hcengineering/platform · error

Direct modifications of ratings are not allowed.

Error message

Direct modifications of ratings are not allowed.

What it means

The rating plugin's tx middleware intercepts CUD transactions and forbids any direct create/update/delete of rating.class.DocRating or rating.class.PersonRating documents. Ratings must be derived through the plugin's own flow (e.g. DocReaction transactions), so direct writes are rejected to keep aggregates consistent.

Source

Thrown at server-plugins/rating/src/index.ts:53

} from '@hcengineering/server-core'

/**
 * @public
 */
export const serverRatingId = 'server-rating' as Plugin

export class RatingMiddleware extends BaseMiddleware {
  static async create (ctx: MeasureContext, context: PipelineContext, next?: Middleware): Promise<Middleware> {
    return new RatingMiddleware(context, next)
  }

  async tx (ctx: MeasureContext, tx: Tx[]): Promise<TxMiddlewareResult> {
    for (const t of tx) {
      if (TxProcessor.isExtendsCUD(t._class)) {
        const cud = t as TxCUD<Doc>

        if (cud.objectClass === rating.class.DocRating || cud.objectClass === rating.class.PersonRating) {
          throw new Error('Direct modifications of ratings are not allowed.')
        }
        const c = rating.class.DocReaction
        if (cud.objectClass === c) {
          // Star/Like,Rate values could only be used one per user.
          switch (cud._class) {
            case core.class.TxCreateDoc:
              // Check for duplicate of like, rate value, Emojii
              await this.validateNewReaction(ctx, cud as TxCreateDoc<DocReaction>)
              break
            case core.class.TxUpdateDoc:
              // Disallow update for Emojii, Star, Like, Usefull
              // Allow only for RateValue
              await this.validateReactionUpdate(ctx, cud as TxUpdateDoc<DocReaction>)
              break
            case core.class.TxRemoveDoc:
              await this.validateReactionRemove(ctx, cud as TxRemoveDoc<DocReaction>)
              break
          }

View on GitHub (pinned to 63e28dc964)

Solutions

1. Stop writing DocRating/PersonRating directly; use the plugin's reaction API (create DocReaction via the supported flow).
2. Refactor migrations/seeds to produce reactions (or compute ratings offline) instead of inserting rating documents.
3. Remove or gate any client-side code that calls createDoc/updateDoc/removeDoc on rating classes.
4. If you truly need backfills, do them in a context that bypasses/registers before this middleware, understanding aggregate consistency is then your responsibility.

Example fix

// before
await client.createDoc(rating.class.DocRating, space, { ... })
// after
await client.createDoc(rating.class.DocReaction, space, {
  attachedTo: docId,
  reactionType: ReactionKind.Like,
  value: 1
})

const FORBIDDEN = [rating.class.DocRating, rating.class.PersonRating]
if (FORBIDDEN.includes(tx.objectClass)) {
  throw new Error('Use DocReaction instead of writing rating docs directly')
}

function isDirectRatingWrite(t: TxCUD<Doc>): boolean {
  return t.objectClass === rating.class.DocRating || t.objectClass === rating.class.PersonRating
}

try {
  await client.createDoc(target.class, space, data)
} catch (err) {
  if (/Direct modifications of ratings/.test(err.message)) {
    console.error('Rating docs are derived; use the DocReaction API')
  }
  throw err
}

When it happens

Trigger: Any TxCreateDoc/TxUpdateDoc/TxRemoveDoc with objectClass DocRating or PersonRating submitted through the transactor while this plugin is registered — e.g. application code or a client calling createDoc/updateDoc on those classes directly.

Common situations: Client UI writing rating docs directly, migration/import scripts copying rating rows, tests seeding rating documents via generic CRUD instead of the plugin API.

Related errors

• Duplicate emoji reaction is not allowed.
• Modifications of reaction type are not allowed.
• Model txes must target only core.space.Model
• Failed to load server config
• getDisplayMedia not supported

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/1541d0bb997fb9ac. Report an issue: GitHub.