m1k1o/neko · error

ErrIsNotAllowedToHost

ErrIsNotAllowedToHost

Error message

is not allowed to host

What it means

The declared sentinel ErrIsNotAllowedToHost in server/internal/websocket/handler/control.go is returned by controlRelease (and reachable via controlRequest paths) when the session's profile lacks CanHost or private mode is enabled for the session. In private mode, hosting is restricted, and users without the CanHost profile flag may never take or manipulate host control.

Source

Thrown at server/internal/websocket/handler/control.go:13

package handler

import (
	"errors"

	"github.com/m1k1o/neko/server/pkg/types"
	"github.com/m1k1o/neko/server/pkg/types/event"
	"github.com/m1k1o/neko/server/pkg/types/message"
	"github.com/m1k1o/neko/server/pkg/xorg"
)

var (
	ErrIsNotAllowedToHost = errors.New("is not allowed to host")
	ErrIsNotTheHost       = errors.New("is not the host")
	ErrIsAlreadyTheHost   = errors.New("is already the host")
	ErrIsAlreadyHosted    = errors.New("is already hosted")
)

func (h *MessageHandlerCtx) controlRelease(session types.Session) error {
	if !session.Profile().CanHost || session.PrivateModeEnabled() {
		return ErrIsNotAllowedToHost
	}

	if !session.IsHost() {
		return ErrIsNotTheHost
	}

	h.desktop.ResetKeys()
	session.ClearHost()

	return nil

View on GitHub (pinned to b0f01cedea)

Solutions

1. Grant CanHost: true to the member profile if the user should be able to host.
2. Disable private mode for the room if hosting should be open to participants.
3. Have an admin/host perform the release instead of the restricted session.
4. Hide control buttons client-side when the profile lacks CanHost.

Example fix

// before
profile := types.MemberProfile{ CanWatch: true }
// after
profile := types.MemberProfile{ CanWatch: true, CanHost: true }

// client-side, before sending control release/request
if (!session.profile.canHost || session.privateMode) {
  console.warn('this session is not allowed to host')
  return
}

function canHost(session) {
  return session?.profile?.canHost === true
}

try {
  socket.emit('control/release')
} catch (e) {
  if (e.message === 'is not allowed to host') hideHostControls()
}

When it happens

Trigger: Sending a control release/request message from a session where session.Profile().CanHost is false, or where session.PrivateModeEnabled() is true and the session is not permitted to host.

Common situations: View-only members attempting to grab control; private-mode rooms where the operator did not grant CanHost to participants; a client UI showing a 'release control' button even when the user never had hosting rights.

Related errors

• cannot access clipboard
• is not the host
• ErrIsNotTheHost
• ErrIsAlreadyTheHost
• ErrIsAlreadyHosted

AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01). Data as JSON: /api/errors/236ad55228ad3478. Report an issue: GitHub.