RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The 'slashCommand' Meteor method requires an authenticated DDP connection; Meteor.userId() returning null (no resume token, anonymous connection, invalidated login) throws error-invalid-user before any command lookup. This is the standard Rocket.Chat 'method called without a logged-in user' guard; the method is deprecated in favor of POST /v1/commands.run, which authenticates via headers.

Source

Thrown at apps/meteor/server/lib/utils/slashCommand.ts:147

		}

		return cmd.previewCallback(command, params, message, preview, userId, triggerId);
	},
};

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		slashCommand(params: { cmd: string; params: string; msg: IMessage; triggerId: string }): unknown;
	}
}

Meteor.methods<ServerMethods>({
	async slashCommand(command) {
		methodDeprecationLogger.method('slashCommand', '9.0.0', '/v1/commands.run');
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'slashCommand',
			});
		}

		if (!command?.cmd || !slashCommands.commands[command.cmd]) {
			throw new Meteor.Error('error-invalid-command', 'Invalid Command Provided', {
				method: 'executeSlashCommandPreview',
			});
		}

		return slashCommands.run({
			command: command.cmd,
			params: command.params,
			message: command.msg,
			triggerId: command.triggerId,
			userId,
		});
	},

View on GitHub (pinned to b2c16d5842)

Solutions

1. Log in over DDP (Meteor.loginWithToken or accounts login) before invoking the method.
2. For server-to-server use, call REST POST /api/v1/commands.run with X-Auth-Token/X-User-Id headers instead.
3. On token expiry, re-authenticate and retry once.

Example fix

// before: anonymous DDP connection
Meteor.call('slashCommand', { cmd: 'gimme', params: 'cat', msg });

// after: authenticated REST call
await fetch('/api/v1/commands.run', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-Auth-Token': authToken, 'X-User-Id': uid },
  body: JSON.stringify({ command: '/gimme', roomId: msg.rid, params: 'cat' }),
});

const uid = Meteor.userId();
if (!uid) {
  await reauthenticate(); // or redirect to login
}
Meteor.call('slashCommand', { cmd, params, msg });

try {
  await Meteor.callAsync('slashCommand', { cmd, params, msg });
} catch (err: any) {
  if (err?.error === 'error-invalid-user' && err?.reason === 'Invalid user') {
    await reauthenticate();
    return Meteor.callAsync('slashCommand', { cmd, params, msg }); // retry once with fresh credentials
  }
  throw err;
}

When it happens

Trigger: Meteor.call('slashCommand', ...) from a connection without a resumed login session; server-side invocation outside any user context; expired/revoked login token (logout-all) on a still-open socket.

Common situations: Bots or scripts using DDP without calling login/loginWithToken first; custom clients that skip the Accounts login flow; long-lived connections whose tokens were revoked.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/1c644e3276b70254. Report an issue: GitHub.