RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

unmuteUserInRoom requires a truthy fromId AND the 'mute-user' permission scoped to the room (hasPermissionAsync(fromId, 'mute-user', data.rid)); failing either throws error-not-allowed. Unmuting uses the exact same permission as muting.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/unmuteUserInRoom.ts:21

import { Rooms, Subscriptions, Users } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { RoomMemberActions } from '../../../definition/IRoomTypeConfig';
import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { callbacks } from '../../lib/callbacks';
import { notifyOnRoomChangedById } from '../../lib/notifyListener';
import { roomCoordinator } from '../../lib/rooms/roomCoordinator';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		unmuteUserInRoom(data: { rid: IRoom['_id']; username: string }): boolean;
	}
}

export const unmuteUserInRoom = async (fromId: string, data: { rid: IRoom['_id']; username: string }): Promise<boolean> => {
	if (!fromId || !(await hasPermissionAsync(fromId, 'mute-user', data.rid))) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'unmuteUserInRoom',
		});
	}

	const room = await Rooms.findOneById(data.rid);

	if (!room) {
		throw new Meteor.Error('error-invalid-room', 'Invalid room', {
			method: 'unmuteUserInRoom',
		});
	}

	if (!(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.MUTE, fromId))) {
		throw new Meteor.Error('error-invalid-room-type', `${room.t} is not a valid room type`, {
			method: 'unmuteUserInRoom',
			type: room.t,
		});
	}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Grant mute-user to the acting user's role (Administration > Permissions)
2. Ensure the acting user id is set when calling the exported unmuteUserInRoom function directly
3. Hide mute/unmute actions unless the client-side permission check for mute-user passes
4. For room-scoped roles, confirm the role's scope includes this room

Example fix

// before
Meteor.call('unmuteUserInRoom', { rid, username }); // role lacks mute-user

// after
if (hasPermission('mute-user', rid)) {
  Meteor.call('unmuteUserInRoom', { rid, username });
}

import { hasPermission } from '../../../app/authorization/client';

if (!hasPermission('mute-user', rid)) {
  // hide mute/unmute actions instead of calling the method
}

try {
  await Meteor.callAsync('unmuteUserInRoom', { rid, username });
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-not-allowed') {
    // acting user lacks mute-user on this room; notify and refresh member list UI
  }
}

When it happens

Trigger: A moderator whose role lacks mute-user calls Meteor.call('unmuteUserInRoom', { rid, username }); or the exported function is invoked with an empty/undefined fromId.

Common situations: Custom moderator roles created without mute-user; bots attempting to unmute with low-privilege users; room-scoped permission overrides that removed mute-user for a specific channel.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• error-invalid-role
• error-permission-not-found
• The required "roomId" or "roomName" param provided does not
• error-invalid-user
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/60b9fac7fb0e4bf7. Report an issue: GitHub.