RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid User

What it means

getFileFromWebdav is the DDP method that downloads a file's bytes from a user's connected WebDAV account. It throws error-invalid-user when Meteor.userId() is falsy — the calling connection has no authenticated user. The check precedes the integration-setting, account, and download steps, so unauthenticated calls never reach the WebDAV server.

Source

Thrown at apps/meteor/server/bridges/webdav/methods/getFileFromWebdav.ts:22

import { Meteor } from 'meteor/meteor';

import { settings } from '../../../settings';
import { getWebdavCredentials } from '../lib/getWebdavCredentials';
import { WebdavClientAdapter } from '../lib/webdavClientAdapter';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getFileFromWebdav(accountId: IWebdavAccount['_id'], file: IWebdavNode): Promise<{ success: boolean; data: Uint8Array<ArrayBuffer> }>;
	}
}

Meteor.methods<ServerMethods>({
	async getFileFromWebdav(accountId, file) {
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'getFileFromWebdav' });
		}
		if (!settings.get('Webdav_Integration_Enabled')) {
			throw new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {
				method: 'getFileFromWebdav',
			});
		}

		const account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});
		if (!account) {
			throw new Meteor.Error('error-invalid-account', 'Invalid WebDAV Account', {
				method: 'getFileFromWebdav',
			});
		}

		try {
			const cred = getWebdavCredentials(account);
			const client = new WebdavClientAdapter(account.serverURL, cred);
			const fileContent = await client.getFileContents(file.filename);

View on GitHub (pinned to b2c16d5842)

Solutions

1. Authenticate the DDP connection before requesting files
2. Re-login on session expiry and retry the download once
3. In UIs, gate file fetches on a live session check

Example fix

// before
Meteor.call('getFileFromWebdav', accountId, file); // → error-invalid-user

// after
if (!Meteor.userId()) await relogin();
Meteor.call('getFileFromWebdav', accountId, file, (err) => { /* handle */ });

if (!Meteor.userId()) {
  await relogin();
}
await Meteor.callAsync('getFileFromWebdav', accountId, file);

Meteor.call('getFileFromWebdav', accountId, file, (err) => {
  if (err && err.error === 'error-invalid-user') {
    // session expired in the file picker: re-login, then re-request
  }
});

When it happens

Trigger: Calling Meteor.call('getFileFromWebdav', accountId, file) from a connection without a valid login, e.g. an expired session in a file-picker UI or an unauthenticated script.

Common situations: File-picker dialogs left open past token expiry; automation fetching WebDAV files without DDP authentication; server-side code calling the method without binding a user.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/26230a294ed75a16. Report an issue: GitHub.