{"record":{"id":"12be654d1566a88f","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-12be65","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/pushConfig.ts","lineNumber":47,"sourceCode":"\n\treturn tokens;\n};\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tpush_test(): { message: string; params: number[] };\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync push_test() {\n\t\tmethodDeprecationLogger.method('push_test', '9.0.0', '/v1/push.test');\n\n\t\tconst user = await Meteor.userAsync();\n\n\t\tif (!user) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\t\tmethod: 'push_test',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(user, 'test-push-notifications'))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\t\tmethod: 'push_test',\n\t\t\t});\n\t\t}\n\n\t\tif (settings.get('Push_enable') !== true) {\n\t\t\tthrow new Meteor.Error('error-push-disabled', 'Push is disabled', {\n\t\t\t\tmethod: 'push_test',\n\t\t\t});\n\t\t}\n\n\t\tconst tokensCount = await executePushTest(user._id, user.username);\n\t\treturn {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/pushConfig.ts#L29-L65","documentation":"The push_test Meteor method first resolves the caller with Meteor.userAsync(); an unauthenticated invocation (no user on the connection) yields null and it throws Meteor.Error('error-not-allowed', 'Not allowed', { method: 'push_test' }). A second gate immediately after requires the 'test-push-notifications' permission — the same code for a different cause.","triggerScenarios":"Calling Meteor.call('push_test') over a DDP connection without a logged-in user: server-side scripts invoking it bare, expired login token, or methods invoked before login completes. (The line-53 variant fires for logged-in users lacking test-push-notifications.)","commonSituations":"Automation calling methods without establishing a session, stale login tokens after password reset/logout, users with admin roles that don't include test-push-notifications, or custom clients skipping the login handshake.","solutions":["Ensure the DDP connection is authenticated (Meteor.loginWithToken / loginWithPassword) before calling push_test","Grant 'test-push-notifications' to the caller's role in Administration > Permissions for the permission variant","Prefer the REST endpoint POST /api/v1/push.test with an auth token/user (push_test is deprecated)","Check Meteor.userId() client-side before invoking to fail fast with a clear message"],"exampleFix":"// before\nMeteor.call('push_test'); // unauthenticated -> error-not-allowed\n\n// after\nif (!Meteor.userId()) throw new Meteor.Error('error-not-allowed', 'Login required');\nMeteor.call('push_test');","handlingStrategy":"validation","validationCode":"// client-side fail-fast before invoking the method\nif (!Meteor.userId()) {\n  throw new Meteor.Error('error-not-allowed', 'Login required for push_test');\n}\nawait Meteor.callAsync('push_test');","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('push_test');\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-not-allowed' && err.details?.method === 'push_test') {\n    // re-authenticate (login flow) and grant test-push-notifications, then retry\n  } else {\n    throw err;\n  }\n}","preventionTips":["Always authenticate the DDP connection before calling protected methods","Grant 'test-push-notifications' to the roles that run push diagnostics","Migrate to POST /api/v1/push.test with proper REST auth — the method is deprecated"],"tags":["push","authentication","meteor-method","permissions","push-test"],"backgroundTag":"authentication-required","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}