RocketChat/Rocket.Chat · error · Error

error-not-allowed

Error message

error-not-allowed

What it means

Thrown by GET push.get when canAccessRoomAsync(room, receiver) resolves false. The authenticated user (receiver) does not have permission to view the room that contains the requested message. It is a plain new Error('error-not-allowed'), so the response is not a structured forbidden body.

Source

Thrown at apps/meteor/server/api/v1/push.ts:320

			const { id } = this.queryParams;

			const receiver = await Users.findOneById(this.userId);
			if (!receiver) {
				throw new Error('error-user-not-found');
			}

			const message = await Messages.findOneById(id);
			if (!message) {
				throw new Error('error-message-not-found');
			}

			const room = await Rooms.findOneById(message.rid);
			if (!room) {
				throw new Error('error-room-not-found');
			}

			if (!(await canAccessRoomAsync(room, receiver))) {
				throw new Error('error-not-allowed');
			}

			const data = await PushNotification.getNotificationForMessageId({ receiver, room, message });

			return API.v1.success({ data });
		},
	)
	.get(
		'push.info',
		{
			authRequired: true,
			response: {
				200: pushInfoResponseSchema,
				401: validateUnauthorizedErrorResponse,
			},
		},
		async function action() {
			const defaultGateway = (await Settings.findOneById('Push_gateway', { projection: { packageValue: 1 } }))?.packageValue;

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Verify the calling user's membership/subscription for the target room before requesting push info.
  2. Use the user's own notification list rather than arbitrary message ids.
  3. If access was recently revoked, stop polling push.get for that message.
  4. On the client, suppress/silently drop this error since the user legitimately cannot see the content.
Defensive patterns

Strategy: validation

Validate before calling

// Confirm the user can access the room before fetching push info
async function canUserSeeRoom(userId: string, roomId: string): Promise<boolean> {
  // use the subscriptions/rooms endpoints scoped to the caller
  const res = await fetch(`/api/v1/rooms.info?roomId=${encodeURIComponent(roomId)}`).then(r => r.status);
  return res === 200;
}

Try / catch

try {
  await fetch(`/api/v1/push.get?id=${id}`).then(r => r.json());
} catch (e) {
  if (String(e).includes('error-not-allowed')) { /* user lacks room access; suppress */ }
}

Prevention

When it happens

Trigger: GET /api/v1/push.get?id=<id> where the message exists and its room exists, but the calling user is not a member / lacks view permission on that room (e.g. private channel, DM between other users, restricted team room).

Common situations: User was removed from the channel after the notification was queued; client tries to fetch push info for a message in a room the user was never invited to; cross-workspace id leak.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/9d42ef8f81b00f53. Report an issue: GitHub.