RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by the getSlashCommandPreviews Meteor method when Meteor.userId() returns null, i.e. the DDP connection has no authenticated user. Slash-command previews execute the command's preview callback in the caller's context, so a valid login is a hard prerequisite; the method rejects the call before touching the command registry.

Source

Thrown at apps/meteor/server/meteor-methods/messages/getSlashCommandPreviews.ts:44

			method: 'executeSlashCommandPreview',
		});
	}

	const theCmd = slashCommands.commands[command.cmd];
	if (!theCmd.providesPreview) {
		throw new Meteor.Error('error-invalid-command', 'Command Does Not Provide Previews', {
			method: 'executeSlashCommandPreview',
		});
	}

	return slashCommands.getPreviews(command.cmd, command.params, command.msg, command.userId);
};

Meteor.methods<ServerMethods>({
	async getSlashCommandPreviews(command) {
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'getSlashCommandPreview',
			});
		}

		return getSlashCommandPreviews({ ...command, userId });
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Ensure Meteor.userId() is truthy before issuing the call
  2. Re-authenticate when the resume token was invalidated, then retry the preview request
  3. For DDP scripts, always complete a login method call before invoking domain methods

Example fix

// before
Meteor.call('getSlashCommandPreviews', { cmd, params, msg });

// after
if (!Meteor.userId()) {
  // route to login / re-auth flow instead of calling
} else {
  Meteor.call('getSlashCommandPreviews', { cmd, params, msg });
}
Defensive patterns

Strategy: validation

Validate before calling

const userId = Meteor.userId();
if (!userId) {
  // not logged in — trigger the auth flow instead of calling the method
}

Try / catch

try {
  const previews = await Meteor.callAsync('getSlashCommandPreviews', command);
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-invalid-user') {
    // session expired — route to login and re-run after re-auth
  } else {
    throw error;
  }
}

Prevention

When it happens

Trigger: Meteor.call('getSlashCommandPreviews', ...) from a logged-out tab, after the resume token was invalidated (password change, 'logout other locations', session expiry), or from a raw DDP client (node-ddp-client, python) that connected but never called the login method.

Common situations: Long-lived browser tabs whose Meteor session expired; bots and automation scripts that open a DDP connection and call methods without logging in first; races where the preview request fires during logout or before login completes.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/aa9232e70c6e11f4. Report an issue: GitHub.