{"record":{"id":"57a5bd5e5c2873a0","repo":"RocketChat/Rocket.Chat","slug":"403-57a5bd","errorCode":"403","errorMessage":"Access to Method Forbidden","messagePattern":"Access to Method Forbidden","errorType":"exception","errorClass":"Meteor.Error","httpStatus":403,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/addAllUserToRoom.ts","lineNumber":29,"sourceCode":"import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';\nimport { getSubscriptionAutotranslateDefaultConfig } from '../../lib/getSubscriptionAutotranslateDefaultConfig';\nimport { notifyOnSubscriptionChangedById } from '../../lib/notifyListener';\nimport { getDefaultSubscriptionPref } from '../../lib/utils/lib/getDefaultSubscriptionPref';\nimport { settings } from '../../settings';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\taddAllUserToRoom(rid: IRoom['_id'], activeUsersOnly?: boolean): Promise<true>;\n\t}\n}\n\nexport const addAllUserToRoomFn = async (userId: string, rid: IRoom['_id'], activeUsersOnly = false): Promise<true> => {\n\tcheck(rid, String);\n\tcheck(activeUsersOnly, Boolean);\n\n\tif (!(await hasPermissionAsync(userId, 'add-all-to-room'))) {\n\t\tthrow new Meteor.Error(403, 'Access to Method Forbidden', {\n\t\t\tmethod: 'addAllToRoom',\n\t\t});\n\t}\n\n\tconst userFilter: {\n\t\tactive?: boolean;\n\t} = {};\n\tif (activeUsersOnly === true) {\n\t\tuserFilter.active = true;\n\t}\n\n\tconst users = await Users.find(userFilter).toArray();\n\tif (users.length > settings.get<number>('API_User_Limit')) {\n\t\tthrow new Meteor.Error('error-user-limit-exceeded', 'User Limit Exceeded', {\n\t\t\tmethod: 'addAllToRoom',\n\t\t});\n\t}\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/addAllUserToRoom.ts#L11-L47","documentation":"addAllUserToRoomFn throws HTTP 403 'Access to Method Forbidden' when hasPermissionAsync(userId, 'add-all-to-room') is false. This admin-grade permission guards the bulk operation that adds every workspace user to one room; without it the method rejects before the user-count or room checks run. The Meteor method is deprecated since 9.0.0 in favor of POST /v1/channels.addAll and /v1/groups.addAll, which apply the same permission.","triggerScenarios":"A non-admin user calling the addAllUserToRoom method, or a REST token whose user lacks the add-all-to-room permission, calling channels.addAll/groups.addAll.","commonSituations":"Custom admin panels or scripts using a service account without elevated roles; permission grids edited so no role carries add-all-to-room; moderator trying a bulk add meant for admins.","solutions":["Grant the add-all-to-room permission to the caller's role in Administration > Permissions.","For REST, authenticate with an admin user or token whose role has add-all-to-room.","Catch the 403 and surface an authorization message instead of silently failing."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// optional preflight: only show the bulk-add control to users holding the permission\nconst canBulkAdd = await Meteor.callAsync('getUserPermissions').then((perms) => perms.includes('add-all-to-room'));\nif (!canBulkAdd) { /* hide/disable the action */ }","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('addAllUserToRoom', rid, activeUsersOnly);\n} catch (e: any) {\n\tif (e?.error === 403) {\n\t\t// authorization failure: surface 'not allowed', do not retry with the same identity\n\t}\n}","preventionTips":["Reserve bulk add for admin-grade accounts; document the required add-all-to-room permission.","Check the caller's permissions before exposing the control in UI.","Prefer the REST endpoints with a token whose role carries the permission."],"tags":["meteor-methods","authorization","rooms","http-403"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}