Add atomic organization role administration

organizations/organizations.go

@@ -107,6 +107,7 @@ type Repository interface {
 	Invitations(context.Context, string, int) ([]Invitation, error)
 	RevokeInvitation(context.Context, string, string, time.Time, AuditEvent) error
 	AcceptInvitation(context.Context, [32]byte, string, time.Time, AuditEvent) error
+	OrganizationMemberships(context.Context, string, int) ([]Membership, error)
 	MembershipsForUser(context.Context, string) ([]Membership, error)
 	TeamsForUser(context.Context, string, string) ([]Team, error)
 }
@@ -331,6 +332,16 @@ func (service *Service) Memberships(ctx context.Context, userID string) ([]Membe
 	return service.repository.MembershipsForUser(ctx, userID)
 }
 
+// Members returns a bounded, stable list of active and suspended memberships
+// for one organization. Authorization remains an application concern because
+// the same storage primitive serves different organization policies.
+func (service *Service) Members(ctx context.Context, organizationID string, limit int) ([]Membership, error) {
+	if !idPattern.MatchString(organizationID) || limit < 1 || limit > 2000 {
+		return nil, errors.New("organizations: invalid member query")
+	}
+	return service.repository.OrganizationMemberships(ctx, organizationID, limit)
+}
+
 func (service *Service) Teams(ctx context.Context, organizationID, userID string) ([]Team, error) {
 	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(userID) {
 		return nil, errors.New("organizations: invalid team query")