{"record":{"id":"007e1d0d731455d7","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-007e1d","errorCode":"error-action-not-allowed","errorMessage":"Permission is restricted","messagePattern":"Permission is restricted","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/authorization/permissionRole.ts","lineNumber":15,"sourceCode":"import { License } from '@rocket.chat/core-services';\nimport { Permissions, Roles } from '@rocket.chat/models';\nimport { Meteor } from 'meteor/meteor';\n\nimport { hasPermissionAsync } from './hasPermission';\nimport { CONSTANTS, AuthorizationUtils } from '../../../app/authorization/lib';\nimport { notifyOnPermissionChangedById } from '../notifyListener';\n\nexport const addPermissionToRoleMethod = async (uid: string, permissionId: string, role: string): Promise<void> => {\n\tif (role === 'guest' && !AuthorizationUtils.hasRestrictionsToRole(role) && (await License.hasValidLicense())) {\n\t\tAuthorizationUtils.addRolePermissionWhiteList(role, await License.getGuestPermissions());\n\t}\n\n\tif (AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role)) {\n\t\tthrow new Meteor.Error('error-action-not-allowed', 'Permission is restricted', {\n\t\t\tmethod: 'authorization:addPermissionToRole',\n\t\t\taction: 'Adding_permission',\n\t\t});\n\t}\n\n\tconst permission = await Permissions.findOneById(permissionId);\n\n\tif (!permission) {\n\t\tthrow new Meteor.Error('error-invalid-permission', 'Permission does not exist', {\n\t\t\tmethod: 'authorization:addPermissionToRole',\n\t\t\taction: 'Adding_permission',\n\t\t});\n\t}\n\n\tif (!(await Roles.findOneById(role, { projection: { _id: 1 } }))) {\n\t\tthrow new Meteor.Error('error-invalid-role', 'Role does not exist', {\n\t\t\tmethod: 'authorization:addPermissionToRole',\n\t\t\taction: 'Adding_permission',","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/authorization/permissionRole.ts#L1-L33","documentation":"addPermissionToRoleMethod (method authorization:addPermissionToRole) throws error-action-not-allowed, 'Permission is restricted', when AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role) is true — the workspace carries an explicit restriction forbidding that permission on that role. Restrictions are managed with AuthorizationUtils.addRolePermissionRestriction / removeRolePermissionRestriction and are also applied to the guest role (license-managed permission whitelist).","triggerScenarios":"Adding a restricted permission to the restricted role from Administration -> Permissions (or via the API): e.g. granting a privileged permission to 'guest' while the guest-role restriction list forbids it.","commonSituations":"Hardening attempts to elevate restricted roles hit the guard; enterprise deployments where guest permissions are constrained by license; bootstrap scripts that apply a full role-permission matrix without honoring restrictions.","solutions":["Grant the permission on a different, unrestricted role and assign users that role instead","If you own the restriction policy, remove it first on the server: AuthorizationUtils.removeRolePermissionRestriction(role, permissionId)","Check whether the restriction comes from license-managed guest permissions before fighting it — it may require a license change","Read the role's restriction list (AuthorizationUtils) before building admin tooling on top of addPermissionToRole"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role)) {\n  // pick a different role or surface 'restricted by policy' instead of calling the method\n}","typeGuard":null,"tryCatchPattern":"try {\n  await addPermissionToRoleMethod(uid, permissionId, role);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-action-not-allowed' && e.details?.action === 'Adding_permission') {\n    // policy restriction: choose another role or have an owner remove the restriction; do not retry\n  }\n  throw e;\n}","preventionTips":["Read role restrictions before rendering the permissions grid so restricted cells are disabled","Keep role-permission bootstrap scripts aware of AuthorizationUtils restrictions","Document license-imposed guest restrictions for admins"],"tags":["authorization","permissions","roles","admin","enterprise"],"backgroundTag":"permission-restricted-by-role","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}