RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by the removeSlackBridgeChannelLinks Meteor method when Meteor.userAsync() returns null - the call was made on a DDP connection with no authenticated user. The user record (not just the id) is needed because it is passed to hasPermissionAsync and used for audit context.

Source

Thrown at apps/meteor/server/bridges/slack/removeChannelLinks.ts:19

import type { ServerMethods } from '@rocket.chat/ddp-client';
import { Rooms } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { settings } from '../../settings';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		removeSlackBridgeChannelLinks(): { message: string; params: unknown[] };
	}
}

Meteor.methods<ServerMethods>({
	async removeSlackBridgeChannelLinks() {
		const user = await Meteor.userAsync();
		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'removeSlackBridgeChannelLinks',
			});
		}

		if (!(await hasPermissionAsync(user, 'remove-slackbridge-links'))) {
			throw new Meteor.Error('error-not-authorized', 'Not authorized', {
				method: 'removeSlackBridgeChannelLinks',
			});
		}

		if (settings.get('SlackBridge_Enabled') !== true) {
			throw new Meteor.Error('SlackBridge_disabled');
		}

		await Rooms.unsetAllImportIds();

		return {
			message: 'Slackbridge_channel_links_removed_successfully',

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Re-authenticate before calling the method; check Meteor.userId() on the client.
  2. Hide/disable the admin control when the session is not valid.
  3. From server code, run within an authenticated user's method context.

Example fix

// before
Meteor.call('removeSlackBridgeChannelLinks') // logged out

// after
if (!Meteor.userId()) { await reLogin(); }
Meteor.call('removeSlackBridgeChannelLinks')
Defensive patterns

Strategy: validation

Validate before calling

const user = await Meteor.userAsync();
if (!user) throw new Meteor.Error('error-invalid-user','login required');
await Meteor.call('removeSlackBridgeChannelLinks');

Type guard

function isAuthenticated() { return typeof Meteor.userId() === 'string'; }

Try / catch

try { Meteor.call('removeSlackBridgeChannelLinks'); }
catch (e) {
  if (e?.error === 'error-invalid-user') { await reLogin(); Meteor.call('removeSlackBridgeChannelLinks'); return; }
  throw e;
}

Prevention

When it happens

Trigger: Meteor.call('removeSlackBridgeChannelLinks') from a logged-out client, or after the session expired but before the UI reacted.

Common situations: Admin page left open in a background tab whose session lapsed; the operator clicks 'Remove SlackBridge links'. Server-side invocation without user context.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/7a6b035dcd60dbe1. Report an issue: GitHub.