plandex-ai/plandex · warning

User does not have permission to remove invite with role:

Error message

User does not have permission to remove invite with role: 

What it means

DeleteInviteHandler enforces that the caller may remove an invite only if they hold the remove-user permission for the invite's org role, or they are the original inviter AND hold the invite-user permission for that role. Otherwise it returns 403 with this message naming the role. It is a deliberate authorization check, not an unexpected failure.

Source

Thrown at app/server/handlers/invites.go:394

		http.Error(w, "Error getting invite: "+err.Error(), http.StatusInternalServerError)
		return
	}

	if invite == nil || invite.OrgId != auth.OrgId {
		log.Printf("Invite not found: %v\n", inviteId)
		http.Error(w, "Invite not found: "+inviteId, http.StatusNotFound)
		return
	}

	// ensure current user can remove target invite
	removePermission := shared.Permission(strings.Join([]string{string(shared.PermissionRemoveUser), invite.OrgRoleId}, "|"))

	invitePermission := shared.Permission(strings.Join([]string{string(shared.PermissionInviteUser), invite.OrgRoleId}, "|"))

	if !(auth.HasPermission(removePermission) ||
		(auth.User.Id == invite.InviterId && auth.HasPermission(invitePermission))) {
		log.Printf("User does not have permission to remove invite with role: %v\n", invite.OrgRoleId)
		http.Error(w, "User does not have permission to remove invite with role: "+invite.OrgRoleId, http.StatusForbidden)
		return
	}

	err = db.DeleteInvite(inviteId, nil)

	if err != nil {
		log.Printf("Error deleting invite: %v\n", err)
		http.Error(w, "Error deleting invite: "+err.Error(), http.StatusInternalServerError)
		return
	}

	log.Println("Successfully deleted invite")
}

View on GitHub (pinned to e2d772072e)

Solutions

1. Have an org admin (holding remove_user for that role) delete the invite
2. If you are the inviter, verify your role still grants invite_user|<role> and have an admin adjust permissions otherwise
3. Do not retry — the 403 is deterministic until permissions change

// pre-check: only attempt delete if current user is admin or the inviter
const canDelete = currentUser.isAdmin || invite.inviterId === currentUser.id
if (!canDelete) throw new Error('Requires remove_user|<role> permission (or inviter with invite_user|<role>)')

try {
	await client.deleteInvite(inviteId)
} catch (e) {
	if (e.status === 403) {
		// permission denied — do not retry; request admin action
		return
	}
	throw e
}

When it happens

Trigger: DELETE /invites/{inviteId} by a user lacking the 'remove_user|<role>' permission who is also not the original inviter (or is the inviter but lacks 'invite_user|<role>') — e.g. a member-tier user attempting to delete an admin-role invite.

Common situations: A non-admin teammate tries to revoke an invite; the inviter's role was downgraded so they no longer hold invite_user for that role; API client using a service account without the right permission grants.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• User does not have permission to rename project
• User does not have permission to delete project
• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to rename plan

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/758bc9ad515dd6e7. Report an issue: GitHub.