RocketChat/Rocket.Chat · warning · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Message starring not allowed

What it means

starMessage refuses to run when the workspace setting Message_AllowStarring is disabled, throwing Meteor.Error('error-action-not-allowed', 'Message starring not allowed'). It is a global feature flag, not a per-room or per-user restriction: message starring is simply turned off for the whole install.

Source

Thrown at apps/meteor/server/lib/messaging/stars/starMessage.ts:22

import { Messages, Subscriptions, Rooms } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { settings } from '../../../settings';
import { canAccessRoomAsync, roomAccessAttributes } from '../../authorization';
import { methodDeprecationLogger } from '../../deprecationWarningLogger';
import { isTheLastMessage } from '../../messages/isTheLastMessage';
import { notifyOnRoomChangedById, notifyOnMessageChange } from '../../notifyListener';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		starMessage(message: Pick<IMessage, 'rid' | '_id'> & { starred: boolean }): boolean;
	}
}

export const starMessage = async (user: IUser, message: Pick<IMessage, 'rid' | '_id'> & { starred: boolean }): Promise<boolean> => {
	if (!settings.get('Message_AllowStarring')) {
		throw new Meteor.Error('error-action-not-allowed', 'Message starring not allowed', {
			method: 'starMessage',
			action: 'Message_starring',
		});
	}

	const subscription = await Subscriptions.findOneByRoomIdAndUserId(message.rid, user._id, {
		projection: { _id: 1 },
	});
	if (!subscription) {
		return false;
	}
	if (!(await Messages.findOneByRoomIdAndMessageId(message.rid, message._id))) {
		return false;
	}

	const room = await Rooms.findOneById(message.rid, { projection: { ...roomAccessAttributes, lastMessage: 1 } });

	if (!room) {

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Enable Message_AllowStarring in Administration -> Workspace -> General (Message section) if starring is wanted
  2. Client: read the Message_AllowStarring public setting and hide the star action when it is false
  3. If starring must stay disabled, remove the UI entry points so users can never fire the method

Example fix

// before - UI always calls the method
Meteor.call('starMessage', { rid, _id: messageId, starred: true });

// after - gate on the public setting clients receive
if (settings.get('Message_AllowStarring') === true) {
  Meteor.call('starMessage', { rid, _id: messageId, starred: true });
Defensive patterns

Strategy: validation

Validate before calling

// Public settings are pushed to clients - check before offering the action
if (settingsCollection.findOne('_Message_AllowStarring')?.value === true) {
  Meteor.call('starMessage', { rid, _id: messageId, starred: true });
} else {
  hideStarAction();
}

Try / catch

Meteor.call('starMessage', msg, (err) => {
  if (err?.error === 'error-action-not-allowed') {
    disableStarUi(); // workspace-wide flag - permanent for this install, do not retry
  }
});

Prevention

When it happens

Trigger: Meteor.call('starMessage', { rid, _id, starred }) while an administrator has set Message_AllowStarring to false (Administration -> General -> Message); apps or integrations calling the starMessage method on such installs.

Common situations: Workspace hardening where admins disable starring; custom clients that always show a star button regardless of server settings; upgrades where the setting was flipped during migration.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/26bd023120e0a1f0. Report an issue: GitHub.