RocketChat/Rocket.Chat · error

Invalid user

Error message

Invalid user

What it means

Users.findOneById(fromId) returned null inside banUserFromRoomMethod: the authenticated userId behind the request has no user document. In practice this only happens when the user was deleted while their token/session was still valid, or a forged or mismatched userId reaches the method. It is an integrity signal rather than a normal client error.

Source

Thrown at apps/meteor/server/lib/banUserFromRoom.ts:24

import { hasRoleAsync } from './authorization/hasRole';
import { banUserFromRoom } from './rooms/banUserFromRoom';
import { roomCoordinator } from './rooms/roomCoordinator';
import { RoomMemberActions } from '../../definition/IRoomTypeConfig';

export const banUserFromRoomMethod = async (fromId: string, data: { rid: string; username: string }): Promise<boolean> => {
	if (!(await hasPermissionAsync(fromId, 'ban-user', data.rid))) {
		throw new Error('Not allowed');
	}

	const room = await Rooms.findOneById(data.rid);

	if (!room || !(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.BAN, fromId))) {
		throw new Error('Not allowed');
	}

	const fromUser = await Users.findOneById(fromId);
	if (!fromUser) {
		throw new Error('Invalid user');
	}

	if (!(await canAccessRoomAsync(room, fromUser))) {
		throw new Error('The required "roomId" or "roomName" param provided does not match any group');
	}

	const bannedUser = await Users.findOneByUsernameIgnoringCase(data.username);
	if (!bannedUser) {
		throw new Error('User not found');
	}

	const subscription = await Subscriptions.findOneByRoomIdAndUserId(data.rid, bannedUser._id, {
		projection: { _id: 1, status: 1 },
	});
	if (!subscription) {
		throw new Error('User is not in this room');
	}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Re-authenticate to obtain a session tied to an existing user
  2. Verify the account still exists (users.info) with an admin token
  3. If it persists, purge orphaned tokens/sessions belonging to the deleted user
Defensive patterns

Strategy: try-catch

Validate before calling

const { user } = await GET '/api/v1/users.info' { userId: uid }; // admin token
if (!user) {
  // session points at a deleted account - force re-login
}

Try / catch

try {
  await POST '/api/v1/rooms.banUser' { roomId, username };
} catch (e) {
  if (String(e.message).includes('Invalid user')) {
    // caller's account no longer exists - invalidate token and re-authenticate
  } else {
    throw e;
  }
}

Prevention

When it happens

Trigger: User deleted (or merged) after their token was issued; token reuse after account removal; a test harness passing a made-up fromId into the method.

Common situations: Offboarding automation deleting users with live sessions; duplicate-account cleanup; interrupted user-migration jobs.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e7eb112efa93196a. Report an issue: GitHub.