))
+            ;
+        }
+
+        $response
+            ->addCookie(Auth::$cookieName.'_legacy', Auth::encodeSession($user->getId(), $secret), $expiry, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null)
+            ->addCookie(Auth::$cookieName, Auth::encodeSession($user->getId(), $secret), $expiry, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, Config::getParam('cookieSamesite'))
+        ;
+
+        $response->dynamic(new Document(\array_merge($membership->getArrayCopy(), [
+            'email' => $user->getAttribute('email'),
+            'name' => $user->getAttribute('name'),
+        ])), Response::MODEL_MEMBERSHIP);
+
+    });
+
 App::get('/v1/teams/:teamId/memberships')
     ->desc('Get Team Memberships')
     ->groups(['api', 'teams'])
diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index e41e5531ff..084f5c6aa4 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -6,34 +6,34 @@ use Tests\E2E\Client;
 
 trait TeamsBaseClient
 {
-    /**
-     * @depends testCreateTeam
-     */
-    public function testGetTeamMemberships($data):array
-    {
-        $teamUid = $data['teamUid'] ?? '';
+    // /**
+    //  * @depends testCreateTeam
+    //  */
+    // public function testGetTeamMemberships($data):array
+    // {
+    //     $teamUid = $data['teamUid'] ?? '';
 
-        /**
-         * Test for SUCCESS
-         */
-        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships', array_merge([
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders()));
+    //     /**
+    //      * Test for SUCCESS
+    //      */
+    //     $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships', array_merge([
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ], $this->getHeaders()));
 
-        $this->assertEquals(200, $response['headers']['status-code']);
-        $this->assertIsInt($response['body']['sum']);
-        $this->assertNotEmpty($response['body']['memberships'][0]['$id']);
-        $this->assertEquals($this->getUser()['name'], $response['body']['memberships'][0]['name']);
-        $this->assertEquals($this->getUser()['email'], $response['body']['memberships'][0]['email']);
-        $this->assertEquals('owner', $response['body']['memberships'][0]['roles'][0]);
+    //     $this->assertEquals(200, $response['headers']['status-code']);
+    //     $this->assertIsInt($response['body']['sum']);
+    //     $this->assertNotEmpty($response['body']['memberships'][0]['$id']);
+    //     $this->assertEquals($this->getUser()['name'], $response['body']['memberships'][0]['name']);
+    //     $this->assertEquals($this->getUser()['email'], $response['body']['memberships'][0]['email']);
+    //     $this->assertEquals('owner', $response['body']['memberships'][0]['roles'][0]);
 
-        /**
-         * Test for FAILURE
-         */
+    //     /**
+    //      * Test for FAILURE
+    //      */
 
-        return $data;
-    }
+    //     return $data;
+    // }
 
     /**
      * @depends testCreateTeam
@@ -122,118 +122,158 @@ trait TeamsBaseClient
         ];
     }
 
