What causes "Not allowed" in RocketChat/Rocket.Chat?

Run the method as a user with 'clear-oembed-cache' (typically admin); grant that permission to the appropriate role if missing

RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

The OEmbedCacheCleanup Meteor method requires a logged-in user holding the 'clear-oembed-cache' permission; anything else throws error-not-allowed. The method purges OEmbed (link-preview) cache entries older than API_EmbedCacheExpirationDays days.

Source

Thrown at apps/meteor/server/meteor-methods/platform/OEmbedCacheCleanup.ts:26

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		OEmbedCacheCleanup(): { message: string };
	}
}

export const executeClearOEmbedCache = async () => {
	const date = new Date();
	const expirationDays = settings.get<number>('API_EmbedCacheExpirationDays');
	date.setDate(date.getDate() - expirationDays);
	return OEmbedCache.removeBeforeDate(date);
};

Meteor.methods<ServerMethods>({
	async OEmbedCacheCleanup() {
		const uid = Meteor.userId();
		if (!uid || !(await hasPermissionAsync(uid, 'clear-oembed-cache'))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'OEmbedCacheCleanup',
			});
		}

		await executeClearOEmbedCache();
		return {
			message: 'cache_cleared',
		};
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

Run the method as a user with 'clear-oembed-cache' (typically admin); grant that permission to the appropriate role if missing
Gate the UI action behind a client-side 'clear-oembed-cache' permission check
Handle error-not-allowed as an authorization failure — fix roles, do not retry

Example fix

// before
Meteor.call('OEmbedCacheCleanup');

// after
if (hasPermission(uid, 'clear-oembed-cache')) {
  Meteor.call('OEmbedCacheCleanup');
}

Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId() || !hasPermission(Meteor.userId(), 'clear-oembed-cache')) {
  disableCacheCleanupAction();
}

Type guard

const isNotAllowed = (e: unknown): e is Meteor.Error =>
  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-allowed';

Try / catch

try {
  await Meteor.callAsync('OEmbedCacheCleanup');
} catch (e) {
  if (isNotAllowed(e)) {
    showError('You need the clear-oembed-cache permission');
    return; // permanent — fix the role, do not retry
  }
  throw e;
}

Prevention

Bind admin-only maintenance actions to explicit permission checks in the UI
Keep clear-oembed-cache on the admin role only
Never expose maintenance methods to unauthenticated sessions

When it happens

Trigger: Calling Meteor.call('OEmbedCacheCleanup') from an anonymous connection, or as a user whose roles do not include 'clear-oembed-cache'.

Common situations: Non-admin users triggering cache cleanup; custom admin panels invoking the method without a permission gate; the permission removed from the admin role during a roles refactor.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/7e280a8e1f4ebbe5. Report an issue: GitHub.