{"record":{"id":"ced4bbf4564edec3","repo":"different-ai/openwork","slug":"the-owner-role-cannot-be-assigned-from-this-action","errorCode":null,"errorMessage":"The owner role cannot be assigned from this action.","messagePattern":"The owner role cannot be assigned from this action\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx","lineNumber":133,"sourceCode":"      orgContext?.roles,\n    );\n  }\n\n  function ensureCanManageSettings() {\n    if (!getCurrentAccess().canManageSettings) {\n      throw new Error(\"Only workspace owners and super-admins can change settings.\");\n    }\n  }\n\n  function ensureCanDeleteOrganization() {\n    if (!getCurrentAccess().canDeleteOrganization) {\n      throw new Error(\"Only the workspace owner can delete this organization.\");\n    }\n  }\n\n  function ensureRoleCanBeAssigned(role: string) {\n    if (roleIncludesCanonicalRole(role, \"owner\")) {\n      throw new Error(\"The owner role cannot be assigned from this action.\");\n    }\n  }\n\n  function ensureTargetIsNotOwner(memberId: string) {\n    const target = orgContext?.members.find((member) => member.id === memberId) ?? null;\n    if (target?.isOwner) {\n      throw new Error(\"The workspace owner cannot be changed or removed from this action.\");\n    }\n    return target;\n  }\n\n  function shouldRefreshRolesForPage(org: DenOrgSummary) {\n    const isMembersPage = pathname === \"/dashboard/members\" || pathname === \"/dashboard/manage-members\";\n    return isMembersPage && getOrgAccessFlags(org.role, false).isAdmin;\n  }\n\n  async function loadOrgDirectory() {\n    const { response, payload } = await requestJson(\"/v1/me/orgs\", { method: \"GET\" }, 12000);","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx#L115-L151","documentation":"ensureRoleCanBeAssigned blocks any role mutation whose target role resolves to the canonical owner role via roleIncludesCanonicalRole, throwing 'The owner role cannot be assigned from this action.' Owner is transferred through a dedicated flow, not invites/role edits/role CRUD. It gates inviteMember, updateMemberRole, createRole, and updateRole.","triggerScenarios":"Inviting a member with a role that includes the owner canonical role, updating a member's role to owner, or creating/editing a custom role that includes the owner canonical role — all rejected to prevent implicit ownership transfer.","commonSituations":"A UI role picker that lists the owner role, a custom-role editor that allows toggling owner-granted permissions, an API/script batching member updates that includes an owner assignment, or migrating roles from another system that had owner as an assignable role.","solutions":["Choose a non-owner role (admin/member/custom) for the invite or role change.","Use the dedicated ownership-transfer flow to change who owns the organization.","Remove owner-inherited permissions from custom roles in createRole/updateRole.","Update the UI role picker to exclude the owner role from assignable options.","If scripting, filter role payloads to exclude the owner canonical role before calling."],"exampleFix":"// before\nawait updateMemberRole(memberId, \"owner\");\n// after\nawait updateMemberRole(memberId, \"admin\"); // ownership transfer uses the dedicated transfer flow","handlingStrategy":"validation","validationCode":"import { roleIncludesCanonicalRole } from \"...\"; // reuse provider helper\nfunction isAssignableRole(role: string): boolean {\n  return !roleIncludesCanonicalRole(role, \"owner\");\n}\nif (!isAssignableRole(selectedRole)) return; // exclude from picker","typeGuard":"null","tryCatchPattern":"try {\n  await updateMemberRole(memberId, role);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"owner role cannot be assigned\")) {\n    showToast(\"Use the ownership transfer flow to change the owner.\");\n  } else throw e;\n}","preventionTips":["Exclude the owner role from all assignable-role pickers.","In custom-role editors, block inheriting owner canonical permissions.","Filter role lists before batch member updates.","Document that ownership changes use a dedicated transfer flow."],"tags":["permissions","rbac","organization","validation"],"backgroundTag":"forbidden-role-assignment","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}