plandex-ai/plandex · warning

User does not have permission to rename project

Error message

User does not have permission to rename project

What it means

This 403 is returned by authorizeProjectRename after authorizeProject succeeds but the authenticated user lacks the shared.PermissionRenameAnyProject permission. The project exists in the org, but only users holding that permission may rename projects; ordinary members are denied. It is an explicit authorization failure, not an authentication one.

Source

Thrown at app/server/handlers/auth_helpers.go:648

	}

	if !projectExists && shouldErr {
		log.Println("project does not exist in org")
		http.Error(w, "project does not exist in org", http.StatusNotFound)
		return false
	}

	return projectExists
}

func authorizeProjectRename(w http.ResponseWriter, projectId string, auth *types.ServerAuth) bool {
	if !authorizeProject(w, projectId, auth) {
		return false
	}

	if !auth.HasPermission(shared.PermissionRenameAnyProject) {
		log.Println("User does not have permission to rename project")
		http.Error(w, "User does not have permission to rename project", http.StatusForbidden)
		return false
	}

	return true
}

func authorizeProjectDelete(w http.ResponseWriter, projectId string, auth *types.ServerAuth) bool {
	if !authorizeProject(w, projectId, auth) {
		return false
	}

	if !auth.HasPermission(shared.PermissionDeleteAnyProject) {
		log.Println("User does not have permission to delete project")
		http.Error(w, "User does not have permission to delete project", http.StatusForbidden)
		return false
	}

	return true

View on GitHub (pinned to e2d772072e)

Solutions

1. Ask an org owner/admin to grant the PermissionRenameAnyProject permission (or a role that includes it) to the user
2. Have a user who already holds the permission perform the rename
3. Check the client UI to hide/disable rename actions for users lacking the permission
4. If using API tokens, regenerate the token with the rename-project scope

Example fix

// before (server): any project member could rename
if !auth.HasPermission(shared.PermissionRenameAnyProject) {
	http.Error(w, "User does not have permission to rename project", http.StatusForbidden)
	return false
}
// after (client): check permission before offering rename
if (auth.permissions.includes('rename_any_project')) {
  showRenameButton(project);
} else {
  console.warn('Rename requires the rename-any-project permission');
}

function canRenameProjects(auth) {
  return auth.user.role === 'owner' || auth.user.role === 'admin' ||
         auth.permissions.includes('rename_any_project');
}

function hasPermission(auth, perm) {
  return Array.isArray(auth?.permissions) && auth.permissions.includes(perm);
}

try {
  const res = await api.renameProject(projectId, newName);
  return res;
} catch (e) {
  if (e.status === 403 && /permission to rename project/.test(e.body)) {
    notifyUser('You need the rename-any-project permission to rename this project');
    return null;
  }
  throw e;
}

When it happens

Trigger: RenameProjectHandler invoked by a user whose auth context does not include PermissionRenameAnyProject — typically a regular org member rather than an owner/admin attempting PUT/rename on a project.

Common situations: A member tries to rename a team project they didn't create; role changes removed the permission but the client UI still shows the rename action; API token scoped with reduced permissions used in scripts.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• User does not have permission to delete project
• User does not have permission to remove user with role: {org
• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to rename plan

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/a74203e82c76d42c. Report an issue: GitHub.