RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Message editing not allowed

What it means

Thrown by updateMessage when the caller may not edit the message: they lack the 'edit-message' permission in that room AND either the workspace setting Message_AllowEditing is disabled or the message belongs to another user. Holding 'edit-message' permission bypasses both the setting and the ownership check.

Source

Thrown at apps/meteor/server/meteor-methods/messages/updateMessage.ts:57

		return;
	}

	if (!!message.tmid && originalMessage._id === message.tmid) {
		throw new Meteor.Error('error-message-same-as-tmid', 'Cannot set tmid the same as the _id', {
			method: 'updateMessage',
		});
	}

	if (!originalMessage.tmid && !!message.tmid) {
		throw new Meteor.Error('error-message-change-to-thread', 'Cannot update message to a thread', { method: 'updateMessage' });
	}

	const _hasPermission = await hasPermissionAsync(uid, 'edit-message', message.rid);
	const editAllowed = settings.get('Message_AllowEditing');
	const editOwn = originalMessage.u && originalMessage.u._id === uid;

	if (!_hasPermission && (!editAllowed || !editOwn)) {
		throw new Meteor.Error('error-action-not-allowed', 'Message editing not allowed', {
			method: 'updateMessage',
			action: 'Message_editing',
		});
	}

	const blockEditInMinutes = settings.get('Message_AllowEditing_BlockEditInMinutes');
	const bypassBlockTimeLimit = await hasPermissionAsync(uid, 'bypass-time-limit-edit-and-delete', message.rid);

	if (!bypassBlockTimeLimit && Match.test(blockEditInMinutes, Number) && blockEditInMinutes !== 0) {
		let currentTsDiff = 0;
		let msgTs;

		if (originalMessage.ts instanceof Date || Match.test(originalMessage.ts, Number)) {
			msgTs = moment(originalMessage.ts);
		}
		if (msgTs) {
			currentTsDiff = moment().diff(msgTs, 'minutes');
		}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Enable Message_AllowEditing in Administration > Message settings if users should edit their own messages
  2. Grant the 'edit-message' permission to the caller's role (Admin > Permissions), scoped per room if needed
  3. Client-side: hide edit affordances unless the user has edit-message OR (Message_AllowEditing AND owns the message)

Example fix

// before (edit always shown)
{canEditMessage && <EditAction msg={msg} />}
const canEditMessage = true;

// after
const canEditMessage =
  hasPermission(uid, 'edit-message', msg.rid) ||
  (settings.get('Message_AllowEditing') && msg.u._id === uid);
Defensive patterns

Strategy: validation

Validate before calling

const uid = Meteor.userId();
const mayEdit =
  !!uid &&
  (hasPermission(uid, 'edit-message', msg.rid) ||
    (settings.get('Message_AllowEditing') && msg.u?._id === uid));
if (!mayEdit) {
  hideEditUI(msg);
}

Type guard

const isEditNotAllowed = (e: unknown): e is Meteor.Error =>
  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-action-not-allowed';

Try / catch

try {
  await Meteor.callAsync('updateMessage', payload);
} catch (e) {
  if (isEditNotAllowed(e)) {
    disableEditing(); // degrade gracefully — authorization failures must not be retried
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: A user without 'edit-message' editing their own message while Message_AllowEditing is false; any user editing someone else's message without the 'edit-message' role permission; permissions revoked between rendering the edit UI and submitting the change.

Common situations: Workspace security settings disabled message editing (Message_AllowEditing off); role configuration dropped edit-message; custom clients showing edit controls regardless of permission; moderation tooling editing others' messages without the role grant.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d0dd2a307ca2d950. Report an issue: GitHub.