Reimplement remove / create in console

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/iam_policies.go

@@ -164,7 +164,9 @@ var IAMOwnerPolicy = policy.NewPolicy(
 	policy.Allow(
 		ActionMembershipProfileGet,
 		ActionMembershipProfileList,
+		ActionMembershipProfileCreate,
 		ActionMembershipProfileUpdate,
+		ActionMembershipProfileDelete,
 	).
 		WithSID("full-membership-profile-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
@@ -243,7 +245,9 @@ var IAMAdminPolicy = policy.NewPolicy(
 	policy.Allow(
 		ActionMembershipProfileGet,
 		ActionMembershipProfileList,
+		ActionMembershipProfileCreate,
 		ActionMembershipProfileUpdate,
+		ActionMembershipProfileDelete,
 	).
 		WithSID("membership-profile-admin-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),

pkg/iam/organization_service.go

@@ -942,7 +942,7 @@ func (s *OrganizationService) CreateUser(ctx context.Context, req *CreateUserReq
 		now     = time.Now()
 	)
 
-	err := s.pg.WithConn(
+	err := s.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
 			identity := &coredata.Identity{}
@@ -966,6 +966,9 @@ func (s *OrganizationService) CreateUser(ctx context.Context, req *CreateUserReq
 
 			profile = &coredata.MembershipProfile{
 				ID:                       gid.New(req.OrganizationID.TenantID(), coredata.MembershipProfileEntityType),
+				IdentityID:               identity.ID,
+				OrganizationID:           req.OrganizationID,
+				Source:                   coredata.ProfileSourceManual,
 				FullName:                 req.FullName,
 				Kind:                     req.Kind,
 				AdditionalEmailAddresses: req.AdditionalEmailAddresses,