{"record":{"id":"ef414a934995bfcf","repo":"RocketChat/Rocket.Chat","slug":"error-not-authorized-ef414a","errorCode":"error-not-authorized","errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/crowd.ts","lineNumber":28,"sourceCode":"declare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tcrowd_test_connection(): { message: TranslationKey; params: string[] };\n\t\tcrowd_sync_users(): { message: string; params: string[] };\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync crowd_test_connection() {\n\t\tconst user = await Meteor.userAsync();\n\t\tif (!user) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'crowd_test_connection',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(user, 'test-admin-options'))) {\n\t\t\tthrow new Meteor.Error('error-not-authorized', 'Not authorized', {\n\t\t\t\tmethod: 'crowd_test_connection',\n\t\t\t});\n\t\t}\n\n\t\tif (settings.get('CROWD_Enable') !== true) {\n\t\t\tthrow new Meteor.Error('crowd_disabled');\n\t\t}\n\n\t\ttry {\n\t\t\tconst crowd = new CROWD();\n\t\t\tawait crowd.checkConnection();\n\n\t\t\treturn {\n\t\t\t\tmessage: 'Crowd_Connection_successful' as const,\n\t\t\t\tparams: [],\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tlogger.error({","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/crowd.ts#L10-L46","documentation":"crowd_test_connection checks the 'test-admin-options' permission for the logged-in user and throws 'error-not-authorized' when it is absent. Only roles allowed to test admin integration settings may run the Crowd connection test.","triggerScenarios":"A logged-in user whose roles do not include 'test-admin-options' triggers the test connection button or calls the method.","commonSituations":"A custom helpdesk role created without admin-test permissions; the permission was removed from the admin role during a permissions audit.","solutions":["Grant 'test-admin-options' to the caller's role in the admin Permissions screen","Run the test from an account that already holds the permission (default admin roles)","Verify the user's effective permissions before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client: only offer the test action to users who can test admin options\nconst canTest = useHasPermission('test-admin-options');\nif (!canTest) { /* hide/disable the Test Connection button */ }","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('crowd_test_connection');\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-not-authorized') {\n    // show 'not allowed' feedback instead of a raw error\n  }\n}","preventionTips":["Gate admin-panel integration tests behind hasPermission('test-admin-options')","When creating custom admin-ish roles, copy the full permission set of a stock admin role first"],"tags":["authorization","permissions","crowd","admin"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}