RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-room

error-invalid-room

Error message

Invalid room

What it means

getUserMentionsByChannel throws error-invalid-room when Rooms.findOneById(roomId) finds nothing OR when canAccessRoomAsync(room, user) denies access — a single error covers both 'no such room' and 'no permission for this room'. The mentions query only runs for rooms the user can legitimately read.

Source

Thrown at apps/meteor/server/meteor-methods/messages/getUserMentionsByChannel.ts:32

	}
}

export const getUserMentionsByChannel = async (
	userId: string,
	roomId: string,
	options: { limit?: number; skip?: number; sort?: { ts?: -1 | 1 } },
) => {
	check(roomId, String);

	const user = await Users.findOneById(userId);
	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user');
	}

	const room = await Rooms.findOneById(roomId);

	if (!room || !(await canAccessRoomAsync(room, user))) {
		throw new Meteor.Error('error-invalid-room', 'Invalid room', {
			method: 'getUserMentionsByChannel',
		});
	}

	return Messages.findVisibleByMentionAndRoomId(user.username, roomId, options).toArray();
};

Meteor.methods<ServerMethods>({
	async getUserMentionsByChannel({ roomId, options }) {
		methodDeprecationLogger.method('getUserMentionsByChannel', '9.0.0', '/v1/channels.getAllUserMentionsByChannel');
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'getUserMentionsByChannel',
			});
		}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Validate the room id and the caller's membership before calling
  2. Clear cached references to deleted rooms
  3. Catch error-invalid-room and skip the room instead of failing the whole export

Example fix

// before
const mentions = await getUserMentionsByChannel(uid, roomId, options);

// after (client)
const sub = Subscriptions.findOne({ rid: roomId });
if (!sub) {
  // not a member or no such room locally — skip
} else {
  const mentions = await Meteor.callAsync('getUserMentionsByChannel', { roomId, options });
}
Defensive patterns

Strategy: try-catch

Validate before calling

const sub = Subscriptions.findOne({ rid: roomId });
if (!sub) {
  // no membership or unknown room — skip the mentions call
}

Try / catch

try {
  const mentions = await Meteor.callAsync('getUserMentionsByChannel', { roomId, options });
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-invalid-room') {
    return []; // room deleted or not accessible — treat as empty
  }
  throw error;
}

Prevention

When it happens

Trigger: A roomId typo or deleted room; a private channel the user is not a member of; a DM the user is not part of; passing a room id obtained from a different workspace.

Common situations: Stale room ids in client state after room deletion; deep links referencing restricted channels; scripts exporting mentions that loop over every room id including restricted ones.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/8a6ba1594477112b. Report an issue: GitHub.