RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by GET roles.getUsersInRole when a roomId query param is supplied AND the authenticated user lacks the 'view-other-user-channels' permission. The route already requires 'access-permissions'; this is an additional guard for room-scoped user listing. Returns a structured Meteor.Error('error-not-allowed', ...).

Source

Thrown at apps/meteor/server/api/v1/roles.ts:193

		},
		async function action() {
			const { roomId, role } = this.queryParams;
			const { offset, count = 50 } = await getPaginationItems(this.queryParams);

			const projection = {
				name: 1,
				username: 1,
				emails: 1,
				avatarETag: 1,
				createdAt: 1,
				_updatedAt: 1,
			};

			if (!role) {
				throw new Meteor.Error('error-param-not-provided', 'Query param "role" is required');
			}
			if (roomId && !(await hasPermissionAsync(this.user, 'view-other-user-channels'))) {
				throw new Meteor.Error('error-not-allowed', 'Not allowed');
			}

			const options = { projection: { _id: 1 } };
			const roleData = await Roles.findOneById<Pick<IRole, '_id'>>(role, options);

			if (!roleData) {
				throw new Meteor.Error('error-invalid-roleId');
			}

			const { cursor, totalCount } = await getUsersInRolePaginated(roleData._id, roomId, {
				limit: count,
				sort: { username: 1 },
				skip: offset,
				projection,
			});

			const [users, total] = await Promise.all([cursor.toArray(), totalCount]);

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Drop the roomId param to list role members workspace-wide instead of scoped to a room.
2. Grant the user 'view-other-user-channels' if room-scoped listing is legitimately required.
3. Request the listing from an account that holds both permissions.

Example fix

// before
fetch(`/api/v1/roles.getUsersInRole?role=${role}&roomId=${roomId}`);

// after - omit roomId when caller lacks view-other-user-channels
fetch(`/api/v1/roles.getUsersInRole?role=${role}`);

// If the caller may lack view-other-user-channels, omit roomId
function buildUsersInRoleUrl(role: string, roomId?: string, canViewOtherChannels?: boolean): string {
  const base = `/api/v1/roles.getUsersInRole?role=${encodeURIComponent(role)}`;
  return roomId && canViewOtherChannels ? `${base}&roomId=${encodeURIComponent(roomId)}` : base;
}

try {
  await fetch(url).then(r => r.json());
} catch (e) {
  if (e.error === 'error-not-allowed') { /* retry without roomId */ }
}

When it happens

Trigger: GET /api/v1/roles.getUsersInRole?role=<r>&roomId=<room> by a user who has 'access-permissions' but not 'view-other-user-channels'.

Common situations: A moderator/admin with limited permissions tries to list role members scoped to a room they cannot view; permission set was tightened; custom role with partial grants.

Related errors

• error-not-allowed
• error-not-authorized
• error-user-already-in-role
• error-user-not-in-role
• error-action-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/edebc7cbc763a918. Report an issue: GitHub.