{"record":{"id":"0bd28abb51be686d","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-0bd28a","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/addUsersToRoom.ts","lineNumber":74,"sourceCode":"\tif (room.t === 'd' && !isRoomNativeFederated(room)) {\n\t\tthrow new Meteor.Error('error-cant-invite-for-direct-room', \"Can't invite user to direct rooms\", {\n\t\t\tmethod: 'addUsersToRoom',\n\t\t});\n\t}\n\n\t// Can add to any room you're in, with permission, otherwise need specific room type permission\n\tlet canAddUser = false;\n\tif (userInRoom && (await hasPermissionAsync(userId, 'add-user-to-joined-room', room._id))) {\n\t\tcanAddUser = true;\n\t} else if (room.t === 'c' && (await hasPermissionAsync(userId, 'add-user-to-any-c-room'))) {\n\t\tcanAddUser = true;\n\t} else if (room.t === 'p' && (await hasPermissionAsync(userId, 'add-user-to-any-p-room'))) {\n\t\tcanAddUser = true;\n\t}\n\n\t// Adding wasn't allowed\n\tif (!canAddUser) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'addUsersToRoom',\n\t\t});\n\t}\n\n\t// Missing the users to be added\n\tif (!Array.isArray(data.users)) {\n\t\tthrow new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {\n\t\t\tmethod: 'addUsersToRoom',\n\t\t});\n\t}\n\n\tawait beforeAddUsersToRoom.run({ usernames: data.users, inviter: user }, room);\n\n\tawait Promise.all(\n\t\tdata.users.map(async (username) => {\n\t\t\tconst sanitizedUsername = sanitizeUsername(username);\n\n\t\t\tconst newUser = await Users.findOneByUsernameIgnoringCase(sanitizedUsername);","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/addUsersToRoom.ts#L56-L92","documentation":"Thrown by addUsersToRoomMethod() in apps/meteor/server/meteor-methods/rooms/addUsersToRoom.ts:74 when none of the three permission paths yield canAddUser: the acting user is not in the room without 'add-user-to-joined-room', the room is not type 'c' with 'add-user-to-any-c-room', and not type 'p' with 'add-user-to-any-p-room'. This is the invitation authorization matrix — you either need membership plus the joined-room permission, or the type-specific global permission.","triggerScenarios":"A regular member invites without 'add-user-to-joined-room'; a non-member invites into a public channel without 'add-user-to-any-c-room'; a non-member invites into a private channel without 'add-user-to-any-p-room'; permissions exist but scoped to a different room; acting as a bot account with no invite permissions.","commonSituations":"Workspaces tightening default permissions so members can no longer invite; custom roles missing the invite permissions after an upgrade; scripts running as service accounts that were never granted add-user permissions; moderators assuming moderation powers imply invite rights.","solutions":["Grant the appropriate permission: 'add-user-to-joined-room' (members), 'add-user-to-any-c-room' (public channels), or 'add-user-to-any-p-room' (private channels) in Administration > Permissions.","Pre-check programmatically before inviting (see validation code) so failure surfaces before user-facing work.","If the caller should be in the room, ensure their subscription exists — permission path one requires both membership and the permission.","For integrations, authenticate as an account that holds one of these permissions or use REST invite endpoints with an admin token."],"exampleFix":"// before\nawait addUsersToRoomMethod(uid, { rid, users });\n\n// after\nconst inRoom = Boolean(await Subscriptions.findOneByRoomIdAndUserId(rid, uid, { projection: { _id: 1 } }));\nconst allowed =\n  (inRoom && (await hasPermissionAsync(uid, 'add-user-to-joined-room', rid))) ||\n  (room.t === 'c' && (await hasPermissionAsync(uid, 'add-user-to-any-c-room'))) ||\n  (room.t === 'p' && (await hasPermissionAsync(uid, 'add-user-to-any-p-room')));\nif (!allowed) throw new Error('no invite permission for this room');\nawait addUsersToRoomMethod(uid, { rid, users });","handlingStrategy":"validation","validationCode":"const inRoom = Boolean(await Subscriptions.findOneByRoomIdAndUserId(rid, uid, { projection: { _id: 1 } }));\nconst allowed =\n  (inRoom && (await hasPermissionAsync(uid, 'add-user-to-joined-room', rid))) ||\n  (room.t === 'c' && (await hasPermissionAsync(uid, 'add-user-to-any-c-room'))) ||\n  (room.t === 'p' && (await hasPermissionAsync(uid, 'add-user-to-any-p-room')));\nif (!allowed) throw new Error('no permission to add users to this room');","typeGuard":null,"tryCatchPattern":"try {\n  await addUsersToRoomMethod(uid, { rid, users });\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {\n    // tell the user which invite permission they need; do not blind-retry\n  }\n}","preventionTips":["Mirror the three-path permission check before enabling invite UI.","Run automation as accounts holding a type-specific invite permission.","Re-check permissions when workspaces tighten invite defaults after upgrades."],"tags":["meteor-method","permissions","authorization","rooms","invite"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}