{"record":{"id":"46cbaa811656430c","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-46cbaa","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/storage-vercel-blob/src/adapter.ts","lineNumber":58,"sourceCode":"    uploadInstructions: {\n      adminHandler: {\n        path: '@payloadcms/storage-vercel-blob/client#VercelBlobClientUploadHandler',\n      },\n      enabled: Boolean(clientUploads),\n      generate: async ({\n        collectionSlug,\n        docPrefix,\n        filename,\n        filesize,\n        mimeType,\n        overrideAccess,\n        req,\n      }) => {\n        if (\n          !overrideAccess &&\n          (clientUploadsAccess ? !(await clientUploadsAccess({ collectionSlug, req })) : !req.user)\n        ) {\n          throw new Forbidden(req.t)\n        }\n\n        const resolved = await resolveSignedURLKey({\n          collectionPrefix: prefix,\n          collectionSlug,\n          docPrefix,\n          filename,\n          req,\n          useCompositePrefixes,\n        })\n\n        return {\n          name: 'uploadToVercelBlob',\n          type: 'dispatch',\n          data: {\n            pathname: resolved.fileKey,\n            token: await generateClientTokenFromReadWriteToken({\n              addRandomSuffix,","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/storage-vercel-blob/src/adapter.ts#L40-L76","documentation":"Thrown as Forbidden (HTTP 403) by the Vercel Blob storage adapter when generating client upload instructions. Identical gate to the S3 adapter: overrideAccess falsy AND (clientUploadsAccess denies, or no clientUploadsAccess and req.user is null).","triggerScenarios":"Client requests Vercel Blob upload instructions without overrideAccess while unauthenticated, or while a configured clientUploadsAccess callback returns false.","commonSituations":"Unauthenticated frontend calling the upload-instructions endpoint; custom clientUploadsAccess callback that rejects valid users; server path missing overrideAccess; session expired between page load and upload start.","solutions":["Authenticate the request before generating Vercel Blob upload instructions.","Pass overrideAccess: true for trusted server-side generation.","Configure a clientUploadsAccess callback that matches the intended public/auth policy.","Ensure the auth token/cookie reaches the adapter invocation."],"exampleFix":"// before\nconst adapter = new VercelBlobAdapter({ token, collectionSlugs: ['media'] })\n// unauthenticated client → Forbidden\n\n// after\nconst adapter = new VercelBlobAdapter({\n  token,\n  collectionSlugs: ['media'],\n  clientUploadsAccess: async ({ req }) => Boolean(req.user),\n})\n// and on the server call:\n// generateUploadInstructions({ overrideAccess: true, req, ... })","handlingStrategy":"validation","validationCode":"function canRequestVercelBlobInstructions(args: {\n  overrideAccess?: boolean\n  user?: unknown\n  clientUploadsAccessResult?: boolean\n}): boolean {\n  return Boolean(args.overrideAccess || args.user || args.clientUploadsAccessResult)\n}\n\nif (!canRequestVercelBlobInstructions({ overrideAccess, user: req.user })) {\n  throw new Error('Authentication required to request Vercel Blob upload instructions')\n}","typeGuard":"import { Forbidden } from 'payload'\n\nfunction isForbidden(err: unknown): err is Forbidden {\n  return err instanceof Forbidden\n}","tryCatchPattern":"try {\n  await generateUploadInstructions({ collectionSlug, filename, req })\n} catch (err) {\n  if (err instanceof Forbidden) {\n    redirectToLogin()\n    return\n  }\n  throw err\n}","preventionTips":["Authenticate the request before generating Vercel Blob instructions.","Pass overrideAccess: true on trusted server paths.","Define a clientUploadsAccess callback matching your intended policy."],"tags":["vercel-blob","upload","access-control","forbidden","auth"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}