{"record":{"id":"7b1b85bbe69f1b22","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-7b1b85","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/setUserActiveStatus.ts","lineNumber":25,"sourceCode":"\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tsetUserActiveStatus(userId: string, active: boolean, confirmRelinquish?: boolean): boolean;\n\t}\n}\n\nexport const executeSetUserActiveStatus = async (\n\tfromUserId: string,\n\tuserId: string,\n\tactive: boolean,\n\tconfirmRelinquish?: boolean,\n): Promise<boolean> => {\n\tcheck(userId, String);\n\tcheck(active, Boolean);\n\n\tif (!fromUserId || (await hasPermissionAsync(fromUserId, 'edit-other-user-active-status')) !== true) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'setUserActiveStatus',\n\t\t});\n\t}\n\n\tawait setUserActiveStatus(userId, active, confirmRelinquish, fromUserId);\n\n\treturn true;\n};\n\nMeteor.methods<ServerMethods>({\n\tasync setUserActiveStatus(userId, active, confirmRelinquish) {\n\t\tconst uid = Meteor.userId();\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'setUserActiveStatus',\n\t\t\t});\n\t\t}\n","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/setUserActiveStatus.ts#L7-L43","documentation":"executeSetUserActiveStatus authorizes the caller, not the target: it requires fromUserId to be truthy AND to hold the edit-other-user-active-status permission. Either failing yields error-not-allowed before any deactivation logic (last-admin protection, room ownership checks) runs.","triggerScenarios":"Meteor.call('setUserActiveStatus', userId, active, confirmRelinquish) from a user whose roles lack edit-other-user-active-status; or a server-side call passing an empty fromUserId.","commonSituations":"Custom admin panels assuming 'admin role == all permissions' after a role refactor; permission revoked but the client UI cache still shows the toggle; tests calling the method without permission stubs.","solutions":["Grant edit-other-user-active-status to the acting role under Administration -> Permissions","For programmatic flows use POST /api/v1/users.setActiveStatus with an authorized token","Only render activate/deactivate controls when the caller has the permission (roles-based UI gating)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const canEditActiveStatus = (roles: string[]) =>\n  roles.includes('admin') || roleHasPermission(roles, 'edit-other-user-active-status');\nif (!canEditActiveStatus(currentUser.roles)) {\n  hideControl('deactivate-user');\n  return;\n}","typeGuard":null,"tryCatchPattern":"catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-not-allowed') {\n    showNotice('You lack edit-other-user-active-status permission');\n  }\n}","preventionTips":["Gate activate/deactivate UI on the edit-other-user-active-status permission, not on the admin role label","For automation use POST /api/v1/users.setActiveStatus with an authorized token","After role changes, refresh permissions client-side before showing admin actions"],"tags":["meteor","users","permissions","admin"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}