{"record":{"id":"7e280a8e1f4ebbe5","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-7e280a","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/platform/OEmbedCacheCleanup.ts","lineNumber":26,"sourceCode":"declare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tOEmbedCacheCleanup(): { message: string };\n\t}\n}\n\nexport const executeClearOEmbedCache = async () => {\n\tconst date = new Date();\n\tconst expirationDays = settings.get<number>('API_EmbedCacheExpirationDays');\n\tdate.setDate(date.getDate() - expirationDays);\n\treturn OEmbedCache.removeBeforeDate(date);\n};\n\nMeteor.methods<ServerMethods>({\n\tasync OEmbedCacheCleanup() {\n\t\tconst uid = Meteor.userId();\n\t\tif (!uid || !(await hasPermissionAsync(uid, 'clear-oembed-cache'))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\t\tmethod: 'OEmbedCacheCleanup',\n\t\t\t});\n\t\t}\n\n\t\tawait executeClearOEmbedCache();\n\t\treturn {\n\t\t\tmessage: 'cache_cleared',\n\t\t};\n\t},\n});\n","sourceCodeStart":8,"sourceCodeEnd":37,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/platform/OEmbedCacheCleanup.ts#L8-L37","documentation":"The OEmbedCacheCleanup Meteor method requires a logged-in user holding the 'clear-oembed-cache' permission; anything else throws error-not-allowed. The method purges OEmbed (link-preview) cache entries older than API_EmbedCacheExpirationDays days.","triggerScenarios":"Calling Meteor.call('OEmbedCacheCleanup') from an anonymous connection, or as a user whose roles do not include 'clear-oembed-cache'.","commonSituations":"Non-admin users triggering cache cleanup; custom admin panels invoking the method without a permission gate; the permission removed from the admin role during a roles refactor.","solutions":["Run the method as a user with 'clear-oembed-cache' (typically admin); grant that permission to the appropriate role if missing","Gate the UI action behind a client-side 'clear-oembed-cache' permission check","Handle error-not-allowed as an authorization failure — fix roles, do not retry"],"exampleFix":"// before\nMeteor.call('OEmbedCacheCleanup');\n\n// after\nif (hasPermission(uid, 'clear-oembed-cache')) {\n  Meteor.call('OEmbedCacheCleanup');\n}","handlingStrategy":"validation","validationCode":"if (!Meteor.userId() || !hasPermission(Meteor.userId(), 'clear-oembed-cache')) {\n  disableCacheCleanupAction();\n}","typeGuard":"const isNotAllowed = (e: unknown): e is Meteor.Error =>\n  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-allowed';","tryCatchPattern":"try {\n  await Meteor.callAsync('OEmbedCacheCleanup');\n} catch (e) {\n  if (isNotAllowed(e)) {\n    showError('You need the clear-oembed-cache permission');\n    return; // permanent — fix the role, do not retry\n  }\n  throw e;\n}","preventionTips":["Bind admin-only maintenance actions to explicit permission checks in the UI","Keep clear-oembed-cache on the admin role only","Never expose maintenance methods to unauthenticated sessions"],"tags":["rocket-chat","meteor","permissions","oembed","cache","authorization"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}