What causes "Current user is not allowed to create trainings" in hcengineering/platform?

Grant the current user's role the training creation permission (configure RolesAssignment/permission mixins).

Current user is not allowed to create trainings

Error message

Current user is not allowed to create trainings

What it means

createTraining performs a permission check with canCreateTraining() before doing any work and throws if the current user lacks create permission for trainings. This is an explicit client-side authorization gate mirroring server-side security. No document is created when it fires.

Source

Thrown at plugins/training-resources/src/utils/createTraining.ts:21

//

import { type Training, trainingPrefix, TrainingState } from '@hcengineering/training'
import { type Doc, type Ref } from '@hcengineering/core'
import { getClient } from '@hcengineering/presentation'
import { navigate } from '@hcengineering/ui'
import training from '../plugin'
import { trainingRoute } from '../routing/routes/trainingRoute'
import { canCreateTraining } from './canCreateTraining'
import { getCurrentEmployeeRef } from './getCurrentEmployeeRef'
import { getNextTrainingSeqNumber } from './getNextTrainingSeqNumber'

export type CreateTrainingData = Required<
Omit<Training, keyof Doc | 'code' | 'state' | 'revision' | 'owner' | 'author'>
>

export async function createTraining (data: CreateTrainingData): Promise<Ref<Training>> {
  if (!canCreateTraining()) {
    throw new Error('Current user is not allowed to create trainings')
  }

  const client = getClient()
  const currentEmployeeRef = getCurrentEmployeeRef()
  const seqNumber = await getNextTrainingSeqNumber()

  const id = await client.createDoc(training.class.Training, training.space.Trainings, {
    ...data,
    code: `${trainingPrefix}-${seqNumber}`,
    state: TrainingState.Draft,
    revision: 1,
    owner: currentEmployeeRef,
    author: currentEmployeeRef
  })

  navigate(trainingRoute.build({ id, tab: null }))

  return id

View on GitHub (pinned to 63e28dc964)

Solutions

Grant the current user's role the training creation permission (configure RolesAssignment/permission mixins).
Check canCreateTraining() in the UI before showing the create action.
Log in as a user with the correct role to verify.
Review recent permission-model changes or migrations.

Example fix

// before
await createTraining(data)
// after
if (canCreateTraining()) {
  await createTraining(data)
} else {
  showNoPermissionNotification()
}

Defensive patterns

Strategy: type-guard

Validate before calling

if (!canCreateTraining()) { notify('You do not have permission to create trainings'); return }

Type guard

function mayCreateTraining(user: Account): boolean { return canCreateTraining() }

Try / catch

try { return await createTraining(data) } catch (e) { if (e.message.includes('not allowed')) showPermissionDenied(); else throw e }

Prevention

Gate UI actions on canCreateTraining() before invoking
Assign proper roles to users who need training creation
Keep permission mixins configured in spaces
Cover permission checks in tests

When it happens

Trigger: Calling createTraining(data) while logged in as a user/role (e.g. guest, read-only employee) without training-create permission.

Common situations: Users without the appropriate role opening the create-training UI; permission mixins not configured in the space; testing as an account with insufficient roles; permission model changes after an upgrade.

Related errors

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/acb5c11505fb9639. Report an issue: GitHub.