RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Importing is not allowed

What it means

uploadImportFile checks `hasPermissionAsync(userId, 'run-import')` and throws error-action-not-allowed when missing. Starting an import (which uploading a file does) is admin-only by default.

Source

Thrown at apps/meteor/server/meteor-methods/import/uploadImportFile.ts:76

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		uploadImportFile(binaryContent: string, contentType: string, fileName: string, importerKey: string): void;
	}
}

Meteor.methods<ServerMethods>({
	async uploadImportFile(binaryContent, contentType, fileName, importerKey) {
		methodDeprecationLogger.method('uploadImportFile', '9.0.0', '/v1/uploadImportFile');
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'uploadImportFile');
		}

		if (!(await hasPermissionAsync(userId, 'run-import'))) {
			throw new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'uploadImportFile');
		}

		await executeUploadImportFile(userId, binaryContent, contentType, fileName, importerKey);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant run-import to the caller's role or upload as admin
  2. Gate the upload UI on the permission client-side
  3. For REST, ensure the token's role has run-import (all /v1/import upload endpoints require it)

Example fix

// before
Meteor.call('uploadImportFile', bin, 'text/csv', 'users.csv', 'csv', cb); // error-action-not-allowed

// after
const canImport = usePermission('run-import');
if (canImport) Meteor.call('uploadImportFile', bin, 'text/csv', 'users.csv', 'csv', cb);
Defensive patterns

Strategy: validation

Validate before calling

const canRunImport = usePermission('run-import');
if (canRunImport) Meteor.call('uploadImportFile', bin, contentType, fileName, key, cb);

Try / catch

Meteor.call('uploadImportFile', bin, type, name, key, (err) => {
  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {
    // caller lacks run-import — show permission message
  }
});

Prevention

When it happens

Trigger: A logged-in user without run-import uploads an import file via `Meteor.call('uploadImportFile', ...)`.

Common situations: Non-admin staff given the import UI without the permission; service accounts missing the role; workspace policies that revoked run-import from all but a small admin group.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/bb2a734e19ae6234. Report an issue: GitHub.