RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by the 'deleteFileMessage' Meteor method when the calling connection has no authenticated user (Meteor.userId() === null). File deletion must be attributed to a user for permission checks, so the method aborts before even the check(fileID, String) runs. The deprecation logger points to /v1/chat.delete as the replacement.

Source

Thrown at apps/meteor/server/meteor-methods/messages/deleteFileMessage.ts:24

import type { DeleteResult } from 'mongodb';

import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { FileUpload } from '../../lib/media/file-upload';
import { deleteMessageValidatingPermission } from '../../lib/messages/deleteMessage';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		deleteFileMessage(fileID: string): Promise<void | DeleteResult>;
	}
}

Meteor.methods<ServerMethods>({
	async deleteFileMessage(fileID) {
		methodDeprecationLogger.method('deleteFileMessage', '9.0.0', '/v1/chat.delete');
		const userId = Meteor.userId();
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'deleteFileMessage',
			});
		}
		check(fileID, String);

		const msg = await Messages.getMessageByFileId(fileID);

		if (msg) {
			return deleteMessageValidatingPermission(msg, userId);
		}

		const user = await Users.findOneById(userId, { projection: { username: 1 } });
		if (!user) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'deleteFileMessage',
			});
		}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Check Meteor.userId() before invoking; when null, re-authenticate and retry
2. For integrations, authenticate first (DDP login method) or switch to the REST endpoint /v1/chat.delete with an auth token
3. Centralize method calls in a wrapper that redirects to the login flow on 'error-invalid-user'

Example fix

// before
Meteor.call('deleteFileMessage', fileID);

// after
if (!Meteor.userId()) {
  // trigger re-login, then retry
}
Meteor.call('deleteFileMessage', fileID);

if (!Meteor.userId()) {
  // re-run login flow instead of calling
} else {
  Meteor.call('deleteFileMessage', fileID);
}

try {
  await Meteor.callAsync('deleteFileMessage', fileID);
} catch (e) {
  if ((e as Meteor.Error).error === 'error-invalid-user') {
    // force re-login; do not auto-retry in a loop
  }
}

When it happens

Trigger: Meteor.call('deleteFileMessage', fileID) after the user's DDP session token expired or was revoked, or from an integration/bot that opened a DDP connection but never performed the login handshake.

Common situations: Stale tab after logout elsewhere; automated file-cleanup scripts using DDP without a login step; workspace reset wiped tokens while the client kept its stored resume token.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d5c834457812c291. Report an issue: GitHub.