{"record":{"id":"d7fff4c47bfd996b","repo":"calcom/cal.diy","slug":"rolesguard-user-is-not-a-member-of-the-team-with","errorCode":null,"errorMessage":"RolesGuard - User is not a member of the team with id=${teamId}.","messagePattern":"RolesGuard - User is not a member of the team with id=(.+?)\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts","lineNumber":112,"sourceCode":"          `RolesGuard - User is not a member of the organization with id=${orgId}.`\n        );\n      }\n\n      if (ORG_ROLES.includes(allowedRole as unknown as (typeof ORG_ROLES)[number])) {\n        canAccess = hasMinimumRole({\n          checkRole: `ORG_${membership.role}`,\n          minimumRole: allowedRole,\n          roles: ORG_ROLES,\n        });\n      }\n    }\n\n    // Checking the role of the user within the team\n    else if (Boolean(teamId) && !Boolean(orgId)) {\n      const membership = await this.membershipRepository.findMembershipByTeamId(Number(teamId), user.id);\n      if (!membership) {\n        this.logger.log(`User (${user.id}) is not a member of the team (${teamId}), denying access.`);\n        throw new ForbiddenException(`RolesGuard - User is not a member of the team with id=${teamId}.`);\n      }\n      if (TEAM_ROLES.includes(allowedRole as unknown as (typeof TEAM_ROLES)[number])) {\n        canAccess = hasMinimumRole({\n          checkRole: `TEAM_${membership.role}`,\n          minimumRole: allowedRole,\n          roles: TEAM_ROLES,\n        });\n      }\n    }\n\n    // Checking the role for team and org, org is above team in term of permissions\n    else if (Boolean(teamId) && Boolean(orgId)) {\n      const teamMembership = await this.membershipRepository.findMembershipByTeamId(Number(teamId), user.id);\n      const orgMembership = await this.membershipRepository.findMembershipByOrgId(Number(orgId), user.id);\n\n      if (!orgMembership) {\n        this.logger.log(`User (${user.id}) is not part of the organization (${orgId}), denying access.`);\n        throw new ForbiddenException(`RolesGuard - User is not part of the organization with id=${orgId}.`);","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/guards/roles/roles.guard.ts#L94-L130","documentation":"ForbiddenException from RolesGuard when checking role access for a team-scoped (teamId present, orgId absent) request and membershipRepository.findMembershipByTeamId(teamId, user.id) returns null — the user has no Membership in that team, so the role check is skipped and a 403 is thrown.","triggerScenarios":"Calling a team-scoped route (teamId set, no orgId) where the authenticated user has no Membership row in that team. The guard logs 'User (id) is not a member of the team (teamId), denying access.'","commonSituations":"User was removed from the team; team invite pending; teamId typo; user is in the parent org but never added to the specific team; test user not seeded with a team Membership.","solutions":["Have a team admin/owner add the user to the team and have the user accept.","Confirm the teamId in the request path matches a team the user belongs to.","If access was just granted, clear the RolesGuard Redis cache to drop the stale 'false'.","For tests, seed a team Membership for the user."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const membership = await membershipRepository.findMembershipByTeamId(Number(teamId), user.id);\nif (!membership) {\n  // prompt user to be added to the team before calling\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.get(`/v2/teams/${teamId}/members`);\n} catch (e) {\n  if (e.status === 403 && /not a member of the team/.test(e.message)) {\n    // ask user to join the team\n  }\n  throw e;\n}","preventionTips":["Have a team admin add the user to the team.","Confirm the teamId is correct.","Clear the RolesGuard cache after team membership changes."],"tags":["auth","roles","membership","team","guard"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}