RocketChat/Rocket.Chat · error · Meteor.Error

error-not-authorized

error-not-authorized

Error message

Not authorized

What it means

crowd_test_connection checks the 'test-admin-options' permission for the logged-in user and throws 'error-not-authorized' when it is absent. Only roles allowed to test admin integration settings may run the Crowd connection test.

Source

Thrown at apps/meteor/server/meteor-methods/auth/crowd.ts:28

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		crowd_test_connection(): { message: TranslationKey; params: string[] };
		crowd_sync_users(): { message: string; params: string[] };
	}
}

Meteor.methods<ServerMethods>({
	async crowd_test_connection() {
		const user = await Meteor.userAsync();
		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'crowd_test_connection',
			});
		}

		if (!(await hasPermissionAsync(user, 'test-admin-options'))) {
			throw new Meteor.Error('error-not-authorized', 'Not authorized', {
				method: 'crowd_test_connection',
			});
		}

		if (settings.get('CROWD_Enable') !== true) {
			throw new Meteor.Error('crowd_disabled');
		}

		try {
			const crowd = new CROWD();
			await crowd.checkConnection();

			return {
				message: 'Crowd_Connection_successful' as const,
				params: [],
			};
		} catch (err) {
			logger.error({

View on GitHub (pinned to b2c16d5842)

Solutions

1. Grant 'test-admin-options' to the caller's role in the admin Permissions screen
2. Run the test from an account that already holds the permission (default admin roles)
3. Verify the user's effective permissions before retrying

// client: only offer the test action to users who can test admin options
const canTest = useHasPermission('test-admin-options');
if (!canTest) { /* hide/disable the Test Connection button */ }

try {
  await Meteor.callAsync('crowd_test_connection');
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-not-authorized') {
    // show 'not allowed' feedback instead of a raw error
  }
}

When it happens

Trigger: A logged-in user whose roles do not include 'test-admin-options' triggers the test connection button or calls the method.

Common situations: A custom helpdesk role created without admin-test permissions; the permission was removed from the admin role during a permissions audit.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• error-not-authorized
• error-action-not-allowed
• error-invalid-permission
• error-not-allowed
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/ef414a934995bfcf. Report an issue: GitHub.