RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Importing is not allowed

What it means

getImportFileData checks `hasPermissionAsync(userId, 'run-import')` before doing work and throws error-action-not-allowed when the logged-in user lacks that permission. On a default install `run-import` is granted only to the admin role (see server/lib/authorization/constant/permissions.ts), so any non-admin caller is rejected.

Source

Thrown at apps/meteor/server/meteor-methods/import/getImportFileData.ts:83

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getImportFileData(): IImporterSelection | { waiting: true };
	}
}

Meteor.methods<ServerMethods>({
	async getImportFileData() {
		methodDeprecationLogger.method('getImportFileData', '9.0.0', '/v1/getImportFileData');
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'getImportFileData');
		}

		if (!(await hasPermissionAsync(userId, 'run-import'))) {
			throw new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'getImportFileData');
		}

		return executeGetImportFileData();
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant `run-import` to the caller's role under Administration > Permissions (or make the call as an admin)
  2. If using the REST API, authenticate with a user/token whose role has run-import (the /v1/import endpoints declare permissionsRequired: ['run-import'])
  3. Hide the import UI client-side with a permission check so the call is never attempted

Example fix

// before
Meteor.call('getImportFileData', cb); // error-action-not-allowed for non-admin

// after — gate the call on the permission (client)
const canImport = usePermission('run-import');
if (canImport) Meteor.call('getImportFileData', cb);
Defensive patterns

Strategy: validation

Validate before calling

const canRunImport = usePermission('run-import');
if (!canRunImport) {
  // hide/disable the import screen — never call getImportFileData
}

Try / catch

Meteor.call('getImportFileData', (err, data) => {
  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {
    // show 'you need run-import permission' — do not retry
  }
});

Prevention

When it happens

Trigger: A logged-in non-admin user calls `Meteor.call('getImportFileData')` while their roles do not include `run-import`; also occurs after an admin deliberately removed run-import from a custom role.

Common situations: Building an import UI for support-staff roles without granting run-import; using a bot/service account whose role lacks the permission; assuming import permissions follow workspace membership instead of the permission matrix.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/16e91c7d5b8f6056. Report an issue: GitHub.