plandex-ai/plandex · warning

Only the plan owner can rename a plan

Error message

Only the plan owner can rename a plan

What it means

RenamePlanHandler returns this 403 when the authenticated user is not the owner of the plan (plan.OwnerId != auth.User.Id). Renaming is restricted to the plan's original creator even if the user is a member of the org/project with general access. This is an authorization policy rejection, not a technical failure.

Source

Thrown at app/server/handlers/plans_crud.go:187

	log.Println("planId: ", planId)

	plan := authorizePlan(w, planId, auth)

	if plan == nil {
		return
	}

	var requestBody shared.RenamePlanRequest
	if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
		log.Printf("Error parsing request body: %v\n", err)
		http.Error(w, "Error parsing request body", http.StatusBadRequest)
		return
	}

	if plan.OwnerId != auth.User.Id {
		log.Println("Only the plan owner can rename a plan")
		http.Error(w, "Only the plan owner can rename a plan", http.StatusForbidden)
		return
	}

	if requestBody.Name == "" {
		log.Println("Name cannot be empty")
		http.Error(w, "Name cannot be empty", http.StatusBadRequest)
		return
	}

	err := db.RenamePlan(planId, requestBody.Name, nil)

	if err != nil {
		log.Printf("Error renaming plan: %v\n", err)
		http.Error(w, "Error renaming plan: "+err.Error(), http.StatusInternalServerError)
		return
	}

	log.Println("Successfully renamed plan")

View on GitHub (pinned to e2d772072e)

Solutions

1. Have the plan owner perform the rename, or log in as them
2. Transfer ownership of the plan to the intended user (update plans.owner_id, if a transfer flow exists)
3. Ask an admin to rename via the owner's account per policy
4. If the product should allow org admins to rename, file/change the handler to permit admins — but do not bypass client-side

Example fix

// before
curl -X POST .../plans/$ID/rename -H "Authorization: Bearer $TEAMMATE_TOKEN" -d '{"name":"x"}'
// after
curl -X POST .../plans/$ID/rename -H "Authorization: Bearer $OWNER_TOKEN" -d '{"name":"x"}'

if plan.OwnerId != currentUser.Id { return errors.New("only the plan owner can rename this plan") }

resp, err := client.RenamePlan(planId, name)
if apiErr, ok := asApiError(resp, err); ok && resp.StatusCode == 403 {
	// surface ownership requirement to the user or fall back to the owner
}

When it happens

Trigger: Authenticated member (non-owner) issues POST rename on a plan owned by a teammate; plan ownership not transferred after the original owner left the org; API token belonging to a different user than the plan creator.

Common situations: Team member tries to rename a colleague's plan via CLI; offboarding didn't reassign plan ownership; a service account token is used for a plan created by a human user; shared project where all plans were created by one admin.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only the plan owner can delete a plan
• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to rename plan
• User does not have permission to archive plan

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/accfc56921fb1bf9. Report an issue: GitHub.