{"record":{"id":"6b7e3c2ec74874d2","repo":"gitroomhq/postiz-app","slug":"you-do-not-have-permission-to-delete-this-user","errorCode":null,"errorMessage":"You do not have permission to delete this user","messagePattern":"You do not have permission to delete this user","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"libraries/nestjs-libraries/src/database/prisma/organizations/organization.service.ts","lineNumber":175,"sourceCode":"\n    return { added: true };\n  }\n\n  async deleteTeamMember(org: Organization, userId: string) {\n    const userOrgs = await this._organizationRepository.getOrgsByUserId(userId);\n    const findOrgToDelete = userOrgs.find((orgUser) => orgUser.id === org.id);\n    if (!findOrgToDelete) {\n      throw new Error('User is not part of this organization');\n    }\n\n    // @ts-ignore\n    const myRole = org.users[0].role;\n    const userRole = findOrgToDelete.users[0].role;\n    const myLevel = myRole === 'USER' ? 0 : myRole === 'ADMIN' ? 1 : 2;\n    const userLevel = userRole === 'USER' ? 0 : userRole === 'ADMIN' ? 1 : 2;\n\n    if (myLevel < userLevel) {\n      throw new Error('You do not have permission to delete this user');\n    }\n\n    return this._organizationRepository.deleteTeamMember(org.id, userId);\n  }\n\n  disableOrEnableNonSuperAdminUsers(orgId: string, disable: boolean) {\n    return this._organizationRepository.disableOrEnableNonSuperAdminUsers(\n      orgId,\n      disable\n    );\n  }\n\n  getShortlinkPreference(orgId: string) {\n    return this._organizationRepository.getShortlinkPreference(orgId);\n  }\n\n  updateShortlinkPreference(orgId: string, shortlink: ShortLinkPreference) {\n    return this._organizationRepository.updateShortlinkPreference(","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/gitroomhq/postiz-app/blob/0f1647f7491a217d43eb5ae7a480484bdf0aff3e/libraries/nestjs-libraries/src/database/prisma/organizations/organization.service.ts#L157-L193","documentation":"Thrown by OrganizationService.deleteTeamMember when the caller's role in the organization is lower than the role of the user they are trying to remove. Roles are ranked USER=0, ADMIN=1, SUPERADMIN/OWNER=2. A caller may only delete members at or below their own level.","triggerScenarios":"Calling DELETE /organization/:orgId/user/:userId (deleteTeamMember) where the authenticated user is a USER or ADMIN and the target member holds a strictly higher role (e.g. an ADMIN attempting to delete a SUPERADMIN, or a USER attempting to delete an ADMIN).","commonSituations":"Team management UI allowing admins to see but not delete owners; orgs seeded with multiple SUPERADMINs after plan changes; frontend not filtering the member list by deletable roles.","solutions":["Hide/disable the delete action in the UI for members whose role exceeds the current user's role","Ask a SUPERADMIN of the organization to perform the deletion","Demote the target user's role first (if you have permission), then delete them","If the hierarchy rule is wrong for your deployment, adjust the myLevel/userLevel comparison in organization.service.ts:175"],"exampleFix":"// before\nawait organizationService.deleteTeamMember(orgId, targetUserId);\n// after\nconst myLevel = role === 'USER' ? 0 : role === 'ADMIN' ? 1 : 2;\nconst targetLevel = targetRole === 'USER' ? 0 : targetRole === 'ADMIN' ? 1 : 2;\nif (myLevel >= targetLevel) {\n  await organizationService.deleteTeamMember(orgId, targetUserId);\n}","handlingStrategy":"validation","validationCode":"const level = (r) => (r === 'USER' ? 0 : r === 'ADMIN' ? 1 : 2);\nconst canDelete = myRole && targetRole && level(myRole) >= level(targetRole);\nif (canDelete) await api.deleteTeamMember(orgId, targetUserId);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fetch the team with roles and the current user's role before rendering delete buttons","Filter member lists by 'deletable by me' server-derived metadata","Surface a clear 'insufficient role' toast instead of a raw error"],"tags":["authorization","roles","team-management","organizations"],"backgroundTag":"rbac-insufficient-permissions","analyzedSha":"0f1647f7491a217d43eb5ae7a480484bdf0aff3e","analyzedAt":"2026-08-27T12:09:55.020Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}