{"record":{"id":"8bbcb7a0e1e81ec3","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-8bbcb7","errorCode":"not-authorized","errorMessage":"Not Authorized","messagePattern":"Not Authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/imports/personal-access-tokens/server/api/methods/removeToken.ts","lineNumber":16,"sourceCode":"import { Meteor } from 'meteor/meteor';\nimport type { ServerMethods } from '@rocket.chat/ddp-client';\nimport { Users } from '@rocket.chat/models';\n\nimport { hasPermissionAsync } from '../../../../../server/lib/authorization/hasPermission';\nimport { twoFactorRequired } from '../../../../../server/lib/2fa/twoFactorRequired';\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\t'personalAccessTokens:removeToken'(params: { tokenName: string }): Promise<void>;\n\t}\n}\n\nexport const removePersonalAccessTokenOfUser = async (tokenName: string, userId: string): Promise<void> => {\n\tif (!(await hasPermissionAsync(userId, 'create-personal-access-tokens'))) {\n\t\tthrow new Meteor.Error('not-authorized', 'Not Authorized', {\n\t\t\tmethod: 'personalAccessTokens:removeToken',\n\t\t});\n\t}\n\tconst tokenExist = await Users.findPersonalAccessTokenByTokenNameAndUserId({\n\t\tuserId,\n\t\ttokenName,\n\t});\n\tif (!tokenExist) {\n\t\tthrow new Meteor.Error('error-token-does-not-exists', 'Token does not exist', {\n\t\t\tmethod: 'personalAccessTokens:removeToken',\n\t\t});\n\t}\n\tawait Users.removePersonalAccessTokenOfUser({\n\t\tuserId,\n\t\tloginTokenObject: {\n\t\t\ttype: 'personalAccessToken',\n\t\t\tname: tokenName,\n\t\t},","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/imports/personal-access-tokens/server/api/methods/removeToken.ts#L1-L34","documentation":"Thrown by removePersonalAccessTokenOfUser when the target user lacks the 'create-personal-access-tokens' permission. Despite the action being a removal, Rocket.Chat gates all personal-access-token operations behind this single permission, so a user without it cannot delete tokens either. This is the internal-API guard with an explicit userId.","triggerScenarios":"Calling removePersonalAccessTokenOfUser(tokenName, userId) for a user whose role does not include 'create-personal-access-tokens'.","commonSituations":"Permission revoked after token creation; role downgrade; integration acting on behalf of a user without the permission.","solutions":["Grant the 'create-personal-access-tokens' permission to the user's role.","Confirm you are operating on the intended userId.","Return a 403 and ask an admin to adjust permissions.","Document that removal requires the same permission as creation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"async function canManageTokens(userId: string): Promise<boolean> {\n  return hasPermissionAsync(userId, 'create-personal-access-tokens');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await removePersonalAccessTokenOfUser(tokenName, userId);\n} catch (e) {\n  if (e.error === 'not-authorized') {\n    // return 403 and prompt admin to grant the permission\n  } else throw e;\n}","preventionTips":["Note that removal requires the same permission as creation.","Check permission before showing a delete action in the UI.","Audit role changes that remove token permissions."],"tags":["personal-access-tokens","authorization","permissions"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}