What causes "Not allowed" in RocketChat/Rocket.Chat?

Before translating, verify the user still has access to the message's room (active subscription or public room).

RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by 'autoTranslate.translateMessage' when Rooms.findOneById(msg.rid) returns nothing (message without a live room) or when canAccessRoomAsync(room, { _id: userId }) denies the caller. The second, far more common path is an authorization failure: the user is not a member of, and cannot otherwise access, the room the message belongs to.

Source

Thrown at apps/meteor/server/meteor-methods/platform/translateMessage.ts:33

}

Meteor.methods<ServerMethods>({
	async 'autoTranslate.translateMessage'(message, targetLanguage) {
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'autoTranslate.translateMessage',
			});
		}
		check(message?._id, String);
		check(targetLanguage, String);
		const msg = await Messages.findOneById(message._id);
		if (!msg) {
			throw new Meteor.Error('error-message-not-found', 'Message not found');
		}
		const room = await Rooms.findOneById(msg.rid);
		if (!room || !(await canAccessRoomAsync(room, { _id: userId }))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed');
		}
		return translateMessage(targetLanguage, msg);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

Before translating, verify the user still has access to the message's room (active subscription or public room).
Client-side, drop or lock messages whose room subscription was removed.
If access is denied unexpectedly, audit the room type and the user's roles against canAccessRoom rules (e.g. private room without membership).

Defensive patterns

Strategy: try-catch

Validate before calling

// before offering translate, confirm the user still has a subscription for the room
const sub = await RocketChat.models.Subscriptions.findOne({ rid: message.rid });
if (!sub && !roomIsPubliclyReadable(message.rid)) {
	// hide translate action - server will reject with error-not-allowed
}

Try / catch

try {
	await Meteor.callAsync('autoTranslate.translateMessage', { _id: message._id }, lang);
} catch (e: any) {
	if (e?.error === 'error-not-allowed') {
		// user lost access to msg.rid: purge cached messages for that room
	}
}

Prevention

Prune cached room messages when the subscription-remove event arrives.
Do not surface translate actions on quoted messages from rooms the user cannot access.
Audit room access after permission model changes if denials appear unexpected.

When it happens

Trigger: Translating a message in a room the user was removed from while it was still rendered; a message from a private room surfaced through a quote/thread the user cannot access; a deleted room still referenced by cached messages.

Common situations: Removed-from-channel races in busy clients; DM history still rendered after the conversation closed; rooms switched from public to private by admins.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/ff4b489ba9ff1396. Report an issue: GitHub.