RocketChat/Rocket.Chat · error · Meteor.Error

not_authorized

not_authorized

Error message

User not authorized

What it means

After the login check, getLatestImportOperations requires `view-import-operations`; without it the method throws not_authorized. This permission is granted only to the admin role by default, making import history admin-only out of the box.

Source

Thrown at apps/meteor/server/meteor-methods/import/getLatestImportOperations.ts:38

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getLatestImportOperations(): IImport[];
	}
}

Meteor.methods<ServerMethods>({
	async getLatestImportOperations() {
		methodDeprecationLogger.method('getLatestImportOperations', '9.0.0', '/v1/getLatestImportOperations');
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'getLatestImportOperations');
		}

		if (!(await hasPermissionAsync(userId, 'view-import-operations'))) {
			throw new Meteor.Error('not_authorized', 'User not authorized', 'getLatestImportOperations');
		}

		return executeGetLatestImportOperations();
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Grant `view-import-operations` to the caller's role in Administration > Permissions
  2. Call as an admin user
  3. For REST, use a token whose role has view-import-operations (the endpoint declares permissionsRequired: ['view-import-operations'])

Example fix

// before
Meteor.call('getLatestImportOperations', cb); // not_authorized

// after
const canViewOps = usePermission('view-import-operations');
if (canViewOps) Meteor.call('getLatestImportOperations', cb);
Defensive patterns

Strategy: validation

Validate before calling

const canView = usePermission('view-import-operations');
if (canView) Meteor.call('getLatestImportOperations', cb);

Try / catch

Meteor.call('getLatestImportOperations', (err, ops) => {
  if (err && (err as Meteor.Error).error === 'not_authorized') {
    // missing view-import-operations — hide history, do not retry
  }
});

Prevention

When it happens

Trigger: A logged-in user without `view-import-operations` calls `Meteor.call('getLatestImportOperations')` — e.g. a custom auditor/support role that was never granted the permission.

Common situations: Extending import screens to non-admin roles; using a service account whose role only has run-import; forgetting that this method checks a different permission (view-import-operations) than the run/import methods.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9a53203bcb26cddc. Report an issue: GitHub.