{"record":{"id":"114aea05f429adf3","repo":"different-ai/openwork","slug":"only-the-workspace-owner-can-delete-this-organizat","errorCode":null,"errorMessage":"Only the workspace owner can delete this organization.","messagePattern":"Only the workspace owner can delete this organization\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx","lineNumber":127,"sourceCode":"  }\n\n  function getCurrentAccess() {\n    return getOrgAccessFlags(\n      orgContext?.currentMember.role ?? \"member\",\n      orgContext?.currentMember.isOwner ?? false,\n      orgContext?.roles,\n    );\n  }\n\n  function ensureCanManageSettings() {\n    if (!getCurrentAccess().canManageSettings) {\n      throw new Error(\"Only workspace owners and super-admins can change settings.\");\n    }\n  }\n\n  function ensureCanDeleteOrganization() {\n    if (!getCurrentAccess().canDeleteOrganization) {\n      throw new Error(\"Only the workspace owner can delete this organization.\");\n    }\n  }\n\n  function ensureRoleCanBeAssigned(role: string) {\n    if (roleIncludesCanonicalRole(role, \"owner\")) {\n      throw new Error(\"The owner role cannot be assigned from this action.\");\n    }\n  }\n\n  function ensureTargetIsNotOwner(memberId: string) {\n    const target = orgContext?.members.find((member) => member.id === memberId) ?? null;\n    if (target?.isOwner) {\n      throw new Error(\"The workspace owner cannot be changed or removed from this action.\");\n    }\n    return target;\n  }\n\n  function shouldRefreshRolesForPage(org: DenOrgSummary) {","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx#L109-L145","documentation":"ensureCanDeleteOrganization throws 'Only the workspace owner can delete this organization.' when canDeleteOrganization is false in getOrgAccessFlags — only the canonical owner (and super-admins per the flags implementation) may delete. It gates deleteOrganization.","triggerScenarios":"deleteOrganization called by an admin or member, or by an owner of a different organization, or before access flags resolve (defaults to member role -> canDeleteOrganization false).","commonSituations":"Admin attempting cleanup of an unused workspace, a UI showing the delete button without checking flags, super-admin operating in an org where the flag computation excludes them, or stale access flags after an ownership transfer.","solutions":["Have the current workspace owner perform the deletion.","Verify ownership transfer completed if ownership recently changed.","Check getOrgAccessFlags inputs (currentMember.role, roles) are loaded and for the correct org.","Hide the delete control unless canDeleteOrganization is true.","If deletion is organization-wide necessary, have the Den super-admin perform it via admin surface."],"exampleFix":"// before\nawait deleteOrganization(orgId);\n// after\nif (!getCurrentAccess().canDeleteOrganization) return showForbiddenNotice();\nawait deleteOrganization(orgId);","handlingStrategy":"validation","validationCode":"if (!getCurrentAccess().canDeleteOrganization) return; // hide delete control\nawait deleteOrganization(orgId);","typeGuard":"null","tryCatchPattern":"try {\n  await deleteOrganization(orgId);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"Only the workspace owner\")) {\n    showToast(\"Ask the workspace owner to delete this organization.\");\n  } else throw e;\n}","preventionTips":["Render the delete action only when canDeleteOrganization is true.","Refresh access flags after ownership transfers.","Confirm org context points at the organization being deleted.","Use an explicit confirmation dialog that also re-checks the flag."],"tags":["permissions","authorization","organization","rbac"],"backgroundTag":"insufficient-permissions","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}