RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-arguments

error-invalid-arguments

Error message

Invalid arguments

What it means

addOAuthApp requires applicationParams.active to be a literal boolean. JSON clients that send "active": "true" (string), 1/0, or omit it are rejected. The REST ajv schema already enforces type boolean, so this Meteor.Error mostly bites direct/internal callers whose values were coerced on the way in.

Source

Thrown at apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts:41

		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'addOAuthApp' });
	}

	if (!applicationParams.name || typeof applicationParams.name.valueOf() !== 'string' || applicationParams.name.trim() === '') {
		throw new Meteor.Error('error-invalid-name', 'Invalid name', { method: 'addOAuthApp' });
	}

	if (
		!applicationParams.redirectUri ||
		typeof applicationParams.redirectUri.valueOf() !== 'string' ||
		applicationParams.redirectUri.trim() === ''
	) {
		throw new Meteor.Error('error-invalid-redirectUri', 'Invalid redirectUri', {
			method: 'addOAuthApp',
		});
	}

	if (typeof applicationParams.active !== 'boolean') {
		throw new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {
			method: 'addOAuthApp',
		});
	}

	const application = {
		...applicationParams,
		redirectUri: parseUriList(applicationParams.redirectUri),
		clientId: Random.id(),
		clientSecret: Random.secret(),
		_createdAt: new Date(),
		_updatedAt: new Date(),
		_createdBy: {
			_id: user._id,
			username: user.username,
		},
	};

	if (application.redirectUri.length === 0) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Send the JSON literal true or false for active
2. Coerce on the client before posting: active: Boolean(formData.active) with an explicit checkbox mapping
3. For direct calls, type-check params against OauthAppsAddParams before invoking

Example fix

// before
{ "name": "App", "active": "true", "redirectUri": "https://app.example.com/cb" }

// after
{ "name": "App", "active": true, "redirectUri": "https://app.example.com/cb" }

// client-side: send a real boolean, not a form-encoded string
const active = form.active === true || form.active === 'true'; // explicit mapping
await post('/oauth-apps.create', { ...form, active }); // JSON body keeps it boolean

const isBoolean = (v: unknown): v is boolean => typeof v === 'boolean';

const isValidActiveFlag = (p: unknown): boolean =>
  typeof p === 'object' && p !== null && isBoolean((p as any).active);

try {
  await addOAuthApp(params, uid);
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-invalid-arguments') {
    setFieldError('active', 'Active must be true or false');
  } else {
    throw error;
  }
}

When it happens

Trigger: POST /api/v1/oauth-apps.create with { active: 'true' } or { active: 1 }; direct addOAuthApp calls passing a truthy non-boolean; form serializers that turn checkboxes into strings.

Common situations: HTML form encoders serializing booleans as strings; scripting clients using query-string semantics where everything is a string; refactors that changed the field type.

Related errors

• error-invalid-name
• error-invalid-redirectUri
• Type not supported
• invalid-params
• error-user-param-not-provided

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/a57b926f3dd3ca8f. Report an issue: GitHub.