RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-arguments

error-invalid-arguments

Error message

Invalid arguments

What it means

addUserToRole() validates its inputs: roleId and username must both be present and 'string-valued' (checked via valueOf() so String objects pass but numbers/objects fail). Empty strings, null, or non-string arguments throw error-invalid-arguments before any database lookup happens.

Source

Thrown at apps/meteor/server/meteor-methods/auth/addUserToRole.ts:19

import { api } from '@rocket.chat/core-services';
import type { IRole, IUser } from '@rocket.chat/core-typings';
import { Roles, Users } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { addUserRolesAsync } from '../../lib/roles/addUserRoles';
import { settings } from '../../settings';

export const addUserToRole = async (userId: string, roleId: string, username: IUser['username'], scope?: string): Promise<boolean> => {
	if (!(await hasPermissionAsync(userId, 'access-permissions'))) {
		throw new Meteor.Error('error-action-not-allowed', 'Accessing permissions is not allowed', {
			method: 'authorization:addUserToRole',
			action: 'Accessing_permissions',
		});
	}

	if (!roleId || typeof roleId.valueOf() !== 'string' || !username || typeof username.valueOf() !== 'string') {
		throw new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {
			method: 'authorization:addUserToRole',
		});
	}

	const role = await Roles.findOneById<Pick<IRole, '_id'>>(roleId, { projection: { _id: 1 } });

	if (!role) {
		throw new Meteor.Error('error-invalid-role', 'Invalid Role', {
			method: 'authorization:addUserToRole',
		});
	}

	if (role._id === 'admin' && !(await hasPermissionAsync(userId, 'assign-admin-role'))) {
		throw new Meteor.Error('error-action-not-allowed', 'Assigning admin is not allowed', {
			method: 'authorization:addUserToRole',
			action: 'Assign_admin',
		});
	}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Ensure both roleId and username are non-empty strings before calling (cast with String(...) when needed).
2. Disable the submit action until role and user selectors hold values.
3. Log the outbound payload when this fires to spot serialization bugs.

Example fix

// before: role select still on its empty default
Meteor.call('authorization:addUserToRole', roleSelect.value /* '' */, username);

// after: guard both arguments
const roleId = String(roleSelect.value || '').trim();
const uname = String(username || '').trim();
if (!roleId || !uname) throw new Error('roleId and username are required');
Meteor.call('authorization:addUserToRole', roleId, uname);

const isValidRoleAndUsername = (roleId: unknown, username: unknown): boolean =>
  typeof roleId === 'string' && roleId.length > 0 &&
  typeof username === 'string' && username.length > 0;

try {
  await Meteor.callAsync('authorization:addUserToRole', roleId, username, scope);
} catch (err: any) {
  if (err?.error === 'error-invalid-arguments' && err?.details?.method === 'authorization:addUserToRole') {
    // log the payload shape to find the serialization bug, fix inputs, then retry
    logBadPayload({ roleId, username });
    return;
  }
  throw err;
}

When it happens

Trigger: Calling authorization:addUserToRole / roles.addUserToRole with roleId undefined (a select defaulting to ''), username null, or numeric ids not cast to string; accidentally passing a DOM element or event instead of its .value.

Common situations: Forms whose state starts empty with submit not disabled; refactors renaming props (roleId vs _id); JSON payloads using numbers for ids.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• error-invalid-room
• error-duplicate-role-names-not-allowed
• error-invalid-scope
• error-invalid-scope
• error-invalid-param

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/aad98d91af1795a6. Report an issue: GitHub.