{"record":{"id":"a873eb890bf2b1af","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-a873eb","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/deleteUser.ts","lineNumber":55,"sourceCode":"\t\tthrow new Meteor.Error('error-action-not-allowed', 'Leaving the app without admins is not allowed', {\n\t\t\tmethod: 'deleteUser',\n\t\t\taction: 'Remove_last_admin',\n\t\t});\n\t}\n\n\tawait deleteUser(userId, confirmRelinquish, fromUserId);\n\n\treturn true;\n};\n\nMeteor.methods<ServerMethods>({\n\tasync deleteUser(userId, confirmRelinquish = false) {\n\t\tmethodDeprecationLogger.method('deleteUser', '9.0.0', '/v1/users.delete');\n\t\tcheck(userId, String);\n\n\t\tconst uid = Meteor.userId();\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\t\tmethod: 'deleteUser',\n\t\t\t});\n\t\t}\n\n\t\tif ((await hasPermissionAsync(uid, 'delete-user')) !== true) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\t\tmethod: 'deleteUser',\n\t\t\t});\n\t\t}\n\n\t\treturn executeDeleteUser(uid, userId, confirmRelinquish);\n\t},\n});\n","sourceCodeStart":37,"sourceCodeEnd":69,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/deleteUser.ts#L37-L69","documentation":"The `deleteUser` Meteor method throws `error-not-allowed` when `Meteor.userId()` is null — there is no authenticated DDP session. This is the first gate in the method wrapper, before the `delete-user` permission check and before `executeDeleteUser` runs. The method is deprecated since 9.0.0 in favor of REST `DELETE /v1/users.delete`.","triggerScenarios":"Calling `Meteor.call('deleteUser', userId, confirmRelinquish?)` while unauthenticated: logged-out tab, expired resume token after reconnect, or server-side invocation without a user context.","commonSituations":"Admin UI actions fired from stale sessions; scripts calling the deprecated DDP method without login; token invalidation during long-running sessions.","solutions":["Authenticate first; only call `deleteUser` when `Meteor.userId()` is set.","Prefer the REST endpoint `DELETE /api/v1/users.delete` with an auth token + `delete-user` permission.","Re-run the login flow on reconnect and retry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!Meteor.userId()) {\n  return; // require an authenticated session before deleting users\n}\nawait Meteor.callAsync('deleteUser', userId, confirmRelinquish);","typeGuard":"const isAuthenticated = (): boolean => typeof Meteor.userId() === 'string';","tryCatchPattern":"try {\n  await Meteor.callAsync('deleteUser', userId);\n} catch (e: any) {\n  if (e?.error === 'error-not-allowed' && !Meteor.userId()) {\n    // first gate: no session. Re-authenticate and retry.\n  }\n}","preventionTips":["Only issue destructive method calls from authenticated sessions.","Prefer REST DELETE /v1/users.delete with tokens for automation.","Re-authenticate on reconnect before retrying user management operations."],"tags":["meteor","users","delete","authentication","deprecated"],"backgroundTag":"authentication-required","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}