{"record":{"id":"fc4e1b8fff33322d","repo":"different-ai/openwork","slug":"only-workspace-owners-and-super-admins-can-change","errorCode":null,"errorMessage":"Only workspace owners and super-admins can change settings.","messagePattern":"Only workspace owners and super-admins can change settings\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx","lineNumber":121,"sourceCode":"  const isSingleOrgMode = runtimeConfigLoaded && runtimeConfig.orgMode === \"single_org\";\n\n  function ensureActiveOrganizationSelected() {\n    if (!activeOrgId) {\n      throw new Error(\"Organization not found.\");\n    }\n  }\n\n  function getCurrentAccess() {\n    return getOrgAccessFlags(\n      orgContext?.currentMember.role ?? \"member\",\n      orgContext?.currentMember.isOwner ?? false,\n      orgContext?.roles,\n    );\n  }\n\n  function ensureCanManageSettings() {\n    if (!getCurrentAccess().canManageSettings) {\n      throw new Error(\"Only workspace owners and super-admins can change settings.\");\n    }\n  }\n\n  function ensureCanDeleteOrganization() {\n    if (!getCurrentAccess().canDeleteOrganization) {\n      throw new Error(\"Only the workspace owner can delete this organization.\");\n    }\n  }\n\n  function ensureRoleCanBeAssigned(role: string) {\n    if (roleIncludesCanonicalRole(role, \"owner\")) {\n      throw new Error(\"The owner role cannot be assigned from this action.\");\n    }\n  }\n\n  function ensureTargetIsNotOwner(memberId: string) {\n    const target = orgContext?.members.find((member) => member.id === memberId) ?? null;\n    if (target?.isOwner) {","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx#L103-L139","documentation":"ensureCanManageSettings throws 'Only workspace owners and super-admins can change settings.' when getOrgAccessFlags reports canManageSettings false for the current member's role (owner/super-admin required). It gates updateOrganizationSettings so unauthorized role holders cannot mutate org settings.","triggerScenarios":"updateOrganizationSettings invoked by a member or admin whose computed access flags (from orgContext.currentMember.role, org membership, and roles) lack canManageSettings — e.g. after a role downgrade, in the wrong org context, or before roles finish loading (defaulting to 'member').","commonSituations":"A former owner demoted to admin still has an open settings tab, super-admin acting in the wrong organization, getCurrentAccess defaulting to 'member' while orgContext.roles is still loading, or a UI that renders the settings form without checking access flags.","solutions":["Confirm the signed-in user's role in the target org is owner or super-admin.","Switch to the correct organization if acting in the wrong org context.","Wait for orgContext/roles to load before evaluating access (avoid the 'member' default).","Hide/disable the settings form unless getCurrentAccess().canManageSettings is true.","Have an owner perform the settings change if the current role is legitimately insufficient."],"exampleFix":"// before\nawait updateOrganizationSettings(orgId, settings);\n// after\nif (getCurrentAccess().canManageSettings) await updateOrganizationSettings(orgId, settings);\nelse showToast(\"Only workspace owners and super-admins can change settings.\");","handlingStrategy":"validation","validationCode":"if (!getCurrentAccess().canManageSettings) return; // disable the settings form\nawait updateOrganizationSettings(orgId, settings);","typeGuard":"null","tryCatchPattern":"try {\n  await updateOrganizationSettings(orgId, settings);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"owners and super-admins\")) {\n    showToast(\"You do not have permission to change settings.\");\n  } else throw e;\n}","preventionTips":["Check canManageSettings before rendering the settings form.","Recompute access flags after role changes or org switches.","Avoid calling mutations with default 'member' access while roles are loading.","Keep owner/super-admin role checks server-side as well (defense in depth)."],"tags":["permissions","authorization","organization","rbac"],"backgroundTag":"insufficient-permissions","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}