+    // /**
+    //  * @depends testCreateTeamMembership
+    //  */
+    // public function testUpdateTeamMembership($data):array
+    // {
+    //     $teamUid = $data['teamUid'] ?? '';
+    //     $secret = $data['secret'] ?? '';
+    //     $membershipUid = $data['membershipUid'] ?? '';
+    //     $userUid = $data['userUid'] ?? '';
+
+    //     /**
+    //      * Test for SUCCESS
+    //      */
+    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ]), [
+    //         'secret' => $secret,
+    //         'userId' => $userUid,
+    //     ]);
+
+    //     $this->assertEquals(200, $response['headers']['status-code']);
+    //     $this->assertNotEmpty($response['body']['$id']);
+    //     $this->assertNotEmpty($response['body']['userId']);
+    //     $this->assertNotEmpty($response['body']['teamId']);
+    //     $this->assertCount(2, $response['body']['roles']);
+    //     $this->assertIsInt($response['body']['joined']);
+    //     $this->assertEquals(true, $response['body']['confirm']);
+
+    //     /**
+    //      * Test for FAILURE
+    //      */
+    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ]), [
+    //         'secret' => 'sdasdasd',
+    //         'userId' => $userUid,
+    //     ]);
+
+    //     $this->assertEquals(401, $response['headers']['status-code']);
+
+    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ]), [
+    //         'secret' => '',
+    //         'userId' => $userUid,
+    //     ]);
+
+    //     $this->assertEquals(400, $response['headers']['status-code']);
+
+    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ]), [
+    //         'secret' => $secret,
+    //         'userId' => 'sdasd',
+    //     ]);
+
+    //     $this->assertEquals(401, $response['headers']['status-code']);
+
+    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ]), [
+    //         'secret' => $secret,
+    //         'userId' => '',
+    //     ]);
+
+    //     $this->assertEquals(400, $response['headers']['status-code']);
+
+    //     return $data;
+    // }
+
+    // /**
+    //  * @depends testUpdateTeamMembership
+    //  */
+    // public function testDeleteTeamMembership($data):array
+    // {
+    //     $teamUid = $data['teamUid'] ?? '';
+    //     $membershipUid = $data['membershipUid'] ?? '';
+        
+    //     /**
+    //      * Test for SUCCESS
+    //      */
+    //     $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ], $this->getHeaders()));
+
+    //     $this->assertEquals(204, $response['headers']['status-code']);
+    //     $this->assertEmpty($response['body']);
+
+    //     /**
+    //      * Test for FAILURE
+    //      */
+    //     $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+    //         'origin' => 'http://localhost',
+    //         'content-type' => 'application/json',
+    //         'x-appwrite-project' => $this->getProject()['$id'],
+    //     ], $this->getHeaders()));
+
+    //     $this->assertEquals(200, $response['headers']['status-code']);
+    //     $this->assertCount(1, $response['body']['memberships']);
+
+    //     return [];
+    // }
+
     /**
      * @depends testCreateTeamMembership
      */
-    public function testUpdateTeamMembership($data):array
-    {
-        $teamUid = $data['teamUid'] ?? '';
-        $secret = $data['secret'] ?? '';
-        $membershipUid = $data['membershipUid'] ?? '';
-        $userUid = $data['userUid'] ?? '';
-
-        /**
-         * Test for SUCCESS
-         */
-        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ]), [
-            'secret' => $secret,
-            'userId' => $userUid,
-        ]);
-
-        $this->assertEquals(200, $response['headers']['status-code']);
-        $this->assertNotEmpty($response['body']['$id']);
-        $this->assertNotEmpty($response['body']['userId']);
-        $this->assertNotEmpty($response['body']['teamId']);
-        $this->assertCount(2, $response['body']['roles']);
-        $this->assertIsInt($response['body']['joined']);
-        $this->assertEquals(true, $response['body']['confirm']);
-
-        /**
-         * Test for FAILURE
-         */
-        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ]), [
-            'secret' => 'sdasdasd',
-            'userId' => $userUid,
-        ]);
-
-        $this->assertEquals(401, $response['headers']['status-code']);
-
-        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ]), [
-            'secret' => '',
-            'userId' => $userUid,
-        ]);
-
-        $this->assertEquals(400, $response['headers']['status-code']);
-
-        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ]), [
-            'secret' => $secret,
-            'userId' => 'sdasd',
-        ]);
-
-        $this->assertEquals(401, $response['headers']['status-code']);
-
-        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ]), [
-            'secret' => $secret,
-            'userId' => '',
-        ]);
-
-        $this->assertEquals(400, $response['headers']['status-code']);
-
-        return $data;
-    }
-
-    /**
-     * @depends testUpdateTeamMembership
-     */
-    public function testDeleteTeamMembership($data):array
+    public function testUpdateTeamMembershipRoles($data):array
     {
         $teamUid = $data['teamUid'] ?? '';
         $membershipUid = $data['membershipUid'] ?? '';
-        
+   
         /**
          * Test for SUCCESS
          */
-        $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
             'origin' => 'http://localhost',
             'content-type' => 'application/json',
             'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders()));
+        ], $this->getHeaders(), [
+            
+        ]));
 
-        $this->assertEquals(204, $response['headers']['status-code']);
-        $this->assertEmpty($response['body']);
+        var_dump($response);
+        var_dump($teamUid);
+        var_dump($membershipUid);
+        exit();     
 
-        /**
-         * Test for FAILURE
-         */
-        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders()));
+        // /**
+        //  * Test for FAILURE
+        //  */
+        // $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+        //     'origin' => 'http://localhost',
+        //     'content-type' => 'application/json',
+        //     'x-appwrite-project' => $this->getProject()['$id'],
+        // ], $this->getHeaders()));
 
-        $this->assertEquals(200, $response['headers']['status-code']);
-        $this->assertCount(1, $response['body']['memberships']);
+        // $this->assertEquals(200, $response['headers']['status-code']);
+        // $this->assertCount(1, $response['body']['memberships']);
 
         return [];
     }
+
 }
\ No newline at end of file

From 10435d43927a26cdf8fbd934f9622b7d81f37283 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Wed, 12 May 2021 20:17:56 +0530
Subject: [PATCH 02/11] feat: update membership roles

