{"record":{"id":"eba14e16db414a14","repo":"RocketChat/Rocket.Chat","slug":"not-allowed-eba14e","errorCode":"not-allowed","errorMessage":"not-allowed","messagePattern":"not-allowed","errorType":"error_code","errorClass":"MeteorError","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/modules/streamer/streamer.module.ts","lineNumber":187,"sourceCode":"\n\t\tif (typeof options === 'boolean') {\n\t\t\tuseCollection = options;\n\t\t} else {\n\t\t\tif (options.useCollection) {\n\t\t\t\tuseCollection = options.useCollection;\n\t\t\t}\n\n\t\t\tif (options.args) {\n\t\t\t\targs = options.args;\n\t\t\t}\n\t\t}\n\n\t\tif (eventName.length === 0) {\n\t\t\tthrow new MeteorError('invalid-event-name');\n\t\t}\n\n\t\tif ((await this.isReadAllowed(publication, eventName, args)) !== true) {\n\t\t\tthrow new MeteorError('not-allowed');\n\t\t}\n\n\t\t// after meteor 3.4.1 immediately after a disconnection session becomes null (which is not wrong)\n\t\t// we were just not counting on this, session is _session so we actually should not use it\n\t\t// now after any await, the session can potentially be null, so we need to check for that\n\t\tif (!Streamer.isPublicationActive(publication)) {\n\t\t\t// if the client is disconnected, we don't want to do anything, it will not have an disconnect event to undo anymore\n\t\t\tthrow new MeteorError('publication-client-disconnected');\n\t\t}\n\n\t\tconst subscription = {\n\t\t\tsubscription: publication,\n\t\t\teventName,\n\t\t};\n\n\t\tthis.addSubscription(subscription, eventName);\n\n\t\tpublication.onStop(() => {","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/modules/streamer/streamer.module.ts#L169-L205","documentation":"After the event-name check, the streamer evaluates the stream's read rule via isReadAllowed; Rocket.Chat registers per-stream ACLs (e.g. stream-notify-user events must belong to the connected user, room streams require access). Any result other than exactly true throws Meteor.Error 'not-allowed' and the subscription is refused.","triggerScenarios":"Subscribing to a stream event the rule set denies: another user's stream-notify-user/<otherUserId>/... events, a room stream for a room the user is not in, or streams gated by role or server setting.","commonSituations":"A DDP session kept open across a re-login still holding subscriptions keyed to the previous user; custom clients trying to listen to global or foreign streams; an admin tightening stream permissions while sessions were live.","solutions":["Build event names from the currently connected user (Meteor.userId()) and re-subscribe after every login/logout","For room streams, join the room first or subscribe only from within it","Read the stream's server-side rule to see exactly which predicate failed","If access should be granted, ask the server admin to extend the stream's allow-read rule"],"exampleFix":"// before\nMeteor.subscribe('stream-notify-user', `${otherUserId}/notification`, false); // -> not-allowed\n\n// after\nMeteor.subscribe('stream-notify-user', `${Meteor.userId()}/notification`, false);","handlingStrategy":"try-catch","validationCode":"const buildOwnUserEvent = (event: string): string => `${Meteor.userId()}/${event}`;\nconst buildOwnRoomEvent = (rid: string): string => rid; // and only subscribe to rooms you have a subscription for","typeGuard":null,"tryCatchPattern":"Meteor.subscribe('stream-notify-user', eventName, false, {\n  onError(error) {\n    if (error instanceof Meteor.Error && error.error === 'not-allowed') {\n      // user has no read access to this stream; drop the subscription and surface it in UI state\n      onStreamAccessDenied(eventName);\n    }\n  },\n});","preventionTips":["Build event names from the currently connected user and re-subscribe after every login/logout","Only subscribe to room streams for rooms present in the user's subscriptions","Read the stream's server-side read rule before assuming access"],"tags":["ddp","meteor","streamer","permissions","acl"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}