{"record":{"id":"26bd023120e0a1f0","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-26bd02","errorCode":"error-action-not-allowed","errorMessage":"Message starring not allowed","messagePattern":"Message starring not allowed","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"warning","filePath":"apps/meteor/server/lib/messaging/stars/starMessage.ts","lineNumber":22,"sourceCode":"import { Messages, Subscriptions, Rooms } from '@rocket.chat/models';\nimport { Meteor } from 'meteor/meteor';\n\nimport { settings } from '../../../settings';\nimport { canAccessRoomAsync, roomAccessAttributes } from '../../authorization';\nimport { methodDeprecationLogger } from '../../deprecationWarningLogger';\nimport { isTheLastMessage } from '../../messages/isTheLastMessage';\nimport { notifyOnRoomChangedById, notifyOnMessageChange } from '../../notifyListener';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tstarMessage(message: Pick<IMessage, 'rid' | '_id'> & { starred: boolean }): boolean;\n\t}\n}\n\nexport const starMessage = async (user: IUser, message: Pick<IMessage, 'rid' | '_id'> & { starred: boolean }): Promise<boolean> => {\n\tif (!settings.get('Message_AllowStarring')) {\n\t\tthrow new Meteor.Error('error-action-not-allowed', 'Message starring not allowed', {\n\t\t\tmethod: 'starMessage',\n\t\t\taction: 'Message_starring',\n\t\t});\n\t}\n\n\tconst subscription = await Subscriptions.findOneByRoomIdAndUserId(message.rid, user._id, {\n\t\tprojection: { _id: 1 },\n\t});\n\tif (!subscription) {\n\t\treturn false;\n\t}\n\tif (!(await Messages.findOneByRoomIdAndMessageId(message.rid, message._id))) {\n\t\treturn false;\n\t}\n\n\tconst room = await Rooms.findOneById(message.rid, { projection: { ...roomAccessAttributes, lastMessage: 1 } });\n\n\tif (!room) {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/messaging/stars/starMessage.ts#L4-L40","documentation":"starMessage refuses to run when the workspace setting Message_AllowStarring is disabled, throwing Meteor.Error('error-action-not-allowed', 'Message starring not allowed'). It is a global feature flag, not a per-room or per-user restriction: message starring is simply turned off for the whole install.","triggerScenarios":"Meteor.call('starMessage', { rid, _id, starred }) while an administrator has set Message_AllowStarring to false (Administration -> General -> Message); apps or integrations calling the starMessage method on such installs.","commonSituations":"Workspace hardening where admins disable starring; custom clients that always show a star button regardless of server settings; upgrades where the setting was flipped during migration.","solutions":["Enable Message_AllowStarring in Administration -> Workspace -> General (Message section) if starring is wanted","Client: read the Message_AllowStarring public setting and hide the star action when it is false","If starring must stay disabled, remove the UI entry points so users can never fire the method"],"exampleFix":"// before - UI always calls the method\nMeteor.call('starMessage', { rid, _id: messageId, starred: true });\n\n// after - gate on the public setting clients receive\nif (settings.get('Message_AllowStarring') === true) {\n  Meteor.call('starMessage', { rid, _id: messageId, starred: true });","handlingStrategy":"validation","validationCode":"// Public settings are pushed to clients - check before offering the action\nif (settingsCollection.findOne('_Message_AllowStarring')?.value === true) {\n  Meteor.call('starMessage', { rid, _id: messageId, starred: true });\n} else {\n  hideStarAction();\n}","typeGuard":null,"tryCatchPattern":"Meteor.call('starMessage', msg, (err) => {\n  if (err?.error === 'error-action-not-allowed') {\n    disableStarUi(); // workspace-wide flag - permanent for this install, do not retry\n  }\n});","preventionTips":["Drive star UI visibility from the Message_AllowStarring public setting","Refresh the flag on settings-change stream events instead of caching it forever","Treat error-action-not-allowed with action Message_starring as a config state, not a bug"],"tags":["starring","settings","feature-flag","ddp-method"],"backgroundTag":"feature-disabled-by-setting","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}