RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Refresh OAuth Services is not allowed

What it means

After the login check, refreshOAuthService requires the 'add-oauth-service' permission and throws 'error-action-not-allowed' (with detail action 'Refreshing_OAuth_Services') when the caller does not hold it. Refreshing login services re-registers OAuth services and is restricted to users who may modify OAuth configuration.

Source

Thrown at apps/meteor/server/meteor-methods/auth/refreshOAuthService.ts:28

	interface ServerMethods {
		refreshOAuthService(): Promise<void>;
	}
}

Meteor.methods<ServerMethods>({
	async refreshOAuthService() {
		methodDeprecationLogger.method('refreshOAuthService', '9.0.0', '/v1/settings.refreshOAuthServices');

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'refreshOAuthService',
			});
		}

		if ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {
			throw new Meteor.Error('error-action-not-allowed', 'Refresh OAuth Services is not allowed', {
				method: 'refreshOAuthService',
				action: 'Refreshing_OAuth_Services',
			});
		}

		await refreshLoginServices();
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant 'add-oauth-service' to the caller's role in the admin Permissions screen
  2. Run the refresh from a full admin account
  3. Verify the caller's effective permissions before retrying
Defensive patterns

Strategy: validation

Validate before calling

// client: only show the refresh action to users who may add OAuth services
const canRefresh = useHasPermission('add-oauth-service');
if (!canRefresh) { /* hide/disable the refresh action */ }

Try / catch

try {
  await Meteor.callAsync('refreshOAuthService');
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-action-not-allowed') {
    // caller lacks 'add-oauth-service': grant it or run as admin
  }
}

Prevention

When it happens

Trigger: A logged-in user without 'add-oauth-service' calls refreshOAuthService, or an admin role had the permission removed.

Common situations: A sub-admin role that can view settings but not modify OAuth configuration; permission grants changed during migration.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/083e104dd614ca67. Report an issue: GitHub.