RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by the resetIrcConnection Meteor method when Meteor.userId() is falsy, i.e. there is no authenticated user on the DDP connection. The method is server-only and requires a logged-in user before it checks IRC_Enabled or the edit-privileged-setting permission.

Source

Thrown at apps/meteor/server/bridges/irc/methods/resetIrcConnection.ts:24

import { notifyOnSettingChangedById } from '../../../lib/notifyListener';
import { settings } from '../../../settings';
import { updateAuditedByUser } from '../../../settings/lib/auditedSettingUpdates';
import Bridge from '../irc-bridge';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		resetIrcConnection(): { message: string; params: unknown[] };
	}
}

Meteor.methods<ServerMethods>({
	async resetIrcConnection() {
		const ircEnabled = Boolean(settings.get('IRC_Enabled'));
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'resetIrcConnection' });
		}

		if (!(await hasPermissionAsync(uid, 'edit-privileged-setting'))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'resetIrcConnection' });
		}

		const auditSettingOperation = updateAuditedByUser({
			_id: uid,
			username: (await Meteor.userAsync())!.username!,
			ip: this.connection?.clientAddress || '',
			useragent: this.connection?.httpHeaders['user-agent'] || '',
		});

		const updatedLastPingValue = await auditSettingOperation(Settings.updateValueById, 'IRC_Bridge_Last_Ping', new Date(0), {
			upsert: true,
		});
		if (updatedLastPingValue.modifiedCount || updatedLastPingValue.upsertedCount) {
			void notifyOnSettingChangedById('IRC_Bridge_Last_Ping');

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Ensure the client is authenticated (login completed) before calling resetIrcConnection; re-login on 401/expired-session signals.
2. Disable the UI control when no user/session is present.
3. From server code, bind a user context or gate the call behind an authenticated admin path.

Example fix

// before
Meteor.call('resetIrcConnection') // while logged out

// after
if (Meteor.userId()) Meteor.call('resetIrcConnection')
else reLogin().then(() => Meteor.call('resetIrcConnection'))

const uid = Meteor.userId();
if (!uid) throw new Meteor.Error('error-invalid-user','login required');
await Meteor.call('resetIrcConnection');

function isAuthenticated() { return typeof Meteor.userId() === 'string'; }

try { Meteor.call('resetIrcConnection'); }
catch (e) {
  if (e?.error === 'error-invalid-user') { await reLogin(); Meteor.call('resetIrcConnection'); return; }
  throw e;
}

When it happens

Trigger: Client calls Meteor.call('resetIrcConnection') on a connection where the user is not logged in, or the login session expired before the call landed. Also possible from a server-side call that has no user context.

Common situations: Long-idled admin tab whose session expired still has the 'Reset IRC' button enabled. A method call fired during logout race. Server-side invocation without binding a user.

Related errors

• error-invalid-user
• error-invalid-user
• error-not-allowed
• error-not-authorized
• SlackBridge_disabled

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/0ca391dd25305c3c. Report an issue: GitHub.