{"record":{"id":"9679c2db58201d68","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-9679c2","errorCode":"error-not-allowed","errorMessage":"not-allowed","messagePattern":"not-allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/messages/sendMessage.ts","lineNumber":44,"sourceCode":" * @param extraInfo\n *   - ts: The timestamp of the message. the message object already has a ts, but this value is validated and only a window of 10 seconds is allowed to be used. this value overrides the message.ts value without validation.\n *\n *\n * @returns\n */\nexport async function executeSendMessage(\n\tuid: IUser['_id'] | IUser,\n\tmessage: AtLeast<IMessage, 'rid'>,\n\textraInfo?: { ts?: Date; previewUrls?: string[] },\n) {\n\tif (message.tshow && !message.tmid) {\n\t\tthrow new Meteor.Error('invalid-params', 'tshow provided but missing tmid', {\n\t\t\tmethod: 'sendMessage',\n\t\t});\n\t}\n\n\tif (message.tmid && !settings.get('Threads_enabled')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'not-allowed', {\n\t\t\tmethod: 'sendMessage',\n\t\t});\n\t}\n\n\tconst isTimestampFromClient = Boolean(!extraInfo?.ts && message.ts);\n\tconst now = new Date();\n\tmessage.ts = extraInfo?.ts ?? message.ts ?? now;\n\tif (isTimestampFromClient) {\n\t\tconst tsDiff = Math.abs(moment(message.ts).diff(Date.now()));\n\t\tif (tsDiff > 60000) {\n\t\t\tthrow new Meteor.Error('error-message-ts-out-of-sync', 'Message timestamp is out of sync', {\n\t\t\t\tmethod: 'sendMessage',\n\t\t\t\tmessage_ts: message.ts,\n\t\t\t\tserver_ts: new Date().getTime(),\n\t\t\t});\n\t\t}\n\t\tif (tsDiff > 10000) {\n\t\t\tmessage.ts = now;","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/messages/sendMessage.ts#L26-L62","documentation":"If the message carries a tmid (thread reply) but the workspace setting Threads_enabled is false, executeSendMessage throws error-not-allowed. The whole thread feature is off server-side, so any thread-addressed send is rejected regardless of room or permissions.","triggerScenarios":"Client with cached thread UI sends a reply with tmid after an admin disabled threads; bot or integration hardcoded to thread its messages on a workspace where threads are off; fresh install where Threads_enabled defaults to false.","commonSituations":"Setting flipped after clients loaded thread UI; sandbox/test workspace without threads enabled; automation written against a threaded workspace reused on a non-threaded one.","solutions":["Enable threads: Admin -> Workspace -> Threads (Threads_enabled)","Client-side: read the threads setting and disable thread UI before a tmid can be attached","Fall back to a plain message without tmid when threads are disabled"],"exampleFix":"// before\nawait Meteor.callAsync('sendMessage', { rid, msg, tmid });\n\n// after: strip thread fields when the feature is off\nconst threadsEnabled = settings.get('Threads_enabled');\nawait Meteor.callAsync('sendMessage', { rid, msg, ...(threadsEnabled ? { tmid } : {}) });","handlingStrategy":"validation","validationCode":"// client: only attach thread fields when threads are enabled\nconst threadsEnabled = settings.get('Threads_enabled');\nconst payload = { rid, msg, ...(threadsEnabled && tmid ? { tmid } : {}) };\nawait Meteor.callAsync('sendMessage', payload);","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('sendMessage', { rid, msg, tmid });\n} catch (e: any) {\n\tif (e?.error === 'error-not-allowed') {\n\t\t// threads disabled: resend as a plain message without tmid\n\t\tawait Meteor.callAsync('sendMessage', { rid, msg });\n\t\treturn;\n\t}\n\tthrow e;\n}","preventionTips":["Subscribe to the Threads_enabled setting and gate thread UI on it","Strip tmid/tshow when the setting flips to false","Watch for admin setting changes via the settings subscription, not a boot-time snapshot"],"tags":["meteor-method","messages","threads","settings"],"backgroundTag":"feature-flag-disabled","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}