RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by addUsersToRoomMethod() in apps/meteor/server/meteor-methods/rooms/addUsersToRoom.ts:74 when none of the three permission paths yield canAddUser: the acting user is not in the room without 'add-user-to-joined-room', the room is not type 'c' with 'add-user-to-any-c-room', and not type 'p' with 'add-user-to-any-p-room'. This is the invitation authorization matrix — you either need membership plus the joined-room permission, or the type-specific global permission.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/addUsersToRoom.ts:74

	if (room.t === 'd' && !isRoomNativeFederated(room)) {
		throw new Meteor.Error('error-cant-invite-for-direct-room', "Can't invite user to direct rooms", {
			method: 'addUsersToRoom',
		});
	}

	// Can add to any room you're in, with permission, otherwise need specific room type permission
	let canAddUser = false;
	if (userInRoom && (await hasPermissionAsync(userId, 'add-user-to-joined-room', room._id))) {
		canAddUser = true;
	} else if (room.t === 'c' && (await hasPermissionAsync(userId, 'add-user-to-any-c-room'))) {
		canAddUser = true;
	} else if (room.t === 'p' && (await hasPermissionAsync(userId, 'add-user-to-any-p-room'))) {
		canAddUser = true;
	}

	// Adding wasn't allowed
	if (!canAddUser) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'addUsersToRoom',
		});
	}

	// Missing the users to be added
	if (!Array.isArray(data.users)) {
		throw new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {
			method: 'addUsersToRoom',
		});
	}

	await beforeAddUsersToRoom.run({ usernames: data.users, inviter: user }, room);

	await Promise.all(
		data.users.map(async (username) => {
			const sanitizedUsername = sanitizeUsername(username);

			const newUser = await Users.findOneByUsernameIgnoringCase(sanitizedUsername);

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant the appropriate permission: 'add-user-to-joined-room' (members), 'add-user-to-any-c-room' (public channels), or 'add-user-to-any-p-room' (private channels) in Administration > Permissions.
  2. Pre-check programmatically before inviting (see validation code) so failure surfaces before user-facing work.
  3. If the caller should be in the room, ensure their subscription exists — permission path one requires both membership and the permission.
  4. For integrations, authenticate as an account that holds one of these permissions or use REST invite endpoints with an admin token.

Example fix

// before
await addUsersToRoomMethod(uid, { rid, users });

// after
const inRoom = Boolean(await Subscriptions.findOneByRoomIdAndUserId(rid, uid, { projection: { _id: 1 } }));
const allowed =
  (inRoom && (await hasPermissionAsync(uid, 'add-user-to-joined-room', rid))) ||
  (room.t === 'c' && (await hasPermissionAsync(uid, 'add-user-to-any-c-room'))) ||
  (room.t === 'p' && (await hasPermissionAsync(uid, 'add-user-to-any-p-room')));
if (!allowed) throw new Error('no invite permission for this room');
await addUsersToRoomMethod(uid, { rid, users });
Defensive patterns

Strategy: validation

Validate before calling

const inRoom = Boolean(await Subscriptions.findOneByRoomIdAndUserId(rid, uid, { projection: { _id: 1 } }));
const allowed =
  (inRoom && (await hasPermissionAsync(uid, 'add-user-to-joined-room', rid))) ||
  (room.t === 'c' && (await hasPermissionAsync(uid, 'add-user-to-any-c-room'))) ||
  (room.t === 'p' && (await hasPermissionAsync(uid, 'add-user-to-any-p-room')));
if (!allowed) throw new Error('no permission to add users to this room');

Try / catch

try {
  await addUsersToRoomMethod(uid, { rid, users });
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {
    // tell the user which invite permission they need; do not blind-retry
  }
}

Prevention

When it happens

Trigger: A regular member invites without 'add-user-to-joined-room'; a non-member invites into a public channel without 'add-user-to-any-c-room'; a non-member invites into a private channel without 'add-user-to-any-p-room'; permissions exist but scoped to a different room; acting as a bot account with no invite permissions.

Common situations: Workspaces tightening default permissions so members can no longer invite; custom roles missing the invite permissions after an upgrade; scripts running as service accounts that were never granted add-user permissions; moderators assuming moderation powers imply invite rights.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/0bd28abb51be686d. Report an issue: GitHub.