RocketChat/Rocket.Chat · error · Error

error-not-authorized

Error message

error-not-authorized

What it means

findAdminRooms (apps/meteor/server/api/lib/rooms.ts) powers the admin room listing (rooms.adminRooms). It unconditionally requires the view-room-administration permission via hasPermissionAsync and throws plain Error 'error-not-authorized' otherwise — before any filtering by name/type ever runs. All failures at this site are permission failures, not data errors.

Source

Thrown at apps/meteor/server/api/lib/rooms.ts:27

export async function findAdminRooms({
	uid,
	filter,
	types = [],
	pagination: { offset, count, sort },
}: {
	uid: string;
	filter: string;
	types: Array<RoomType | 'discussions' | 'teams'>;
	pagination: { offset: number; count: number; sort: Sort };
}): Promise<{
	rooms: Array<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>;
	count: number;
	offset: number;
	total: number;
}> {
	if (!(await hasPermissionAsync(uid, 'view-room-administration'))) {
		throw new Error('error-not-authorized');
	}
	const name = filter?.trim();
	const discussion = types?.includes('discussions');
	const includeTeams = types?.includes('teams');
	const typesToRemove = ['discussions', 'teams'];
	const showTypes = Array.isArray(types) ? types.filter((type): type is RoomType => !typesToRemove.includes(type)) : [];
	const options: FindOptions<IRoom> = {
		projection: adminFields,
		skip: offset,
		limit: count,
	};

	const result = Rooms.findByNameOrFnameContainingAndTypes(name, showTypes, discussion, includeTeams, options);

	const { cursor, totalCount } = result;

	const [rooms, total] = await Promise.all([
		cursor

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Use an administrator's credentials (or a user with the admin role)
  2. Grant view-room-administration to the specific role in Administration > Permissions if moderators should list rooms
  3. Switch to a non-admin endpoint (rooms.list) for basic room enumeration needs

Example fix

// before
GET /api/v1/rooms.adminRooms (member token) -> error-not-authorized

// after
GET /api/v1/rooms.adminRooms (admin token)  // or grant view-room-administration to the role
Defensive patterns

Strategy: try-catch

Try / catch

try {
  const { data } = await client.get('/api/v1/rooms.adminRooms', { params });
} catch (e: any) {
  if ((e?.response?.data?.error ?? '') === 'error-not-authorized') {
    throw new ForbiddenError('token lacks view-room-administration — use an admin account');
  }
  throw e;
}

Prevention

When it happens

Trigger: GET /api/v1/rooms.adminRooms called with a token whose user lacks view-room-administration (regular member, bot, or custom role without admin rights).

Common situations: Admin-panel scrapers using a member account; custom 'moderator' role expected to see room admin pages but missing the permission; token confusion between admin and bot accounts.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/f196fc59f5dd8189. Report an issue: GitHub.