plandex-ai/plandex · info

User already has access to org via domain:

Error message

User already has access to org via domain: 

What it means

If the org has AutoAddDomainUsers enabled and the invitee's email domain equals the org's Domain, the handler responds 400 with 'User already has access to org via domain: <domain>'. Such users join automatically, so an explicit invite is redundant and rejected. Note the code writes the error but does not return, so execution continues to GetUserByEmail afterward.

Source

Thrown at app/server/handlers/invites.go:85

	if !auth.HasPermission(permission) {
		log.Printf("User does not have permission to invite user with role: %v\n", req.OrgRoleId)
		http.Error(w, "User does not have permission to invite user with role: "+req.OrgRoleId, http.StatusForbidden)
		return
	}

	// ensure user doesn't already have access to org via domain
	split := strings.Split(req.Email, "@")
	if len(split) != 2 {
		log.Printf("Invalid email: %v\n", req.Email)
		http.Error(w, "Invalid email: "+req.Email, http.StatusBadRequest)
		return
	}
	domain := &split[1]

	if org.AutoAddDomainUsers && org.Domain == domain {
		log.Printf("User already has access to org via domain: %v\n", domain)
		http.Error(w, "User already has access to org via domain: "+*domain, http.StatusBadRequest)
	}

	// ensure user with this email isn't already in the org
	user, err := db.GetUserByEmail(req.Email)

	if err != nil {
		log.Printf("Error getting user: %v\n", err)
		http.Error(w, "Error getting user: "+err.Error(), http.StatusInternalServerError)
		return
	}

	if user != nil {
		isMember, err := db.ValidateOrgMembership(user.Id, auth.OrgId)

		if err != nil {
			log.Printf("Error validating org membership: %v\n", err)
			http.Error(w, "Error validating org membership: "+err.Error(), http.StatusInternalServerError)
			return

View on GitHub (pinned to e2d772072e)

Solutions

1. Don't send the invite — instruct the user to sign up/log in with their company email; they'll be added to the org automatically via the domain rule
2. If an invite is genuinely needed, disable AutoAddDomainUsers in org settings or ask an admin to change the org Domain
3. As a client, check org.AutoAddDomainUsers and org.Domain before calling the invite API and skip/short-circuit matching emails
4. On the server, consider adding a 'return' after this http.Error to stop processing (currently execution continues, which can cause a second write)

Example fix

// before
if org.AutoAddDomainUsers && org.Domain == domain {
    log.Printf("User already has access to org via domain: %v\n", domain)
    http.Error(w, "User already has access to org via domain: "+*domain, http.StatusBadRequest)
}
// after
if org.AutoAddDomainUsers && org.Domain == domain {
    log.Printf("User already has access to org via domain: %v\n", domain)
    http.Error(w, "User already has access to org via domain: "+*domain, http.StatusBadRequest)
    return
}

// Skip the invite if the org auto-adds this email's domain
org, err := client.GetOrg(ctx)
if err != nil {
    return err
}
domain := email[strings.LastIndex(email, "@")+1:]
if org.AutoAddDomainUsers && strings.EqualFold(org.Domain, domain) {
    return fmt.Errorf("%s already has access via domain %s — no invite needed", email, domain)
}

func coveredByAutoAdd(org *Org, email string) bool {
    if org == nil || !org.AutoAddDomainUsers || org.Domain == "" {
        return false
    }
    parts := strings.Split(email, "@")
    return len(parts) == 2 && strings.EqualFold(parts[1], org.Domain)
}

err := client.InviteUser(ctx, email, roleID)
if err != nil && strings.Contains(err.Error(), "already has access to org via domain") {
    // Not a failure: tell the user to sign up with their company email instead
    return ErrAutoDomainCovered
}

When it happens

Trigger: Inviting an email whose domain (after '@') matches the org's configured Domain while AutoAddDomainUsers is true — e.g. org domain 'acme.com' with auto-add on, inviting 'newhire@acme.com'.

Common situations: Admins manually inviting colleagues from their company domain, not realizing auto-add already covers them; the org's Domain setting changed to a broad value so many invites now collide; invited person already signed up via the domain flow.

Related errors

• error parsing request body: %v
• File %s is too large: %d (max %d)
• Invalid email:
• User is already a member of org
• Invite already exists

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/6c77fa5617fa6d76. Report an issue: GitHub.