{"record":{"id":"7bce863e49bbec46","repo":"plandex-ai/plandex","slug":"user-does-not-have-permission-to-create-a-plan","errorCode":null,"errorMessage":"User does not have permission to create a plan","messagePattern":"User does not have permission to create a plan","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"app/server/handlers/plans_crud.go","lineNumber":32,"sourceCode":"\t\"strings\"\n\t\"time\"\n\n\tshared \"plandex-shared\"\n\n\t\"github.com/gorilla/mux\"\n)\n\nfunc CreatePlanHandler(w http.ResponseWriter, r *http.Request) {\n\tlog.Println(\"Received request for CreatePlanHandler\")\n\n\tauth := Authenticate(w, r, true)\n\tif auth == nil {\n\t\treturn\n\t}\n\n\tif !auth.HasPermission(shared.PermissionCreatePlan) {\n\t\tlog.Println(\"User does not have permission to create a plan\")\n\t\thttp.Error(w, \"User does not have permission to create a plan\", http.StatusForbidden)\n\t\treturn\n\t}\n\n\tvars := mux.Vars(r)\n\tprojectId := vars[\"projectId\"]\n\n\tlog.Println(\"projectId: \", projectId)\n\n\tif !authorizeProject(w, projectId, auth) {\n\t\treturn\n\t}\n\n\t_, apiErr := hooks.ExecHook(hooks.WillCreatePlan, hooks.HookParams{Auth: auth})\n\tif apiErr != nil {\n\t\twriteApiError(w, *apiErr)\n\t\treturn\n\t}\n","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/plans_crud.go#L14-L50","documentation":"CreatePlanHandler returns this 403 Forbidden when the authenticated user's auth context lacks the shared.PermissionCreatePlan permission. This is an authorization check, not a runtime failure: the server deliberately rejects the request because the org/user's role or plan restrictions do not grant plan creation.","triggerScenarios":"POST to create a plan by a user whose org role (e.g. read-only or restricted member) does not include PermissionCreatePlan, or whose org plan tier disables plan creation; also occurs when an admin removed the permission from the user's group.","commonSituations":"New org member with default restricted role tries to create plans; org downgraded their subscription so create-plan permission was revoked; permission misconfigured in the org's group settings.","solutions":["Have an org admin grant the user's role/group the create-plan permission","Check the org's subscription/settings to confirm plan creation is enabled","Verify you are authenticated as the intended user (token for the right account/org)","If self-hosting, inspect the permission model for shared.PermissionCreatePlan and the user's assigned permissions"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const perms = await getMyPermissions(orgId);\nif (!perms.includes('create_plan')) {\n  throw new Error('Your role cannot create plans — request permission from an org admin');\n}","typeGuard":"function canCreatePlan(auth) {\n  return typeof auth === 'object' && auth !== null\n    && Array.isArray(auth.permissions)\n    && auth.permissions.includes('create_plan');\n}","tryCatchPattern":"try {\n  await createPlan(projectId, name);\n} catch (e) {\n  if (/permission to create a plan/i.test(e.message)) {\n    notifyUser('You need the create-plan permission; contact your org admin.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Check the user's role/permissions in the UI before offering plan creation","Ensure org subscription tiers that users are on still include plan creation","Keep group/permission assignments audited","Handle 403 distinctly from 5xx in client error handling"],"tags":["http-403","authorization","permissions","plans"],"backgroundTag":"permission-denied","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}