{"record":{"id":"9a53203bcb26cddc","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-9a5320","errorCode":"not_authorized","errorMessage":"User not authorized","messagePattern":"User not authorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/import/getLatestImportOperations.ts","lineNumber":38,"sourceCode":"\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tgetLatestImportOperations(): IImport[];\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync getLatestImportOperations() {\n\t\tmethodDeprecationLogger.method('getLatestImportOperations', '9.0.0', '/v1/getLatestImportOperations');\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', 'getLatestImportOperations');\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(userId, 'view-import-operations'))) {\n\t\t\tthrow new Meteor.Error('not_authorized', 'User not authorized', 'getLatestImportOperations');\n\t\t}\n\n\t\treturn executeGetLatestImportOperations();\n\t},\n});\n","sourceCodeStart":20,"sourceCodeEnd":44,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/import/getLatestImportOperations.ts#L20-L44","documentation":"After the login check, getLatestImportOperations requires `view-import-operations`; without it the method throws not_authorized. This permission is granted only to the admin role by default, making import history admin-only out of the box.","triggerScenarios":"A logged-in user without `view-import-operations` calls `Meteor.call('getLatestImportOperations')` — e.g. a custom auditor/support role that was never granted the permission.","commonSituations":"Extending import screens to non-admin roles; using a service account whose role only has run-import; forgetting that this method checks a different permission (view-import-operations) than the run/import methods.","solutions":["Grant `view-import-operations` to the caller's role in Administration > Permissions","Call as an admin user","For REST, use a token whose role has view-import-operations (the endpoint declares permissionsRequired: ['view-import-operations'])"],"exampleFix":"// before\nMeteor.call('getLatestImportOperations', cb); // not_authorized\n\n// after\nconst canViewOps = usePermission('view-import-operations');\nif (canViewOps) Meteor.call('getLatestImportOperations', cb);","handlingStrategy":"validation","validationCode":"const canView = usePermission('view-import-operations');\nif (canView) Meteor.call('getLatestImportOperations', cb);","typeGuard":null,"tryCatchPattern":"Meteor.call('getLatestImportOperations', (err, ops) => {\n  if (err && (err as Meteor.Error).error === 'not_authorized') {\n    // missing view-import-operations — hide history, do not retry\n  }\n});","preventionTips":["Grant view-import-operations to roles that audit imports","Do not confuse run-import (execute) with view-import-operations (read history)","Check the permission before rendering the history screen"],"tags":["rocket-chat","permissions","import","meteor-methods"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}