fix #761

api/member.go

@@ -142,14 +142,23 @@ func (pma *ProjectMemberAPI) Post() {
 		return
 	}
 
-	for _, rid := range req.Roles {
+	if len(req.Roles) <= 0 || len(req.Roles) > 1 {
-		err = dao.AddProjectMember(projectID, userID, int(rid))
+		pma.CustomAbort(http.StatusBadRequest, "only one role is supported")
+	}
+
+	rid := req.Roles[0]
+	if !(rid == models.PROJECTADMIN ||
+		rid == models.DEVELOPER ||
+		rid == models.GUEST) {
+		pma.CustomAbort(http.StatusBadRequest, "invalid role")
+	}
+
+	err = dao.AddProjectMember(projectID, userID, rid)
 	if err != nil {
 		log.Errorf("Failed to update DB to add project user role, project id: %d, user id: %d, role id: %d", projectID, userID, rid)
 		pma.RenderError(http.StatusInternalServerError, "Failed to update data in database")
 		return
 	}
-	}
 }
 
 // Put ...

docs/swagger.yaml

@@ -314,7 +314,7 @@ paths:
           description: Relevant project ID.
         - name: roles
           in: body
-          description: Role members for adding to relevant project.
+          description: Role members for adding to relevant project. Only one role is supported in the role list.
           schema:
             $ref: '#/definitions/RoleParam'
       tags: