{"record":{"id":"3bdd7dc2d43f483d","repo":"Budibase/budibase","slug":"file-cannot-be-imported","errorCode":null,"errorMessage":"File cannot be imported","messagePattern":"File cannot be imported","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/sdk/workspace/backups/imports.ts","lineNumber":180,"sourceCode":"      for (let file of await fsp.readdir(dirPath)) {\n        const inputPath = join(dirPath, file)\n        if (!inputPath.endsWith(ATTACHMENT_DIRECTORY)) {\n          const stats = await fsp.lstat(inputPath)\n          if (stats.isFile() && inputPath.endsWith(\".enc\")) {\n            const outputPath = inputPath.replace(/\\.enc$/, \"\")\n            await encryption.decryptFile(inputPath, outputPath, password)\n            await fsp.rm(inputPath)\n          } else if (stats.isDirectory()) {\n            await processDirectory(inputPath)\n          }\n        }\n      }\n    }\n\n    await processDirectory(path)\n  } catch (err: any) {\n    if (err.message === \"incorrect header check\") {\n      throw new Error(\"File cannot be imported\")\n    }\n    throw err\n  }\n}\n\nexport function getGlobalDBFile(tmpPath: string) {\n  return fs.readFileSync(join(tmpPath, GLOBAL_DB_EXPORT_FILE), \"utf8\")\n}\n\nexport function getListOfAppsInMulti(tmpPath: string) {\n  return fs.readdirSync(tmpPath).filter(dir => dir !== GLOBAL_DB_EXPORT_FILE)\n}\n\nexport interface ImportAppOpts {\n  updateAttachmentColumns?: boolean\n  importObjStoreContents?: boolean\n  objectStoreAppId?: string\n  preserveLiteLLMConfig?: boolean","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/sdk/workspace/backups/imports.ts#L162-L198","documentation":"decryptFiles walks an extracted import directory and decrypts .enc files via zlib-based operations; the raw zlib failure \"incorrect header check\" (wrong password/corrupt data) is caught and re-thrown as the friendlier \"File cannot be imported\". It signals the package is not decryptable with what was supplied.","triggerScenarios":"importApp/extractProjectPackage called on an encrypted export while passing the wrong password (or none in a path that reaches decryption), so zlib inflate fails with \"incorrect header check\" which is mapped to this error.","commonSituations":"Importing an app export encrypted with a password the importer does not have; truncated/corrupted upload where the first bytes are no longer the zlib header; importing an unencrypted archive through the encrypted-import code path.","solutions":["Re-export the app and provide the exact password used at export time (template.file.password)","Verify the uploaded file is complete — compare file size/hash against the original export","Confirm you are importing the correct archive type through the correct endpoint","Test decryption locally (e.g. openssl/zlib) to confirm the password before calling the API"],"exampleFix":"// before\nawait importApp({ file: { path: p, type: \"text/plain\", password: \"wrongpass\" } })\n// after\nawait importApp({ file: { path: p, type: \"text/plain\", password: process.env.EXPORT_PASSWORD } })","handlingStrategy":"try-catch","validationCode":"// Pre-check: attempt local zlib header read\nexecSync(`head -c 2 ${archivePath} | xxd | grep -q 789c || echo 'bad zlib header'`)","typeGuard":null,"tryCatchPattern":"try {\n  await importApp(template)\n} catch (err: any) {\n  if (err.message === \"File cannot be imported\") {\n    // prompt for the correct password or obtain a clean export\n  } else {\n    throw err\n  }\n}","preventionTips":["Keep export passwords in a secrets manager","Validate checksums before import","Test decryption locally first"],"tags":["import","encryption","decryption"],"backgroundTag":"decryption-failed","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}