RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The 'authorization:addPermissionToRole' DDP method (deprecated in favor of POST /api/v1/permissions.addRole) requires a logged-in user; Meteor.userId() returning null throws error-invalid-user before delegating to the permission-checked core logic. It protects role-permission edits from anonymous connections.

Source

Thrown at apps/meteor/server/meteor-methods/auth/addPermissionToRole.ts:19

import type { ServerMethods } from '@rocket.chat/ddp-client';
import { Meteor } from 'meteor/meteor';

import { addPermissionToRoleMethod } from '../../lib/authorization/permissionRole';
import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		'authorization:addPermissionToRole'(permissionId: string, role: string): void;
	}
}

Meteor.methods<ServerMethods>({
	async 'authorization:addPermissionToRole'(permissionId, role) {
		methodDeprecationLogger.method('authorization:addPermissionToRole', '9.0.0', '/v1/permissions.addRole');
		const uid = Meteor.userId();
		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'authorization:addPermissionToRole' });
		}
		await addPermissionToRoleMethod(uid, permissionId, role);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Re-authenticate the DDP connection (login or loginWithToken) and retry.
2. Use the REST equivalent POST /api/v1/permissions.addRole with an admin token.
3. Redirect the user to login when the session is no longer valid.

Example fix

// before: session expired, Meteor.userId() is null
Meteor.call('authorization:addPermissionToRole', permissionId, role);

// after: ensure a live session before acting
const uid = Meteor.userId();
if (!uid) { await reauthenticate(); }
Meteor.call('authorization:addPermissionToRole', permissionId, role);

const uid = Meteor.userId();
if (!uid) {
  await reauthenticate();
}
Meteor.call('authorization:addPermissionToRole', permissionId, role);

try {
  await Meteor.callAsync('authorization:addPermissionToRole', permissionId, role);
} catch (err: any) {
  if (err?.error === 'error-invalid-user' && err?.details?.method === 'authorization:addPermissionToRole') {
    return redirectToLogin(); // session expired mid-admin
  }
  throw err;
}

When it happens

Trigger: Meteor.call('authorization:addPermissionToRole', permissionId, role) on a connection without a valid login session — expired token, never-logged-in bot connection, or logged-out admin tab.

Common situations: Permission-management UI driven by a stale session; scripts calling DDP methods directly without login; token expiry in the middle of an admin session.

Related errors

• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/ed761dc6d8c053a2. Report an issue: GitHub.