plandex-ai/plandex · error

not a member of org

Error message

not a member of org

What it means

The user is not a member of the requested org and no active invite exists to auto-accept, so the server logs 'not a member of org' and returns HTTP 401 when raiseErr is true. This is a policy denial: valid user, valid token, no access to that org.

Source

Thrown at app/server/handlers/auth_helpers.go:562

		}

		if invite != nil {
			log.Println("accepting invite")

			err := db.AcceptInvite(r.Context(), invite, authToken.UserId)

			if err != nil {
				log.Printf("error accepting invite: %v\n", err)
				if raiseErr {
					http.Error(w, "error accepting invite", http.StatusInternalServerError)
				}
				return nil
			}

		} else {
			log.Println("user is not a member of the org")
			if raiseErr {
				http.Error(w, "not a member of org", http.StatusUnauthorized)
			}
			return nil
		}
	}

	// get user permissions
	permissions, err := db.GetUserPermissions(authToken.UserId, parsed.OrgId)

	if err != nil {
		log.Printf("error getting user permissions: %v\n", err)
		if raiseErr {
			http.Error(w, "error getting user permissions", http.StatusInternalServerError)
		}
		return nil
	}

	// build the permissions map
	permissionsMap := make(shared.Permissions)

View on GitHub (pinned to e2d772072e)

Solutions

1. Verify the OrgId in the request matches an org the user actually belongs to
2. Request an invitation to the org or have an admin add the user
3. Re-fetch the user's org list and switch the client to a valid org
4. Clear stale org selection in the client if membership was revoked

orgs, err := client.ListMyOrgs(ctx)
if err != nil {
	return err
}
if !slices.ContainsFunc(orgs, func(o Org) bool { return o.ID == orgID }) {
	return fmt.Errorf("org %s: not a member; request an invite first", orgID)
}

func hasOrgAccess(orgs []Org, orgID string) bool {
	for _, o := range orgs {
		if o.ID == orgID {
			return true
		}
	}
	return false
}

if err := doCall(ctx); err != nil {
	var apiErr *APIError
	if errors.As(err, &apiErr) && apiErr.StatusCode == 401 && strings.Contains(apiErr.Message, "not a member of org") {
		return switchToValidOrgOrRequestInvite()
	}
	return err
}

When it happens

Trigger: Authenticated request whose parsed.OrgId belongs to an org the user never joined and for which GetActiveInviteByEmail returns no invite.

Common situations: User typing/selecting the wrong org id; calling another company's org endpoint; org membership revoked while the client still has the org selected; stale cached org id after leaving an org.

Related errors

• error setting auth: %v
• error writing auth: %v
• no org selected
• no org id
• User does not have permission to invite user with role:

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/47f13b562afec4f0. Report an issue: GitHub.