{"record":{"id":"1c644e3276b70254","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-1c644e","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/utils/slashCommand.ts","lineNumber":147,"sourceCode":"\t\t}\n\n\t\treturn cmd.previewCallback(command, params, message, preview, userId, triggerId);\n\t},\n};\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tslashCommand(params: { cmd: string; params: string; msg: IMessage; triggerId: string }): unknown;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync slashCommand(command) {\n\t\tmethodDeprecationLogger.method('slashCommand', '9.0.0', '/v1/commands.run');\n\t\tconst userId = Meteor.userId();\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'slashCommand',\n\t\t\t});\n\t\t}\n\n\t\tif (!command?.cmd || !slashCommands.commands[command.cmd]) {\n\t\t\tthrow new Meteor.Error('error-invalid-command', 'Invalid Command Provided', {\n\t\t\t\tmethod: 'executeSlashCommandPreview',\n\t\t\t});\n\t\t}\n\n\t\treturn slashCommands.run({\n\t\t\tcommand: command.cmd,\n\t\t\tparams: command.params,\n\t\t\tmessage: command.msg,\n\t\t\ttriggerId: command.triggerId,\n\t\t\tuserId,\n\t\t});\n\t},","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/utils/slashCommand.ts#L129-L165","documentation":"The 'slashCommand' Meteor method requires an authenticated DDP connection; Meteor.userId() returning null (no resume token, anonymous connection, invalidated login) throws error-invalid-user before any command lookup. This is the standard Rocket.Chat 'method called without a logged-in user' guard; the method is deprecated in favor of POST /v1/commands.run, which authenticates via headers.","triggerScenarios":"Meteor.call('slashCommand', ...) from a connection without a resumed login session; server-side invocation outside any user context; expired/revoked login token (logout-all) on a still-open socket.","commonSituations":"Bots or scripts using DDP without calling login/loginWithToken first; custom clients that skip the Accounts login flow; long-lived connections whose tokens were revoked.","solutions":["Log in over DDP (Meteor.loginWithToken or accounts login) before invoking the method.","For server-to-server use, call REST POST /api/v1/commands.run with X-Auth-Token/X-User-Id headers instead.","On token expiry, re-authenticate and retry once."],"exampleFix":"// before: anonymous DDP connection\nMeteor.call('slashCommand', { cmd: 'gimme', params: 'cat', msg });\n\n// after: authenticated REST call\nawait fetch('/api/v1/commands.run', {\n  method: 'POST',\n  headers: { 'Content-Type': 'application/json', 'X-Auth-Token': authToken, 'X-User-Id': uid },\n  body: JSON.stringify({ command: '/gimme', roomId: msg.rid, params: 'cat' }),\n});","handlingStrategy":"validation","validationCode":"const uid = Meteor.userId();\nif (!uid) {\n  await reauthenticate(); // or redirect to login\n}\nMeteor.call('slashCommand', { cmd, params, msg });","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('slashCommand', { cmd, params, msg });\n} catch (err: any) {\n  if (err?.error === 'error-invalid-user' && err?.reason === 'Invalid user') {\n    await reauthenticate();\n    return Meteor.callAsync('slashCommand', { cmd, params, msg }); // retry once with fresh credentials\n  }\n  throw err;\n}","preventionTips":["Establish the DDP session and await login before any privileged Meteor.call.","Prefer REST endpoints with explicit token headers for automation — they fail loudly with 401s.","Re-issue credentials on token expiry rather than retrying blindly."],"tags":["authentication","meteor-methods","slash-commands","ddp"],"backgroundTag":"not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}