{"record":{"id":"1bee6eacbfd0797d","repo":"wekan/wekan","slug":"error-invalid-user-1bee6e","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"server/methods/lockoutSettings.js","lineNumber":28,"sourceCode":"function reportLockout({ userId, failedAttempts, lockoutSeconds }) {\n  try {\n    require('/server/lib/securityLog').record({\n      key: 'brute.lockout',\n      action: 'blocked',\n      source: 'DDP login',\n      detail: `locked one address out of account ${userId} after ${failedAttempts} `\n        + `wrong passwords, for ${lockoutSeconds}s`,\n    });\n  } catch (e) { /* logging must never break the guard */ }\n}\n\n\nMeteor.methods({\n  async reloadAccountsLockout() {\n    // Check if user has admin rights\n    const userId = this.userId;\n    if (!userId) {\n      throw new Meteor.Error('error-invalid-user', 'Invalid user');\n    }\n    const user = await ReactiveCache.getUser(userId);\n    if (!user || !user.isAdmin) {\n      throw new Meteor.Error('error-not-allowed', 'Not allowed');\n    }\n\n    try {\n      // Get configurations from database\n      const knownUsersConfig = {\n        failuresBeforeLockout: (await LockoutSettings.findOneAsync('known-failuresBeforeLockout'))?.value || 3,\n        lockoutPeriod: (await LockoutSettings.findOneAsync('known-lockoutPeriod'))?.value || 60,\n        failureWindow: (await LockoutSettings.findOneAsync('known-failureWindow'))?.value || 15\n      };\n\n      const unknownUsersConfig = {\n        failuresBeforeLockout: (await LockoutSettings.findOneAsync('unknown-failuresBeforeLockout'))?.value || 3,\n        lockoutPeriod: (await LockoutSettings.findOneAsync('unknown-lockoutPeriod'))?.value || 60,\n        failureWindow: (await LockoutSettings.findOneAsync('unknown-failureWindow'))?.value || 15","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/wekan/wekan/blob/eb1433158b1804bcf3edaa5cb18f08ae2e04d6c2/server/methods/lockoutSettings.js#L10-L46","documentation":"reloadAccountsLockout in server/methods/lockoutSettings.js throws error-invalid-user when this.userId is falsy — the method was called without an authenticated session. It reloads account-lockout settings and is admin-gated on the very next check, so anonymous invocation is rejected first.","triggerScenarios":"Meteor.call('reloadAccountsLockout') from a logged-out client, anonymous DDP connection, or after session expiry; server-internal call where this.userId is undefined.","commonSituations":"Settings page fires before auth completes; test harness invoking the method without a logged-in user; proxy stripping auth cookies.","solutions":["Ensure login before calling: guard on Meteor.userId().","Re-authenticate after token expiry and retry.","For automation, use an admin REST endpoint with a token instead of raw DDP.","Only invoke the method from the admin settings UI path."],"exampleFix":"// before\nMeteor.call('reloadAccountsLockout', cb); // anonymous\n// after\nif (Meteor.userId()) Meteor.call('reloadAccountsLockout', cb);\nelse loginRedirect();","handlingStrategy":"try-catch","validationCode":"if (!Meteor.userId()) { redirectToLogin(); } else { Meteor.call('reloadAccountsLockout', ...); }","typeGuard":"function isLoggedIn() { return typeof Meteor !== 'undefined' && Boolean(Meteor.userId()); }","tryCatchPattern":"Meteor.call('reloadAccountsLockout', (err) => {\n  if (err && err.error === 'error-invalid-user') { redirectToLogin(); return; }\n  if (err) throw err;\n  notify('Lockout settings reloaded');\n});","preventionTips":["Fire settings reloads only after login completes (post-auth lifecycle hooks).","Use an admin REST token for automated settings changes.","Re-authenticate after session expiry instead of retrying.","Keep the call inside the admin settings UI path."],"tags":["authentication","authorization","admin-only","account-lockout"],"backgroundTag":"unauthenticated-ddp-call","analyzedSha":"eb1433158b1804bcf3edaa5cb18f08ae2e04d6c2","analyzedAt":"2026-09-01T21:05:02.951Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}