{"record":{"id":"a7367cd5682583f4","repo":"RocketChat/Rocket.Chat","slug":"error-not-authorized-a7367c","errorCode":"error-not-authorized","errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/messages/deleteFileMessage.ts","lineNumber":51,"sourceCode":"\t\t\treturn deleteMessageValidatingPermission(msg, userId);\n\t\t}\n\n\t\tconst user = await Users.findOneById(userId, { projection: { username: 1 } });\n\t\tif (!user) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'deleteFileMessage',\n\t\t\t});\n\t\t}\n\n\t\tconst file = await Uploads.findOneById(fileID, { projection: { userId: 1, rid: 1, expiresAt: 1, uploadedAt: 1 } });\n\t\tif (!file) {\n\t\t\tthrow new Meteor.Error('error-invalid-file', 'Invalid file', {\n\t\t\t\tmethod: 'deleteFileMessage',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await Upload.canDeleteFile(user, file, null))) {\n\t\t\tthrow new Meteor.Error('error-not-authorized', 'Not authorized', {\n\t\t\t\tmethod: 'deleteFileMessage',\n\t\t\t});\n\t\t}\n\n\t\treturn FileUpload.getStore('Uploads').deleteById(fileID);\n\t},\n});\n","sourceCodeStart":33,"sourceCodeEnd":59,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/messages/deleteFileMessage.ts#L33-L59","documentation":"Thrown when Upload.canDeleteFile(user, file, null) resolves false — the authenticated user is not allowed to delete this upload. With msg=null the service (apps/meteor/server/services/upload/service.ts:60) allows deletion only if: the file has both userId and rid, AND either it is an unconfirmed upload (expiresAt set) owned by the caller with room access, OR the caller passes canDeleteMessageAsync against a synthetic message built from the file's owner/timestamp/room — i.e. ownership or room-level delete-message permission is required.","triggerScenarios":"A non-owner calls deleteFileMessage for another user's confirmed upload without moderator delete permissions; the caller lacks room access for file.rid; the upload's userId/rid fields are missing entirely (canDeleteFile returns false for incomplete records).","commonSituations":"UI shows a delete affordance based on stale or incomplete data; shared channels where users assume they can remove others' files; permission roles changed after the UI rendered; orphaned uploads missing userId/rid.","solutions":["Only offer deletion when the caller owns the file (file.userId === Meteor.userId()) or holds delete-message rights in that room","Grant or obtain the required room permission (e.g. moderator role with delete-message capability) and retry","Have the file owner or a room admin perform the deletion","Fix Uploads records that lack userId/rid — they can never be deleted through this path"],"exampleFix":"// before\nMeteor.call('deleteFileMessage', file._id); // shown for everyone's files\n\n// after\nconst canDelete = file.userId === Meteor.userId() || subscription?.roles?.includes('moderator');\nif (canDelete) {\n  Meteor.call('deleteFileMessage', file._id);\n}","handlingStrategy":"validation","validationCode":"const uid = Meteor.userId();\nconst canDelete = file.userId === uid\n  || Boolean(subscription?.roles?.includes('moderator'))\n  || Boolean(subscription?.roles?.includes('owner'));\nif (!canDelete) {\n  // do not show/enable the delete action at all\n}\nMeteor.call('deleteFileMessage', file._id);","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('deleteFileMessage', fileID);\n} catch (e) {\n  if ((e as Meteor.Error).error === 'error-not-authorized') {\n    // inform the user they cannot delete this file; disable the action\n  }\n}","preventionTips":["Derive the delete affordance from file ownership plus the user's subscription roles in that room","Re-evaluate permissions when rendering, not only on load — roles change server-side","Do not expose delete UI for other users' confirmed uploads unless the caller moderates the room"],"tags":["meteor","authorization","permissions","file-upload"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}