{"record":{"id":"083e104dd614ca67","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-083e10","errorCode":"error-action-not-allowed","errorMessage":"Refresh OAuth Services is not allowed","messagePattern":"Refresh OAuth Services is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/refreshOAuthService.ts","lineNumber":28,"sourceCode":"\tinterface ServerMethods {\n\t\trefreshOAuthService(): Promise<void>;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync refreshOAuthService() {\n\t\tmethodDeprecationLogger.method('refreshOAuthService', '9.0.0', '/v1/settings.refreshOAuthServices');\n\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'refreshOAuthService',\n\t\t\t});\n\t\t}\n\n\t\tif ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Refresh OAuth Services is not allowed', {\n\t\t\t\tmethod: 'refreshOAuthService',\n\t\t\t\taction: 'Refreshing_OAuth_Services',\n\t\t\t});\n\t\t}\n\n\t\tawait refreshLoginServices();\n\t},\n});\n","sourceCodeStart":10,"sourceCodeEnd":37,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/refreshOAuthService.ts#L10-L37","documentation":"After the login check, refreshOAuthService requires the 'add-oauth-service' permission and throws 'error-action-not-allowed' (with detail action 'Refreshing_OAuth_Services') when the caller does not hold it. Refreshing login services re-registers OAuth services and is restricted to users who may modify OAuth configuration.","triggerScenarios":"A logged-in user without 'add-oauth-service' calls refreshOAuthService, or an admin role had the permission removed.","commonSituations":"A sub-admin role that can view settings but not modify OAuth configuration; permission grants changed during migration.","solutions":["Grant 'add-oauth-service' to the caller's role in the admin Permissions screen","Run the refresh from a full admin account","Verify the caller's effective permissions before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client: only show the refresh action to users who may add OAuth services\nconst canRefresh = useHasPermission('add-oauth-service');\nif (!canRefresh) { /* hide/disable the refresh action */ }","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('refreshOAuthService');\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-action-not-allowed') {\n    // caller lacks 'add-oauth-service': grant it or run as admin\n  }\n}","preventionTips":["Gate OAuth configuration actions on the same permission the server checks","Keep view-only roles away from mutation buttons"],"tags":["authorization","permissions","oauth","settings"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}