---
 app/controllers/api/teams.php | 61 ++++++-----------------------------
 1 file changed, 10 insertions(+), 51 deletions(-)

diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 79c8b502c6..3e34df1b53 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -498,6 +498,11 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
         /** @var Appwrite\Database\Database $projectDB */
         /** @var Appwrite\Event\Event $audits */
 
+        $team = $projectDB->getDocument($teamId);
+        if (empty($team->getId()) || Database::SYSTEM_COLLECTION_TEAMS != $team->getCollection()) {
+            throw new Exception('Team not found', 404);
+        }
+
         $membership = $projectDB->getDocument($membershipId);
         if (empty($membership->getId()) || Database::SYSTEM_COLLECTION_MEMBERSHIPS != $membership->getCollection()) {
             throw new Exception('Membership not found', 404);
@@ -507,48 +512,16 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             throw new Exception('Team IDs don\'t match', 404);
         }
 
-        $team = $projectDB->getDocument($teamId);
-        if (empty($team->getId()) || Database::SYSTEM_COLLECTION_TEAMS != $team->getCollection()) {
-            throw new Exception('Team not found', 404);
-        }
-
-        $userId = $membership->getAttribute('userId', '');
-        $user = $projectDB->getCollectionFirst([ // Get user
-            'limit' => 1,
-            'filters' => [
-                '$collection='.Database::SYSTEM_COLLECTION_USERS,
-                '$id='.$userId,
-            ],
-        ]);
-
-        if (empty($user) || $user->getId() === null) {
-            throw new Exception("User associated with Membership Id not found", 404);
-        }
+        // Only team owner or api key should be allowed to make this request.
 
         $membership // Update the roles
             ->setAttribute('roles', $roles)
         ;
 
-        $user
-            ->setAttribute('memberships', $membership, Document::SET_TYPE_APPEND)
-        ;
+        $membership = $projectDB->updateDocument($membership->getArrayCopy());
 
-        $user = $projectDB->updateDocument($user->getArrayCopy());
-
-        if (false === $user) {
-            throw new Exception('Failed saving user to DB', 500);
-        }
-
-        Authorization::disable();
-
-        $team = $projectDB->updateDocument(\array_merge($team->getArrayCopy(), [
-            'sum' => $team->getAttribute('sum', 0) + 1,
-        ]));
-
-        Authorization::reset();
-
-        if (false === $team) {
-            throw new Exception('Failed saving team to DB', 500);
+        if (false === $membership) {
+            throw new Exception('Failed updating membership', 500);
         }
 
         $audits
@@ -557,21 +530,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             ->setParam('resource', 'teams/'.$teamId)
         ;
 
-        if (!Config::getParam('domainVerification')) {
-            $response
-                ->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $secret)]))
-            ;
-        }
-
-        $response
-            ->addCookie(Auth::$cookieName.'_legacy', Auth::encodeSession($user->getId(), $secret), $expiry, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null)
-            ->addCookie(Auth::$cookieName, Auth::encodeSession($user->getId(), $secret), $expiry, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, Config::getParam('cookieSamesite'))
-        ;
-
-        $response->dynamic(new Document(\array_merge($membership->getArrayCopy(), [
-            'email' => $user->getAttribute('email'),
-            'name' => $user->getAttribute('name'),
-        ])), Response::MODEL_MEMBERSHIP);
+        $response->dynamic(new Document($membership->getArrayCopy()), Response::MODEL_MEMBERSHIP);
 
     });
 

From 31dc2d79eb27e86c4549161b725589cd9f4e39cf Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Wed, 12 May 2021 22:30:22 +0530
Subject: [PATCH 03/11] feat: added enpoint for updating membership roles

---
 app/controllers/api/teams.php                |  34 ++-
 tests/e2e/Services/Teams/TeamsBaseClient.php | 213 +++++++++++--------
 2 files changed, 150 insertions(+), 97 deletions(-)

diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 3e34df1b53..7c5614d700 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -508,16 +508,31 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             throw new Exception('Membership not found', 404);
         }
 
-        if ($membership->getAttribute('teamId') !== $teamId) {
-            throw new Exception('Team IDs don\'t match', 404);
+        $memberships = $projectDB->getCollection([
+            'limit' => 2000,
+            'offset' => 0,
+            'filters' => [
+                '$collection='.Database::SYSTEM_COLLECTION_MEMBERSHIPS,
+                'teamId='.$team->getId(),
+            ],
+        ]);
+
+        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::$roles);
+        $isAppUser = Auth::isAppUser(Authorization::$roles);
+        $isOwner = false;
+
+        foreach ($memberships as $member) {
+            if ($member->getAttribute('userId') == $user->getId() && \in_array('owner', $member->getAttribute('roles', []))) {
+                $isOwner = true;
+            }
+        }
+        
+        if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
+            throw new Exception('User is not allowed to modify roles', 401);
         }
 
