What causes "org owner role id is empty" in plandex-ai/plandex?

Call CacheOrgRoleIds() at startup (MustInitDb) and fail fast if it errors

org owner role id is empty

Error message

org owner role id is empty

What it means

This is the fallback guard in GetOrgOwnerRoleId: even after cacheOrgOwnerRoleId returned nil, the package-level orgOwnerRoleId is still empty, so the function refuses to return an invalid role id. It indicates an inconsistent cache state rather than a failed query.

Source

Thrown at app/server/db/rbac_helpers.go:20

import (
	"fmt"
	"log"
)

var orgOwnerRoleId string
var orgMemberRoleId string

func GetOrgOwnerRoleId() (string, error) {
	if orgOwnerRoleId == "" {
		err := cacheOrgOwnerRoleId()
		if err != nil {
			return "", fmt.Errorf("error getting org owner role id: %v", err)
		}
	}

	if orgOwnerRoleId == "" {
		return "", fmt.Errorf("org owner role id is empty")
	}

	return orgOwnerRoleId, nil
}

func GetOrgMemberRoleId() (string, error) {
	if orgMemberRoleId == "" {
		err := cacheOrgMemberRoleId()
		if err != nil {
			return "", fmt.Errorf("error getting org member role id: %v", err)
		}
	}

	if orgMemberRoleId == "" {
		return "", fmt.Errorf("org member role id is empty")
	}

	return orgMemberRoleId, nil

View on GitHub (pinned to e2d772072e)

Solutions

Call CacheOrgRoleIds() at startup (MustInitDb) and fail fast if it errors
Add a mutex or use sync.Once around cacheOrgOwnerRoleId to prevent concurrent reset
Log and re-call cacheOrgOwnerRoleId once inside this branch before giving up
Verify no code path assigns orgOwnerRoleId = "" after startup

Example fix

// before
if orgOwnerRoleId == "" {
	return "", fmt.Errorf("org owner role id is empty")
}
// after
if orgOwnerRoleId == "" {
	if err := cacheOrgOwnerRoleId(); err != nil {
		return "", fmt.Errorf("org owner role id is empty: %v", err)
	}
}

Defensive patterns

Strategy: validation

Validate before calling

if orgOwnerRoleId == "" {
	if err := CacheOrgRoleIds(); err != nil {
		return fmt.Errorf("cannot resolve owner role id: %w", err)
	}
}
role, err := GetOrgOwnerRoleId()

Type guard

func roleCacheReady() bool {
	return orgOwnerRoleId != "" && orgMemberRoleId != ""
}

Prevention

Initialize the cache once with sync.Once and treat empty cache as fatal
Never assign the package globals outside the cache functions
Re-derive the value instead of returning bare 'is empty' errors

When it happens

Trigger: cacheOrgOwnerRoleId succeeded but wrote nothing usable, or orgOwnerRoleId was reset/cleared concurrently after being cached; effectively only reachable if the caching logic or global variable is corrupted.

Common situations: Code changes that clear the package global; race between multiple goroutines initializing the cache; a schema where the 'owner' row id is legitimately an empty string.

Related errors

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/74dbae3e40340546. Report an issue: GitHub.