{"record":{"id":"58bcb26e092b7d13","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-58bcb2","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/getUsersOfRoom.ts","lineNumber":42,"sourceCode":"\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync getUsersOfRoom(rid, showAll, { limit, skip } = {}, filter) {\n\t\tif (!rid) {\n\t\t\tthrow new Meteor.Error('error-invalid-room', 'Invalid room', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tcheck(rid, String);\n\n\t\tconst userId = Meteor.userId();\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tconst room = await Rooms.findOneById(rid, { projection: { ...roomAccessAttributes, broadcast: 1 } });\n\t\tif (!room) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tif (!(await canAccessRoomAsync(room, { _id: userId }))) {\n\t\t\tthrow new Meteor.Error('not-authorized', 'Not Authorized', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tif (room.broadcast && !(await hasPermissionAsync(userId, 'view-broadcast-member-list', rid))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\t// TODO this is currently counting deactivated users\n\t\tconst total = await Subscriptions.countByRoomIdWhenUsernameExists(rid);\n\n\t\tconst { cursor } = findUsersOfRoom({\n\t\t\trid,\n\t\t\tstatus: !showAll ? { $ne: UserStatus.OFFLINE } : undefined,\n\t\t\tlimit,\n\t\t\tskip,","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/getUsersOfRoom.ts#L24-L60","documentation":"Rooms.findOneById(rid) returned null, so getUsersOfRoom throws error-not-allowed ('Not allowed'). Despite the message, this exact throw is a not-found condition: no room document with that _id exists on this server. The misleading code comes from reusing error-not-allowed for the missing-room branch.","triggerScenarios":"Passing a non-existent, typo'd, or already-deleted room id; a rid that belongs to a different workspace (e.g. MONGO_URL pointing at another environment's database).","commonSituations":"Stale rid cached in localStorage or a bookmarked URL after the room was deleted; room deleted while the tab stayed open; dev ids run against a prod database.","solutions":["Only pass rid values taken from a currently loaded room document","If the room was deleted, clear the cached rid and redirect away from the members view","Verify MONGO_URL / environment so ids resolve against the intended database"],"exampleFix":"// before\nMeteor.callAsync('getUsersOfRoom', ridFromStorage, showAll);\n\n// after\nconst room = Rooms.findOne({ _id: ridFromStorage });\nif (!room) {\n\tclearCachedRid();\n\treturn;\n}\nawait Meteor.callAsync('getUsersOfRoom', room._id, showAll);","handlingStrategy":"try-catch","validationCode":"const room = Rooms.findOne({ _id: rid });\nif (!room) {\n\tclearCachedRid();\n\treturn;\n}\nawait Meteor.callAsync('getUsersOfRoom', rid, showAll);","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('getUsersOfRoom', rid, showAll);\n} catch (err) {\n\tif ((err as { error?: string }).error === 'error-not-allowed' && !Rooms.findOne({ _id: rid })) {\n\t\t// room does not exist (message is misleading) — purge stale rid\n\t}\n}","preventionTips":["Only use rid values from currently loaded room documents","Purge cached rids from localStorage/URLs when rooms are deleted","Confirm the environment (MONGO_URL) matches where the rid was created"],"tags":["meteor","rooms","not-found","members","error-message-mismatch"],"backgroundTag":"room-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}