{"record":{"id":"259c7bef31f4cd06","repo":"RocketChat/Rocket.Chat","slug":"not-allowed","errorCode":"Not allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/ee/server/lib/audit/functions.ts","lineNumber":60,"sourceCode":"\t}\n\n\tif (type === 'l') {\n\t\tconst extraQuery = await callbacks.run('livechat.applyRoomRestrictions', {}, { userId });\n\t\tconst rooms: IRoom[] = await LivechatRooms.findByVisitorIdAndAgentId(\n\t\t\tvisitor,\n\t\t\tagent,\n\t\t\t{\n\t\t\t\tprojection: { _id: 1 },\n\t\t\t},\n\t\t\textraQuery,\n\t\t).toArray();\n\t\treturn rooms?.length ? { rids: rooms.map(({ _id }) => _id), name: i18n.t('Omnichannel') } : undefined;\n\t}\n};\n\nconst requireAuditor = async (userId: string | null): Promise<IUser> => {\n\tif (!userId) {\n\t\tthrow new Meteor.Error('Not allowed');\n\t}\n\n\tconst user = await Users.findOneById(userId);\n\tif (!user || !(await hasPermissionAsync(user._id, 'can-audit'))) {\n\t\tthrow new Meteor.Error('Not allowed');\n\t}\n\treturn user;\n};\n\ntype AuditMessagesParams = {\n\trid?: IRoom['_id'];\n\tstartDate: Date;\n\tendDate: Date;\n\tusers: NonNullable<IUser['username']>[];\n\tmsg: IMessage['msg'];\n\ttype: string;\n\tvisitor?: ILivechatVisitor['_id'];\n\tagent?: ILivechatAgent['_id'];","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/lib/audit/functions.ts#L42-L78","documentation":"Thrown by requireAuditor (audit/functions.ts:60) when the userId argument is null — i.e. the audit message endpoint was invoked with no authenticated user. It is a Meteor.Error with code 'Not allowed'. This fires before any permission lookup because there is no identity to check.","triggerScenarios":"auditGetMessagesMethod is called with userId === null (unauthenticated request, missing this.userId in a Meteor method, or a server call that forgot to pass an id).","commonSituations":"A REST/Meteor method is invoked without a login token; a test or integration calls the audit method server-side without forwarding a user id; session expired mid-operation.","solutions":["Ensure the caller is authenticated and that the userId is forwarded into auditGetMessagesMethod / requireAuditor.","On the client, re-authenticate before retrying the audit request.","If invoking server-side, pass the acting user's _id explicitly instead of null."],"exampleFix":"// before\nconst msgs = await auditGetMessagesMethod(null, params);\n\n// after\nconst msgs = await auditGetMessagesMethod(this.userId, params);","handlingStrategy":"validation","validationCode":"function requireUserId(userId: string | null): string {\n  if (!userId) throw new Meteor.Error('Not allowed', 'Authentication required');\n  return userId;\n}","typeGuard":"const isAuthedUserId = (u: unknown): u is string => typeof u === 'string' && u.length > 0;","tryCatchPattern":"try { await auditGetMessagesMethod(this.userId, params); } catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'Not allowed' && !this.userId) {\n    // redirect to login\n  } else throw e;\n}","preventionTips":["Always forward this.userId (or the REST request's user id) into audit methods.","Reject unauthenticated audit calls at the route/method boundary before reaching requireAuditor."],"tags":["audit","auth","permissions","enterprise"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}