RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The Meteor method wrapper for starMessage resolves the caller with Meteor.userAsync(); when that returns null (no authenticated user on the connection) it throws Meteor.Error('error-invalid-user', 'Invalid user'). It is purely an authentication gate: the DDP method was invoked on a connection without a logged-in user.

Source

Thrown at apps/meteor/server/lib/messaging/stars/starMessage.ts:70

	await Apps.self?.triggerEvent(AppEvents.IPostMessageStarred, message, user, message.starred);

	await Messages.updateUserStarById(message._id, user._id, message.starred);

	void notifyOnMessageChange({
		id: message._id,
	});

	return true;
};

Meteor.methods<ServerMethods>({
	async starMessage(message) {
		methodDeprecationLogger.method('starMessage', '9.0.0', '/v1/chat.starMessage');
		const user = (await Meteor.userAsync()) as IUser;

		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'starMessage',
			});
		}

		return starMessage(user, message);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Ensure Meteor.userId() is set before invoking starMessage
  2. Queue the action and re-run it after the login-resume completes
  3. In automated clients, establish credentials and wait for authentication before calling user-scoped methods

Example fix

// before
Meteor.call('starMessage', msg); // called while logged out

// after
Tracker.autorun((c) => {
  if (Meteor.userId()) {
    Meteor.call('starMessage', msg);
    c.stop();
  }
});
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) {
  await reauthenticate();
}
if (Meteor.userId()) {
  Meteor.call('starMessage', msg);
}

Type guard

const isAuthenticated = (): boolean => typeof Meteor.userId() === 'string';

Try / catch

Meteor.call('starMessage', msg, (err) => {
  if (err?.error === 'error-invalid-user') {
    routeToLogin({ back: currentRoute }); // session is gone - stop and re-login
  }
});

Prevention

When it happens

Trigger: Calling Meteor.call('starMessage', msg) before login finishes, after logout/session expiry (token invalid), or from a server-side connection that has no bound this.userId.

Common situations: Page reloaded and the star clicked before the login resumed; token expired mid-session; logged out in another tab; automated scripts forgetting to authenticate.

Understand the failure class

Background: error-invalid-user: "Invalid user" errors in Rocket.Chat — what they mean and how to fix them — this error's family across 2 libraries.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/80022cbe666c3bf9. Report an issue: GitHub.