{"record":{"id":"60b9fac7fb0e4bf7","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-60b9fa","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/unmuteUserInRoom.ts","lineNumber":21,"sourceCode":"import { Rooms, Subscriptions, Users } from '@rocket.chat/models';\nimport { Meteor } from 'meteor/meteor';\n\nimport { RoomMemberActions } from '../../../definition/IRoomTypeConfig';\nimport { hasPermissionAsync } from '../../lib/authorization/hasPermission';\nimport { callbacks } from '../../lib/callbacks';\nimport { notifyOnRoomChangedById } from '../../lib/notifyListener';\nimport { roomCoordinator } from '../../lib/rooms/roomCoordinator';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tunmuteUserInRoom(data: { rid: IRoom['_id']; username: string }): boolean;\n\t}\n}\n\nexport const unmuteUserInRoom = async (fromId: string, data: { rid: IRoom['_id']; username: string }): Promise<boolean> => {\n\tif (!fromId || !(await hasPermissionAsync(fromId, 'mute-user', data.rid))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'unmuteUserInRoom',\n\t\t});\n\t}\n\n\tconst room = await Rooms.findOneById(data.rid);\n\n\tif (!room) {\n\t\tthrow new Meteor.Error('error-invalid-room', 'Invalid room', {\n\t\t\tmethod: 'unmuteUserInRoom',\n\t\t});\n\t}\n\n\tif (!(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.MUTE, fromId))) {\n\t\tthrow new Meteor.Error('error-invalid-room-type', `${room.t} is not a valid room type`, {\n\t\t\tmethod: 'unmuteUserInRoom',\n\t\t\ttype: room.t,\n\t\t});\n\t}","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/unmuteUserInRoom.ts#L3-L39","documentation":"unmuteUserInRoom requires a truthy fromId AND the 'mute-user' permission scoped to the room (hasPermissionAsync(fromId, 'mute-user', data.rid)); failing either throws error-not-allowed. Unmuting uses the exact same permission as muting.","triggerScenarios":"A moderator whose role lacks mute-user calls Meteor.call('unmuteUserInRoom', { rid, username }); or the exported function is invoked with an empty/undefined fromId.","commonSituations":"Custom moderator roles created without mute-user; bots attempting to unmute with low-privilege users; room-scoped permission overrides that removed mute-user for a specific channel.","solutions":["Grant mute-user to the acting user's role (Administration > Permissions)","Ensure the acting user id is set when calling the exported unmuteUserInRoom function directly","Hide mute/unmute actions unless the client-side permission check for mute-user passes","For room-scoped roles, confirm the role's scope includes this room"],"exampleFix":"// before\nMeteor.call('unmuteUserInRoom', { rid, username }); // role lacks mute-user\n\n// after\nif (hasPermission('mute-user', rid)) {\n  Meteor.call('unmuteUserInRoom', { rid, username });\n}","handlingStrategy":"validation","validationCode":"import { hasPermission } from '../../../app/authorization/client';\n\nif (!hasPermission('mute-user', rid)) {\n  // hide mute/unmute actions instead of calling the method\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('unmuteUserInRoom', { rid, username });\n} catch (error) {\n  if (error instanceof Meteor.Error && error.error === 'error-not-allowed') {\n    // acting user lacks mute-user on this room; notify and refresh member list UI\n  }\n}","preventionTips":["Gate mute/unmute UI on hasPermission('mute-user', rid)","Always pass a real acting user id when calling the exported function","Check room-scoped permission overrides when a global role should work but does not"],"tags":["permissions","moderation","meteor-methods"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}