RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

The push_test Meteor method first resolves the caller with Meteor.userAsync(); an unauthenticated invocation (no user on the connection) yields null and it throws Meteor.Error('error-not-allowed', 'Not allowed', { method: 'push_test' }). A second gate immediately after requires the 'test-push-notifications' permission — the same code for a different cause.

Source

Thrown at apps/meteor/server/lib/pushConfig.ts:47

	return tokens;
};

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		push_test(): { message: string; params: number[] };
	}
}

Meteor.methods<ServerMethods>({
	async push_test() {
		methodDeprecationLogger.method('push_test', '9.0.0', '/v1/push.test');

		const user = await Meteor.userAsync();

		if (!user) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'push_test',
			});
		}

		if (!(await hasPermissionAsync(user, 'test-push-notifications'))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'push_test',
			});
		}

		if (settings.get('Push_enable') !== true) {
			throw new Meteor.Error('error-push-disabled', 'Push is disabled', {
				method: 'push_test',
			});
		}

		const tokensCount = await executePushTest(user._id, user.username);
		return {

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Ensure the DDP connection is authenticated (Meteor.loginWithToken / loginWithPassword) before calling push_test
  2. Grant 'test-push-notifications' to the caller's role in Administration > Permissions for the permission variant
  3. Prefer the REST endpoint POST /api/v1/push.test with an auth token/user (push_test is deprecated)
  4. Check Meteor.userId() client-side before invoking to fail fast with a clear message

Example fix

// before
Meteor.call('push_test'); // unauthenticated -> error-not-allowed

// after
if (!Meteor.userId()) throw new Meteor.Error('error-not-allowed', 'Login required');
Meteor.call('push_test');
Defensive patterns

Strategy: validation

Validate before calling

// client-side fail-fast before invoking the method
if (!Meteor.userId()) {
  throw new Meteor.Error('error-not-allowed', 'Login required for push_test');
}
await Meteor.callAsync('push_test');

Try / catch

try {
  await Meteor.callAsync('push_test');
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-not-allowed' && err.details?.method === 'push_test') {
    // re-authenticate (login flow) and grant test-push-notifications, then retry
  } else {
    throw err;
  }
}

Prevention

When it happens

Trigger: Calling Meteor.call('push_test') over a DDP connection without a logged-in user: server-side scripts invoking it bare, expired login token, or methods invoked before login completes. (The line-53 variant fires for logged-in users lacking test-push-notifications.)

Common situations: Automation calling methods without establishing a session, stale login tokens after password reset/logout, users with admin roles that don't include test-push-notifications, or custom clients skipping the login handshake.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/12be654d1566a88f. Report an issue: GitHub.