{"record":{"id":"dc498dbd6cebc88c","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-dc498d","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/messaging/stars/starMessage.ts","lineNumber":41,"sourceCode":"\t\t\tmethod: 'starMessage',\n\t\t\taction: 'Message_starring',\n\t\t});\n\t}\n\n\tconst subscription = await Subscriptions.findOneByRoomIdAndUserId(message.rid, user._id, {\n\t\tprojection: { _id: 1 },\n\t});\n\tif (!subscription) {\n\t\treturn false;\n\t}\n\tif (!(await Messages.findOneByRoomIdAndMessageId(message.rid, message._id))) {\n\t\treturn false;\n\t}\n\n\tconst room = await Rooms.findOneById(message.rid, { projection: { ...roomAccessAttributes, lastMessage: 1 } });\n\n\tif (!room) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'starMessage' });\n\t}\n\n\tif (!(await canAccessRoomAsync(room, { _id: user._id }))) {\n\t\tthrow new Meteor.Error('not-authorized', 'Not Authorized', { method: 'starMessage' });\n\t}\n\n\tif (isTheLastMessage(room, message)) {\n\t\tawait Rooms.updateLastMessageStar(room._id, user._id, message.starred);\n\t\tvoid notifyOnRoomChangedById(room._id);\n\t}\n\n\tawait Apps.self?.triggerEvent(AppEvents.IPostMessageStarred, message, user, message.starred);\n\n\tawait Messages.updateUserStarById(message._id, user._id, message.starred);\n\n\tvoid notifyOnMessageChange({\n\t\tid: message._id,\n\t});","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/messaging/stars/starMessage.ts#L23-L59","documentation":"Inside starMessage, after the subscription and message existence checks pass, the room is loaded with Rooms.findOneById; a null result throws Meteor.Error('error-not-allowed', 'Not allowed'). The user is subscribed and the message row exists, but the room document itself is gone - an inconsistent state pointing at orphaned data.","triggerScenarios":"Meteor.call('starMessage', ...) where message.rid points at a deleted room while the user's subscription row and the message row still exist - typically after partial deletions, interrupted cleanups, or migration artifacts.","commonSituations":"Imports/migrations leaving orphaned subscriptions and messages; direct database surgery that dropped rooms without cascading; replication lag in manual ops.","solutions":["Repair the data: remove subscription and message rows whose rid no longer resolves to a room","Re-run room deletion through server methods so the cascade completes","If it reproduces with a live room, inspect the message's rid for typos or corruption"],"exampleFix":"// before - stale rows keep the star UI alive, method throws\nMeteor.call('starMessage', { rid, _id: messageId, starred: true });\n\n// after - data repair (mongo shell): drop subscriptions orphaned by room deletion\n// db.subscriptions.find({ rid: { $nin: db.rooms.distinct('_id') } })\n//   .forEach(s => db.subscriptions.deleteOne({ _id: s._id }))","handlingStrategy":"try-catch","validationCode":"// Server-side guard before delegating\nconst room = await Rooms.findOneById(message.rid, { projections: { _id: 1 } });\nif (!room) {\n  return; // orphaned subscription/message - schedule data repair\n}\nawait starMessage(user, message);","typeGuard":null,"tryCatchPattern":"Meteor.call('starMessage', msg, (err) => {\n  if (err?.error === 'error-not-allowed' && err.details?.method === 'starMessage') {\n    flagRoomAsBroken(msg.rid); // hide room and alert admins about orphaned data\n  }\n});","preventionTips":["Always delete rooms through server methods so subscriptions and messages cascade","Audit for orphaned subscriptions/messages after bulk imports","Report room-missing on star as data corruption, not user error"],"tags":["starring","room-not-found","data-integrity","ddp-method"],"backgroundTag":"room-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}