RocketChat/Rocket.Chat · critical · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by findDirectMessageRoom in im.ts (lines 54-59). The authenticated uid was passed to Users.findOneById and no user document was returned. This means the authenticated session's user no longer exists in the database: the account was deleted/deactivated, the user record was purged, or the auth token references a uid that is no longer valid. It is annotated with method: 'findDirectMessageRoom' for diagnostics.

Source

Thrown at apps/meteor/server/api/v1/im.ts:56

import type { ExtractRoutesFromAPI } from '../ApiClass';
import { API } from '../api';
import type { TypedAction } from '../definition';
import { addUserToFileObj } from '../lib/addUserToFileObj';
import { composeRoomWithLastMessage } from '../lib/composeRoomWithLastMessage';
import { getPaginationItems } from '../lib/getPaginationItems';

const findDirectMessageRoom = async (
	keys: { roomId?: string; username?: string },
	uid: string,
): Promise<{ room: IRoom; subscription: ISubscription | null }> => {
	const nameOrId = 'roomId' in keys ? keys.roomId : keys.username;
	if (typeof nameOrId !== 'string') {
		throw new Meteor.Error('error-room-param-not-provided', 'Query param "roomId" or "username" is required');
	}

	const user = await Users.findOneById(uid);
	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'findDirectMessageRoom',
		});
	}

	const room = await getRoomByNameOrIdWithOptionToJoin({
		user,
		nameOrId,
		type: 'd',
	});

	if (!room || room?.t !== 'd') {
		throw new Meteor.Error('error-room-not-found', 'The required "roomId" param provided does not match any direct message');
	}

	const subscription = await Subscriptions.findOne({ 'rid': room._id, 'u._id': uid });

	return {
		room,

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Re-authenticate with a valid user; revoke and reissue tokens for any deleted user.
2. Confirm the user still exists (GET /api/v1/me will also fail; check the admin Users list) and is active.
3. If the user was deleted intentionally, stop using that token and provision a new service account/bot user.
4. Ensure deletion flows also revoke sessions and invalidate API tokens to prevent this.

Example fix

// before
const client = new SDK(tokenOfDeletedUser);
await client.call('GET', '/api/v1/im.info', { roomId }); // -> error-invalid-user

// after
const me = await client.call('GET', '/api/v1/me'); // expect 401; obtain a fresh token for an active user
const fresh = await login(activeUsername, activePassword);
await new SDK(fresh.token).call('GET', '/api/v1/im.info', { roomId });

// Pre-flight: confirm the token's user still exists before relying on im.* calls.
const me = await api.get('/api/v1/me').catch((e) => e);
if (me instanceof Error || !me?._id) {
  throw new Error('Auth token is invalid or its user no longer exists; re-authenticate');
}
await api.get('/api/v1/im.info', { roomId });

function isActiveUser(u) {
  return u != null && typeof u._id === 'string' && u.active !== false;
}

try {
  await api.get('/api/v1/im.info', { roomId });
} catch (e) {
  if (isMeteorError(e) && e.reason === 'error-invalid-user') {
    // token's user was deleted; revoke and re-authenticate
    await logoutAndReauthenticate();
    return;
  }
  throw e;
}

When it happens

Trigger: Calling any im.* endpoint through the helper after the authenticated user's document has been removed (deletion, GDPR purge, import/migration mismatch) while the session/token is still being used.

Common situations: A long-lived bot token whose user was deactivated/deleted but the token was not revoked. A session kept open after account deletion. A test that deletes the acting user mid-flow. Post-migration uid mismatches.

Related errors

• error-room-param-not-provided
• Not logged in
• Could not open popup
• Room not found
• old-url-format

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/0d7726f345325370. Report an issue: GitHub.