{"record":{"id":"966d72d82b25a605","repo":"calcom/cal.diy","slug":"rolesguard-user-is-not-a-member-of-the-organizat","errorCode":null,"errorMessage":"RolesGuard - User is not a member of the organization with id=${orgId}.","messagePattern":"RolesGuard - User is not a member of the organization with id=(.+?)\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts","lineNumber":93,"sourceCode":"\n    // System admin can access everything\n    else if (user.isSystemAdmin) {\n      this.logger.log(`User (${user.id}) is system admin, allowing access.`);\n      canAccess = true;\n    }\n\n    // if the required role is SYSTEM_ADMIN_ROLE but user is not system admin, return false\n    else if (allowedRole === SYSTEM_ADMIN_ROLE && !user.isSystemAdmin) {\n      this.logger.log(`User (${user.id}) is not system admin, denying access.`);\n      canAccess = false;\n    }\n\n    // Checking the role of the user within the organization\n    else if (Boolean(orgId) && !Boolean(teamId)) {\n      const membership = await this.membershipRepository.findMembershipByOrgId(Number(orgId), user.id);\n      if (!membership) {\n        this.logger.log(`User (${user.id}) is not a member of the organization (${orgId}), denying access.`);\n        throw new ForbiddenException(\n          `RolesGuard - User is not a member of the organization with id=${orgId}.`\n        );\n      }\n\n      if (ORG_ROLES.includes(allowedRole as unknown as (typeof ORG_ROLES)[number])) {\n        canAccess = hasMinimumRole({\n          checkRole: `ORG_${membership.role}`,\n          minimumRole: allowedRole,\n          roles: ORG_ROLES,\n        });\n      }\n    }\n\n    // Checking the role of the user within the team\n    else if (Boolean(teamId) && !Boolean(orgId)) {\n      const membership = await this.membershipRepository.findMembershipByTeamId(Number(teamId), user.id);\n      if (!membership) {\n        this.logger.log(`User (${user.id}) is not a member of the team (${teamId}), denying access.`);","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts#L75-L111","documentation":"ForbiddenException from RolesGuard when checking role access for an org-scoped (orgId present, teamId absent) request and membershipRepository.findMembershipByOrgId(orgId, user.id) returns null — the user is not a member of that organization at all, so role comparison is skipped and a hard 403 is thrown.","triggerScenarios":"Calling an org-scoped route (orgId set, no teamId) where the authenticated user has no Membership row linking them to that organization. The guard logs 'User (id) is not a member of the organization' before throwing.","commonSituations":"User was removed from the org; invitation never accepted; orgId typo/mismatch; cross-tenant access attempted; user belongs to a team inside a different org; test user not seeded into the org.","solutions":["Have an org admin invite the user and have the user accept the invitation.","Confirm the orgId in the request matches an org the user actually belongs to.","If the user was just added, the RolesGuard Redis cache (apiv2:user:…:guard:roles:…) may hold a stale 'false' — clear it.","For tests, seed a Membership row for the user in that org."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const membership = await membershipRepository.findMembershipByOrgId(Number(orgId), user.id);\nif (!membership) {\n  // prompt user to accept an org invitation before calling\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.get(`/v2/orgs/${orgId}/teams`);\n} catch (e) {\n  if (e.status === 403 && /not a member of the organization/.test(e.message)) {\n    // ask user to join the org\n  }\n  throw e;\n}","preventionTips":["Ensure the user has accepted the org invitation.","Confirm the orgId is correct for the user's tenant.","Clear the RolesGuard Redis cache after membership changes."],"tags":["auth","roles","membership","organization","guard"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}