RocketChat/Rocket.Chat · error · Meteor.Error

error-not-authorized

error-not-authorized

Error message

Not authorized

What it means

cloud:checkRegisterStatus requires the 'manage-cloud' permission; a logged-in user without it gets error-not-authorized. Cloud registration endpoints are admin-only because they expose and change workspace registration state.

Source

Thrown at apps/meteor/server/meteor-methods/platform/cloud.ts:54

}

Meteor.methods<ServerMethods>({
	/**
	 * @deprecated this method is deprecated and will be removed soon.
	 * Prefer using cloud.registrationStatus rest api.
	 */
	async 'cloud:checkRegisterStatus'() {
		methodDeprecationLogger.method('cloud:checkRegisterStatus', '9.0.0', '/v1/cloud.registrationStatus');
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'cloud:checkRegisterStatus',
			});
		}

		if (!(await hasPermissionAsync(uid, 'manage-cloud'))) {
			throw new Meteor.Error('error-not-authorized', 'Not authorized', {
				method: 'cloud:checkRegisterStatus',
			});
		}

		return retrieveRegistrationStatus();
	},
	async 'cloud:getWorkspaceRegisterData'() {
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'cloud:getWorkspaceRegisterData',
			});
		}

		if (!(await hasPermissionAsync(uid, 'manage-cloud'))) {
			throw new Meteor.Error('error-not-authorized', 'Not authorized', {
				method: 'cloud:getWorkspaceRegisterData',

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant 'manage-cloud' to the calling user's role (normally Admin only)
  2. Gate cloud-status UI and actions behind a manage-cloud permission check
  3. Use a properly permissioned account for automation that reads cloud status

Example fix

// before
Meteor.call('cloud:checkRegisterStatus');

// after
if (hasPermission(uid, 'manage-cloud')) {
  const status = await Meteor.callAsync('cloud:checkRegisterStatus');
}
Defensive patterns

Strategy: validation

Validate before calling

if (hasPermission(Meteor.userId(), 'manage-cloud')) {
  const status = await Meteor.callAsync('cloud:checkRegisterStatus');
}

Type guard

const isNotAuthorized = (e: unknown): e is Meteor.Error =>
  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-authorized';

Try / catch

try {
  await Meteor.callAsync('cloud:checkRegisterStatus');
} catch (e) {
  if (isNotAuthorized(e)) {
    hideCloudPanels(); // role issue — no retry
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: A logged-in non-admin calling 'cloud:checkRegisterStatus'; a cloud-status widget running under a regular user's session.

Common situations: Admin UI opened by users whose roles lack manage-cloud; permission removed during role consolidation; scripts using service accounts without cloud permissions.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/f5b8401fa49036c1. Report an issue: GitHub.