RocketChat/Rocket.Chat · error · Meteor.Error

Not allowed

Not allowed

Error message

Not allowed

What it means

Thrown by requireAuditor (audit/functions.ts:60) when the userId argument is null — i.e. the audit message endpoint was invoked with no authenticated user. It is a Meteor.Error with code 'Not allowed'. This fires before any permission lookup because there is no identity to check.

Source

Thrown at apps/meteor/ee/server/lib/audit/functions.ts:60

	}

	if (type === 'l') {
		const extraQuery = await callbacks.run('livechat.applyRoomRestrictions', {}, { userId });
		const rooms: IRoom[] = await LivechatRooms.findByVisitorIdAndAgentId(
			visitor,
			agent,
			{
				projection: { _id: 1 },
			},
			extraQuery,
		).toArray();
		return rooms?.length ? { rids: rooms.map(({ _id }) => _id), name: i18n.t('Omnichannel') } : undefined;
	}
};

const requireAuditor = async (userId: string | null): Promise<IUser> => {
	if (!userId) {
		throw new Meteor.Error('Not allowed');
	}

	const user = await Users.findOneById(userId);
	if (!user || !(await hasPermissionAsync(user._id, 'can-audit'))) {
		throw new Meteor.Error('Not allowed');
	}
	return user;
};

type AuditMessagesParams = {
	rid?: IRoom['_id'];
	startDate: Date;
	endDate: Date;
	users: NonNullable<IUser['username']>[];
	msg: IMessage['msg'];
	type: string;
	visitor?: ILivechatVisitor['_id'];
	agent?: ILivechatAgent['_id'];

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Ensure the caller is authenticated and that the userId is forwarded into auditGetMessagesMethod / requireAuditor.
2. On the client, re-authenticate before retrying the audit request.
3. If invoking server-side, pass the acting user's _id explicitly instead of null.

Example fix

// before
const msgs = await auditGetMessagesMethod(null, params);

// after
const msgs = await auditGetMessagesMethod(this.userId, params);

function requireUserId(userId: string | null): string {
  if (!userId) throw new Meteor.Error('Not allowed', 'Authentication required');
  return userId;
}

const isAuthedUserId = (u: unknown): u is string => typeof u === 'string' && u.length > 0;

try { await auditGetMessagesMethod(this.userId, params); } catch (e) {
  if (e instanceof Meteor.Error && e.error === 'Not allowed' && !this.userId) {
    // redirect to login
  } else throw e;
}

When it happens

Trigger: auditGetMessagesMethod is called with userId === null (unauthenticated request, missing this.userId in a Meteor method, or a server call that forgot to pass an id).

Common situations: A REST/Meteor method is invoked without a login token; a test or integration calls the audit method server-side without forwarding a user id; session expired mid-operation.

Related errors

• error-not-authorized-federation
• Room doesn't exist
• The setting "${id}" is not readable.
• The setting "${setting.id}" is not readable.
• result.error

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/259c7bef31f4cd06. Report an issue: GitHub.