RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Bot request not allowed

What it means

requestError() is the BotHelpers generic guard: every getter that depends on admin-configured data calls it when the configuration does not expose enough information to answer the request. The whitelist is the BotHelpers_userFields setting (watched at module load, fed into setupCursors); 'allUsers'/'onlineUsers' throw when it is empty, 'allUsernames'/'onlineUsernames' when it lacks 'username', 'allNames'/'onlineNames' when it lacks 'name', and 'allIDs'/'onlineIDs' when it lacks '_id' or 'username'.

Source

Thrown at apps/meteor/server/lib/bot-helpers/index.ts:106

		});
	}

	async removeUserFromRoom(userName: string, room: string) {
		const foundRoom = await Rooms.findOneByIdOrName(room);

		if (!foundRoom) {
			throw new Meteor.Error('invalid-channel');
		}
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user');
		}
		await removeUserFromRoomMethod(userId, { rid: foundRoom._id, username: userName });
	}

	// generic error whenever property access insufficient to fill request
	requestError() {
		throw new Meteor.Error('error-not-allowed', 'Bot request not allowed', {
			method: 'botRequest',
			action: 'bot_request',
		});
	}

	// "public" properties accessed by getters
	// allUsers / onlineUsers return whichever properties are enabled by settings
	get allUsers() {
		if (!Object.keys(this.userFields).length) {
			this.requestError();
			return false;
		}
		return this._allUsers.toArray();
	}

	get onlineUsers() {
		if (!Object.keys(this.userFields).length) {
			this.requestError();

View on GitHub (pinned to b2c16d5842)

Solutions

1. Set the BotHelpers_userFields setting (comma-separated field list) to include every field the bot requests, e.g. 'username,name,_id' for the IDs getters.
2. Retry the request after the setting propagates (the settings.watch re-runs setupCursors).
3. If the data must stay private, stop requesting that property in the bot and handle error-not-allowed gracefully instead.

Example fix

// BotHelpers_userFields setting
// before
''

// after
'username,name,_id,status'

import { settings } from '../../settings';

// server-side pre-check before granting bots the property
const fields = String(settings.get('BotHelpers_userFields') ?? '').split(',').map((f) => f.trim());
const required = { allUsers: [], onlineUsers: [], allUsernames: ['username'], allIDs: ['_id', 'username'], allNames: ['name'] };
if (required[prop].some((f) => !fields.includes(f))) {
  throw new Error(`BotHelpers_userFields must include: ${required[prop].join(', ') || 'at least one field'}`);
}

const botPropAllowed = (prop: string, fieldsSetting: string): boolean => {
  const fields = fieldsSetting.split(',').map((f) => f.trim());
  if (prop === 'allUsers' || prop === 'onlineUsers') return fields.length > 0;
  if (prop === 'allUsernames' || prop === 'onlineUsernames') return fields.includes('username');
  if (prop === 'allNames' || prop === 'onlineNames') return fields.includes('name');
  if (prop === 'allIDs' || prop === 'onlineIDs') return fields.includes('_id') && fields.includes('username');
  return true;
};

try {
  const users = await Meteor.callAsync('botRequest', 'allUsers');
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {
    // configuration issue: ask the admin to fill BotHelpers_userFields, or degrade gracefully
  }
  throw e;
}

When it happens

Trigger: botRequest('allUsers') or 'onlineUsers' on a server where BotHelpers_userFields is empty; botRequest('allUsernames') when the setting list omits 'username'; botRequest('allNames') when it omits 'name'; 'allIDs'/'onlineIDs' when it omits '_id' or 'username'.

Common situations: Fresh installs where the admin never configured bot helper fields; settings cleared during migration; admins intentionally locking down bot data access while bot apps still request those properties.

Related errors

• error-autotranslate-disabled
• Failed to save registration data
• error-action-not-allowed
• error-message-editing-blocked
• message-length-exceeds-character-limit

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/f2ac555491b8b6b9. Report an issue: GitHub.