RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Adding OAuth Services is not allowed

What it means

addOAuthServiceMethod() requires the caller to hold the 'add-oauth-service' permission before a custom OAuth service may be registered; otherwise error-action-not-allowed with action 'Adding_OAuth_Services'. The DDP wrapper 'addOAuthService' (deprecated in favor of POST /v1/settings.addCustomOAuth) resolves the current user and forwards to this check, so under-privileged or unauthenticated callers never reach the actual service setup.

Source

Thrown at apps/meteor/server/meteor-methods/auth/addOAuthService.ts:18

import type { ServerMethods } from '@rocket.chat/ddp-client';
import { check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { addOAuthService } from '../../lib/oauth/addOAuthService';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		addOAuthService(name: string): void;
	}
}

export const addOAuthServiceMethod = async (userId: string, name: string): Promise<void> => {
	if ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {
		throw new Meteor.Error('error-action-not-allowed', 'Adding OAuth Services is not allowed', {
			method: 'addOAuthService',
			action: 'Adding_OAuth_Services',
		});
	}

	await addOAuthService(name);
};

Meteor.methods<ServerMethods>({
	async addOAuthService(name) {
		methodDeprecationLogger.method('addOAuthService', '9.0.0', '/v1/settings.addCustomOAuth');
		check(name, String);

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'addOAuthService' });
		}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Perform the operation as a user whose role has 'add-oauth-service' (default: admin).
  2. Grant the permission to the intended role via Authorization > Permissions.
  3. For scripts, use an admin user's token against POST /api/v1/settings.addCustomOAuth.

Example fix

// before: token belongs to a user without add-oauth-service -> error-action-not-allowed
await fetch('/api/v1/settings.addCustomOAuth', { method: 'POST', headers: nonAdminHeaders, body });

// after: use an admin user's credentials (or grant add-oauth-service to the caller's role)
await fetch('/api/v1/settings.addCustomOAuth', { method: 'POST', headers: adminHeaders, body });
Defensive patterns

Strategy: try-catch

Validate before calling

// Server-side pre-check mirroring the guard
import { hasPermissionAsync } from '../../lib/authorization/hasPermission';

if ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {
  throw new Error('caller needs add-oauth-service permission');
}

Try / catch

try {
  await addOAuthServiceMethod(userId, name);
} catch (err: any) {
  if (err?.error === 'error-action-not-allowed' && err?.details?.action === 'Adding_OAuth_Services') {
    // escalate: re-run with an admin session or grant the permission to the caller's role
    return escalateToAdmin(() => addOAuthServiceMethod(adminUserId, name));
  }
  throw err;
}

Prevention

When it happens

Trigger: A user whose roles lack add-oauth-service calling Meteor.call('addOAuthService', name) or POST /api/v1/settings.addCustomOAuth; SSO setup automation using a personal token whose owner is not admin.

Common situations: Setting up SSO with a bot/service account never granted admin; customized permission sets where add-oauth-service was removed from the admin role; attempts from a logged-out session (surfaces after the invalid-user check).

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3e87d8bdfac92728. Report an issue: GitHub.