{"record":{"id":"80b5361f1b36b0fd","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-80b536","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/platform/restartServer.ts","lineNumber":25,"sourceCode":"\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\trestart_server(): {\n\t\t\tmessage: string;\n\t\t\tparams: [number];\n\t\t};\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync restart_server() {\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'restart_server' });\n\t\t}\n\n\t\tif ((await hasPermissionAsync(uid, 'restart-server')) !== true) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'restart_server' });\n\t\t}\n\n\t\tsetTimeout(() => {\n\t\t\tsetTimeout(() => {\n\t\t\t\tconsole.warn('Call to process.exit() timed out, aborting.');\n\t\t\t\tprocess.abort();\n\t\t\t}, 1000);\n\t\t\tprocess.exit(1);\n\t\t}, 1000);\n\n\t\treturn {\n\t\t\tmessage: 'The_server_will_restart_in_s_seconds',\n\t\t\tparams: [2],\n\t\t};\n\t},\n});\n","sourceCodeStart":7,"sourceCodeEnd":42,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/platform/restartServer.ts#L7-L42","documentation":"`restart_server` throws `error-not-allowed` when `hasPermissionAsync(uid, 'restart-server')` fails for the logged-in user. The permission is role-based; admin roles normally carry it, but a workspace can revoke it or the caller may hold a role that never had it.","triggerScenarios":"A logged-in user whose roles lack the `restart-server` permission calls `Meteor.call('restart_server')` — a regular user, a bot/service account, or an admin after the permission was removed from the admin role.","commonSituations":"Permission revoked from the admin role in Administration -> Permissions; custom roles created without `restart-server`; calling through an integration user.","solutions":["Call the method as a user whose roles include `restart-server` (typically an admin)","Grant the permission: Administration -> Permissions -> add `restart-server` to the intended role","Hide or disable the restart control for users without the permission"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// hide/disable the control unless the session user holds the permission\nconst uid = Meteor.userId();\nconst allowed = Boolean(uid) && userHasPermission(uid, 'restart-server');\nrestartButton.disabled = !allowed;","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('restart_server');\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {\n    showPermissionError('restart-server'); // or hide the control entirely\n  }\n}","preventionTips":["Check effective permissions before showing admin actions","Keep restart-server granted only to trusted admin roles in the permissions editor","Audit role/permission changes after workspace upgrades"],"tags":["permissions","authorization","admin","server-restart","meteor-method"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}