{"record":{"id":"339f4c366e08d190","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-339f4c","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/bridges/irc/methods/resetIrcConnection.ts","lineNumber":28,"sourceCode":"\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tresetIrcConnection(): { message: string; params: unknown[] };\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync resetIrcConnection() {\n\t\tconst ircEnabled = Boolean(settings.get('IRC_Enabled'));\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'resetIrcConnection' });\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(uid, 'edit-privileged-setting'))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'resetIrcConnection' });\n\t\t}\n\n\t\tconst auditSettingOperation = updateAuditedByUser({\n\t\t\t_id: uid,\n\t\t\tusername: (await Meteor.userAsync())!.username!,\n\t\t\tip: this.connection?.clientAddress || '',\n\t\t\tuseragent: this.connection?.httpHeaders['user-agent'] || '',\n\t\t});\n\n\t\tconst updatedLastPingValue = await auditSettingOperation(Settings.updateValueById, 'IRC_Bridge_Last_Ping', new Date(0), {\n\t\t\tupsert: true,\n\t\t});\n\t\tif (updatedLastPingValue.modifiedCount || updatedLastPingValue.upsertedCount) {\n\t\t\tvoid notifyOnSettingChangedById('IRC_Bridge_Last_Ping');\n\t\t}\n\n\t\tconst updatedResetTimeValue = await auditSettingOperation(Settings.updateValueById, 'IRC_Bridge_Reset_Time', new Date(), {\n\t\t\tupsert: true,","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/bridges/irc/methods/resetIrcConnection.ts#L10-L46","documentation":"Thrown by the resetIrcConnection Meteor method when the caller is authenticated but lacks the 'edit-privileged-setting' permission. Resetting the IRC bridge connection touches a privileged setting (IRC_Bridge_Last_Ping) via the audited-settings helper, so privileged-setting edit rights are required.","triggerScenarios":"A logged-in non-admin (or an admin role without edit-privileged-setting) calls Meteor.call('resetIrcConnection').","commonSituations":"A custom operator role created for IRC management was not granted edit-privileged-setting. The permission was removed during hardening.","solutions":["Grant 'edit-privileged-setting' to the calling user's role via the permissions admin.","Restrict the reset-IRC UI action to roles that hold the permission.","If IRC bridge management should not need privileged-setting rights, refactor the method to use a dedicated permission and an internal (non-audited-as-privileged) write."],"exampleFix":"// before - operator role lacks edit-privileged-setting\nMeteor.call('resetIrcConnection') // -> error-not-allowed\n\n// after\n// admin: grant edit-privileged-setting to the operator role, then\nMeteor.call('resetIrcConnection')","handlingStrategy":"validation","validationCode":"const canEditPrivileged = await hasPermission('edit-privileged-setting');\nif (!canEditPrivileged) throw new ClientError('forbidden','edit-privileged-setting required');","typeGuard":"function canResetIrc(perms) { return Array.isArray(perms) && perms.includes('edit-privileged-setting'); }","tryCatchPattern":"try { Meteor.call('resetIrcConnection'); }\ncatch (e) {\n  if (e?.error === 'error-not-allowed') { surface('edit-privileged-setting permission missing'); return; }\n  throw e;\n}","preventionTips":["Grant edit-privileged-setting to roles that manage IRC.","Hide the reset-IRC control from roles lacking the permission.","Re-audit permissions after role refactors."],"tags":["meteor","methods","irc","bridge","permissions","authorization","settings"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}