{"record":{"id":"9d42ef8f81b00f53","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-9d42ef","errorCode":null,"errorMessage":"error-not-allowed","messagePattern":"error-not-allowed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/api/v1/push.ts","lineNumber":320,"sourceCode":"\t\t\tconst { id } = this.queryParams;\n\n\t\t\tconst receiver = await Users.findOneById(this.userId);\n\t\t\tif (!receiver) {\n\t\t\t\tthrow new Error('error-user-not-found');\n\t\t\t}\n\n\t\t\tconst message = await Messages.findOneById(id);\n\t\t\tif (!message) {\n\t\t\t\tthrow new Error('error-message-not-found');\n\t\t\t}\n\n\t\t\tconst room = await Rooms.findOneById(message.rid);\n\t\t\tif (!room) {\n\t\t\t\tthrow new Error('error-room-not-found');\n\t\t\t}\n\n\t\t\tif (!(await canAccessRoomAsync(room, receiver))) {\n\t\t\t\tthrow new Error('error-not-allowed');\n\t\t\t}\n\n\t\t\tconst data = await PushNotification.getNotificationForMessageId({ receiver, room, message });\n\n\t\t\treturn API.v1.success({ data });\n\t\t},\n\t)\n\t.get(\n\t\t'push.info',\n\t\t{\n\t\t\tauthRequired: true,\n\t\t\tresponse: {\n\t\t\t\t200: pushInfoResponseSchema,\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tconst defaultGateway = (await Settings.findOneById('Push_gateway', { projection: { packageValue: 1 } }))?.packageValue;","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/push.ts#L302-L338","documentation":"Thrown by GET push.get when canAccessRoomAsync(room, receiver) resolves false. The authenticated user (receiver) does not have permission to view the room that contains the requested message. It is a plain new Error('error-not-allowed'), so the response is not a structured forbidden body.","triggerScenarios":"GET /api/v1/push.get?id=<id> where the message exists and its room exists, but the calling user is not a member / lacks view permission on that room (e.g. private channel, DM between other users, restricted team room).","commonSituations":"User was removed from the channel after the notification was queued; client tries to fetch push info for a message in a room the user was never invited to; cross-workspace id leak.","solutions":["Verify the calling user's membership/subscription for the target room before requesting push info.","Use the user's own notification list rather than arbitrary message ids.","If access was recently revoked, stop polling push.get for that message.","On the client, suppress/silently drop this error since the user legitimately cannot see the content."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm the user can access the room before fetching push info\nasync function canUserSeeRoom(userId: string, roomId: string): Promise<boolean> {\n  // use the subscriptions/rooms endpoints scoped to the caller\n  const res = await fetch(`/api/v1/rooms.info?roomId=${encodeURIComponent(roomId)}`).then(r => r.status);\n  return res === 200;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await fetch(`/api/v1/push.get?id=${id}`).then(r => r.json());\n} catch (e) {\n  if (String(e).includes('error-not-allowed')) { /* user lacks room access; suppress */ }\n}","preventionTips":["Only request push info for messages in rooms the calling user is a member of.","Suppress this error client-side; it is an expected outcome after access revocation."],"tags":["push","rest-api","authorization","forbidden","permissions"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}