RocketChat/Rocket.Chat · error · Meteor.Error

403

403

Error message

Access to Method Forbidden

What it means

addAllUserToRoomFn throws HTTP 403 'Access to Method Forbidden' when hasPermissionAsync(userId, 'add-all-to-room') is false. This admin-grade permission guards the bulk operation that adds every workspace user to one room; without it the method rejects before the user-count or room checks run. The Meteor method is deprecated since 9.0.0 in favor of POST /v1/channels.addAll and /v1/groups.addAll, which apply the same permission.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/addAllUserToRoom.ts:29

import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { getSubscriptionAutotranslateDefaultConfig } from '../../lib/getSubscriptionAutotranslateDefaultConfig';
import { notifyOnSubscriptionChangedById } from '../../lib/notifyListener';
import { getDefaultSubscriptionPref } from '../../lib/utils/lib/getDefaultSubscriptionPref';
import { settings } from '../../settings';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		addAllUserToRoom(rid: IRoom['_id'], activeUsersOnly?: boolean): Promise<true>;
	}
}

export const addAllUserToRoomFn = async (userId: string, rid: IRoom['_id'], activeUsersOnly = false): Promise<true> => {
	check(rid, String);
	check(activeUsersOnly, Boolean);

	if (!(await hasPermissionAsync(userId, 'add-all-to-room'))) {
		throw new Meteor.Error(403, 'Access to Method Forbidden', {
			method: 'addAllToRoom',
		});
	}

	const userFilter: {
		active?: boolean;
	} = {};
	if (activeUsersOnly === true) {
		userFilter.active = true;
	}

	const users = await Users.find(userFilter).toArray();
	if (users.length > settings.get<number>('API_User_Limit')) {
		throw new Meteor.Error('error-user-limit-exceeded', 'User Limit Exceeded', {
			method: 'addAllToRoom',
		});
	}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Grant the add-all-to-room permission to the caller's role in Administration > Permissions.
2. For REST, authenticate with an admin user or token whose role has add-all-to-room.
3. Catch the 403 and surface an authorization message instead of silently failing.

// optional preflight: only show the bulk-add control to users holding the permission
const canBulkAdd = await Meteor.callAsync('getUserPermissions').then((perms) => perms.includes('add-all-to-room'));
if (!canBulkAdd) { /* hide/disable the action */ }

try {
	await Meteor.callAsync('addAllUserToRoom', rid, activeUsersOnly);
} catch (e: any) {
	if (e?.error === 403) {
		// authorization failure: surface 'not allowed', do not retry with the same identity
	}
}

When it happens

Trigger: A non-admin user calling the addAllUserToRoom method, or a REST token whose user lacks the add-all-to-room permission, calling channels.addAll/groups.addAll.

Common situations: Custom admin panels or scripts using a service account without elevated roles; permission grids edited so no role carries add-all-to-room; moderator trying a bulk add meant for admins.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The required "roomId" or "roomName" param provided does not
• error-invalid-user
• error-not-allowed
• error-not-allowed
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/57a5bd5e5c2873a0. Report an issue: GitHub.