RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

WebDAV Integration Not Allowed

What it means

getWebdavFilePreview is gated on two settings: Webdav_Integration_Enabled must be true AND Accounts_OAuth_Nextcloud_URL must be set. The preview flow builds a URL against the Nextcloud host (`${serverURL}/index.php/core/preview.png?file=...`), so without a configured Nextcloud base URL the method refuses with error-not-allowed even though generic WebDAV browsing may work.

Source

Thrown at apps/meteor/server/bridges/webdav/methods/getWebdavFilePreview.ts:28

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getWebdavFilePreview(accountId: IWebdavAccount['_id'], path: string): { success: true; data: ArrayBuffer } | undefined;
	}
}

Meteor.methods<ServerMethods>({
	async getWebdavFilePreview(accountId, path) {
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid User', {
				method: 'getWebdavFilePreview',
			});
		}

		if (!settings.get('Webdav_Integration_Enabled') || !settings.get('Accounts_OAuth_Nextcloud_URL')) {
			throw new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {
				method: 'getWebdavFilePreview',
			});
		}

		const account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});
		if (!account) {
			throw new Meteor.Error('error-invalid-account', 'Invalid WebDAV Account', {
				method: 'getWebdavFilePreview',
			});
		}

		try {
			const cred = getWebdavCredentials(account);
			const client = createClient(account.serverURL, cred);
			const serverURL = settings.get('Accounts_OAuth_Nextcloud_URL');
			const res = await client.customRequest(`${serverURL}/index.php/core/preview.png?file=${path}&x=64&y=64`, {
				method: 'GET',
				responseType: 'arraybuffer',

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Enable Webdav_Integration_Enabled under Administration > WebDAV Integration
  2. Set Accounts_OAuth_Nextcloud_URL to the Nextcloud base URL the account was authorized against
  3. If the provider is not Nextcloud, hide/disable the preview affordance in the UI — previews are Nextcloud-only by construction
Defensive patterns

Strategy: validation

Validate before calling

import { settings } from '../../../settings/server';

// expose capability to the UI instead of letting it discover the error
export const webdavPreviewAvailable = (): boolean =>
  Boolean(settings.get('Webdav_Integration_Enabled')) &&
  Boolean(settings.get('Accounts_OAuth_Nextcloud_URL'));

Try / catch

try {
  await Meteor.callAsync('getWebdavFilePreview', accountId, path);
} catch (e: any) {
  if (e?.error === 'error-not-allowed') {
    // hide preview UI; integration disabled or Nextcloud URL missing
  }
}

Prevention

When it happens

Trigger: Admin disabled Webdav_Integration_Enabled; Accounts_OAuth_Nextcloud_URL was never set because the deployment uses a non-Nextcloud WebDAV provider; settings changed while a user had the WebDAV file picker open.

Common situations: Using generic WebDAV (e.g. Apache/mod_dav, Sabre) where no Nextcloud URL exists, so previews are structurally unavailable; partially completed Nextcloud OAuth setup; the toggle was switched off temporarily during maintenance.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/cf59fda2c6d1cd44. Report an issue: GitHub.