{"record":{"id":"e80f635b02f7fa36","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-e80f63","errorCode":"error-not-allowed","errorMessage":"Not allowed","messagePattern":"Not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/removeOAuthService.ts","lineNumber":81,"sourceCode":"\t\t}\n\t});\n};\n\nMeteor.methods<ServerMethods>({\n\tasync removeOAuthService(name) {\n\t\tmethodDeprecationLogger.method('removeOAuthService', '9.0.0', '/v1/settings.removeCustomOAuth');\n\t\tcheck(name, String);\n\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'removeOAuthService',\n\t\t\t});\n\t\t}\n\n\t\tif ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'removeOAuthService' });\n\t\t}\n\n\t\tawait removeCustomOAuthSettings(name);\n\t},\n});\n","sourceCodeStart":63,"sourceCodeEnd":87,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/removeOAuthService.ts#L63-L87","documentation":"After the login check, removeOAuthService requires the 'add-oauth-service' permission and throws 'error-not-allowed' when the caller does not hold it. Removing a custom OAuth service deletes its settings, so it is gated on the same permission as adding one.","triggerScenarios":"A logged-in user whose roles do not include 'add-oauth-service' calls removeOAuthService(name).","commonSituations":"A role with view-only settings access attempts removal; permission grants pruned during a security review.","solutions":["Grant 'add-oauth-service' to the caller's role in the admin Permissions screen","Perform the removal from a full admin account","Verify effective permissions before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client: gate the remove action on the same permission the server checks\nconst canRemove = useHasPermission('add-oauth-service');\nif (!canRemove) { /* hide/disable the remove action */ }","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('removeOAuthService', name);\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-not-allowed') {\n    // caller lacks 'add-oauth-service': grant it or run as admin\n  }\n}","preventionTips":["Gate remove actions on the 'add-oauth-service' permission in the UI","Confirm the permission survived role migrations before delegating OAuth management"],"tags":["authorization","permissions","oauth","settings"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}