{"record":{"id":"7b785ec9b73906b3","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-7b785e","errorCode":"not_authorized","errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/integrations/incoming/deleteIncomingIntegration.ts","lineNumber":22,"sourceCode":"\nimport { hasPermissionAsync } from '../../../lib/authorization/hasPermission';\nimport { methodDeprecationLogger } from '../../../lib/deprecationWarningLogger';\nimport { notifyOnIntegrationChanged } from '../../../lib/notifyListener';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tdeleteIncomingIntegration(integrationId: string): Promise<boolean>;\n\t}\n}\n\nexport const deleteIncomingIntegration = async (integrationId: string, userId: string): Promise<void> => {\n\tconst canManageAllIntegrations = !!userId && (await hasPermissionAsync(userId, 'manage-incoming-integrations'));\n\tconst canManageOwnIntegrations =\n\t\t!canManageAllIntegrations && !!userId && (await hasPermissionAsync(userId, 'manage-own-incoming-integrations'));\n\n\tif (!canManageAllIntegrations && !canManageOwnIntegrations) {\n\t\tthrow new Meteor.Error('not_authorized', 'Unauthorized', {\n\t\t\tmethod: 'deleteIncomingIntegration',\n\t\t});\n\t}\n\n\tconst integration = await Integrations.removeByIdAndCreatedByIfExists({\n\t\t_id: integrationId,\n\t\t...(canManageOwnIntegrations && { createdBy: userId }),\n\t});\n\n\tif (!integration) {\n\t\tthrow new Meteor.Error('error-invalid-integration', 'Invalid integration', {\n\t\t\tmethod: 'deleteIncomingIntegration',\n\t\t});\n\t}\n\n\tvoid notifyOnIntegrationChanged(integration, 'removed');\n};\n","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/integrations/incoming/deleteIncomingIntegration.ts#L4-L40","documentation":"Thrown by the deleteIncomingIntegration helper when the caller holds neither 'manage-incoming-integrations' nor 'manage-own-incoming-integrations' (or userId is empty, since both checks are gated on !!userId). Either permission alone is sufficient; the error means the caller has neither at the time of the call.","triggerScenarios":"A regular user without any integration permission calls deleteIncomingIntegration; permissions were revoked but the client session still caches old role state; userId passed as empty string when invoking the exported helper.","commonSituations":"Admin removed integration rights as cleanup and users' open admin screens kept the delete button enabled; permission changes requiring re-login to take effect in the client's cached role subscription.","solutions":["Grant 'manage-incoming-integrations' (full) or 'manage-own-incoming-integrations' (own only) to a role the caller holds","Have the caller log out and back in so refreshed permissions reach the client, then retry","Or delete the integration from an admin account; for automation use DELETE /api/v1/integrations.remove"],"exampleFix":"// before\nawait Meteor.callAsync('deleteIncomingIntegration', id); // by a user with no integration permission\n// after: perform the delete as an admin-managed service\nawait fetch(`${root}/api/v1/integrations.remove`, { method: 'POST', headers: { 'X-Auth-Token': adminToken, 'X-User-Id': adminUid }, body: JSON.stringify({ integrationId: id, type: 'webhook-incoming' }) });","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('deleteIncomingIntegration', integrationId);\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'not_authorized') { /* hide delete affordance; suggest admin or permission grant */ }\n}","preventionTips":["Show delete buttons only for users with an integration-management permission","Re-login after role changes","Route automated cleanup through an authorized REST token"],"tags":["rocket-chat","incoming-integration","permissions","meteor-method"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}