{"record":{"id":"4b1e1c67c38d8f8f","repo":"different-ai/openwork","slug":"only-workspace-owners-and-super-admins-can-change-4b1e1c","errorCode":null,"errorMessage":"Only workspace owners and super-admins can change member roles.","messagePattern":"Only workspace owners and super-admins can change member roles\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx","lineNumber":676,"sourceCode":"    }\n\n    await runMutation(\"cancel-invitation\", async () => {\n      ensureActiveOrganizationSelected();\n      const { response, payload } = await requestJson(\n        `/v1/invitations/${encodeURIComponent(invitationId)}/cancel`,\n        { method: \"POST\", body: JSON.stringify({}) },\n        12000,\n      );\n\n      if (!response.ok) {\n        throw getRequestError(payload, response, `Failed to cancel invitation (${response.status}).`);\n      }\n    });\n  }\n\n  async function updateMemberRole(memberId: string, role: string) {\n    if (!getCurrentAccess().canManageRoles) {\n      throw new Error(\"Only workspace owners and super-admins can change member roles.\");\n    }\n    ensureTargetIsNotOwner(memberId);\n    ensureRoleCanBeAssigned(role);\n\n    await runMutation(\"update-member-role\", async () => {\n      ensureActiveOrganizationSelected();\n      const { response, payload } = await requestJson(\n        `/v1/members/${encodeURIComponent(memberId)}/role`,\n        {\n          method: \"POST\",\n          body: JSON.stringify({ role }),\n        },\n        12000,\n      );\n\n      if (!response.ok) {\n        throw getRequestError(payload, response, `Failed to update member (${response.status}).`);\n      }","sourceCodeStart":658,"sourceCodeEnd":694,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx#L658-L694","documentation":"updateMemberRole is gated by access.canManageRoles, which only owners and super-admins satisfy. Changing a member's role when this flag is false throws \"Only workspace owners and super-admins can change member roles.\" before ensureTargetIsNotOwner and the API call. This is a deliberate client-side RBAC check for role management.","triggerScenarios":"Calling updateMemberRole(memberId, role) (e.g. from editMemberForm in ManageMembersScreen) as an admin-but-not-owner/super-admin, or any member without canManageRoles.","commonSituations":"A plain admin attempts to promote a member to super-admin; the role select in the member row is enabled for users who shouldn't see it; access flags are stale after the current member's role changed.","solutions":["Ask an owner or super-admin to change the member's role.","Verify your own role — only owner/super-admin roles carry canManageRoles.","Refresh org context if your role was recently upgraded, then retry.","Disable the role selector unless access.canManageRoles is true."],"exampleFix":"// before\n<select onChange={(e) => updateMemberRole(member.id, e.target.value)}>\n\n// after\n<select\n  disabled={!access.canManageRoles}\n  onChange={(e) => updateMemberRole(member.id, e.target.value)}\n>","handlingStrategy":"validation","validationCode":"if (!access.canManageRoles) {\n  // disable role selector / block updateMemberRole call\n}","typeGuard":null,"tryCatchPattern":"try {\n  await updateMemberRole(memberId, role);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"change member roles\")) {\n    toast(e.message);\n  } else throw e;\n}","preventionTips":["Disable the per-member role select unless access.canManageRoles.","Explain in UI that only owners/super-admins change roles.","Refresh access flags after your own role changes."],"tags":["authorization","rbac","roles"],"backgroundTag":"insufficient-permissions","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}