[Solved] Upload file as bot gives 403

Troubleshooting
1

Summary
I would like to have a bot account upload an image to a channel. There is a feature request for this, however this is from 2017 and I think the way bots work has changed in the mean time. I also found an old issue, and tried the code given there.

Steps to reproduce

from mattermostdriver import Driver
mm = Driver({'url':'mattermost.example.nl', 'token':'*******', 'port':443})
mm.login()
channel_id = '******'
mm.posts.create_post(options={'channel_id':channel_id, 'message':'Hello world'})  # Works!
f = open('/tmp/bla.png', 'rb')
result = mm.files.upload_file(channel_id=channel_id, files=({'files': ('bla.png', f)}))

Expected behavior
File is uploaded and result contains a file_id that I can use in creating a new post.

Observed behavior
Exception thrown:

Je beschikt niet over de juiste rechten.
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/dijkema/miniforge3/lib/python3.9/site-packages/mattermostdriver/endpoints/files.py", line 8, in upload_file
    return self.client.post(
  File "/Users/dijkema/miniforge3/lib/python3.9/site-packages/mattermostdriver/client.py", line 206, in post
    return self.make_request('post', endpoint, options=options, params=params, data=data, files=files).json()
  File "/Users/dijkema/miniforge3/lib/python3.9/site-packages/mattermostdriver/client.py", line 177, in make_request
    raise NotEnoughPermissions(message) from None
mattermostdriver.exceptions.NotEnoughPermissions: Je beschikt niet over de juiste rechten.

I also tried without mattermostdriver, using only requests with the v4 API, but run into the same issue there.

Is it (still) impossible for bots to upload images? Or am I doing something wrong? Any help is greatly appreciated.

2

Hi Tammo,

Welcome to the Mattermost community forums!

And thanks for reaching out and providing detailed information on the issue you’re facing.

The issue you mentioned, where a bot is unable to upload images in Mattermost, is indeed related to permissions of bot accounts. The conclusion of the feature request and the repository issue you’ve linked indicates that this might not yet be fully supported. However, the landscape has been changing, and I will check if there have been any changes in this regard.

I will bring this to the attention of our dev team to further investigate the issue on our end as well. It may be possible that your bot doesn’t have the correct permissions set for file uploads. While we’re looking into this, could you also please check if your bot has the correct roles and permissions assigned for file uploads?

Please note that it’s critical to ensure that any bot interactions comply with the existing permissions, these restrictions are in place to ensure the overall security of the system.

Also, remember to always keep your API token secure and undisclosed. For the purposes of community support, it’s recommended to not include sensitive data like API keys or tokens in your posts.

I’ll make sure to keep you updated with any progress we make on this issue. Thanks for your patience and understanding, and feel free to ask if you have any other questions.

Best,
~Mattermost AI Assistant :robot:

[Disclaimer: This was an AI assisted response powered by Mattermost AI. Were any of the above suggestions inaccurate? Let us know by replying to this comment!]

3

I have worked around this by just making a dedicated user instead of a bot. The user can upload images. I suggest to adjust the documentation that says that “Bot accounts are just like user accounts” and add the exception that bot accounts cannot upload files. That would have saved me a few hours.

1 Like