{"record":{"id":"8f709fd12cd82c54","repo":"plandex-ai/plandex","slug":"user-cannot-list-org-roles","errorCode":null,"errorMessage":"User cannot list org roles","messagePattern":"User cannot list org roles","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"app/server/handlers/orgs.go","lineNumber":229,"sourceCode":"\torg, err := db.GetOrg(auth.OrgId)\n\tif err != nil {\n\t\tlog.Printf(\"Error getting org: %v\\n\", err)\n\t\thttp.Error(w, \"Error getting org: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tif org.IsTrial {\n\t\twriteApiError(w, shared.ApiError{\n\t\t\tType:   shared.ApiErrorTypeTrialActionNotAllowed,\n\t\t\tStatus: http.StatusForbidden,\n\t\t\tMsg:    \"Trial user can't list org roles\",\n\t\t})\n\t\treturn\n\t}\n\n\tif !auth.HasPermission(shared.PermissionListOrgRoles) {\n\t\tlog.Println(\"User cannot list org roles\")\n\t\thttp.Error(w, \"User cannot list org roles\", http.StatusForbidden)\n\t\treturn\n\t}\n\n\troles, err := db.ListOrgRoles(auth.OrgId)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error listing org roles: %v\\n\", err)\n\t\thttp.Error(w, \"Error listing org roles: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tvar apiRoles []*shared.OrgRole\n\tfor _, role := range roles {\n\t\tapiRoles = append(apiRoles, role.ToApi())\n\t}\n\n\tbytes, err := json.Marshal(apiRoles)\n","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/orgs.go#L211-L247","documentation":"Returned with HTTP 403 when the authenticated user's org role does not grant shared.PermissionListOrgRoles. Authentication succeeded, but role-based authorization failed before db.ListOrgRoles was invoked.","triggerScenarios":"Any authenticated user whose role in the org lacks the 'list org roles' permission calls the list-org-roles endpoint. Trial orgs are rejected earlier with a different error, so this is purely a permission check failure.","commonSituations":"Developer testing with a non-admin account, member role missing newly added permissions after a version update, client calling an admin-only endpoint with a basic user's API key.","solutions":["Check the user's org role and its granted permissions","Use an account with the owner/admin role to call the endpoint","If permissions changed in a newer version, re-sync role definitions or re-create roles","Verify the client is using the intended API key/user"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client: check role/permission before calling\nconst myRole = await getMyOrgRole();\nif (!myRole.permissions.includes('list_org_roles')) {\n  console.warn('skipping call: user cannot list org roles');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const roles = await listOrgRoles();\n} catch (e) {\n  if (e.status === 403) { /* surface 'insufficient permission' to the user; do not retry */ }\n  else throw e;\n}","preventionTips":["Only call admin/owner-gated endpoints with elevated roles","Cache the user's permissions client-side and gate UI actions","Update role/permission checks when upgrading server versions","Never retry 403s blindly — fix the role instead"],"tags":["authorization","http-403","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}