RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by the resetIrcConnection Meteor method when the caller is authenticated but lacks the 'edit-privileged-setting' permission. Resetting the IRC bridge connection touches a privileged setting (IRC_Bridge_Last_Ping) via the audited-settings helper, so privileged-setting edit rights are required.

Source

Thrown at apps/meteor/server/bridges/irc/methods/resetIrcConnection.ts:28

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		resetIrcConnection(): { message: string; params: unknown[] };
	}
}

Meteor.methods<ServerMethods>({
	async resetIrcConnection() {
		const ircEnabled = Boolean(settings.get('IRC_Enabled'));
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'resetIrcConnection' });
		}

		if (!(await hasPermissionAsync(uid, 'edit-privileged-setting'))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'resetIrcConnection' });
		}

		const auditSettingOperation = updateAuditedByUser({
			_id: uid,
			username: (await Meteor.userAsync())!.username!,
			ip: this.connection?.clientAddress || '',
			useragent: this.connection?.httpHeaders['user-agent'] || '',
		});

		const updatedLastPingValue = await auditSettingOperation(Settings.updateValueById, 'IRC_Bridge_Last_Ping', new Date(0), {
			upsert: true,
		});
		if (updatedLastPingValue.modifiedCount || updatedLastPingValue.upsertedCount) {
			void notifyOnSettingChangedById('IRC_Bridge_Last_Ping');
		}

		const updatedResetTimeValue = await auditSettingOperation(Settings.updateValueById, 'IRC_Bridge_Reset_Time', new Date(), {
			upsert: true,

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Grant 'edit-privileged-setting' to the calling user's role via the permissions admin.
2. Restrict the reset-IRC UI action to roles that hold the permission.
3. If IRC bridge management should not need privileged-setting rights, refactor the method to use a dedicated permission and an internal (non-audited-as-privileged) write.

Example fix

// before - operator role lacks edit-privileged-setting
Meteor.call('resetIrcConnection') // -> error-not-allowed

// after
// admin: grant edit-privileged-setting to the operator role, then
Meteor.call('resetIrcConnection')

const canEditPrivileged = await hasPermission('edit-privileged-setting');
if (!canEditPrivileged) throw new ClientError('forbidden','edit-privileged-setting required');

function canResetIrc(perms) { return Array.isArray(perms) && perms.includes('edit-privileged-setting'); }

try { Meteor.call('resetIrcConnection'); }
catch (e) {
  if (e?.error === 'error-not-allowed') { surface('edit-privileged-setting permission missing'); return; }
  throw e;
}

When it happens

Trigger: A logged-in non-admin (or an admin role without edit-privileged-setting) calls Meteor.call('resetIrcConnection').

Common situations: A custom operator role created for IRC management was not granted edit-privileged-setting. The permission was removed during hardening.

Related errors

• error-not-authorized
• error-invalid-user
• SlackBridge_disabled
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/339f4c366e08d190. Report an issue: GitHub.