{"record":{"id":"03027699c184d076","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-030276","errorCode":"error-action-not-allowed","errorMessage":"Mailing is not allowed","messagePattern":"Mailing is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/api/v1/rooms.ts","lineNumber":1012,"sourceCode":"\t\tresponse: {\n\t\t\t200: ajv.compile<void | { missing: string[] }>({\n\t\t\t\ttype: 'object',\n\t\t\t\tproperties: {\n\t\t\t\t\tsuccess: { type: 'boolean', enum: [true] },\n\t\t\t\t\tmissing: { type: 'array', items: { type: 'string' } },\n\t\t\t\t},\n\t\t\t\trequired: ['success'],\n\t\t\t\tadditionalProperties: false,\n\t\t\t}),\n\t\t\t400: validateBadRequestErrorResponse,\n\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t},\n\t},\n\tasync function action() {\n\t\tconst { rid, type } = this.bodyParams;\n\n\t\tif (!(await hasPermissionAsync(this.user, 'mail-messages', rid))) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Mailing is not allowed');\n\t\t}\n\n\t\tconst room = await Rooms.findOneById(rid);\n\t\tif (!room) {\n\t\t\tthrow new Meteor.Error('error-invalid-room');\n\t\t}\n\n\t\tconst user = await Users.findOneById(this.userId);\n\n\t\tif (!user || !(await canAccessRoomAsync(room, user))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not Allowed');\n\t\t}\n\n\t\tif (type === 'file') {\n\t\t\tconst { dateFrom, dateTo } = this.bodyParams;\n\t\t\tconst { format } = this.bodyParams;\n\n\t\t\tconst convertedDateFrom = dateFrom ? new Date(dateFrom) : new Date(0);","sourceCodeStart":994,"sourceCodeEnd":1030,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/rooms.ts#L994-L1030","documentation":"Thrown by POST rooms.mail when the calling user lacks the 'mail-messages' permission for the given room (rid). The mail/export route is gated behind a permission usually reserved for admins/moderators; without it the request never proceeds.","triggerScenarios":"POST /api/v1/rooms.mail with { rid, type } where hasPermissionAsync(user, 'mail-messages', rid) is false.","commonSituations":"Regular (non-admin) users trying the mail/export feature; permission renamed or removed in a policy reset; custom role that forgot to include 'mail-messages'; scoped permissions not granted for the target room.","solutions":["Grant 'mail-messages' to the user's role in Permissions admin (or via permissions API).","If the feature shouldn't be exposed, hide the UI control for users without the permission.","For scoped setups, ensure the permission is granted for the specific rid/channel, not just globally."],"exampleFix":"// before\nawait rest.post('/api/v1/rooms.mail', { rid, type: 'email' });\n\n// after\nconst me = await rest.get('/api/v1/me');\nif (!me.permissions?.includes('mail-messages')) {\n  notifyUser('Mailing requires the mail-messages permission.');\n} else {\n  await rest.post('/api/v1/rooms.mail', { rid, type: 'email' });\n}","handlingStrategy":"validation","validationCode":"const me = await rest.get('/api/v1/me');\nconst canMail = (me.roles ?? []).some(r => ['admin'].includes(r))\n  || (me.permissions ?? []).includes('mail-messages');\nif (!canMail) throw new Error('mail-messages permission required');","typeGuard":"function hasMailPermission(perms: string[] | undefined): boolean {\n  return Array.isArray(perms) && perms.includes('mail-messages');\n}","tryCatchPattern":"try {\n  await rest.post('/api/v1/rooms.mail', { rid, type });\n} catch (e) {\n  if (isMeteorError(e, 'error-action-not-allowed')) {\n    notify('You need the mail-messages permission.');\n  } else throw e;\n}","preventionTips":["Hide the mail/export action for users without 'mail-messages'.","Grant the permission to the relevant role in admin.","Check scoped room-level permission for private channels."],"tags":["permissions","mail","rest-api","authorization"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}