{"record":{"id":"68023e9d3efdb1b0","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-68023e","errorCode":"not-authorized","errorMessage":"Not Authorized","messagePattern":"Not Authorized","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/messaging/stars/starMessage.ts","lineNumber":45,"sourceCode":"\n\tconst subscription = await Subscriptions.findOneByRoomIdAndUserId(message.rid, user._id, {\n\t\tprojection: { _id: 1 },\n\t});\n\tif (!subscription) {\n\t\treturn false;\n\t}\n\tif (!(await Messages.findOneByRoomIdAndMessageId(message.rid, message._id))) {\n\t\treturn false;\n\t}\n\n\tconst room = await Rooms.findOneById(message.rid, { projection: { ...roomAccessAttributes, lastMessage: 1 } });\n\n\tif (!room) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'starMessage' });\n\t}\n\n\tif (!(await canAccessRoomAsync(room, { _id: user._id }))) {\n\t\tthrow new Meteor.Error('not-authorized', 'Not Authorized', { method: 'starMessage' });\n\t}\n\n\tif (isTheLastMessage(room, message)) {\n\t\tawait Rooms.updateLastMessageStar(room._id, user._id, message.starred);\n\t\tvoid notifyOnRoomChangedById(room._id);\n\t}\n\n\tawait Apps.self?.triggerEvent(AppEvents.IPostMessageStarred, message, user, message.starred);\n\n\tawait Messages.updateUserStarById(message._id, user._id, message.starred);\n\n\tvoid notifyOnMessageChange({\n\t\tid: message._id,\n\t});\n\n\treturn true;\n};\n","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/messaging/stars/starMessage.ts#L27-L63","documentation":"starMessage verifies room visibility with canAccessRoomAsync(room, { _id: user._id }); failure throws Meteor.Error('not-authorized', 'Not Authorized'). The user still holds a subscription row (checked earlier), but the authorization engine currently denies access - role or permission changes, room type changes, or app-user restrictions.","triggerScenarios":"Starring in a room where access was revoked at the permission layer while the subscription row lingers: roles stripped, private channel converted or restricted, app users blocked from encrypted/private rooms, DM counterpart deletion.","commonSituations":"Permission revocation racing a star action; apps starring with a user context that cannot access the room; stale subscription rows after access revocation.","solutions":["In integrations, mirror the server check with canAccessRoomAsync before calling starMessage","Refresh the user's roles/permissions and room list after authorization changes","For app users, grant room access or switch to a user context that has membership"],"exampleFix":"// before\nawait starMessage(appUser, { rid, _id: messageId, starred: true });\n\n// after\nif (await canAccessRoomAsync(room, appUser)) {\n  await starMessage(appUser, { rid, _id: messageId, starred: true });","handlingStrategy":"validation","validationCode":"if (await canAccessRoomAsync(room, { _id: user._id })) {\n  await starMessage(user, message);\n} else {\n  await resyncRoomAccess(message.rid);\n}","typeGuard":null,"tryCatchPattern":"Meteor.call('starMessage', msg, (err) => {\n  if (err?.error === 'not-authorized') {\n    resyncRoomAccess(msg.rid); // access revoked - drop the local room view\n  }\n});","preventionTips":["Mirror canAccessRoomAsync in any integration before calling starMessage","Listen for role/permission change events and invalidate cached room access","Treat not-authorized as terminal for the current user+room pair"],"tags":["starring","authorization","room-access","ddp-method"],"backgroundTag":"room-access-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}