RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The Meteor method wrapper for toggleFavorite throws error-invalid-user when Meteor.userId() is null — there is no authenticated user on the connection. The method is also deprecated since 9.0.0 in favor of the REST endpoint POST /api/v1/rooms.favorite.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/toggleFavorite.ts:40

	const { modifiedCount } = await Subscriptions.setFavoriteByRoomIdAndUserId(rid, userId, favorite);

	if (modifiedCount) {
		void notifyOnSubscriptionChangedByRoomIdAndUserId(rid, userId);
	}

	return modifiedCount;
};

Meteor.methods<ServerMethods>({
	async toggleFavorite(rid, favorite) {
		methodDeprecationLogger.method('toggleFavorite', '9.0.0', '/v1/rooms.favorite');
		check(rid, String);
		check(favorite, Match.Optional(Boolean));
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'toggleFavorite',
			});
		}

		return toggleFavoriteMethod(userId, rid, favorite);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Ensure login completed (Meteor.userId() non-null) before calling; re-authenticate on token expiry
2. Migrate to REST: POST /api/v1/rooms.favorite with { roomId, favorite } and an auth token
3. Gate favorite actions on an authenticated session state so logged-out clients never fire the method

Example fix

// before
Meteor.call('toggleFavorite', rid, true);

// after (9.0.0+)
await fetch('/api/v1/rooms.favorite', {
  method: 'POST',
  headers: { 'X-Auth-Token': token, 'X-User-Id': uid, 'Content-Type': 'application/json' },
  body: JSON.stringify({ roomId: rid, favorite: true }),
});

const userId = Meteor.userId();
if (!userId) {
  // complete login first; or use REST POST /api/v1/rooms.favorite
}
await Meteor.callAsync('toggleFavorite', rid, true);

try {
  await Meteor.callAsync('toggleFavorite', rid, favorite);
} catch (error) {
  if (error instanceof Meteor.Error && error.error === 'error-invalid-user') {
    // unauthenticated: re-login, then retry or switch to the REST endpoint
  }
}

When it happens

Trigger: Calling Meteor.call('toggleFavorite', ...) before the login handshake completes, with an expired or revoked token, or from server code with no bound user on the connection.

Common situations: Auth races at page load; sessions dropped after password change; integrations still on the legacy method instead of the REST rooms.favorite endpoint after 9.0.0.

Understand the failure class

Background: error-invalid-user: "Invalid user" errors in Rocket.Chat — what they mean and how to fix them — this error's family across 2 libraries.

Related errors

• Adding SAML service is deprecated
• error-invalid-user
• error-invalid-user
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/fc08c7a34f92682d. Report an issue: GitHub.