-        // Only team owner or api key should be allowed to make this request.
-
-        $membership // Update the roles
-            ->setAttribute('roles', $roles)
-        ;
-
+        // Update the roles
+        $membership->setAttribute('roles', $roles);
         $membership = $projectDB->updateDocument($membership->getArrayCopy());
 
         if (false === $membership) {
@@ -526,12 +541,11 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
 
         $audits
             ->setParam('userId', $user->getId())
-            ->setParam('event', 'teams.membership.update')
+            ->setParam('event', 'teams.memberships.update')
             ->setParam('resource', 'teams/'.$teamId)
         ;
 
         $response->dynamic(new Document($membership->getArrayCopy()), Response::MODEL_MEMBERSHIP);
-
     });
 
 App::get('/v1/teams/:teamId/memberships')
diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index 084f5c6aa4..478eccb943 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -122,85 +122,88 @@ trait TeamsBaseClient
         ];
     }
 
-    // /**
-    //  * @depends testCreateTeamMembership
-    //  */
-    // public function testUpdateTeamMembership($data):array
-    // {
-    //     $teamUid = $data['teamUid'] ?? '';
-    //     $secret = $data['secret'] ?? '';
-    //     $membershipUid = $data['membershipUid'] ?? '';
-    //     $userUid = $data['userUid'] ?? '';
+    /**
+     * @depends testCreateTeamMembership
+     */
+    public function testUpdateTeamMembership($data):array
+    {
+        $teamUid = $data['teamUid'] ?? '';
+        $secret = $data['secret'] ?? '';
+        $membershipUid = $data['membershipUid'] ?? '';
+        $userUid = $data['userUid'] ?? '';
 
-    //     /**
-    //      * Test for SUCCESS
-    //      */
-    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ]), [
-    //         'secret' => $secret,
-    //         'userId' => $userUid,
-    //     ]);
+        /**
+         * Test for SUCCESS
+         */
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ]), [
+            'secret' => $secret,
+            'userId' => $userUid,
+        ]);
 
-    //     $this->assertEquals(200, $response['headers']['status-code']);
-    //     $this->assertNotEmpty($response['body']['$id']);
-    //     $this->assertNotEmpty($response['body']['userId']);
-    //     $this->assertNotEmpty($response['body']['teamId']);
-    //     $this->assertCount(2, $response['body']['roles']);
-    //     $this->assertIsInt($response['body']['joined']);
-    //     $this->assertEquals(true, $response['body']['confirm']);
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertNotEmpty($response['body']['$id']);
+        $this->assertNotEmpty($response['body']['userId']);
+        $this->assertNotEmpty($response['body']['teamId']);
+        $this->assertCount(2, $response['body']['roles']);
+        $this->assertIsInt($response['body']['joined']);
+        $this->assertEquals(true, $response['body']['confirm']);
 
-    //     /**
-    //      * Test for FAILURE
-    //      */
-    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ]), [
-    //         'secret' => 'sdasdasd',
-    //         'userId' => $userUid,
-    //     ]);
+        $session = $this->client->parseCookie((string)$response['headers']['set-cookie'])['a_session_'.$this->getProject()['$id']];
+        $data['session'] = $session;
 
-    //     $this->assertEquals(401, $response['headers']['status-code']);
+        /**
+         * Test for FAILURE
+         */
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ]), [
+            'secret' => 'sdasdasd',
+            'userId' => $userUid,
+        ]);
 
-    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ]), [
-    //         'secret' => '',
-    //         'userId' => $userUid,
-    //     ]);
+        $this->assertEquals(401, $response['headers']['status-code']);
 
-    //     $this->assertEquals(400, $response['headers']['status-code']);
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ]), [
+            'secret' => '',
+            'userId' => $userUid,
+        ]);
 
-    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ]), [
-    //         'secret' => $secret,
-    //         'userId' => 'sdasd',
-    //     ]);
+        $this->assertEquals(400, $response['headers']['status-code']);
 
-    //     $this->assertEquals(401, $response['headers']['status-code']);
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ]), [
+            'secret' => $secret,
+            'userId' => 'sdasd',
+        ]);
 
-    //     $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ]), [
-    //         'secret' => $secret,
-    //         'userId' => '',
-    //     ]);
+        $this->assertEquals(401, $response['headers']['status-code']);
 
-    //     $this->assertEquals(400, $response['headers']['status-code']);
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid.'/status', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ]), [
+            'secret' => $secret,
+            'userId' => '',
+        ]);
 
-    //     return $data;
-    // }
+        $this->assertEquals(400, $response['headers']['status-code']);
+
+        return $data;
+    }
 
