RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Permission is restricted

What it means

addPermissionToRoleMethod (method authorization:addPermissionToRole) throws error-action-not-allowed, 'Permission is restricted', when AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role) is true — the workspace carries an explicit restriction forbidding that permission on that role. Restrictions are managed with AuthorizationUtils.addRolePermissionRestriction / removeRolePermissionRestriction and are also applied to the guest role (license-managed permission whitelist).

Source

Thrown at apps/meteor/server/lib/authorization/permissionRole.ts:15

import { License } from '@rocket.chat/core-services';
import { Permissions, Roles } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from './hasPermission';
import { CONSTANTS, AuthorizationUtils } from '../../../app/authorization/lib';
import { notifyOnPermissionChangedById } from '../notifyListener';

export const addPermissionToRoleMethod = async (uid: string, permissionId: string, role: string): Promise<void> => {
	if (role === 'guest' && !AuthorizationUtils.hasRestrictionsToRole(role) && (await License.hasValidLicense())) {
		AuthorizationUtils.addRolePermissionWhiteList(role, await License.getGuestPermissions());
	}

	if (AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role)) {
		throw new Meteor.Error('error-action-not-allowed', 'Permission is restricted', {
			method: 'authorization:addPermissionToRole',
			action: 'Adding_permission',
		});
	}

	const permission = await Permissions.findOneById(permissionId);

	if (!permission) {
		throw new Meteor.Error('error-invalid-permission', 'Permission does not exist', {
			method: 'authorization:addPermissionToRole',
			action: 'Adding_permission',
		});
	}

	if (!(await Roles.findOneById(role, { projection: { _id: 1 } }))) {
		throw new Meteor.Error('error-invalid-role', 'Role does not exist', {
			method: 'authorization:addPermissionToRole',
			action: 'Adding_permission',

View on GitHub (pinned to b2c16d5842)

Solutions

1. Grant the permission on a different, unrestricted role and assign users that role instead
2. If you own the restriction policy, remove it first on the server: AuthorizationUtils.removeRolePermissionRestriction(role, permissionId)
3. Check whether the restriction comes from license-managed guest permissions before fighting it — it may require a license change
4. Read the role's restriction list (AuthorizationUtils) before building admin tooling on top of addPermissionToRole

if (AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role)) {
  // pick a different role or surface 'restricted by policy' instead of calling the method
}

try {
  await addPermissionToRoleMethod(uid, permissionId, role);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-action-not-allowed' && e.details?.action === 'Adding_permission') {
    // policy restriction: choose another role or have an owner remove the restriction; do not retry
  }
  throw e;
}

When it happens

Trigger: Adding a restricted permission to the restricted role from Administration -> Permissions (or via the API): e.g. granting a privileged permission to 'guest' while the guest-role restriction list forbids it.

Common situations: Hardening attempts to elevate restricted roles hit the guard; enterprise deployments where guest permissions are constrained by license; bootstrap scripts that apply a full role-permission matrix without honoring restrictions.

Related errors

• error-invalid-permission
• error-not-authorized
• error-duplicate-role-names-not-allowed
• error-invalid-scope
• error-invalid-roleId

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/007e1d0d731455d7. Report an issue: GitHub.