RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

createPrivateGroup guard after a teamId resolved to a real team: hasPermissionAsync(user, 'create-team-group', team.roomId) returned false. Adding a private group to a team requires the create-team-group permission scoped to the team's room, held by team owners/managers and admins by default.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts:47

	extraData: Record<string, any> = {},
	excludeSelf = false,
): Promise<
	ICreatedRoom & {
		rid: string;
	}
> => {
	check(name, String);
	check(members, Match.Optional([String]));

	if (extraData.teamId) {
		const team = await Team.findOneById<Pick<ITeam, '_id' | 'roomId'>>(extraData.teamId, { projection: { roomId: 1 } });
		if (!team) {
			throw new Meteor.Error('error-team-not-found', 'The "teamId" param provided does not match any team', {
				method: 'createPrivateGroup',
			});
		}
		if (!(await hasPermissionAsync(user, 'create-team-group', team.roomId))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
		}
	} else if (!(await hasPermissionAsync(user, 'create-p'))) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
	}

	return createRoom('p', name, user, members, excludeSelf, readOnly, {
		...(customFields && Object.keys(customFields).length && { customFields }),
		...extraData,
	});
};

Meteor.methods<ServerMethods>({
	async createPrivateGroup(name, members, readOnly = false, customFields = {}, extraData = {}) {
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'createPrivateGroup',

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Have a team owner/manager/admin create the group, or grant create-team-group to the member's role on the team.
  2. Create the group standalone and let an owner link it to the team.
  3. Run automation under an account holding create-team-group for that team.

Example fix

// before
Meteor.call('createPrivateGroup', name, members, false, {}, { teamId });

// after
if (isTeamOwnerOrAdmin(team, Meteor.userId())) {
  Meteor.call('createPrivateGroup', name, members, false, {}, { teamId });
} else {
  showToast('Ask a team owner to add this private group');
}
Defensive patterns

Strategy: try-catch

Validate before calling

// if the teams data exposes the caller's role, gate the UI on it:
if (!isTeamOwnerOrAdmin(teamInfo, Meteor.userId())) {
  // hide the add-group-to-team action for this user
}

Try / catch

try {
  await Meteor.callAsync('createPrivateGroup', name, members, false, {}, { teamId });
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {
    // lacks create-team-group on this team - suggest asking an owner
    showToast('Only team owners/managers can add private groups to this team');
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: A regular team member calls createPrivateGroup with the team's teamId; the role lacks create-team-group on that team; owners-only policy for team sub-rooms.

Common situations: Members trying to add private groups to teams; permission refactors that dropped create-team-group; automations running as non-owner members.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3f820def1c32b6cf. Report an issue: GitHub.