{"record":{"id":"635875bfb334ce0e","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-635875","errorCode":"not-authorized","errorMessage":"Not Authorized","messagePattern":"Not Authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/getUsersOfRoom.ts","lineNumber":46,"sourceCode":"\tasync getUsersOfRoom(rid, showAll, { limit, skip } = {}, filter) {\n\t\tif (!rid) {\n\t\t\tthrow new Meteor.Error('error-invalid-room', 'Invalid room', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tcheck(rid, String);\n\n\t\tconst userId = Meteor.userId();\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tconst room = await Rooms.findOneById(rid, { projection: { ...roomAccessAttributes, broadcast: 1 } });\n\t\tif (!room) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tif (!(await canAccessRoomAsync(room, { _id: userId }))) {\n\t\t\tthrow new Meteor.Error('not-authorized', 'Not Authorized', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\tif (room.broadcast && !(await hasPermissionAsync(userId, 'view-broadcast-member-list', rid))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getUsersOfRoom' });\n\t\t}\n\n\t\t// TODO this is currently counting deactivated users\n\t\tconst total = await Subscriptions.countByRoomIdWhenUsernameExists(rid);\n\n\t\tconst { cursor } = findUsersOfRoom({\n\t\t\trid,\n\t\t\tstatus: !showAll ? { $ne: UserStatus.OFFLINE } : undefined,\n\t\t\tlimit,\n\t\t\tskip,\n\t\t\tfilter,\n\t\t});\n\n\t\treturn {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/getUsersOfRoom.ts#L28-L64","documentation":"canAccessRoomAsync(room, { _id: userId }) returned false: the logged-in user cannot access this room. Private channels, teams, and DMs between other users require membership or elevated permissions, so non-members are rejected with not-authorized before any member data is queried.","triggerScenarios":"Requesting members of a private room the user never joined, was removed from, or left; requesting a direct-message room the user is not a participant of.","commonSituations":"Deep links to private rooms the user lacks membership in; membership revoked mid-session while the member list was open; components reused across rooms without re-checking access.","solutions":["Join the room (or get invited) before listing its members","Hide the member-list UI for rooms the user has no subscription/access to — check the local subscription cache first","On this error, refresh room subscriptions and route the user out of the inaccessible room"],"exampleFix":"// before\nMeteor.callAsync('getUsersOfRoom', rid, showAll);\n\n// after\nconst mySub = Subscriptions.findOne({ rid });\nif (!mySub && !roomIsPublic(room)) {\n\t// not a member of a private room — do not even ask the server\n\treturn;\n}\nawait Meteor.callAsync('getUsersOfRoom', rid, showAll);","handlingStrategy":"try-catch","validationCode":"// heuristic: private rooms need a local subscription\nconst sub = Subscriptions.findOne({ rid });\nif (!sub && room?.t !== 'c' && room?.t !== 'p') {\n\t// no access — do not call\n}\n// note: for 'p' (private) rooms the server check is authoritative; keep the catch","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('getUsersOfRoom', rid, showAll);\n} catch (err) {\n\tif ((err as { error?: string }).error === 'not-authorized') {\n\t\t// user cannot access this room — route away, do not retry\n\t}\n}","preventionTips":["Only expose member lists for rooms present in the user's subscriptions","Re-check access when reusing components across different rooms","Refresh subscriptions on window focus to catch revoked memberships"],"tags":["meteor","rooms","authorization","permissions","members"],"backgroundTag":"room-access-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}