RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

After the login check, removeOAuthService requires the 'add-oauth-service' permission and throws 'error-not-allowed' when the caller does not hold it. Removing a custom OAuth service deletes its settings, so it is gated on the same permission as adding one.

Source

Thrown at apps/meteor/server/meteor-methods/auth/removeOAuthService.ts:81

		}
	});
};

Meteor.methods<ServerMethods>({
	async removeOAuthService(name) {
		methodDeprecationLogger.method('removeOAuthService', '9.0.0', '/v1/settings.removeCustomOAuth');
		check(name, String);

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'removeOAuthService',
			});
		}

		if ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'removeOAuthService' });
		}

		await removeCustomOAuthSettings(name);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant 'add-oauth-service' to the caller's role in the admin Permissions screen
  2. Perform the removal from a full admin account
  3. Verify effective permissions before retrying
Defensive patterns

Strategy: validation

Validate before calling

// client: gate the remove action on the same permission the server checks
const canRemove = useHasPermission('add-oauth-service');
if (!canRemove) { /* hide/disable the remove action */ }

Try / catch

try {
  await Meteor.callAsync('removeOAuthService', name);
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-not-allowed') {
    // caller lacks 'add-oauth-service': grant it or run as admin
  }
}

Prevention

When it happens

Trigger: A logged-in user whose roles do not include 'add-oauth-service' calls removeOAuthService(name).

Common situations: A role with view-only settings access attempts removal; permission grants pruned during a security review.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e80f635b02f7fa36. Report an issue: GitHub.