{"record":{"id":"ef889dc89f2cd0b3","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-ef889d","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/storage-azure/src/generateUploadInstructions.ts","lineNumber":33,"sourceCode":"\nexport const generateUploadInstructions = ({\n  access,\n  collectionPrefix,\n  containerName,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const blobClient = getStorageClient().getBlobClient(fileKey)\n\n    const sasToken = generateBlobSASQueryParameters(\n      {\n        blobName: fileKey,\n        containerName,\n        contentType: mimeType,","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/storage-azure/src/generateUploadInstructions.ts#L15-L51","documentation":"Thrown by the Azure storage adapter's `generateUploadInstructions` as a `Forbidden(req.t)` ('You are not allowed to perform this action.') when `overrideAccess` is false and either the configured `access` function returns false OR there is no `access` function and no `req.user`. It guards the issuance of the write SAS token for staged uploads.","triggerScenarios":"An anonymous request to generate upload instructions for an Azure-backed upload collection; a logged-in user who fails the adapter's `access({ collectionSlug, req })` check; `overrideAccess` not set on a server-side call that has no user in the request context.","commonSituations":"Public upload form hitting the endpoint without a session; `access` function tightened to a role the current user lacks; server-to-server upload that forgot to set `overrideAccess: true` or pass a user-bearing request.","solutions":["Ensure the request carries an authenticated user that satisfies the adapter's `access` function","For trusted server-side calls, pass `overrideAccess: true` on the operation that triggers upload-instruction generation","Loosen or fix the `access` predicate if the current user genuinely should be allowed","If public uploads are intended, set an `access` function that returns true for the relevant collection"],"exampleFix":"// before — server call with no user\nawait payload.create({ collection: 'media', data, req: anonymousReq })\n// after — pass an authenticated request or override\nawait payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })","handlingStrategy":"validation","validationCode":"// Server-side: pass an authenticated req or overrideAccess when generating upload instructions\nawait payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })","typeGuard":null,"tryCatchPattern":"const res = await fetch(uploadInstructionsUrl, { credentials: 'include' })\nif (res.status === 403) {\n  // user lacks access or is anonymous — prompt login or use an authenticated server path\n  await relogin()\n}","preventionTips":["Ensure clients calling upload-instruction endpoints are authenticated","For trusted server-to-server uploads, pass `overrideAccess: true` with an authenticated request","Configure the adapter's `access` function to match the intended role policy"],"tags":["storage-azure","authentication","forbidden","file-upload","authorization"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}