RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Importing is not allowed

What it means

startImport requires `run-import`; users without the permission get error-action-not-allowed before executeStartImport runs. The permission defaults to the admin role only, mirroring every other mutating import method.

Source

Thrown at apps/meteor/server/meteor-methods/import/startImport.ts:49

		startImport(params: StartImportParamsPOST): void;
	}
}

Meteor.methods<ServerMethods>({
	async startImport({ input }: StartImportParamsPOST) {
		methodDeprecationLogger.method('startImport', '9.0.0', '/v1/startImport');
		if (!input || typeof input !== 'object' || !isStartImportParamsPOST({ input })) {
			throw new Meteor.Error(`Invalid Selection data provided to the importer.`);
		}

		const userId = Meteor.userId();
		// Takes name and object with users / channels selected to import
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'startImport');
		}

		if (!(await hasPermissionAsync(userId, 'run-import'))) {
			throw new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'startImport');
		}

		return executeStartImport({ input }, userId);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant run-import to the caller's role or run as admin
  2. Disable/gate the Start Import button with a permission check so the method is never invoked
  3. For REST, use a token belonging to a role with run-import

Example fix

// before
Meteor.call('startImport', { input }, cb); // error-action-not-allowed

// after
const canImport = usePermission('run-import');
if (canImport) Meteor.call('startImport', { input }, cb);
Defensive patterns

Strategy: validation

Validate before calling

const canRunImport = usePermission('run-import');
if (canRunImport) Meteor.call('startImport', { input }, cb);

Try / catch

Meteor.call('startImport', { input }, (err) => {
  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {
    // needs run-import — surface permission message, no retry
  }
});

Prevention

When it happens

Trigger: A logged-in non-admin calls `Meteor.call('startImport', ...)`; or run-import was revoked from a custom role that previously could import.

Common situations: Delegating import execution to non-admin staff without granting run-import; token/service accounts created without the permission; permission matrix changes after a role audit.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/fa2e5b7f47ccf5c1. Report an issue: GitHub.