RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Authentication gate of the createPrivateGroup Meteor method wrapper: Meteor.userId() returned null, so the DDP connection had no logged-in user. A sibling guard in the same wrapper throws the same code when Users.findOneById cannot load the account afterwards, but line 64 is specifically the missing-login case.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts:64

		if (!(await hasPermissionAsync(user, 'create-team-group', team.roomId))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
		}
	} else if (!(await hasPermissionAsync(user, 'create-p'))) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
	}

	return createRoom('p', name, user, members, excludeSelf, readOnly, {
		...(customFields && Object.keys(customFields).length && { customFields }),
		...extraData,
	});
};

Meteor.methods<ServerMethods>({
	async createPrivateGroup(name, members, readOnly = false, customFields = {}, extraData = {}) {
		const uid = Meteor.userId();

		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'createPrivateGroup',
			});
		}

		const user = await Users.findOneById(uid, { projection: { services: 0 } });
		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'createPrivateGroup',
			});
		}

		return createPrivateGroupMethod(user, name, members, readOnly, customFields, extraData);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Check Meteor.userId() first and await login on the client.
  2. Re-authenticate on session expiry and retry.
  3. Use POST /api/v1/groups.create with token auth for integrations.

Example fix

// before
Meteor.call('createPrivateGroup', name, members);

// after
if (!Meteor.userId()) {
  await relogin();
}
Meteor.call('createPrivateGroup', name, members);
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) {
  // log in before creating private groups
}

Try / catch

try {
  await Meteor.callAsync('createPrivateGroup', name, members);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-invalid-user') {
    await Meteor.logout();
    goToLogin();
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling Meteor.call('createPrivateGroup', ...) before the client login completes; after token invalidation (password change, server restart); from a DDP connection that never logged in.

Common situations: Group-creation UI racing the login flow; stale sessions; scripts that connect but skip login.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/c9922bda410ab20e. Report an issue: GitHub.