RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Second guard in setAvatarFromServiceWithValidation: throws error-invalid-user when the acting userId argument is falsy. Like all empty-id guards, it indicates a caller bug — the avatar operation was started without a user context. Distinct from error-invalid-desired-user, which is the later failure to find the target user document.

Source

Thrown at apps/meteor/server/lib/users/setUserAvatar.ts:32

import { SystemLogger } from '../logger/system';
import { RocketChatFile } from '../media/file';
import { FileUpload } from '../media/file-upload';

export const setAvatarFromServiceWithValidation = async (
	userId: string,
	dataURI: string,
	contentType?: string,
	service?: string,
	targetUserId?: string,
): Promise<void> => {
	if (!dataURI) {
		throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', {
			method: 'setAvatarFromService',
		});
	}

	if (!userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'setAvatarFromService',
		});
	}

	if (!settings.get('Accounts_AllowUserAvatarChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'setAvatarFromService',
		});
	}

	let user: IUser | null;

	if (targetUserId && targetUserId !== userId) {
		if (!(await hasPermissionAsync(userId, 'edit-other-user-avatar'))) {
			throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
				method: 'setAvatarFromService',
			});
		}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Pass the authenticated user's id (this.userId in methods, uid from the REST layer).
2. Add a falsy guard in the caller and reject the operation early.
3. Ensure the calling context is actually authenticated before initiating avatar upload.

const actingUserId = this.userId;
if (!actingUserId) {
  throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'caller' });
}
await setAvatarFromServiceWithValidation(actingUserId, dataURI, contentType, service, targetUserId);

const hasUserId = (id: unknown): id is string => typeof id === 'string' && id.trim().length > 0;

When it happens

Trigger: Calling the avatar setter from an unauthenticated context (this.userId undefined in a Meteor method), passing the wrong variable, or invoking server code outside a user session.

Common situations: Server-side integration script forgetting to pass the acting user id; method called from a logged-out session; automated clients without a login token.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• error-invalid-desired-user
• error-invalid-user
• invalid-user
• error-invalid-user
• error-invalid-data

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/8e51d84c00ba27ed. Report an issue: GitHub.