RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

getRoomNameById could not find the room: Rooms.findOneById(rid) returned null, reported as 'error-not-allowed'. Like its sibling getRoomById, this method collapses not-found and not-permitted into the same code, and the id lookup is exact - no name fallback exists here.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/getRoomNameById.ts:31

		getRoomNameById(rid: IRoom['_id']): Promise<string | undefined>;
	}
}

Meteor.methods<ServerMethods>({
	async getRoomNameById(rid) {
		methodDeprecationLogger.method('getRoomNameById', '9.0.0', '/v1/rooms.info');
		check(rid, String);
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'getRoomNameById',
			});
		}

		const room = await Rooms.findOneById(rid);

		if (room == null) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'getRoomNameById',
			});
		}

		const subscription = await Subscriptions.findOneByRoomIdAndUserId(rid, userId, {
			projection: { _id: 1 },
		});
		if (subscription) {
			return room.name;
		}

		if (room.t !== 'c' || (await hasPermissionAsync(userId, 'view-c-room')) !== true) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'getRoomNameById',
			});
		}

		return room.name;

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Validate the rid against a current rooms subscription before calling
  2. Check the server directly: db.rooms.findOne({_id: rid})
  3. Handle 'error-not-allowed' by pruning the stale reference from local caches
  4. Migrate to GET /api/v1/rooms.info for a distinguishable not-found signal

Example fix

// before
const name = await Meteor.callAsync('getRoomNameById', rid);

// after - resolve against the live room cache first
const cached = RoomManager.getOpenedRoomByRid(rid);
if (!cached) throw new Error('unknown room');
const name = cached.name ?? (await Meteor.callAsync('getRoomNameById', rid));
Defensive patterns

Strategy: validation

Validate before calling

// confirm the room is present in live state before resolving its name
if (typeof rid !== 'string' || rid.length !== 17) throw new Error('malformed room id');
if (!RoomManager.getOpenedRoomByRid(rid)) throw new Error('unknown room');
const name = await Meteor.callAsync('getRoomNameById', rid);

Try / catch

try {
  const name = await Meteor.callAsync('getRoomNameById', rid);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {
    pruneStaleRid(rid); // not-found and no-access share this code
  }
}

Prevention

When it happens

Trigger: Meteor.call('getRoomNameById', rid) with a deleted room id, a mistyped id, or an id for a different entity type; any well-formed string passes check() and reaches the null-room branch.

Common situations: Rendering cached notification or favorite lists that outlive the room; ids carried over from another workspace during export/import; UI holding rids collected before a room was archived and deleted.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/54eceee824c501a2. Report an issue: GitHub.