{"record":{"id":"3f820def1c32b6cf","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-3f820d","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts","lineNumber":47,"sourceCode":"\textraData: Record<string, any> = {},\n\texcludeSelf = false,\n): Promise<\n\tICreatedRoom & {\n\t\trid: string;\n\t}\n> => {\n\tcheck(name, String);\n\tcheck(members, Match.Optional([String]));\n\n\tif (extraData.teamId) {\n\t\tconst team = await Team.findOneById<Pick<ITeam, '_id' | 'roomId'>>(extraData.teamId, { projection: { roomId: 1 } });\n\t\tif (!team) {\n\t\t\tthrow new Meteor.Error('error-team-not-found', 'The \"teamId\" param provided does not match any team', {\n\t\t\t\tmethod: 'createPrivateGroup',\n\t\t\t});\n\t\t}\n\t\tif (!(await hasPermissionAsync(user, 'create-team-group', team.roomId))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });\n\t\t}\n\t} else if (!(await hasPermissionAsync(user, 'create-p'))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });\n\t}\n\n\treturn createRoom('p', name, user, members, excludeSelf, readOnly, {\n\t\t...(customFields && Object.keys(customFields).length && { customFields }),\n\t\t...extraData,\n\t});\n};\n\nMeteor.methods<ServerMethods>({\n\tasync createPrivateGroup(name, members, readOnly = false, customFields = {}, extraData = {}) {\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'createPrivateGroup',","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts#L29-L65","documentation":"createPrivateGroup guard after a teamId resolved to a real team: hasPermissionAsync(user, 'create-team-group', team.roomId) returned false. Adding a private group to a team requires the create-team-group permission scoped to the team's room, held by team owners/managers and admins by default.","triggerScenarios":"A regular team member calls createPrivateGroup with the team's teamId; the role lacks create-team-group on that team; owners-only policy for team sub-rooms.","commonSituations":"Members trying to add private groups to teams; permission refactors that dropped create-team-group; automations running as non-owner members.","solutions":["Have a team owner/manager/admin create the group, or grant create-team-group to the member's role on the team.","Create the group standalone and let an owner link it to the team.","Run automation under an account holding create-team-group for that team."],"exampleFix":"// before\nMeteor.call('createPrivateGroup', name, members, false, {}, { teamId });\n\n// after\nif (isTeamOwnerOrAdmin(team, Meteor.userId())) {\n  Meteor.call('createPrivateGroup', name, members, false, {}, { teamId });\n} else {\n  showToast('Ask a team owner to add this private group');\n}","handlingStrategy":"try-catch","validationCode":"// if the teams data exposes the caller's role, gate the UI on it:\nif (!isTeamOwnerOrAdmin(teamInfo, Meteor.userId())) {\n  // hide the add-group-to-team action for this user\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('createPrivateGroup', name, members, false, {}, { teamId });\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {\n    // lacks create-team-group on this team - suggest asking an owner\n    showToast('Only team owners/managers can add private groups to this team');\n    return;\n  }\n  throw e;\n}","preventionTips":["Restrict the team-group creation UI to team owners/managers (the roles that carry create-team-group).","Grant create-team-group selectively when members should spawn team private groups.","Automate team group creation with a team owner's credentials or an elevated service account."],"tags":["rocket-chat","meteor","create-private-group","teams","permissions","authorization"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}