{"record":{"id":"387e2ea41b36125c","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-387e2e","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/messages/readMessages.ts","lineNumber":34,"sourceCode":"\nMeteor.methods<ServerMethods>({\n\tasync readMessages(rid, readThreads = false) {\n\t\tcheck(rid, String);\n\n\t\tconst userId = Meteor.userId();\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'readMessages',\n\t\t\t});\n\t\t}\n\n\t\tconst user = ((await Meteor.userAsync()) as IUser | null) ?? undefined;\n\t\tconst room = await Rooms.findOneById(rid);\n\t\tif (!room) {\n\t\t\tthrow new Meteor.Error('error-room-does-not-exist', 'This room does not exist', { method: 'readMessages' });\n\t\t}\n\t\tif (!(await canAccessRoomAsync(room, user))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'readMessages' });\n\t\t}\n\n\t\tawait readMessages(room, userId, readThreads);\n\t},\n});\n","sourceCodeStart":16,"sourceCodeEnd":40,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/messages/readMessages.ts#L16-L40","documentation":"Thrown by the readMessages Meteor method when canAccessRoomAsync(room, user) returns false. The server already resolved the room and the user, so the failure is purely authorization: the caller is not allowed to view this room (not a member of the private room/channel/team, or lacking the required view permission). Marking a room as read is only accepted for rooms the user can legally access.","triggerScenarios":"Meteor.call('readMessages', rid) where rid is: a private channel or team the user was never added to or was removed from; a direct message the user is not a participant in; a room whose type requires a permission (view-c-room, view-p-room, view-joined-room) the user's role does not hold.","commonSituations":"Client marks unread badges for rooms from a stale cached list after the user was kicked or left; a custom integration iterates every room id it ever saw and marks them read; an admin revokes view-joined-room from a role; room was deleted and recreated so the old rid now points at a room the user cannot see.","solutions":["Confirm the user actually has an active subscription/membership for this rid before calling readMessages","Check the user's role permissions in Admin -> Permissions (view-c-room, view-p-room, view-joined-room) and grant the missing one","Verify the rid is the room the UI currently shows; a deleted room raises error-room-does-not-exist instead, so 'Not allowed' means wrong membership, not wrong id","Re-login if the DDP connection carries a stale user context after permissions changed"],"exampleFix":"// before: blind call with a possibly stale rid\nMeteor.call('readMessages', rid);\n\n// after: only mark rooms the user is currently subscribed to\nconst subscription = subscriptions.find((s) => s.rid === rid);\nif (subscription) {\n\tawait Meteor.callAsync('readMessages', rid);\n}","handlingStrategy":"validation","validationCode":"// client: only mark rooms the user is currently subscribed to\nconst canMarkRead = (rid: string): boolean =>\n\tBoolean(Meteor.userId()) && subscriptions.some((s) => s.rid === rid);\n\nif (canMarkRead(rid)) {\n\tawait Meteor.callAsync('readMessages', rid);\n}","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('readMessages', rid);\n} catch (e: any) {\n\tif (e?.error === 'error-not-allowed') {\n\t\t// membership revoked: refresh subscriptions and clear the local unread badge\n\t\treturn;\n\t}\n\tthrow e;\n}","preventionTips":["Drive unread-marking from the user's live subscription collection, not from cached room lists","Re-check membership after reconnect or workspace switch before touching read state","Log rid + userId when this fires to spot permission regressions early"],"tags":["meteor-method","authorization","rooms","read-receipts","threads"],"backgroundTag":"room-access-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}