@@ -230,4 +230,47 @@ func TestCustomOrganizationRole(t *testing.T) {
230230_ ,err := owner .PatchOrganizationRole (ctx ,first .OrganizationID ,templateAdminCustom (uuid .New ()))
231231require .ErrorContains (t ,err ,"does not match" )
232232})
233+
234+ // Attempt to add site & user permissions, which is not allowed
235+ t .Run ("ExcessPermissions" ,func (t * testing.T ) {
236+ t .Parallel ()
237+ dv := coderdtest .DeploymentValues (t )
238+ dv .Experiments = []string {string (codersdk .ExperimentCustomRoles )}
239+ owner ,first := coderdenttest .New (t ,& coderdenttest.Options {
240+ Options :& coderdtest.Options {
241+ DeploymentValues :dv ,
242+ },
243+ LicenseOptions :& coderdenttest.LicenseOptions {
244+ Features : license.Features {
245+ codersdk .FeatureCustomRoles :1 ,
246+ },
247+ },
248+ })
249+
250+ ctx := testutil .Context (t ,testutil .WaitMedium )
251+
252+ siteRole := templateAdminCustom (first .OrganizationID )
253+ siteRole .SitePermissions = []codersdk.Permission {
254+ {
255+ ResourceType :codersdk .ResourceWorkspace ,
256+ Action :codersdk .ActionRead ,
257+ },
258+ }
259+
260+ //nolint:gocritic // owner is required for this
261+ _ ,err := owner .PatchOrganizationRole (ctx ,first .OrganizationID ,siteRole )
262+ require .ErrorContains (t ,err ,"site wide permissions" )
263+
264+ userRole := templateAdminCustom (first .OrganizationID )
265+ userRole .UserPermissions = []codersdk.Permission {
266+ {
267+ ResourceType :codersdk .ResourceWorkspace ,
268+ Action :codersdk .ActionRead ,
269+ },
270+ }
271+
272+ //nolint:gocritic // owner is required for this
273+ _ ,err = owner .PatchOrganizationRole (ctx ,first .OrganizationID ,userRole )
274+ require .ErrorContains (t ,err ,"not allowed to assign user permissions" )
275+ })
233276}