RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The deprecated afterVerifyEmail method throws 'error-invalid-user' when the DDP connection has no authenticated user, i.e. Meteor.userId() returns null. It runs post-email-verification side effects for the logged-in user only, so a caller identity is mandatory. Deprecated since 9.0.0 in favor of POST /api/v1/users.verifyEmail.

Source

Thrown at apps/meteor/server/meteor-methods/auth/afterVerifyEmail.ts:21

import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { runAfterVerifyEmail } from '../../lib/users/runAfterVerifyEmail';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		afterVerifyEmail(): void;
	}
}

Meteor.methods<ServerMethods>({
	async afterVerifyEmail() {
		methodDeprecationLogger.method('afterVerifyEmail', '9.0.0', '/v1/users.verifyEmail');

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'afterVerifyEmail',
			});
		}

		await runAfterVerifyEmail(userId);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Log in (or restore a valid resume token) before calling the method
  2. Migrate to POST /api/v1/users.verifyEmail, which takes the verification token explicitly and does not depend on the DDP session
  3. For scripts, authenticate first via POST /api/v1/login or use a personal access token with the REST API
Defensive patterns

Strategy: validation

Validate before calling

const userId = Meteor.userId();
if (!userId) {
  // re-authenticate or redirect to login before calling
  throw new Error('Login required for afterVerifyEmail');
}
await Meteor.callAsync('afterVerifyEmail');

Try / catch

try {
  await Meteor.callAsync('afterVerifyEmail');
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {
    // session gone: re-run the login flow, then retry once
  }
}

Prevention

When it happens

Trigger: Calling Meteor.call('afterVerifyEmail') on a logged-out connection, with an expired or invalidated resume token, or from server-to-server code that never performed a login.

Common situations: Stale resume token after a server restart/upgrade; token revoked because the same account logged in elsewhere while max parallel logins is 1; scripts or tests invoking the method without a login flow.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9b5170f03ec7ae19. Report an issue: GitHub.