{"record":{"id":"16e91c7d5b8f6056","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-16e91c","errorCode":"error-action-not-allowed","errorMessage":"Importing is not allowed","messagePattern":"Importing is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/import/getImportFileData.ts","lineNumber":83,"sourceCode":"\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tgetImportFileData(): IImporterSelection | { waiting: true };\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync getImportFileData() {\n\t\tmethodDeprecationLogger.method('getImportFileData', '9.0.0', '/v1/getImportFileData');\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', 'getImportFileData');\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(userId, 'run-import'))) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'getImportFileData');\n\t\t}\n\n\t\treturn executeGetImportFileData();\n\t},\n});\n","sourceCodeStart":65,"sourceCodeEnd":89,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/import/getImportFileData.ts#L65-L89","documentation":"getImportFileData checks `hasPermissionAsync(userId, 'run-import')` before doing work and throws error-action-not-allowed when the logged-in user lacks that permission. On a default install `run-import` is granted only to the admin role (see server/lib/authorization/constant/permissions.ts), so any non-admin caller is rejected.","triggerScenarios":"A logged-in non-admin user calls `Meteor.call('getImportFileData')` while their roles do not include `run-import`; also occurs after an admin deliberately removed run-import from a custom role.","commonSituations":"Building an import UI for support-staff roles without granting run-import; using a bot/service account whose role lacks the permission; assuming import permissions follow workspace membership instead of the permission matrix.","solutions":["Grant `run-import` to the caller's role under Administration > Permissions (or make the call as an admin)","If using the REST API, authenticate with a user/token whose role has run-import (the /v1/import endpoints declare permissionsRequired: ['run-import'])","Hide the import UI client-side with a permission check so the call is never attempted"],"exampleFix":"// before\nMeteor.call('getImportFileData', cb); // error-action-not-allowed for non-admin\n\n// after — gate the call on the permission (client)\nconst canImport = usePermission('run-import');\nif (canImport) Meteor.call('getImportFileData', cb);","handlingStrategy":"validation","validationCode":"const canRunImport = usePermission('run-import');\nif (!canRunImport) {\n  // hide/disable the import screen — never call getImportFileData\n}","typeGuard":null,"tryCatchPattern":"Meteor.call('getImportFileData', (err, data) => {\n  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {\n    // show 'you need run-import permission' — do not retry\n  }\n});","preventionTips":["Grant run-import to roles that must import (default: admin only)","Gate every import action behind a client-side permission check","Verify a service account's role includes run-import before scripting imports"],"tags":["rocket-chat","permissions","import","meteor-methods"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}