{"record":{"id":"48aa69aa4cdcb35c","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-48aa69","errorCode":"error-not-allowed","errorMessage":"Action not allowed","messagePattern":"Action not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/platform/checkFederationConfiguration.ts","lineNumber":24,"sourceCode":"declare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tcheckFederationConfiguration(): Promise<{ message: string }>;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync checkFederationConfiguration() {\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'checkFederationConfiguration',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await Authorization.hasPermission(uid, 'view-privileged-setting'))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Action not allowed', {\n\t\t\t\tmethod: 'checkFederationConfiguration',\n\t\t\t});\n\t\t}\n\n\t\tconst errors: string[] = [];\n\n\t\tconst successes: string[] = [];\n\n\t\tconst service = License.hasValidLicense() ? FederationEE : Federation;\n\n\t\tconst status = await service.configurationStatus();\n\n\t\tif (status.externalReachability.ok) {\n\t\t\tsuccesses.push('homeserver configuration looks good');\n\t\t} else {\n\t\t\tlet err = 'external reachability could not be verified';\n\n\t\t\tconst { error } = status.externalReachability;","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/platform/checkFederationConfiguration.ts#L6-L42","documentation":"checkFederationConfiguration requires the 'view-privileged-setting' permission; without it the server throws error-not-allowed right after the login check. Federation configuration exposes sensitive bridge details, so the check is restricted to privileged admins.","triggerScenarios":"A logged-in non-admin, or an admin whose role lost 'view-privileged-setting', invoking checkFederationConfiguration.","commonSituations":"Custom admin consoles whose operator role lacks privileged-setting permissions; permission sets tightened during security audits; sub-admins given the federation UI without the underlying permission.","solutions":["Grant 'view-privileged-setting' to the role of users who must run the federation check","Restrict the federation check UI to users holding that permission","Treat error-not-allowed as a permanent authorization failure — fix the role, do not retry"],"exampleFix":"// before\nMeteor.call('checkFederationConfiguration');\n\n// after\nif (hasPermission(uid, 'view-privileged-setting')) {\n  const { message } = await Meteor.callAsync('checkFederationConfiguration');\n}","handlingStrategy":"validation","validationCode":"if (!hasPermission(Meteor.userId(), 'view-privileged-setting')) {\n  hideFederationCheck();\n}","typeGuard":"const isNotAllowed = (e: unknown): e is Meteor.Error =>\n  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-allowed';","tryCatchPattern":"try {\n  await Meteor.callAsync('checkFederationConfiguration');\n} catch (e) {\n  if (isNotAllowed(e)) {\n    showError('Requires the view-privileged-setting permission');\n    return; // permanent — no retry\n  }\n  throw e;\n}","preventionTips":["Map every privileged admin action to its permission in the UI","Grant view-privileged-setting only to full admins","Treat authorization errors as permanent: fix roles, never retry"],"tags":["rocket-chat","meteor","permissions","federation","authorization","admin"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}