RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid User

What it means

getWebdavFileList is the DDP method that lists a directory on one of the user's connected WebDAV accounts. It throws error-invalid-user when Meteor.userId() is falsy — the calling connection is not authenticated. The check runs before the integration, account, and listing steps, so unauthenticated calls never reach the WebDAV server.

Source

Thrown at apps/meteor/server/bridges/webdav/methods/getWebdavFileList.ts:22

import { Meteor } from 'meteor/meteor';

import { settings } from '../../../settings';
import { getWebdavCredentials } from '../lib/getWebdavCredentials';
import { WebdavClientAdapter } from '../lib/webdavClientAdapter';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getWebdavFileList(accountId: IWebdavAccount['_id'], path: string): { success: boolean; data: IWebdavNode[] };
	}
}

Meteor.methods<ServerMethods>({
	async getWebdavFileList(accountId, path) {
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'getWebdavFileList' });
		}

		if (!settings.get('Webdav_Integration_Enabled')) {
			throw new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {
				method: 'getWebdavFileList',
			});
		}

		const account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});
		if (!account) {
			throw new Meteor.Error('error-invalid-account', 'Invalid WebDAV Account', {
				method: 'getWebdavFileList',
			});
		}

		try {
			const cred = getWebdavCredentials(account);
			const client = new WebdavClientAdapter(account.serverURL, cred);

View on GitHub (pinned to b2c16d5842)

Solutions

1. Authenticate the DDP connection before listing
2. Re-login when the session is stale, then retry
3. Gate file-picker mounting on a live-session check

Example fix

// before
Meteor.call('getWebdavFileList', accountId, path); // → error-invalid-user

// after
if (!Meteor.userId()) await relogin();
Meteor.call('getWebdavFileList', accountId, path, (err) => { /* handle */ });

if (!Meteor.userId()) {
  await relogin();
}
await Meteor.callAsync('getWebdavFileList', accountId, path);

Meteor.call('getWebdavFileList', accountId, path, (err) => {
  if (err && err.error === 'error-invalid-user') {
    // session expired: re-login, then re-list
  }
});

When it happens

Trigger: Calling Meteor.call('getWebdavFileList', accountId, path) on a DDP connection without a valid login — expired token in a file browser, or an unauthenticated script/tool.

Common situations: File browsers opened in tabs whose session expired; automation listing WebDAV files without DDP login; server code invoking the method without a bound user.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/2ba5f82cf53662cc. Report an issue: GitHub.