{"record":{"id":"6a322d234148833b","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-6a322d","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/storage-gcs/src/generateUploadInstructions.ts","lineNumber":32,"sourceCode":"\nexport const generateUploadInstructions = ({\n  access,\n  bucket,\n  collectionPrefix,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const [url] = await getStorageClient()\n      .bucket(bucket)\n      .file(fileKey)\n      .getSignedUrl({\n        action: 'write',\n        contentType: mimeType,\n        expires: Date.now() + 60 * 60 * 5,","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/storage-gcs/src/generateUploadInstructions.ts#L14-L50","documentation":"Thrown by the GCS storage adapter's `generateUploadInstructions` as a `Forbidden(req.t)` ('You are not allowed to perform this action.') when `overrideAccess` is false and either the configured `access` function returns false OR there is no `access` function and no `req.user`. It guards issuance of the signed write URL for staged uploads to Google Cloud Storage. Identical contract to the Azure adapter's check.","triggerScenarios":"An anonymous request to generate upload instructions for a GCS-backed upload collection; a logged-in user who fails the adapter's `access({ collectionSlug, req })` check; server-side call that omits both `overrideAccess` and an authenticated request.","commonSituations":"Public upload form without a session; `access` predicate restricted to a role the user lacks; server-to-server upload forgetting `overrideAccess: true` or a user-bearing `req`; switching a collection from local to GCS storage without re-checking access.","solutions":["Ensure the request carries an authenticated user that satisfies the adapter's `access` function","For trusted server-side calls, pass `overrideAccess: true`","Correct the `access` predicate if the current user should be permitted","For intended public uploads, configure an `access` function that returns true for that collection"],"exampleFix":"// before — anonymous server call\nawait payload.create({ collection: 'media', data, req: emptyReq })\n// after\nawait payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })","handlingStrategy":"validation","validationCode":"// Server-side: pass an authenticated req or overrideAccess when generating upload instructions\nawait payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })","typeGuard":null,"tryCatchPattern":"const res = await fetch(uploadInstructionsUrl, { credentials: 'include' })\nif (res.status === 403) {\n  // anonymous or unauthorized — authenticate then retry\n  await relogin()\n}","preventionTips":["Authenticate clients before issuing GCS upload instructions","Pass `overrideAccess: true` for trusted server-to-server uploads with an authenticated request","Keep the adapter's `access` function aligned with the intended tenant/role policy"],"tags":["storage-gcs","authentication","forbidden","file-upload","authorization"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}