multica-ai/multica · error · ErrBindingNotWorkspaceMember

dingtalk: redeemer is not a workspace member

Error message

dingtalk: redeemer is not a workspace member

What it means

Error "dingtalk: redeemer is not a workspace member" thrown in multica-ai/multica.

Source

Thrown at server/internal/integrations/dingtalk/binding.go:40

// by the OutboundReplier), clicks through to the in-product redeem page, and
// their DingTalk staff id is bound to their Multica account. It mirrors
// slack.BindingTokenService but runs on the generic channel_* queries with
// channel_type='dingtalk'.

// BindingTokenTTL bounds a token's life. The channel_binding_token CHECK
// enforces the same 15-minute cap so a misconfigured caller cannot mint longer.
const BindingTokenTTL = 15 * time.Minute

var (
	// ErrBindingTokenInvalid: token unknown / already consumed / expired. One
	// opaque error for all three avoids a replay timing oracle.
	ErrBindingTokenInvalid = errors.New("dingtalk: binding token invalid or expired")
	// ErrBindingAlreadyAssigned: this DingTalk user id is already bound to a
	// different Multica user (account transfer must go through explicit unbind).
	ErrBindingAlreadyAssigned = errors.New("dingtalk: user id is already bound to a different user")
	// ErrBindingNotWorkspaceMember: the redeemer is not a member of the token's
	// workspace. Translated to 403 at the HTTP boundary.
	ErrBindingNotWorkspaceMember = errors.New("dingtalk: redeemer is not a workspace member")
)

// BindingToken is a freshly minted token. The raw value is returned exactly
// once (embedded in the binding URL); only its hash is persisted.
type BindingToken struct {
	Raw       string
	ExpiresAt time.Time
}

// RedeemedBindingToken is returned after a successful redemption.
type RedeemedBindingToken struct {
	WorkspaceID    pgtype.UUID
	InstallationID pgtype.UUID
	DingTalkUserID string
}

// BindingTokenService mints and redeems DingTalk binding tokens. Redemption is
// transactional: consuming the token and inserting the channel_user_binding row

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Join the workspace before redeeming the DingTalk binding token.

When it happens

Trigger: Thrown at server/internal/integrations/dingtalk/binding.go:40 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/4a1c60f724921c2c. Report an issue: GitHub.