RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Action not allowed

What it means

checkFederationConfiguration requires the 'view-privileged-setting' permission; without it the server throws error-not-allowed right after the login check. Federation configuration exposes sensitive bridge details, so the check is restricted to privileged admins.

Source

Thrown at apps/meteor/server/meteor-methods/platform/checkFederationConfiguration.ts:24

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		checkFederationConfiguration(): Promise<{ message: string }>;
	}
}

Meteor.methods<ServerMethods>({
	async checkFederationConfiguration() {
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'checkFederationConfiguration',
			});
		}

		if (!(await Authorization.hasPermission(uid, 'view-privileged-setting'))) {
			throw new Meteor.Error('error-not-allowed', 'Action not allowed', {
				method: 'checkFederationConfiguration',
			});
		}

		const errors: string[] = [];

		const successes: string[] = [];

		const service = License.hasValidLicense() ? FederationEE : Federation;

		const status = await service.configurationStatus();

		if (status.externalReachability.ok) {
			successes.push('homeserver configuration looks good');
		} else {
			let err = 'external reachability could not be verified';

			const { error } = status.externalReachability;

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant 'view-privileged-setting' to the role of users who must run the federation check
  2. Restrict the federation check UI to users holding that permission
  3. Treat error-not-allowed as a permanent authorization failure — fix the role, do not retry

Example fix

// before
Meteor.call('checkFederationConfiguration');

// after
if (hasPermission(uid, 'view-privileged-setting')) {
  const { message } = await Meteor.callAsync('checkFederationConfiguration');
}
Defensive patterns

Strategy: validation

Validate before calling

if (!hasPermission(Meteor.userId(), 'view-privileged-setting')) {
  hideFederationCheck();
}

Type guard

const isNotAllowed = (e: unknown): e is Meteor.Error =>
  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-allowed';

Try / catch

try {
  await Meteor.callAsync('checkFederationConfiguration');
} catch (e) {
  if (isNotAllowed(e)) {
    showError('Requires the view-privileged-setting permission');
    return; // permanent — no retry
  }
  throw e;
}

Prevention

When it happens

Trigger: A logged-in non-admin, or an admin whose role lost 'view-privileged-setting', invoking checkFederationConfiguration.

Common situations: Custom admin consoles whose operator role lacks privileged-setting permissions; permission sets tightened during security audits; sub-admins given the federation UI without the underlying permission.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/48aa69aa4cdcb35c. Report an issue: GitHub.