{"record":{"id":"48be4a7f6bbc03f9","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-48be4a","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/storage-s3/src/generateUploadInstructions.ts","lineNumber":36,"sourceCode":"export const generateUploadInstructions = ({\n  access,\n  acl,\n  bucket,\n  collectionPrefix,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    let filesizeLimit = req.payload.config.upload.limits?.fileSize\n\n    if (filesizeLimit === Infinity) {\n      filesizeLimit = undefined\n    }\n\n    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const signableHeaders = new Set<string>()","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/storage-s3/src/generateUploadInstructions.ts#L18-L54","documentation":"Thrown as Forbidden (HTTP 403) by the S3 storage adapter's generateUploadInstructions generator. It fires when overrideAccess is falsy and either the configured access callback denies the request, or no access callback is set and req.user is absent. This gates the generation of presigned client-upload URLs.","triggerScenarios":"A client requests upload instructions (presigned URL) without overrideAccess, and either a custom access function returns false or there is no access function and the user is not logged in.","commonSituations":"Frontend directly calling generateUploadInstructions without forwarding the auth token; a server-to-server path forgot to set overrideAccess: true; access policy returns false for the user's role; expired session.","solutions":["Forward the user's authentication token/cookie when the client requests upload instructions.","For trusted server-side generation, pass overrideAccess: true in the generateUploadInstructions args.","Provide an `access` callback to the S3 adapter matching the intended client-upload policy.","Verify the logged-in user's role satisfies the collection's create access."],"exampleFix":"// before\nconst instructions = await collection.upload({\n  data: { filename },\n  file,\n  // user not attached → Forbidden\n})\n\n// after — trusted server context\nconst instructions = await generateUploadInstructions({\n  collectionSlug: 'media',\n  filename,\n  overrideAccess: true,\n  req,\n})","handlingStrategy":"validation","validationCode":"function canRequestUploadInstructions(args: {\n  overrideAccess?: boolean\n  user?: unknown\n  accessResult?: boolean\n}): boolean {\n  return Boolean(args.overrideAccess || args.user || args.accessResult)\n}\n\nif (!canRequestUploadInstructions({ overrideAccess, user: req.user })) {\n  throw new Error('Authentication required to request upload instructions')\n}","typeGuard":"import { Forbidden } from 'payload'\n\nfunction isForbiddenError(err: unknown): err is Forbidden {\n  return err instanceof Forbidden\n}","tryCatchPattern":"try {\n  instructions = await generateUploadInstructions({ collectionSlug, filename, req })\n} catch (err) {\n  if (err instanceof Forbidden) {\n    // prompt re-auth or surface 'no permission'\n  }\n  throw err\n}","preventionTips":["Forward the auth token/cookie whenever the client requests upload instructions.","Use overrideAccess: true only in trusted server contexts.","Configure an `access` callback that mirrors the intended client-upload policy."],"tags":["s3-storage","upload","access-control","forbidden","auth"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}