RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-desired-user

error-invalid-desired-user

Error message

Invalid desired user

What it means

After the setting and permission checks, setAvatarFromServiceWithValidation fetches the target user document (targetUserId when editing someone else, otherwise the actor). If no document matches, error-invalid-desired-user is thrown. Distinct from error-invalid-user (falsy acting id): here the lookup of the intended avatar owner failed.

Source

Thrown at apps/meteor/server/lib/users/setUserAvatar.ts:58

		});
	}

	let user: IUser | null;

	if (targetUserId && targetUserId !== userId) {
		if (!(await hasPermissionAsync(userId, 'edit-other-user-avatar'))) {
			throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
				method: 'setAvatarFromService',
			});
		}

		user = await Users.findOneById(targetUserId, { projection: { _id: 1, username: 1 } });
	} else {
		user = await Users.findOneById(userId, { projection: { _id: 1, username: 1 } });
	}

	if (!user) {
		throw new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', {
			method: 'setAvatarFromService',
		});
	}

	return setUserAvatar(user, dataURI, contentType, service);
};

export function setUserAvatar(
	user: Pick<IUser, '_id' | 'username'>,
	dataURI: Buffer,
	contentType: string,
	service: 'rest',
	etag?: string,
	updater?: Updater<IUser>,
	session?: ClientSession,
): Promise<void>;
export function setUserAvatar(
	user: Pick<IUser, '_id' | 'username'>,

View on GitHub (pinned to b2c16d5842)

Solutions

1. Verify the target user exists first (users.info API or Users.findOneById).
2. Refresh stale ids from the current user directory before retrying.
3. Handle deletion races by re-checking the target right before the operation.

const target = await Users.findOneById(targetUserId ?? userId, { projection: { _id: 1 } });
if (!target) {
  throw new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', { targetUserId });
}
await setAvatarFromServiceWithValidation(userId, dataURI, contentType, service, targetUserId);

When it happens

Trigger: setAvatarFromService with a targetUserId that was deleted or never existed; admin UI holding a stale user id from a listing made before deletion; ids from another environment.

Common situations: User deleted between directory listing and the avatar action; wrong environment's user id; typo'd or truncated target id in integrations.

Related errors

• error-invalid-user
• error-invalid-user
• invalid-user
• error-invalid-user
• error-invalid-data

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9b5ff515ce8bdd5a. Report an issue: GitHub.