{"record":{"id":"a0620284444e45a0","repo":"RocketChat/Rocket.Chat","slug":"error-room-is-abac-managed","errorCode":"error-room-is-abac-managed","errorMessage":"error-room-is-abac-managed","messagePattern":"error-room-is-abac-managed","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/ee/server/hooks/abac/beforeAddUserToRoom.ts","lineNumber":18,"sourceCode":"import { Abac } from '@rocket.chat/core-services';\nimport { License } from '@rocket.chat/license';\n\nimport { beforeAddUserToRoom } from '../../../../server/hooks/rooms/beforeAddUserToRoom';\nimport { settings } from '../../../../server/settings';\n\nbeforeAddUserToRoom.patch(async (prev, users, room, actor) => {\n\tawait prev(users, room, actor);\n\n\tconst validUsers = users.filter(Boolean);\n\t// No need to check ABAC when theres no users or when room is not private or when room is not ABAC managed\n\tif (!validUsers.length || room.t !== 'p' || !room?.abacAttributes?.length) {\n\t\treturn;\n\t}\n\n\t// Throw error (prevent add) if ABAC is disabled (setting, license) but room is ABAC managed\n\tif (!settings.get('ABAC_Enabled') || !License.hasModule('abac')) {\n\t\tthrow new Error('error-room-is-abac-managed');\n\t}\n\n\tawait Abac.checkUsernamesMatchAttributes(validUsers as string[], room.abacAttributes, room);\n});\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/hooks/abac/beforeAddUserToRoom.ts#L1-L23","documentation":"Thrown by the `beforeAddUserToRoom` ABAC hook when a room is private (`t === 'p'`) AND has `abacAttributes` set, but ABAC is not effectively enabled — either the `ABAC_Enabled` setting is off or the license lacks the `abac` module. This guard prevents silently bypassing attribute-based access control on a room that was configured to require it.","triggerScenarios":"Adding a user to a private room that has `abacAttributes` while `settings.get('ABAC_Enabled')` is falsy OR `License.hasModule('abac')` is false. The hook runs after the previous handler in the patch chain.","commonSituations":"License downgrade or expiry removed the ABAC module while ABAC-managed rooms still exist; an admin disabled `ABAC_Enabled` but did not migrate/clear `abacAttributes` off affected rooms; feature flag toggled off in error.","solutions":["Re-enable the `ABAC_Enabled` setting and ensure the license includes the `abac` module.","If ABAC is intentionally disabled, remove `abacAttributes` from the affected private rooms so they are no longer treated as ABAC-managed.","Verify the license is active and provisioned with the ABAC entitlement."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { settings } from '../../../../server/settings';\nimport { License } from '../../license/license';\n\nfunction abacEffectivelyEnabled(room: { t: string; abacAttributes?: unknown[] }): boolean {\n\tif (room.t !== 'p' || !room.abacAttributes?.length) return true; // not ABAC-managed\n\treturn settings.get('ABAC_Enabled') && License.hasModule('abac');\n}","typeGuard":"function isAbacManagedRoomError(e: unknown): boolean {\n\treturn e instanceof Error && e.message === 'error-room-is-abac-managed';\n}","tryCatchPattern":"try {\n\tawait beforeAddUserToRoom.run(users, room, actor);\n} catch (e) {\n\tif (e instanceof Error && e.message === 'error-room-is-abac-managed') {\n\t\t// room is ABAC-managed but ABAC is off — fix config or clear abacAttributes\n\t}\n\tthrow e;\n}","preventionTips":["Keep `ABAC_Enabled` and the `abac` license module active when ABAC-managed rooms exist.","Before disabling ABAC, clear `abacAttributes` from affected rooms.","Monitor license validity for the ABAC module."],"tags":["abac","license","rooms","security","ee"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}