     // /**
     //  * @depends testUpdateTeamMembership
@@ -238,41 +241,77 @@ trait TeamsBaseClient
     // }
 
     /**
-     * @depends testCreateTeamMembership
+     * @depends testUpdateTeamMembership
      */
     public function testUpdateTeamMembershipRoles($data):array
     {
         $teamUid = $data['teamUid'] ?? '';
         $membershipUid = $data['membershipUid'] ?? '';
-   
+        $session = $data['session'] ?? '';
+
         /**
          * Test for SUCCESS
          */
+        $roles = ['admin', 'editor', 'uncle'];
         $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
             'origin' => 'http://localhost',
             'content-type' => 'application/json',
             'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders(), [
-            
-        ]));
+        ], $this->getHeaders()), [
+            'roles' => $roles
+        ]);
 
-        var_dump($response);
-        var_dump($teamUid);
-        var_dump($membershipUid);
-        exit();     
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertNotEmpty($response['body']['$id']);
+        $this->assertNotEmpty($response['body']['userId']);
+        $this->assertNotEmpty($response['body']['teamId']);
+        $this->assertCount(count($roles), $response['body']['roles']);
+        $this->assertEquals($roles[0], $response['body']['roles'][0]);
+        $this->assertEquals($roles[1], $response['body']['roles'][1]);
+        $this->assertEquals($roles[2], $response['body']['roles'][2]);
 
-        // /**
-        //  * Test for FAILURE
-        //  */
-        // $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-        //     'origin' => 'http://localhost',
-        //     'content-type' => 'application/json',
-        //     'x-appwrite-project' => $this->getProject()['$id'],
-        // ], $this->getHeaders()));
+        /**
+         * Test for unknown team
+         */
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.'abc'.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'roles' => $roles
+        ]);
 
-        // $this->assertEquals(200, $response['headers']['status-code']);
-        // $this->assertCount(1, $response['body']['memberships']);
+        $this->assertEquals(404, $response['headers']['status-code']);
 
+        /**
+         * Test for unknown membership ID
+         */
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.'abc', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'roles' => $roles
+        ]);
+
+        $this->assertEquals(404, $response['headers']['status-code']);
+
+        
+        /**
+         * Test for when a user other than the owner tries to update membership
+         */
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid, [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+            'cookie' => 'a_session_'.$this->getProject()['$id'].'=' . $session,
+        ], [
+            'roles' => $roles
+        ]);
+
+        $this->assertEquals(401, $response['headers']['status-code']);
+        $this->assertEquals('User is not allowed to modify roles', $response['body']['message']);
+        
         return [];
     }
 

From 978f6463fca5232aaf0445f2c69351fc69345c8d Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Wed, 12 May 2021 22:32:08 +0530
Subject: [PATCH 04/11] feat: uncomment tests

---
 tests/e2e/Services/Teams/TeamsBaseClient.php | 106 +++++++++----------
 1 file changed, 53 insertions(+), 53 deletions(-)

diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index 478eccb943..1f8a9ec950 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -6,34 +6,34 @@ use Tests\E2E\Client;
 
 trait TeamsBaseClient
 {
-    // /**
-    //  * @depends testCreateTeam
-    //  */
-    // public function testGetTeamMemberships($data):array
-    // {
-    //     $teamUid = $data['teamUid'] ?? '';
+    /**
+     * @depends testCreateTeam
+     */
+    public function testGetTeamMemberships($data):array
+    {
+        $teamUid = $data['teamUid'] ?? '';
 
-    //     /**
-    //      * Test for SUCCESS
-    //      */
-    //     $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships', array_merge([
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ], $this->getHeaders()));
+        /**
+         * Test for SUCCESS
+         */
+        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
 
-    //     $this->assertEquals(200, $response['headers']['status-code']);
-    //     $this->assertIsInt($response['body']['sum']);
-    //     $this->assertNotEmpty($response['body']['memberships'][0]['$id']);
-    //     $this->assertEquals($this->getUser()['name'], $response['body']['memberships'][0]['name']);
-    //     $this->assertEquals($this->getUser()['email'], $response['body']['memberships'][0]['email']);
-    //     $this->assertEquals('owner', $response['body']['memberships'][0]['roles'][0]);
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertIsInt($response['body']['sum']);
+        $this->assertNotEmpty($response['body']['memberships'][0]['$id']);
+        $this->assertEquals($this->getUser()['name'], $response['body']['memberships'][0]['name']);
+        $this->assertEquals($this->getUser()['email'], $response['body']['memberships'][0]['email']);
+        $this->assertEquals('owner', $response['body']['memberships'][0]['roles'][0]);
 
