SigNoz/signoz · error · errors.Error

ErrCodeRoleHasUserAssignees

ErrCodeRoleHasUserAssignees

Error message

role has active user assignments, remove them before deleting

What it means

Pre-delete hook fired when attempting to delete a role: the role is still assigned to at least one user in the org (GetUsersByOrgIDAndRoleID returns rows), so deletion is blocked to avoid orphaned assignments.

Source

Thrown at pkg/modules/user/impluser/getter.go:157

	resetPasswordToken, err := module.store.GetResetPasswordToken(ctx, token)
	if err != nil {
		return err
	}

	if resetPasswordToken.IsExpired() {
		return errors.New(errors.TypeUnauthenticated, types.ErrCodeResetPasswordTokenExpired, "reset password token has expired")
	}

	return nil
}

func (module *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID, _ string) error {
	users, err := module.GetUsersByOrgIDAndRoleID(ctx, orgID, roleID)
	if err != nil {
		return err
	}
	if len(users) > 0 {
		return errors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasUserAssignees, "role has active user assignments, remove them before deleting")
	}
	return nil
}

View on GitHub (pinned to 5069bf80b0)

Solutions

List users assigned to the role (GetUsersByOrgIDAndRoleID / the user-role listing API) and remove the role from each user
Reassign affected users to a replacement role, then retry the role delete
Automate the check in a pre-deletion script so role cleanup is never attempted with active assignees

Example fix

// before
deleteRole(orgID, roleID) // fails
// after
users := getUsersByOrgIDAndRoleID(orgID, roleID)
for _, u := range users { removeUserRole(orgID, u.ID, roleID) }
deleteRole(orgID, roleID)

Defensive patterns

Strategy: validation

Validate before calling

users, _ := getUsersByOrgIDAndRoleID(ctx, orgID, roleID)
if len(users) > 0 {
    // unassign or reassign before delete
    return fmt.Errorf("role in use by %d users", len(users))
}

Prevention

Always run the assignee check before role deletion in admin tooling
Make role removal part of the user offboarding pipeline

When it happens

Trigger: DELETE on a role (e.g. DELETE /api/v1/roles/{id} or the role delete API) while any user in the org still has that role assigned.

Common situations: Bulk user imports that assigned default roles; leftover assignments after offboarding; attempting to clean up roles before unassigning users.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/6bf49548ae7b6b43. Report an issue: GitHub.