{"record":{"id":"f5b8401fa49036c1","repo":"RocketChat/Rocket.Chat","slug":"error-not-authorized-f5b840","errorCode":"error-not-authorized","errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/platform/cloud.ts","lineNumber":54,"sourceCode":"}\n\nMeteor.methods<ServerMethods>({\n\t/**\n\t * @deprecated this method is deprecated and will be removed soon.\n\t * Prefer using cloud.registrationStatus rest api.\n\t */\n\tasync 'cloud:checkRegisterStatus'() {\n\t\tmethodDeprecationLogger.method('cloud:checkRegisterStatus', '9.0.0', '/v1/cloud.registrationStatus');\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'cloud:checkRegisterStatus',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(uid, 'manage-cloud'))) {\n\t\t\tthrow new Meteor.Error('error-not-authorized', 'Not authorized', {\n\t\t\t\tmethod: 'cloud:checkRegisterStatus',\n\t\t\t});\n\t\t}\n\n\t\treturn retrieveRegistrationStatus();\n\t},\n\tasync 'cloud:getWorkspaceRegisterData'() {\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'cloud:getWorkspaceRegisterData',\n\t\t\t});\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(uid, 'manage-cloud'))) {\n\t\t\tthrow new Meteor.Error('error-not-authorized', 'Not authorized', {\n\t\t\t\tmethod: 'cloud:getWorkspaceRegisterData',","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/platform/cloud.ts#L36-L72","documentation":"cloud:checkRegisterStatus requires the 'manage-cloud' permission; a logged-in user without it gets error-not-authorized. Cloud registration endpoints are admin-only because they expose and change workspace registration state.","triggerScenarios":"A logged-in non-admin calling 'cloud:checkRegisterStatus'; a cloud-status widget running under a regular user's session.","commonSituations":"Admin UI opened by users whose roles lack manage-cloud; permission removed during role consolidation; scripts using service accounts without cloud permissions.","solutions":["Grant 'manage-cloud' to the calling user's role (normally Admin only)","Gate cloud-status UI and actions behind a manage-cloud permission check","Use a properly permissioned account for automation that reads cloud status"],"exampleFix":"// before\nMeteor.call('cloud:checkRegisterStatus');\n\n// after\nif (hasPermission(uid, 'manage-cloud')) {\n  const status = await Meteor.callAsync('cloud:checkRegisterStatus');\n}","handlingStrategy":"validation","validationCode":"if (hasPermission(Meteor.userId(), 'manage-cloud')) {\n  const status = await Meteor.callAsync('cloud:checkRegisterStatus');\n}","typeGuard":"const isNotAuthorized = (e: unknown): e is Meteor.Error =>\n  typeof e === 'object' && e !== null && (e as { error?: string }).error === 'error-not-authorized';","tryCatchPattern":"try {\n  await Meteor.callAsync('cloud:checkRegisterStatus');\n} catch (e) {\n  if (isNotAuthorized(e)) {\n    hideCloudPanels(); // role issue — no retry\n    return;\n  }\n  throw e;\n}","preventionTips":["Show cloud management UI only to manage-cloud holders","Keep manage-cloud on the admin role","Use permissioned service accounts for automation touching cloud endpoints"],"tags":["rocket-chat","meteor","permissions","cloud","authorization"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}