RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

getMessages throws 'error-invalid-user' when the DDP connection has no authenticated user (Meteor.userId() null) before fetching anything. Batch message fetching must run as a user so the per-room access check that follows (canAccessRoomIdAsync for every distinct rid) can be evaluated.

Source

Thrown at apps/meteor/server/meteor-methods/messages/getMessages.ts:22

import { check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { canAccessRoomIdAsync } from '../../lib/authorization/canAccessRoom';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getMessages(messages: IMessage['_id'][]): Promise<IMessage[]>;
	}
}

Meteor.methods<ServerMethods>({
	async getMessages(messages) {
		check(messages, [String]);
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'getMessages' });
		}

		const msgs = await Messages.findVisibleByIds(messages).toArray();
		const rids = await Promise.all([...new Set(msgs.map((m) => m.rid))].map((_id) => canAccessRoomIdAsync(_id, uid)));

		if (!rids.every(Boolean)) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getSingleMessage' });
		}

		return msgs;
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Guard on Meteor.userId() and re-login when null
  2. For single-message needs use the REST endpoint /v1/chat.getMessage with an auth token
  3. Prefer authenticated REST endpoints for integration use cases

Example fix

// before
Meteor.call('getMessages', ids);

// after
if (!Meteor.userId()) {
  throw new Error('Login required');
}
Meteor.call('getMessages', ids);
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) {
  throw new Error('Login required to fetch messages');
}
Meteor.call('getMessages', ids);

Try / catch

try {
  const msgs = await Meteor.callAsync('getMessages', ids);
} catch (e) {
  if ((e as Meteor.Error).error === 'error-invalid-user') {
    // re-authenticate, then retry the batch
  }
}

Prevention

When it happens

Trigger: Meteor.call('getMessages', ids) on an unauthenticated or expired connection.

Common situations: Quote/preview resolvers running after logout; scripts bulk-resolving message ids over DDP without a login step.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/27c6221f9b7c67fd. Report an issue: GitHub.