{"record":{"id":"758bc9ad515dd6e7","repo":"plandex-ai/plandex","slug":"user-does-not-have-permission-to-remove-invite-wit","errorCode":null,"errorMessage":"User does not have permission to remove invite with role: ","messagePattern":"User does not have permission to remove invite with role: ","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"app/server/handlers/invites.go","lineNumber":394,"sourceCode":"\t\thttp.Error(w, \"Error getting invite: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tif invite == nil || invite.OrgId != auth.OrgId {\n\t\tlog.Printf(\"Invite not found: %v\\n\", inviteId)\n\t\thttp.Error(w, \"Invite not found: \"+inviteId, http.StatusNotFound)\n\t\treturn\n\t}\n\n\t// ensure current user can remove target invite\n\tremovePermission := shared.Permission(strings.Join([]string{string(shared.PermissionRemoveUser), invite.OrgRoleId}, \"|\"))\n\n\tinvitePermission := shared.Permission(strings.Join([]string{string(shared.PermissionInviteUser), invite.OrgRoleId}, \"|\"))\n\n\tif !(auth.HasPermission(removePermission) ||\n\t\t(auth.User.Id == invite.InviterId && auth.HasPermission(invitePermission))) {\n\t\tlog.Printf(\"User does not have permission to remove invite with role: %v\\n\", invite.OrgRoleId)\n\t\thttp.Error(w, \"User does not have permission to remove invite with role: \"+invite.OrgRoleId, http.StatusForbidden)\n\t\treturn\n\t}\n\n\terr = db.DeleteInvite(inviteId, nil)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error deleting invite: %v\\n\", err)\n\t\thttp.Error(w, \"Error deleting invite: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tlog.Println(\"Successfully deleted invite\")\n}\n","sourceCodeStart":376,"sourceCodeEnd":408,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/invites.go#L376-L408","documentation":"DeleteInviteHandler enforces that the caller may remove an invite only if they hold the remove-user permission for the invite's org role, or they are the original inviter AND hold the invite-user permission for that role. Otherwise it returns 403 with this message naming the role. It is a deliberate authorization check, not an unexpected failure.","triggerScenarios":"DELETE /invites/{inviteId} by a user lacking the 'remove_user|<role>' permission who is also not the original inviter (or is the inviter but lacks 'invite_user|<role>') — e.g. a member-tier user attempting to delete an admin-role invite.","commonSituations":"A non-admin teammate tries to revoke an invite; the inviter's role was downgraded so they no longer hold invite_user for that role; API client using a service account without the right permission grants.","solutions":["Have an org admin (holding remove_user for that role) delete the invite","If you are the inviter, verify your role still grants invite_user|<role> and have an admin adjust permissions otherwise","Do not retry — the 403 is deterministic until permissions change"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// pre-check: only attempt delete if current user is admin or the inviter\nconst canDelete = currentUser.isAdmin || invite.inviterId === currentUser.id\nif (!canDelete) throw new Error('Requires remove_user|<role> permission (or inviter with invite_user|<role>)')","typeGuard":null,"tryCatchPattern":"try {\n\tawait client.deleteInvite(inviteId)\n} catch (e) {\n\tif (e.status === 403) {\n\t\t// permission denied — do not retry; request admin action\n\t\treturn\n\t}\n\tthrow e\n}","preventionTips":["Verify the authenticated user's role permissions before issuing deletes","Only expose delete controls in the UI for users with remove-user rights","Remember inviter-only deletion additionally requires invite_user|<role>"],"tags":["authorization","http-403","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}