{"record":{"id":"bb2a734e19ae6234","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-bb2a73","errorCode":"error-action-not-allowed","errorMessage":"Importing is not allowed","messagePattern":"Importing is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/import/uploadImportFile.ts","lineNumber":76,"sourceCode":"\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tuploadImportFile(binaryContent: string, contentType: string, fileName: string, importerKey: string): void;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync uploadImportFile(binaryContent, contentType, fileName, importerKey) {\n\t\tmethodDeprecationLogger.method('uploadImportFile', '9.0.0', '/v1/uploadImportFile');\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', 'uploadImportFile');\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(userId, 'run-import'))) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'uploadImportFile');\n\t\t}\n\n\t\tawait executeUploadImportFile(userId, binaryContent, contentType, fileName, importerKey);\n\t},\n});\n","sourceCodeStart":58,"sourceCodeEnd":82,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/import/uploadImportFile.ts#L58-L82","documentation":"uploadImportFile checks `hasPermissionAsync(userId, 'run-import')` and throws error-action-not-allowed when missing. Starting an import (which uploading a file does) is admin-only by default.","triggerScenarios":"A logged-in user without run-import uploads an import file via `Meteor.call('uploadImportFile', ...)`.","commonSituations":"Non-admin staff given the import UI without the permission; service accounts missing the role; workspace policies that revoked run-import from all but a small admin group.","solutions":["Grant run-import to the caller's role or upload as admin","Gate the upload UI on the permission client-side","For REST, ensure the token's role has run-import (all /v1/import upload endpoints require it)"],"exampleFix":"// before\nMeteor.call('uploadImportFile', bin, 'text/csv', 'users.csv', 'csv', cb); // error-action-not-allowed\n\n// after\nconst canImport = usePermission('run-import');\nif (canImport) Meteor.call('uploadImportFile', bin, 'text/csv', 'users.csv', 'csv', cb);","handlingStrategy":"validation","validationCode":"const canRunImport = usePermission('run-import');\nif (canRunImport) Meteor.call('uploadImportFile', bin, contentType, fileName, key, cb);","typeGuard":null,"tryCatchPattern":"Meteor.call('uploadImportFile', bin, type, name, key, (err) => {\n  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {\n    // caller lacks run-import — show permission message\n  }\n});","preventionTips":["Gate upload UI on run-import","Remember uploading a file already starts an import — same permission as executing one","Check service-account roles before scripted uploads"],"tags":["rocket-chat","permissions","import","meteor-methods"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}