RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

executeSendMessage resolves the sender - Users.findOneById(uid) when a string id is passed, or the provided user object - and throws error-invalid-user when the user is missing or has no username. This path is used by server-side callers (REST, apps, integrations); the Meteor method wrapper checks the connection separately.

Source

Thrown at apps/meteor/server/meteor-methods/messages/sendMessage.ts:76

				server_ts: new Date().getTime(),
			});
		}
		if (tsDiff > 10000) {
			message.ts = now;
		}
	}

	if (message.msg) {
		if (message.msg.length > (settings.get<number>('Message_MaxAllowedSize') ?? 0)) {
			throw new Meteor.Error('error-message-size-exceeded', 'Message size exceeds Message_MaxAllowedSize', {
				method: 'sendMessage',
			});
		}
	}

	const user = typeof uid === 'string' ? await Users.findOneById(uid) : uid;
	if (!user?.username) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user');
	}

	let { rid } = message;

	// do not allow nested threads
	if (message.tmid) {
		const parentMessage = await Messages.findOneById(message.tmid, { projection: { rid: 1, tmid: 1 } });
		message.tmid = parentMessage?.tmid || message.tmid;

		if (parentMessage?.rid) {
			rid = parentMessage?.rid;
		}
	}

	if (!rid) {
		throw new Error("The 'rid' property on the message object is missing.");
	}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Fetch and verify the user (and that username is set) before calling executeSendMessage
  2. Drop or re-queue the job if the sender no longer exists instead of retrying
  3. Fix imported users that lack a username
Defensive patterns

Strategy: validation

Validate before calling

// server-side caller: verify the sender before executing the send
import { Users } from '@rocket.chat/models';

const user = typeof uid === 'string' ? await Users.findOneById(uid) : uid;
if (!user?.username) {
	throw new Error('sender missing or has no username');
}
await executeSendMessage(user, message);

Prevention

When it happens

Trigger: Server-side call with a uid of a deleted user; user record exists but username is unset (half-migrated or imported user); offboarding deletes the user while a queued job is mid-flight.

Common situations: Bot jobs referencing deleted accounts; LDAP/import pipelines creating users without usernames; race between deletion and in-flight sends.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/26004d9a70f47092. Report an issue: GitHub.