RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The deprecated 'authorization:removeRoleFromPermission' method throws 'error-invalid-user' when Meteor.userId() returns null, i.e. the DDP connection is not authenticated. The permission-role change requires an identified admin caller. Deprecated since 9.0.0 in favor of /v1/permissions.removeRole.

Source

Thrown at apps/meteor/server/meteor-methods/auth/removeRoleFromPermission.ts:19

import type { ServerMethods } from '@rocket.chat/ddp-client';
import { Meteor } from 'meteor/meteor';

import { removeRoleFromPermissionMethod } from '../../lib/authorization/permissionRole';
import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		'authorization:removeRoleFromPermission'(permissionId: string, role: string): void;
	}
}

Meteor.methods<ServerMethods>({
	async 'authorization:removeRoleFromPermission'(permissionId, role) {
		methodDeprecationLogger.method('authorization:removeRoleFromPermission', '9.0.0', '/v1/permissions.removeRole');
		const uid = Meteor.userId();
		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'authorization:removeRoleFromPermission' });
		}
		await removeRoleFromPermissionMethod(uid, permissionId, role);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Log in with a valid session before calling 'authorization:removeRoleFromPermission'
2. Migrate to /v1/permissions.removeRole with an authenticated request
3. Handle session expiry centrally (re-login, retry once)

const uid = Meteor.userId();
if (!uid) {
  // re-login before modifying permission-role mappings
}
await Meteor.callAsync('authorization:removeRoleFromPermission', permissionId, role);

try {
  await Meteor.callAsync('authorization:removeRoleFromPermission', permissionId, role);
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {
    // session expired: re-login, then retry
  }
}

When it happens

Trigger: Calling the method while logged out or with an expired resume token, e.g. from a stale admin permissions page or an anonymous script.

Common situations: Session invalidated after a server restart or concurrent login; automation invoking the method without login.

Related errors

• error-not-allowed
• error-invalid-role
• error-permission-not-found
• The required "roomId" or "roomName" param provided does not
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/fd7375c0826f1c3b. Report an issue: GitHub.