-    //     /**
-    //      * Test for FAILURE
-    //      */
+        /**
+         * Test for FAILURE
+         */
 
-    //     return $data;
-    // }
+        return $data;
+    }
 
     /**
      * @depends testCreateTeam
@@ -205,40 +205,40 @@ trait TeamsBaseClient
         return $data;
     }
 
-    // /**
-    //  * @depends testUpdateTeamMembership
-    //  */
-    // public function testDeleteTeamMembership($data):array
-    // {
-    //     $teamUid = $data['teamUid'] ?? '';
-    //     $membershipUid = $data['membershipUid'] ?? '';
+    /**
+     * @depends testUpdateTeamMembership
+     */
+    public function testDeleteTeamMembership($data):array
+    {
+        $teamUid = $data['teamUid'] ?? '';
+        $membershipUid = $data['membershipUid'] ?? '';
         
-    //     /**
-    //      * Test for SUCCESS
-    //      */
-    //     $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ], $this->getHeaders()));
+        /**
+         * Test for SUCCESS
+         */
+        $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
 
-    //     $this->assertEquals(204, $response['headers']['status-code']);
-    //     $this->assertEmpty($response['body']);
+        $this->assertEquals(204, $response['headers']['status-code']);
+        $this->assertEmpty($response['body']);
 
-    //     /**
-    //      * Test for FAILURE
-    //      */
-    //     $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-    //         'origin' => 'http://localhost',
-    //         'content-type' => 'application/json',
-    //         'x-appwrite-project' => $this->getProject()['$id'],
-    //     ], $this->getHeaders()));
+        /**
+         * Test for FAILURE
+         */
+        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
 
-    //     $this->assertEquals(200, $response['headers']['status-code']);
-    //     $this->assertCount(1, $response['body']['memberships']);
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertCount(1, $response['body']['memberships']);
 
-    //     return [];
-    // }
+        return [];
+    }
 
     /**
      * @depends testUpdateTeamMembership

From df3f2d73e3b00464b00fd9f7369f62f314dc4826 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Wed, 12 May 2021 22:40:44 +0530
Subject: [PATCH 05/11] feat: reorder tests

---
 tests/e2e/Services/Teams/TeamsBaseClient.php | 70 ++++++++++----------
 1 file changed, 35 insertions(+), 35 deletions(-)

diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index 1f8a9ec950..f62329f7f3 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -205,41 +205,6 @@ trait TeamsBaseClient
         return $data;
     }
 
-    /**
-     * @depends testUpdateTeamMembership
-     */
-    public function testDeleteTeamMembership($data):array
-    {
-        $teamUid = $data['teamUid'] ?? '';
-        $membershipUid = $data['membershipUid'] ?? '';
-        
-        /**
-         * Test for SUCCESS
-         */
-        $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders()));
-
-        $this->assertEquals(204, $response['headers']['status-code']);
-        $this->assertEmpty($response['body']);
-
-        /**
-         * Test for FAILURE
-         */
-        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
-            'origin' => 'http://localhost',
-            'content-type' => 'application/json',
-            'x-appwrite-project' => $this->getProject()['$id'],
-        ], $this->getHeaders()));
-
-        $this->assertEquals(200, $response['headers']['status-code']);
-        $this->assertCount(1, $response['body']['memberships']);
-
-        return [];
-    }
-
     /**
      * @depends testUpdateTeamMembership
      */
@@ -312,6 +277,41 @@ trait TeamsBaseClient
         $this->assertEquals(401, $response['headers']['status-code']);
         $this->assertEquals('User is not allowed to modify roles', $response['body']['message']);
         
+        return $data;
+    }
+
+     /**
+     * @depends testUpdateTeamMembershipRoles
+     */
+    public function testDeleteTeamMembership($data):array
+    {
+        $teamUid = $data['teamUid'] ?? '';
+        $membershipUid = $data['membershipUid'] ?? '';
+        
+        /**
+         * Test for SUCCESS
+         */
+        $response = $this->client->call(Client::METHOD_DELETE, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
+
+        $this->assertEquals(204, $response['headers']['status-code']);
+        $this->assertEmpty($response['body']);
+
+        /**
+         * Test for FAILURE
+         */
+        $response = $this->client->call(Client::METHOD_GET, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
+
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertCount(1, $response['body']['memberships']);
+
         return [];
     }
 

From 3b74a92ab379e1ffc09dbd6640069af2decc1e9a Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Thu, 13 May 2021 19:31:52 +0530
Subject: [PATCH 06/11] Apply suggestions from code review

