RocketChat/Rocket.Chat · error · Meteor.Error

error-not-authorized

error-not-authorized

Error message

Not authorized

What it means

Thrown by removeSlackBridgeChannelLinks when the caller is authenticated but lacks the 'remove-slackbridge-links' permission. This is a dedicated permission for the destructive operation of stripping all importIds (SlackBridge channel links) from rooms.

Source

Thrown at apps/meteor/server/bridges/slack/removeChannelLinks.ts:25

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		removeSlackBridgeChannelLinks(): { message: string; params: unknown[] };
	}
}

Meteor.methods<ServerMethods>({
	async removeSlackBridgeChannelLinks() {
		const user = await Meteor.userAsync();
		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'removeSlackBridgeChannelLinks',
			});
		}

		if (!(await hasPermissionAsync(user, 'remove-slackbridge-links'))) {
			throw new Meteor.Error('error-not-authorized', 'Not authorized', {
				method: 'removeSlackBridgeChannelLinks',
			});
		}

		if (settings.get('SlackBridge_Enabled') !== true) {
			throw new Meteor.Error('SlackBridge_disabled');
		}

		await Rooms.unsetAllImportIds();

		return {
			message: 'Slackbridge_channel_links_removed_successfully',
			params: [],
		};
	},
});

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Grant 'remove-slackbridge-links' to the calling role in the permissions admin.
  2. Gate the UI control on the same permission so unauthorized users never see it.
  3. Confirm the operation is truly wanted - it is destructive (unsets all rooms' importIds).

Example fix

// before
Meteor.call('removeSlackBridgeChannelLinks') // lacks permission

// after
// admin: assign remove-slackbridge-links to the role, then
Meteor.call('removeSlackBridgeChannelLinks')
Defensive patterns

Strategy: validation

Validate before calling

const canRemove = await hasPermission('remove-slackbridge-links');
if (!canRemove) throw new ClientError('forbidden','remove-slackbridge-links required');

Type guard

function canRemoveSlackLinks(perms) { return Array.isArray(perms) && perms.includes('remove-slackbridge-links'); }

Try / catch

try { Meteor.call('removeSlackBridgeChannelLinks'); }
catch (e) {
  if (e?.error === 'error-not-authorized') { surface('remove-slackbridge-links permission missing'); return; }
  throw e;
}

Prevention

When it happens

Trigger: A logged-in admin/operator without remove-slackbridge-links calls Meteor.call('removeSlackBridgeChannelLinks').

Common situations: Role created to manage SlackBridge imports but not granted the removal permission. Default admin lost the permission after a permissions reset.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/21ce95cf21a24422. Report an issue: GitHub.