{"record":{"id":"4081a2ec4716da8b","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-4081a2","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/checkUsernameAvailability.ts","lineNumber":35,"sourceCode":"\tusernameBlackList = ['all', 'here'].concat(value.split(',')).map(toRegExp);\n});\n\nconst usernameIsBlocked = (username: string, usernameBlackList: RegExp[]): boolean | number =>\n\tusernameBlackList.length && usernameBlackList.some((restrictedUsername) => restrictedUsername.test(escapeRegExp(username).trim()));\n\nexport const checkUsernameAvailabilityWithValidation = async function (userId: string, username: string): Promise<boolean> {\n\tif (!username) {\n\t\tthrow new Meteor.Error('error-invalid-username', 'Invalid username', { method: 'setUsername' });\n\t}\n\n\tconst user = await Users.findOneById(userId, { projection: { username: 1 } });\n\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setUsername' });\n\t}\n\n\tif (user.username && !settings.get('Accounts_AllowUsernameChange')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'setUsername' });\n\t}\n\n\tif (user.username === username) {\n\t\treturn true;\n\t}\n\treturn checkUsernameAvailability(username);\n};\n\nexport const checkUsernameAvailability = async function (username: string, type: UsernameAvailabilityCheckType = 'user'): Promise<boolean> {\n\tif (usernameIsBlocked(username, usernameBlackList) || !validateName(username)) {\n\t\tthrow new Meteor.Error('error-blocked-username', `${_.escape(username)} is blocked and can't be used!`, {\n\t\t\tmethod: 'checkUsernameAvailability',\n\t\t\tfield: username,\n\t\t});\n\t}\n\n\t// Make sure no users are using this username\n\tconst existingUser = await Users.findOneByUsernameIgnoringCase(username, {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/checkUsernameAvailability.ts#L17-L53","documentation":"checkUsernameAvailabilityWithValidation throws error-not-allowed (method 'setUsername') when the user already has a username and the workspace setting Accounts_AllowUsernameChange is disabled. The server deliberately blocks renames after initial registration; only first-time username assignment is permitted.","triggerScenarios":"Any setUsername attempt by an already-named user on a workspace where Admin > Settings > Accounts has 'Allow Username Change' off (the default hardening posture for many enterprises).","commonSituations":"End users trying to rename themselves after registration on a locked-down workspace; SAML/LDAP-managed installations where identity comes from the upstream provider and renames are intentionally disabled.","solutions":["Enable Accounts_AllowUsernameChange in Administration > Settings > Accounts if self-service renames are wanted","Otherwise have an admin change the username, or manage it in the upstream identity provider (LDAP/SAML mapping)","Hide the username edit field in the UI when the setting is off so users never hit the error"],"exampleFix":"// before\nif (user.username !== newUsername) {\n  Meteor.call('setUsername', newUsername);\n}\n\n// after\nconst canChange = settings.get('Accounts_AllowUsernameChange') || !user.username;\nif (canChange && user.username !== newUsername) {\n  Meteor.call('setUsername', newUsername);\n}","handlingStrategy":"validation","validationCode":"const canRename = !currentUser.username || settings.get('Accounts_AllowUsernameChange');\nif (!canRename) {\n  disableUsernameEdit();\n  return;\n}\nawait checkUsernameAvailabilityWithValidation(userId, newUsername);","typeGuard":null,"tryCatchPattern":"try {\n  await checkUsernameAvailabilityWithValidation(userId, newUsername);\n} catch (e) {\n  if (isMeteorErrorCode(e, 'error-not-allowed')) {\n  \tshowNotice('Username changes are disabled by your administrator');\n  }\n}","preventionTips":["Read Accounts_AllowUsernameChange in the UI to hide the field proactively","For SAML/LDAP workspaces, expect renames to be governed upstream"],"tags":["users","username","settings","permissions"],"backgroundTag":"username-change-disabled","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}