Co-authored-by: Eldad A. Fux <eldad.fux@gmail.com>
---
 app/controllers/api/teams.php | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 7c5614d700..22459ca970 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -508,24 +508,10 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             throw new Exception('Membership not found', 404);
         }
 
-        $memberships = $projectDB->getCollection([
-            'limit' => 2000,
-            'offset' => 0,
-            'filters' => [
-                '$collection='.Database::SYSTEM_COLLECTION_MEMBERSHIPS,
-                'teamId='.$team->getId(),
-            ],
-        ]);
 
         $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::$roles);
         $isAppUser = Auth::isAppUser(Authorization::$roles);
-        $isOwner = false;
-
-        foreach ($memberships as $member) {
-            if ($member->getAttribute('userId') == $user->getId() && \in_array('owner', $member->getAttribute('roles', []))) {
-                $isOwner = true;
-            }
-        }
+        $isOwner = Authorization::isRole('team:'.$team->getId().'/owner');;
         
         if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
             throw new Exception('User is not allowed to modify roles', 401);

From a35a567e0e7033cc7780561e371c55eb13ed3c85 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Thu, 13 May 2021 20:17:35 +0530
Subject: [PATCH 07/11] feat: added server side test

---
 app/controllers/api/teams.php                |  4 +-
 tests/e2e/Scopes/ProjectCustom.php           | 21 ++++++++
 tests/e2e/Services/Teams/TeamsBaseServer.php | 50 ++++++++++++++++++++
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 22459ca970..e9785fba7c 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -475,8 +475,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
     ->desc('Update Membership Roles')
     ->groups(['api', 'teams'])
     ->label('event', 'teams.memberships.update')
-    ->label('scope', 'public')
-    ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY])
+    ->label('scope', 'teams.write')
+    ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'teams')
     ->label('sdk.method', 'updateMembershipRoles')
     ->label('sdk.description', '/docs/references/teams/update-team-membership-roles.md')
diff --git a/tests/e2e/Scopes/ProjectCustom.php b/tests/e2e/Scopes/ProjectCustom.php
index fc35f1ddae..3f80285282 100644
--- a/tests/e2e/Scopes/ProjectCustom.php
+++ b/tests/e2e/Scopes/ProjectCustom.php
@@ -154,4 +154,25 @@ trait ProjectCustom
 
         return self::$project;
     }
+
+    public function getNewKey(array $scopes) {
+
+        $projectId = self::$project['$id'];
+
+        $key = $this->client->call(Client::METHOD_POST, '/projects/' . $projectId . '/keys', [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'cookie' => 'a_session_console=' . $this->getRoot()['session'],
+            'x-appwrite-project' => 'console',
+        ], [
+            'name' => 'Demo Project Key',
+            'scopes' => $scopes,
+        ]);
+
+        $this->assertEquals(201, $key['headers']['status-code']);
+        $this->assertNotEmpty($key['body']);
+        $this->assertNotEmpty($key['body']['secret']);
+
+        return $key['body']['secret'];
+    }
 }
diff --git a/tests/e2e/Services/Teams/TeamsBaseServer.php b/tests/e2e/Services/Teams/TeamsBaseServer.php
index 846c321b1b..44d75fdb32 100644
--- a/tests/e2e/Services/Teams/TeamsBaseServer.php
+++ b/tests/e2e/Services/Teams/TeamsBaseServer.php
@@ -64,6 +64,7 @@ trait TeamsBaseServer
         $this->assertEquals(true, $response['body']['confirm']);
 
         $userUid = $response['body']['userId'];
+        $membershipUid = $response['body']['$id'];
 
         // $response = $this->client->call(Client::METHOD_GET, '/users/'.$userUid, array_merge([
         //     'content-type' => 'application/json',
@@ -117,6 +118,55 @@ trait TeamsBaseServer
         return [
             'teamUid' => $teamUid,
             'userUid' => $userUid,
+            'membershipUid' => $membershipUid
         ];
     }
+
+    /**
+     * @depends testCreateTeamMembership
+     */
+    public function testUpdateMembershipRoles($data)
+    {
+        $teamUid = $data['teamUid'] ?? '';
+        $membershipUid = $data['membershipUid'] ?? '';
+
+        /**
+         * Test for SUCCESS
+         */
+        $roles = ['admin', 'editor', 'uncle'];
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid, array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'roles' => $roles
+        ]);
+
+        $this->assertEquals(200, $response['headers']['status-code']);
+        $this->assertNotEmpty($response['body']['$id']);
+        $this->assertNotEmpty($response['body']['userId']);
+        $this->assertNotEmpty($response['body']['teamId']);
+        $this->assertCount(count($roles), $response['body']['roles']);
+        $this->assertEquals($roles[0], $response['body']['roles'][0]);
+        $this->assertEquals($roles[1], $response['body']['roles'][1]);
+        $this->assertEquals($roles[2], $response['body']['roles'][2]);
+
+
+        /**
+         * Test for FAILURE
+         */
+        $apiKey = $this->getNewKey(['teams.read']);
+        $roles = ['admin', 'editor', 'uncle'];
+        $response = $this->client->call(Client::METHOD_PATCH, '/teams/'.$teamUid.'/memberships/'.$membershipUid, [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+            'x-appwrite-key' => $apiKey
+        ], [
+            'roles' => $roles
+        ]);
+
+        $this->assertEquals(401, $response['headers']['status-code']);
+
+    }
 }
\ No newline at end of file

