{"record":{"id":"1f3f8d20f527c11e","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-1f3f8d","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/createChannel.ts","lineNumber":50,"sourceCode":") => {\n\tcheck(name, String);\n\tcheck(members, Match.Optional([String]));\n\tif (!userId) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'createChannel' });\n\t}\n\n\tconst user = await Users.findOneById(userId, { projection: { services: 0 } });\n\tif (!user?.username) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'createChannel' });\n\t}\n\n\tif (extraData.teamId) {\n\t\tconst team = await Team.findOneById<Pick<ITeam, '_id' | 'roomId'>>(extraData.teamId, { projection: { roomId: 1 } });\n\t\tif (!team) {\n\t\t\tthrow new Meteor.Error('error-team-not-found', 'The \"teamId\" param provided does not match any team', { method: 'createChannel' });\n\t\t}\n\t\tif (!(await hasPermissionAsync(userId, 'create-team-channel', team.roomId))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createChannel' });\n\t\t}\n\t} else if (!(await hasPermissionAsync(userId, 'create-c'))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createChannel' });\n\t}\n\n\treturn createRoom('c', name, user, members, excludeSelf, readOnly, {\n\t\t...(customFields && Object.keys(customFields).length && { customFields }),\n\t\t...extraData,\n\t});\n};\n\nMeteor.methods<ServerMethods>({\n\tasync createChannel(name, members, readOnly = false, customFields = {}, extraData = {}) {\n\t\tmethodDeprecationLogger.method('createChannel', '9.0.0', '/v1/channels.create');\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'createChannel' });","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/createChannel.ts#L32-L68","documentation":"createChannel guard when teamId resolved to a real team: hasPermissionAsync(userId, 'create-team-channel', team.roomId) returned false. Creating a channel inside a team requires the create-team-channel permission scoped to that team's room - by default held by team owners/managers and admins, not ordinary members.","triggerScenarios":"A plain team member calls createChannel with that team's teamId; the role lost create-team-channel on the team; workspace policy restricts team channel creation to owners.","commonSituations":"Members expecting to add channels to teams they joined; permission reshuffles after role refactors; automations creating team channels under a member account.","solutions":["Ask a team owner/manager or admin to create the channel, or grant create-team-channel to the member's role on that team.","Create the channel without teamId and have an owner link it to the team afterwards.","Run automation under an account that holds create-team-channel for the team."],"exampleFix":"// before\nMeteor.call('createChannel', name, members, false, {}, { teamId });\n\n// after\nif (isTeamOwnerOrAdmin(team, Meteor.userId())) {\n  Meteor.call('createChannel', name, members, false, {}, { teamId });\n} else {\n  showToast('Ask a team owner to add this channel');\n}","handlingStrategy":"try-catch","validationCode":"// if the teams data exposes the caller's role, gate the UI on it:\nif (!isTeamOwnerOrAdmin(teamInfo, Meteor.userId())) {\n  // hide the add-channel-to-team action for this user\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('createChannel', name, members, false, {}, { teamId });\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {\n    // lacks create-team-channel on this team - suggest asking an owner\n    showToast('Only team owners/managers can add channels to this team');\n    return;\n  }\n  throw e;\n}","preventionTips":["Restrict the team-channel creation UI to team owners/managers (the roles that carry create-team-channel).","Grant create-team-channel deliberately when members should be able to spawn team channels.","Automate team channel creation with a team owner's credentials or an elevated service account."],"tags":["rocket-chat","meteor","create-channel","teams","permissions","authorization"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}