@@ -62,4 +62,51 @@ func TestEditOrganizationRoles(t *testing.T) {
6262require .NoError (t ,err )
6363require .Contains (t ,buf .String (),"new-role" )
6464})
65+
66+ t .Run ("InvalidRole" ,func (t * testing.T ) {
67+ t .Parallel ()
68+
69+ dv := coderdtest .DeploymentValues (t )
70+ dv .Experiments = []string {string (codersdk .ExperimentCustomRoles )}
71+ client ,owner := coderdenttest .New (t ,& coderdenttest.Options {
72+ Options :& coderdtest.Options {
73+ DeploymentValues :dv ,
74+ },
75+ LicenseOptions :& coderdenttest.LicenseOptions {
76+ Features : license.Features {
77+ codersdk .FeatureCustomRoles :1 ,
78+ },
79+ },
80+ })
81+
82+ ctx := testutil .Context (t ,testutil .WaitMedium )
83+ inv ,root := clitest .New (t ,"organization" ,"roles" ,"edit" ,"--stdin" )
84+ inv .Stdin = bytes .NewBufferString (fmt .Sprintf (`{
85+ "name": "new-role",
86+ "organization_id": "%s",
87+ "display_name": "",
88+ "site_permissions": [
89+ {
90+ "resource_type": "workspace",
91+ "action": "read"
92+ }
93+ ],
94+ "organization_permissions": [
95+ {
96+ "resource_type": "workspace",
97+ "action": "read"
98+ }
99+ ],
100+ "user_permissions": [],
101+ "assignable": false,
102+ "built_in": false
103+ }` ,owner .OrganizationID .String ()))
104+ //nolint:gocritic // only owners can edit roles
105+ clitest .SetupConfig (t ,client ,root )
106+
107+ buf := new (bytes.Buffer )
108+ inv .Stdout = buf
109+ err := inv .WithContext (ctx ).Run ()
110+ require .ErrorContains (t ,err ,"not allowed to assign site wide permissions for an organization role" )
111+ })
65112}