RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The deprecated refreshOAuthService method throws 'error-invalid-user' when Meteor.userId() returns null, i.e. the DDP connection carries no authenticated user. The refresh of OAuth login services is an admin action and always requires a caller. Deprecated since 9.0.0 in favor of /v1/settings.refreshOAuthServices.

Source

Thrown at apps/meteor/server/meteor-methods/auth/refreshOAuthService.ts:22

import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { refreshLoginServices } from '../../lib/refreshLoginServices';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		refreshOAuthService(): Promise<void>;
	}
}

Meteor.methods<ServerMethods>({
	async refreshOAuthService() {
		methodDeprecationLogger.method('refreshOAuthService', '9.0.0', '/v1/settings.refreshOAuthServices');

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'refreshOAuthService',
			});
		}

		if ((await hasPermissionAsync(userId, 'add-oauth-service')) !== true) {
			throw new Meteor.Error('error-action-not-allowed', 'Refresh OAuth Services is not allowed', {
				method: 'refreshOAuthService',
				action: 'Refreshing_OAuth_Services',
			});
		}

		await refreshLoginServices();
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Log in with a valid session before calling refreshOAuthService
  2. Migrate to /v1/settings.refreshOAuthServices with an authenticated request
  3. Handle session expiry centrally (re-login then retry once)
Defensive patterns

Strategy: validation

Validate before calling

const userId = Meteor.userId();
if (!userId) {
  // re-authenticate before refreshing OAuth services
}
await Meteor.callAsync('refreshOAuthService');

Try / catch

try {
  await Meteor.callAsync('refreshOAuthService');
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {
    // session gone: re-login and retry
  }
}

Prevention

When it happens

Trigger: Calling refreshOAuthService while logged out or after the resume token expired or was invalidated.

Common situations: Long-lived admin page with a stale session; post-restart token invalidation; automation invoking the method anonymously.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/8d8eb02c13b007ca. Report an issue: GitHub.