RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid User

What it means

Thrown by the addWebdavAccountByToken helper (used by the addWebdavAccount Meteor methods) when the supplied userId is falsy. The helper is the shared implementation behind both the form-based and token-based WebDAV account flows; it requires a resolved user id before it checks the Webdav_Integration_Enabled setting or validates the payload.

Source

Thrown at apps/meteor/server/bridges/webdav/methods/addWebdavAccount.ts:21

import type { ServerMethods } from '@rocket.chat/ddp-client';
import { WebdavAccounts } from '@rocket.chat/models';
import { Match, check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { settings } from '../../../settings';
import { WebdavClientAdapter } from '../lib/webdavClientAdapter';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		addWebdavAccount(formData: IWebdavAccountPayload): boolean;
		addWebdavAccountByToken(data: IWebdavAccountPayload): boolean;
	}
}

export const addWebdavAccountByToken = async (userId: string, data: IWebdavAccountPayload): Promise<boolean> => {
	if (!userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'addWebdavAccount' });
	}

	if (!settings.get('Webdav_Integration_Enabled')) {
		throw new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {
			method: 'addWebdavAccount',
		});
	}

	check(
		data,
		Match.ObjectIncluding({
			serverURL: String,
			token: Match.ObjectIncluding({
				access_token: String,
				token_type: String,
				refresh_token: Match.Optional(String),
			}),
			name: Match.Maybe(String),

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Ensure a valid userId is passed: in Meteor methods derive it from Meteor.userId() inside the method body and pass it explicitly to the helper.
  2. Guard the call site: if (!userId) return error before invoking addWebdavAccountByToken.
  3. For the token flow, resolve the user from the OAuth token first and only then call the helper with the resolved id.

Example fix

// before
await addWebdavAccountByToken('', data) // empty userId

// after
const userId = Meteor.userId()
if (!userId) throw new Meteor.Error('error-invalid-user', 'login required')
await addWebdavAccountByToken(userId, data)
Defensive patterns

Strategy: validation

Validate before calling

if (!userId || typeof userId !== 'string') {
  throw new Meteor.Error('error-invalid-user','login required');
}
await addWebdavAccountByToken(userId, data);

Type guard

function isNonEmptyUserId(id) { return typeof id === 'string' && id.trim().length > 0; }

Try / catch

try { await addWebdavAccountByToken(userId, data); }
catch (e) {
  if (e?.error === 'error-invalid-user') { userId = Meteor.userId(); await addWebdavAccountByToken(userId, data); return; }
  throw e;
}

Prevention

When it happens

Trigger: The method is invoked without a bound user id - e.g. from server code that did not pass a userId, or from a client flow where the login was not established before the call. addWebdavAccountByToken is also exported and may be called directly with an empty string.

Common situations: Custom server code calls addWebdavAccountByToken('') or omits the id. A client method wrapper passes the wrong variable. OAuth token flow fails to resolve the user before invoking the helper.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/3673b9010e6900b8. Report an issue: GitHub.