RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

messageSearch runs a workspace message search on behalf of the caller and requires identity to authorize room-scoped results: Meteor.userId() returning null throws error-invalid-user before the search backend is consulted. The method is deprecated since 9.0.0 in favor of /v1/chat.search.

Source

Thrown at apps/meteor/server/meteor-methods/messages/messageSearch.ts:114

				docs: await Messages.find(query, {
					// @ts-expect-error col.s.db is not typed
					readPreference: readSecondaryPreferred(Messages.col.s.db),
					...options,
				}).toArray(),
			},
		};
	} catch (error) {
		logger.error({ msg: 'Error while finding messages', error });
		throw new Error('error-while-finding-messages', { cause: error });
	}
};

Meteor.methods<ServerMethods>({
	async messageSearch(text, rid, limit, offset) {
		methodDeprecationLogger.method('messageSearch', '9.0.0', '/v1/chat.search');
		const currentUserId = Meteor.userId();
		if (!currentUserId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'messageSearch',
			});
		}

		return messageSearch(currentUserId, text, rid, limit, offset);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Check Meteor.userId() before invoking search and disable the search box when logged out
2. Re-authenticate on session-invalidated events, then retry
3. Migrate to /v1/chat.search which authenticates via REST token

Example fix

// before
const result = await Meteor.callAsync('messageSearch', text, rid, limit, offset);

// after
if (!Meteor.userId()) {
  // search requires a logged-in user
} else {
  const result = await Meteor.callAsync('messageSearch', text, rid, limit, offset);
}

if (!Meteor.userId()) {
  // message search requires a logged-in user
}

try {
  const result = await Meteor.callAsync('messageSearch', text, rid, limit, offset);
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-invalid-user') {
    // session expired — re-authenticate, then retry
  } else {
    throw error;
  }
}

When it happens

Trigger: Meteor.call('messageSearch', text, rid, limit, offset) from a logged-out tab, with an invalidated resume token, or from an unauthenticated DDP client.

Common situations: Search boxes used after session expiry; custom search UIs mounted outside the authenticated shell; bots calling the DDP method without a login step.

Related errors

• User not logged in
• error-invalid-user
• 403
• error-not-allowed
• invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e6812098cc0536b5. Report an issue: GitHub.