plandex-ai/plandex · error

User cannot list org roles

Error message

User cannot list org roles

What it means

Returned with HTTP 403 when the authenticated user's org role does not grant shared.PermissionListOrgRoles. Authentication succeeded, but role-based authorization failed before db.ListOrgRoles was invoked.

Source

Thrown at app/server/handlers/orgs.go:229

	org, err := db.GetOrg(auth.OrgId)
	if err != nil {
		log.Printf("Error getting org: %v\n", err)
		http.Error(w, "Error getting org: "+err.Error(), http.StatusInternalServerError)
		return
	}

	if org.IsTrial {
		writeApiError(w, shared.ApiError{
			Type:   shared.ApiErrorTypeTrialActionNotAllowed,
			Status: http.StatusForbidden,
			Msg:    "Trial user can't list org roles",
		})
		return
	}

	if !auth.HasPermission(shared.PermissionListOrgRoles) {
		log.Println("User cannot list org roles")
		http.Error(w, "User cannot list org roles", http.StatusForbidden)
		return
	}

	roles, err := db.ListOrgRoles(auth.OrgId)

	if err != nil {
		log.Printf("Error listing org roles: %v\n", err)
		http.Error(w, "Error listing org roles: "+err.Error(), http.StatusInternalServerError)
		return
	}

	var apiRoles []*shared.OrgRole
	for _, role := range roles {
		apiRoles = append(apiRoles, role.ToApi())
	}

	bytes, err := json.Marshal(apiRoles)

View on GitHub (pinned to e2d772072e)

Solutions

1. Check the user's org role and its granted permissions
2. Use an account with the owner/admin role to call the endpoint
3. If permissions changed in a newer version, re-sync role definitions or re-create roles
4. Verify the client is using the intended API key/user

// client: check role/permission before calling
const myRole = await getMyOrgRole();
if (!myRole.permissions.includes('list_org_roles')) {
  console.warn('skipping call: user cannot list org roles');
}

try {
  const roles = await listOrgRoles();
} catch (e) {
  if (e.status === 403) { /* surface 'insufficient permission' to the user; do not retry */ }
  else throw e;
}

When it happens

Trigger: Any authenticated user whose role in the org lacks the 'list org roles' permission calls the list-org-roles endpoint. Trial orgs are rejected earlier with a different error, so this is purely a permission check failure.

Common situations: Developer testing with a non-admin account, member role missing newly added permissions after a version update, client calling an admin-only endpoint with a basic user's API key.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• User does not have permission to rename project
• User does not have permission to delete project
• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to rename plan

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/8f709fd12cd82c54. Report an issue: GitHub.