RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by removeCannedResponse when hasPermissionAsync(uid, 'remove-canned-responses') returns false. The user lacks the permission to delete canned responses. Code is 'error-not-allowed'.

Source

Thrown at apps/meteor/ee/server/meteor-methods/removeCannedResponse.ts:10

import { CannedResponse } from '@rocket.chat/models';
import { check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from '../../../server/lib/authorization/hasPermission';
import notifications from '../../../server/lib/notifications/core/lib/Notifications';

export const removeCannedResponse = async (uid: string, _id: string): Promise<void> => {
	if (!(await hasPermissionAsync(uid, 'remove-canned-responses'))) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'removeCannedResponse',
		});
	}

	check(_id, String);

	const cannedResponse = await CannedResponse.findOneById(_id);
	if (!cannedResponse) {
		throw new Meteor.Error('error-canned-response-not-found', 'Canned Response not found', {
			method: 'removeCannedResponse',
		});
	}

	notifications.streamCannedResponses.emit('canned-responses', { type: 'removed', _id });

	await CannedResponse.removeById(_id);
};

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Grant 'remove-canned-responses' to the user's role in Administration > Permissions.
  2. If the user should only manage their own responses, restrict the UI to delete-by-owner rather than removing this permission.
  3. Confirm the uid passed in is the logged-in user, not a stale id.
Defensive patterns

Strategy: validation

Validate before calling

if (!(await hasPermissionAsync(uid, 'remove-canned-responses'))) {
  throw new Error('You do not have permission to remove canned responses');
}
await removeCannedResponse(uid, _id);

Try / catch

try {
  await removeCannedResponse(uid, _id);
} catch (e) {
  if (isMeteorError(e, 'error-not-allowed')) {
    notifyUser('You lack the remove-canned-responses permission.');
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling removeCannedResponse (the canned-response delete method) with a uid whose roles do not grant 'remove-canned-responses'.

Common situations: Agent or livechat-manager role without the remove permission assigned; permission role was edited and the toggle dropped; new install where the role has not been configured.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/6d8ad7f8916935ab. Report an issue: GitHub.