RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

startImport's authentication gate: after payload validation it reads `Meteor.userId()` and throws error-invalid-user when null. The method mutates workspace data, so an anonymous or expired session is rejected before the permission check.

Source

Thrown at apps/meteor/server/meteor-methods/import/startImport.ts:45

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		startImport(params: StartImportParamsPOST): void;
	}
}

Meteor.methods<ServerMethods>({
	async startImport({ input }: StartImportParamsPOST) {
		methodDeprecationLogger.method('startImport', '9.0.0', '/v1/startImport');
		if (!input || typeof input !== 'object' || !isStartImportParamsPOST({ input })) {
			throw new Meteor.Error(`Invalid Selection data provided to the importer.`);
		}

		const userId = Meteor.userId();
		// Takes name and object with users / channels selected to import
		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', 'startImport');
		}

		if (!(await hasPermissionAsync(userId, 'run-import'))) {
			throw new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'startImport');
		}

		return executeStartImport({ input }, userId);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Confirm `Meteor.userId()` immediately before startImport and re-login if null
  2. Handle error-invalid-user by re-authenticating and retrying once
  3. Use POST /v1/startImport with user credentials for programmatic flows

Example fix

// before
Meteor.call('startImport', { input }, cb); // error-invalid-user

// after
if (!Meteor.userId()) { await relogin(); }
Meteor.call('startImport', { input }, cb);
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) { await relogin(); }
Meteor.call('startImport', { input }, cb);

Try / catch

Meteor.call('startImport', { input }, (err) => {
  if (err && (err as Meteor.Error).error === 'error-invalid-user') {
    // re-login and retry once
  }
});

Prevention

When it happens

Trigger: Invoking `Meteor.call('startImport', { input })` from a connection whose login token expired or that never authenticated; server-side invocation without a bound user.

Common situations: Users leaving the import wizard open past session expiry before clicking Start; automation calling the method without login; session cleared between preparation and start steps.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/efcd9e9fb2f5ce67. Report an issue: GitHub.