RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by saveCannedResponse when hasPermissionAsync(userId, 'save-canned-responses') is false. This is the base permission gate; without it a user cannot create or update any canned response regardless of scope. Code is 'error-not-allowed'.

Source

Thrown at apps/meteor/ee/server/meteor-methods/saveCannedResponse.ts:23

import { hasPermissionAsync } from '../../../server/lib/authorization/hasPermission';
import notifications from '../../../server/lib/notifications/core/lib/Notifications';

type ResponseData = {
	shortcut: string;
	text: string;
	scope: string;
	tags?: string[];
	departmentId?: string;
};

export const saveCannedResponse = async (
	userId: string,
	responseData: ResponseData,
	_id?: string,
): Promise<Omit<IOmnichannelCannedResponse, '_updatedAt' | '_createdAt'> & { _createdAt?: Date }> => {
	if (!(await hasPermissionAsync(userId, 'save-canned-responses'))) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'saveCannedResponse' });
	}

	check(_id, Match.Maybe(String));

	check(responseData, {
		shortcut: String,
		text: String,
		scope: String,
		tags: Match.Maybe([String]),
		departmentId: Match.Maybe(String),
	});

	const canSaveAll = await hasPermissionAsync(userId, 'save-all-canned-responses');
	if (!canSaveAll && ['global'].includes(responseData.scope)) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed to modify canned responses on *global* scope', {
			method: 'saveCannedResponse',
		});
	}

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Grant 'save-canned-responses' to the user's role in Administration > Permissions.
  2. If only certain scopes should be editable, still grant the base permission and rely on the scope-specific checks (canSaveAll / canSaveDepartment).
  3. Verify the userId passed matches the acting user.
Defensive patterns

Strategy: validation

Validate before calling

if (!(await hasPermissionAsync(userId, 'save-canned-responses'))) {
  throw new Error('You do not have permission to save canned responses');
}
await saveCannedResponse(userId, responseData, _id);

Try / catch

try {
  await saveCannedResponse(userId, responseData, _id);
} catch (e) {
  if (isMeteorError(e, 'error-not-allowed')) {
    notifyUser('You lack the save-canned-responses permission.');
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling saveCannedResponse with a userId whose role does not grant 'save-canned-responses'.

Common situations: Agent role not granted the save permission; permission was revoked during a role cleanup; new custom role created without the canned-response permission.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/d7f221152cc71229. Report an issue: GitHub.