RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The `blockUser` Meteor method checks `Meteor.userId()` after argument checks and throws `error-invalid-user` when there is no authenticated session. The method is deprecated since 9.0.0 in favor of the REST endpoint `POST /v1/im.blockUser`. The actual blocking logic lives in `blockUserMethod`, which can throw further domain errors — this one is purely the authentication gate.

Source

Thrown at apps/meteor/server/meteor-methods/users/blockUser.ts:24

import { blockUserMethod } from '../../lib/users/blockUser';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		blockUser({ rid, blocked }: { rid: string; blocked: string }): boolean;
	}
}

Meteor.methods<ServerMethods>({
	async blockUser({ rid, blocked }) {
		methodDeprecationLogger.method('blockUser', '9.0.0', '/v1/im.blockUser');
		check(rid, String);
		check(blocked, String);

		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'blockUser' });
		}

		await blockUserMethod(userId, { rid, blocked });

		return true;
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Ensure the user is logged in (`Meteor.userId()` non-null) before invoking `blockUser`.
  2. Migrate to the REST endpoint `POST /api/v1/im.blockUser` with an auth token — the DDP method is deprecated since 9.0.0.
  3. Re-authenticate on connection invalidation and retry the block.

Example fix

// before (deprecated DDP method)
Meteor.call('blockUser', { rid, blocked });

// after - use the REST endpoint with an authenticated session
await fetch('/api/v1/im.blockUser', {
  method: 'POST',
  headers: { 'X-Auth-Token': token, 'X-User-Id': uid, 'Content-Type': 'application/json' },
  body: JSON.stringify({ rid, blocked }),
});
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) {
  return;
}
// preferred: authenticated REST instead of the deprecated DDP method
await fetch('/api/v1/im.blockUser', { method: 'POST', headers: { 'X-Auth-Token': token, 'X-User-Id': uid, 'Content-Type': 'application/json' }, body: JSON.stringify({ rid, blocked }) });

Type guard

const isAuthenticated = (): boolean => typeof Meteor.userId() === 'string';

Try / catch

try {
  await Meteor.callAsync('blockUser', { rid, blocked });
} catch (e: any) {
  if (e?.error === 'error-invalid-user' && !Meteor.userId()) {
    // authentication gate (not 'user not found'): re-login and retry
  }
}

Prevention

When it happens

Trigger: Calling `Meteor.call('blockUser', { rid, blocked })` while unauthenticated: before login resolves, after logout, with an expired resume token, or from server-side code without a user context.

Common situations: Blocking from a stale logged-out tab; UI actions racing the login flow on page load; integrations still on the deprecated DDP method without a session; version upgrades where clients were migrated to REST but old calls remain in caches.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e9d09b1126567149. Report an issue: GitHub.