RocketChat/Rocket.Chat · error · Error

error-invalid-user

error-invalid-user

Error message

error-invalid-user

What it means

Thrown in the POST livechat/room/:rid/transcript handler after fetching the authenticated user with Users.findOneById(this.userId) and getting null. Because authRequired is on, this.userId is populated by the framework, so a null user record means the authenticated token points at a user that no longer exists in the database.

Source

Thrown at apps/meteor/server/api/v1/omnichannel/transcript.ts:65

			if (!(await Omnichannel.isWithinMACLimit(room))) {
				throw new Error('error-mac-limit-reached');
			}

			await LivechatRooms.unsetEmailTranscriptRequestedByRoomId(rid);

			return API.v1.success();
		},
		async post() {
			const { rid } = this.urlParams;
			const { email, subject } = this.bodyParams;

			const user = await Users.findOneById(this.userId, {
				projection: { _id: 1, username: 1, name: 1, utcOffset: 1 },
			});

			if (!user) {
				throw new Error('error-invalid-user');
			}

			await requestTranscript({ rid, email, subject, user });

			return API.v1.success();
		},
	},
);

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Verify the X-User-Id header matches an existing user document in the users collection.
  2. If the user was deleted intentionally, invalidate the client's stored auth token (logout) before retrying.
  3. Check for fixture/seed inconsistencies in non-production environments.
  4. Audit logs for user deletion events around the time of the failure.

Example fix

null
Defensive patterns

Strategy: try-catch

Validate before calling

const me = await fetch('/api/v1/v1/me', { headers: authHeaders });
if (!me.ok) { /* session invalid - re-login before calling transcript */ }

Type guard

null

Try / catch

try {
  await requestTranscript({ rid, email, subject, user });
} catch (e) {
  if (e.error === 'error-invalid-user') { /* clear local session, re-authenticate */ }
  else throw e;
}

Prevention

When it happens

Trigger: A request carries a valid auth token (X-Auth-Token + X-User-Id) for a userId whose document was deleted or whose collection is inconsistent. requestTranscript would NPE on the null user, so the guard fails fast instead.

Common situations: User was deleted between token issuance and this call; a stale token cached in a client after admin deletion; test fixtures that authenticate but never insert the user; database restored from a backup that is missing the users collection.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/9a73e4815d6ca82f. Report an issue: GitHub.