{"record":{"id":"ce019a1d5873878e","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-ce019a","errorCode":"error-not-allowed","errorMessage":"Cannot change username for federated users or users in federated rooms","messagePattern":"Cannot change username for federated users or users in federated rooms","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/setUsername.ts","lineNumber":43,"sourceCode":"\tconst cursor = Subscriptions.findUserFederatedRoomIds(userId);\n\tconst hasAny = await cursor.hasNext();\n\tawait cursor.close();\n\treturn hasAny;\n};\n\nexport const setUsernameWithValidation = async (userId: string, username: string, joinDefaultChannelsSilenced?: boolean): Promise<void> => {\n\tif (!username) {\n\t\tthrow new Meteor.Error('error-invalid-username', 'Invalid username', { method: 'setUsername' });\n\t}\n\n\tconst user = await Users.findOneById(userId);\n\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setUsername' });\n\t}\n\n\tif (isUserNativeFederated(user) || (await isUserInFederatedRooms(userId))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Cannot change username for federated users or users in federated rooms', {\n\t\t\tmethod: 'setUsername',\n\t\t});\n\t}\n\n\tif (user.username && !settings.get('Accounts_AllowUsernameChange')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed');\n\t}\n\n\tif (user.username === username || (user.username && user.username.toLowerCase() === username.toLowerCase())) {\n\t\treturn;\n\t}\n\n\tif (!validateUsername(username)) {\n\t\tthrow new Meteor.Error(\n\t\t\t'username-invalid',\n\t\t\t`${_.escape(username)} is not a valid username, use only letters, numbers, dots, hyphens and underscores`,\n\t\t);\n\t}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/setUsername.ts#L25-L61","documentation":"setUsernameWithValidation refuses to rename federation-managed identities: the guard at setUsername.ts:42 fires when isUserNativeFederated(user) is true (account created by/for the Federation feature) or when Subscriptions.findUserFederatedRoomIds(userId) yields any room. The username is part of the cross-server federation address (user@server), so renaming would break remote addressing.","triggerScenarios":"Calling the setUsername method for a user who has joined at least one federated room on a workspace with Federation enabled, or for a native federated user (created via first contact from a remote instance). The guard applies to admins too.","commonSituations":"Federation enabled (Settings > Federation) and existing users later join federated channels; imported users accidentally flagged as federated; dev workspaces restored from federated production data. Every rename attempt re-runs the check.","solutions":["Hide the username-edit affordance for federated users instead of letting them hit the error","Have the user leave all federated rooms first, then retry the rename","If federation is not intentionally used, disable/remove the Federation feature so isUserInFederatedRooms no longer matches"],"exampleFix":"// before\nawait setUsernameWithValidation(userId, newUsername); // throws error-not-allowed for federated users\n\n// after\nif (isUserNativeFederated(user) || (await Subscriptions.findUserFederatedRoomIds(userId).hasNext())) {\n  throw new Meteor.Error('error-not-allowed', 'Username locked by federation');\n}\nawait setUsernameWithValidation(userId, newUsername);","handlingStrategy":"validation","validationCode":"import { isUserNativeFederated } from '@rocket.chat/core-typings';\nimport { Subscriptions } from '@rocket.chat/models';\n\nconst cursor = Subscriptions.findUserFederatedRoomIds(userId);\nconst inFederatedRoom = await cursor.hasNext();\nawait cursor.close();\nif (isUserNativeFederated(user) || inFederatedRoom) {\n  // skip the rename flow entirely\n}","typeGuard":null,"tryCatchPattern":"try {\n  await setUsernameWithValidation(userId, username);\n} catch (error) {\n  if (error instanceof Meteor.Error && error.error === 'error-not-allowed' && /federated/i.test(error.reason)) {\n    // show 'username locked by federation' message\n  } else {\n    throw error;\n  }\n}","preventionTips":["Gate the username-edit UI on the user's federation status","Check room federation flags before users join if usernames must stay mutable","Remember admins hit the same guard — it is not a permission problem"],"tags":["federation","username","authorization","meteor"],"backgroundTag":"operation-not-allowed","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}