RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Auto-Translate is not allowed

What it means

First check in saveAutoTranslateSettings, which backs DDP 'autoTranslate.saveSettings' and 'POST /api/v1/autotranslate.saveSettings': the acting user must hold the 'auto-translate' permission (global scope). It fires before argument validation, so under-privileged users get this even for malformed input.

Source

Thrown at apps/meteor/server/lib/autotranslate/functions/saveSettings.ts:16

import { Subscriptions, Rooms } from '@rocket.chat/models';
import { check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from '../../authorization/hasPermission';
import { notifyOnSubscriptionChangedById } from '../../notifyListener';

export const saveAutoTranslateSettings = async (
	userId: string,
	rid: string,
	field: string,
	value: string,
	options: { defaultLanguage: string },
) => {
	if (!(await hasPermissionAsync(userId, 'auto-translate'))) {
		throw new Meteor.Error('error-action-not-allowed', 'Auto-Translate is not allowed', {
			method: 'autoTranslate.saveSettings',
		});
	}

	check(rid, String);
	check(field, String);
	check(value, String);

	if (['autoTranslate', 'autoTranslateLanguage'].indexOf(field) === -1) {
		throw new Meteor.Error('error-invalid-settings', 'Invalid settings field', {
			method: 'saveAutoTranslateSettings',
		});
	}

	const subscription = await Subscriptions.findOneByRoomIdAndUserId(rid, userId);
	if (!subscription) {
		throw new Meteor.Error('error-invalid-subscription', 'Invalid subscription', {
			method: 'saveAutoTranslateSettings',

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant 'auto-translate' to the acting user's role
  2. Confirm the check has no room scope, so the permission must be global
  3. Cache the permission result client-side to avoid repeated failing calls
Defensive patterns

Strategy: validation

Validate before calling

const me = await GET '/api/v1/me';
if (!me.permissions?.includes('auto-translate')) {
  // skip autotranslate.saveSettings entirely
}

Try / catch

try {
  await POST '/api/v1/autotranslate.saveSettings' { roomId, field, value };
} catch (e) {
  if (e.error === 'error-action-not-allowed') {
    // acting user needs the global 'auto-translate' permission
  } else {
    throw e;
  }
}

Prevention

When it happens

Trigger: Calling autotranslate.saveSettings for a user whose roles lack 'auto-translate'; toggling per-room translation from the room settings UI as such a user; a service account saving settings without the permission.

Common situations: Auto-Translate enabled but the permission never granted; recently demoted users with stale clients; REST calls with a token whose user was never added to an auto-translate-enabled role.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e1097647ac7b88b5. Report an issue: GitHub.