RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Importing is not allowed

What it means

getImportProgress enforces `hasPermissionAsync(userId, 'run-import')`; users without it get error-action-not-allowed. The permission is admin-only on default installs. Note the error metadata string in the source says 'setupImporter' (a copy-paste artifact), but the failure is genuinely the run-import check in getImportProgress.

Source

Thrown at apps/meteor/server/meteor-methods/import/getImportProgress.ts:43

};

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getImportProgress(): IImportProgress;
	}
}

Meteor.methods<ServerMethods>({
	async getImportProgress() {
		methodDeprecationLogger.method('getImportProgress', '9.0.0', '/v1/getImportProgress');
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'getImportProgress');
		}

		if (!(await hasPermissionAsync(userId, 'run-import'))) {
			throw new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'setupImporter');
		}

		return executeGetImportProgress();
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant `run-import` to the caller's role, or call as admin
  2. When triaging logs, search for 'Importing is not allowed' rather than trusting the 'setupImporter' metadata in this method
  3. If the caller only needs to view operations, use getLatestImportOperations (view-import-operations) instead

Example fix

// before
Meteor.call('getImportProgress', cb); // error-action-not-allowed for non-admin

// after
const canImport = usePermission('run-import');
if (canImport) Meteor.call('getImportProgress', cb);
// read-only viewers use: Meteor.call('getLatestImportOperations', cb);
Defensive patterns

Strategy: validation

Validate before calling

const canRunImport = usePermission('run-import');
if (canRunImport) Meteor.call('getImportProgress', cb);
// read-only users: use getLatestImportOperations (view-import-operations) instead

Try / catch

Meteor.call('getImportProgress', (err, p) => {
  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {
    // note: this method's error metadata says 'setupImporter' — search by message, not method name
  }
});

Prevention

When it happens

Trigger: A logged-in user whose roles lack `run-import` calls `Meteor.call('getImportProgress')`. The error's third argument reports 'setupImporter' instead of 'getImportProgress', which can mislead log searches.

Common situations: Non-admin roles used for import monitoring; searching logs for the wrong method name because of the metadata quirk; assuming view-import-operations suffices for progress polling (it does not — this method wants run-import).

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/cf4f5482fa20348f. Report an issue: GitHub.