plandex-ai/plandex · warning

User does not have permission to rename plan

Error message

User does not have permission to rename plan

What it means

This 403 is returned by authorizePlanRename when the plan is accessible but the requester is neither the plan owner nor holds shared.PermissionRenameAnyPlan. Renaming is restricted to the owner or users with the rename-any-plan admin permission.

Source

Thrown at app/server/handlers/auth_helpers.go:730

	if plan.OwnerId != auth.User.Id && !auth.HasPermission(shared.PermissionDeleteAnyPlan) {
		log.Println("User does not have permission to delete plan")
		http.Error(w, "User does not have permission to delete plan", http.StatusForbidden)
		return nil
	}

	return plan
}

func authorizePlanRename(w http.ResponseWriter, planId string, auth *types.ServerAuth) *db.Plan {
	plan := authorizePlan(w, planId, auth)

	if plan == nil {
		return nil
	}

	if plan.OwnerId != auth.User.Id && !auth.HasPermission(shared.PermissionRenameAnyPlan) {
		log.Println("User does not have permission to rename plan")
		http.Error(w, "User does not have permission to rename plan", http.StatusForbidden)
		return nil
	}

	return plan
}

func authorizePlanArchive(w http.ResponseWriter, planId string, auth *types.ServerAuth) *db.Plan {
	plan := authorizePlan(w, planId, auth)

	if plan == nil {
		return nil
	}

	if plan.OwnerId != auth.User.Id && !auth.HasPermission(shared.PermissionArchiveAnyPlan) {
		log.Println("User does not have permission to archive plan")
		http.Error(w, "User does not have permission to archive plan", http.StatusForbidden)
		return nil
	}

View on GitHub (pinned to e2d772072e)

Solutions

1. Ask the plan owner to perform the rename, or obtain PermissionRenameAnyPlan
2. Transfer plan ownership to the user who needs rename rights
3. Disable rename controls for non-owners without the permission in the UI

Example fix

// before
await api.renamePlan(planId, 'New title');
// after
if (plan.ownerId !== auth.userId && !auth.permissions.includes('rename_any_plan')) {
  throw new Error('Only the plan owner or an admin can rename this plan');
}
await api.renamePlan(planId, 'New title');

function canRenamePlan(plan, auth) {
  return plan.ownerId === auth.userId || auth.permissions.includes('rename_any_plan');
}

function isPlanOwner(plan, auth) {
  return typeof plan?.ownerId === 'string' && plan.ownerId === auth?.userId;
}

try {
  return await api.renamePlan(planId, title);
} catch (e) {
  if (e.status === 403 && /permission to rename plan/.test(e.body)) {
    notifyUser('Only the plan owner or an admin can rename this plan');
    return null;
  }
  throw e;
}

When it happens

Trigger: A plan-rename endpoint (via authorizePlanRename) called by a non-owner member without PermissionRenameAnyPlan attempting to change the plan's title.

Common situations: A collaborator renames a teammate's plan from a shared view; permission revoked in a role change but client UI not refreshed; scripts using personal tokens acting on others' plans.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to archive plan
• User does not have permission to rename project
• User does not have permission to delete project

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/255f6825262f1455. Report an issue: GitHub.