From bd02cc83706a73e980aab02e880d10b0b5cd2ec2 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Thu, 13 May 2021 20:36:10 +0530
Subject: [PATCH 08/11] feat: added changelog

---
 CHANGES.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGES.md b/CHANGES.md
index 89f4609190..e44d04c8bc 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -22,6 +22,7 @@
 - Added a new env var named `_APP_LOCALE` that allow to change the default `en` locale value (#1056)
 - Updated all the console bottom control to be consistent. Dropped the `+` icon (#1062)
 - Added Response Models for Documents and Preferences (#1075, #1102)
+- Added new endpoint to update team membership roles (#1142)
 
 ## Bugs
 

From 732163bf9f0f7b54de56b016eeac3eb8b8f80c0c Mon Sep 17 00:00:00 2001
From: Eldad Fux <eldad.fux@gmail.com>
Date: Thu, 13 May 2021 20:05:19 +0300
Subject: [PATCH 09/11] Debug

---
 tests/e2e/Services/Teams/TeamsBaseClient.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index f62329f7f3..7dfb171b58 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -152,6 +152,8 @@ trait TeamsBaseClient
         $this->assertIsInt($response['body']['joined']);
         $this->assertEquals(true, $response['body']['confirm']);
 
+        var_dump($response);
+
         $session = $this->client->parseCookie((string)$response['headers']['set-cookie'])['a_session_'.$this->getProject()['$id']];
         $data['session'] = $session;
 

From 2c838bfa77ed797bd5e60e8663ef27ad50e2d62a Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Thu, 13 May 2021 23:29:54 +0530
Subject: [PATCH 10/11] fix: failing tests

---
 tests/e2e/Services/Teams/TeamsBaseClient.php | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index d5df4d4ebd..d1ced3ca11 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -157,6 +157,7 @@ trait TeamsBaseClient
         $this->assertIsInt($response['body']['joined']);
         $this->assertEquals(true, $response['body']['confirm']);
         $session = $this->client->parseCookie((string)$response['headers']['set-cookie'])['a_session_'.$this->getProject()['$id']];
+        $data['session'] = $session;
 
         /**
          * New User tries to update password without old password -> SHOULD PASS
@@ -212,11 +213,6 @@ trait TeamsBaseClient
         $this->assertEquals($response['body']['email'], $email);
         $this->assertEquals($response['body']['name'], $name);
 
-        var_dump($response);
-
-        $session = $this->client->parseCookie((string)$response['headers']['set-cookie'])['a_session_'.$this->getProject()['$id']];
-        $data['session'] = $session;
-
         /**
          * Test for FAILURE
          */

From 6a9d9edc01b60a8e3c16c4bc75e0d5bec7f99d35 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Thu, 13 May 2021 23:31:57 +0530
Subject: [PATCH 11/11] feat: some comments

---
 tests/e2e/Services/Teams/TeamsBaseClient.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php
index d1ced3ca11..00ae8c186e 100644
--- a/tests/e2e/Services/Teams/TeamsBaseClient.php
+++ b/tests/e2e/Services/Teams/TeamsBaseClient.php
@@ -159,6 +159,8 @@ trait TeamsBaseClient
         $session = $this->client->parseCookie((string)$response['headers']['set-cookie'])['a_session_'.$this->getProject()['$id']];
         $data['session'] = $session;
 
+
+        /** [START] TESTS TO CHECK PASSWORD UPDATE OF NEW USER CREATED USING TEAM INVITE */
         /**
          * New User tries to update password without old password -> SHOULD PASS
          */
@@ -213,6 +215,8 @@ trait TeamsBaseClient
         $this->assertEquals($response['body']['email'], $email);
         $this->assertEquals($response['body']['name'], $name);
 
+        /** [END] TESTS TO CHECK PASSWORD UPDATE OF NEW USER CREATED USING TEAM INVITE */
+
         /**
          * Test for FAILURE
          */