RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

executeSetUserActiveStatus authorizes the caller, not the target: it requires fromUserId to be truthy AND to hold the edit-other-user-active-status permission. Either failing yields error-not-allowed before any deactivation logic (last-admin protection, room ownership checks) runs.

Source

Thrown at apps/meteor/server/meteor-methods/users/setUserActiveStatus.ts:25

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		setUserActiveStatus(userId: string, active: boolean, confirmRelinquish?: boolean): boolean;
	}
}

export const executeSetUserActiveStatus = async (
	fromUserId: string,
	userId: string,
	active: boolean,
	confirmRelinquish?: boolean,
): Promise<boolean> => {
	check(userId, String);
	check(active, Boolean);

	if (!fromUserId || (await hasPermissionAsync(fromUserId, 'edit-other-user-active-status')) !== true) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'setUserActiveStatus',
		});
	}

	await setUserActiveStatus(userId, active, confirmRelinquish, fromUserId);

	return true;
};

Meteor.methods<ServerMethods>({
	async setUserActiveStatus(userId, active, confirmRelinquish) {
		const uid = Meteor.userId();
		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'setUserActiveStatus',
			});
		}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant edit-other-user-active-status to the acting role under Administration -> Permissions
  2. For programmatic flows use POST /api/v1/users.setActiveStatus with an authorized token
  3. Only render activate/deactivate controls when the caller has the permission (roles-based UI gating)
Defensive patterns

Strategy: validation

Validate before calling

const canEditActiveStatus = (roles: string[]) =>
  roles.includes('admin') || roleHasPermission(roles, 'edit-other-user-active-status');
if (!canEditActiveStatus(currentUser.roles)) {
  hideControl('deactivate-user');
  return;
}

Try / catch

catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-not-allowed') {
    showNotice('You lack edit-other-user-active-status permission');
  }
}

Prevention

When it happens

Trigger: Meteor.call('setUserActiveStatus', userId, active, confirmRelinquish) from a user whose roles lack edit-other-user-active-status; or a server-side call passing an empty fromUserId.

Common situations: Custom admin panels assuming 'admin role == all permissions' after a role refactor; permission revoked but the client UI cache still shows the toggle; tests calling the method without permission stubs.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/7b1b85bbe69f1b22. Report an issue: GitHub.