feat: Permissions for board members

Closes #262

server/api/controllers/board-memberships/update.js

@@ -0,0 +1,57 @@
+const Errors = {
+  BOARD_MEMBERSHIP_NOT_FOUND: {
+    boardMembershipNotFound: 'Board membership not found',
+  },
+};
+
+module.exports = {
+  inputs: {
+    id: {
+      type: 'string',
+      regex: /^[0-9]+$/,
+      required: true,
+    },
+    role: {
+      type: 'string',
+      isIn: Object.values(BoardMembership.Roles),
+    },
+    canComment: {
+      type: 'boolean',
+    },
+  },
+
+  exits: {
+    boardMembershipNotFound: {
+      responseType: 'notFound',
+    },
+  },
+
+  async fn(inputs) {
+    const { currentUser } = this.req;
+
+    const path = await sails.helpers.boardMemberships
+      .getProjectPath(inputs.id)
+      .intercept('pathNotFound', () => Errors.BOARD_MEMBERSHIP_NOT_FOUND);
+
+    let { boardMembership } = path;
+    const { project } = path;
+
+    const isProjectManager = await sails.helpers.users.isProjectManager(currentUser.id, project.id);
+
+    if (!isProjectManager) {
+      throw Errors.BOARD_MEMBERSHIP_NOT_FOUND; // Forbidden
+    }
+
+    const values = _.pick(inputs, ['role', 'canComment']);
+
+    boardMembership = await sails.helpers.boardMemberships.updateOne(
+      boardMembership,
+      values,
+      this.req,
+    );
+
+    return {
+      item: boardMembership,
+    };
+  },
+};