{"record":{"id":"1f0810d572eabff1","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-1f0810","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/cloud/finishOAuthAuthorization.ts","lineNumber":63,"sourceCode":"\t\t}\n\n\t\tpayload = await response.json();\n\t} catch (err) {\n\t\tSystemLogger.error({\n\t\t\tmsg: 'Failed to finish OAuth authorization with Rocket.Chat Cloud',\n\t\t\turl: '/api/oauth/token',\n\t\t\terr,\n\t\t});\n\n\t\treturn false;\n\t}\n\n\tconst expiresAt = new Date();\n\texpiresAt.setSeconds(expiresAt.getSeconds() + payload.expires_in);\n\n\tconst uid = Meteor.userId();\n\tif (!uid) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'cloud:finishOAuthAuthorization',\n\t\t});\n\t}\n\n\tawait Users.updateOne(\n\t\t{ _id: uid },\n\t\t{\n\t\t\t$set: {\n\t\t\t\t'services.cloud': {\n\t\t\t\t\taccessToken: payload.access_token,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\tscope: payload.scope,\n\t\t\t\t\ttokenType: payload.token_type,\n\t\t\t\t\trefreshToken: payload.refresh_token,\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t);","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/cloud/finishOAuthAuthorization.ts#L45-L81","documentation":"After exchanging the OAuth code for tokens, finishOAuthAuthorization needs the logged-in user (Meteor.userId()) to attach the cloud service credentials to that user's document. If the method call arrives without an authenticated user, it throws error-invalid-user with method 'cloud:finishOAuthAuthorization'.","triggerScenarios":"The admin's Rocket.Chat session expired — or they logged out in another tab — while sitting on the cloud consent screen, so the finishing DDP call carries no userId.","commonSituations":"Long delays on the cloud OAuth consent page; server restart forcing re-login; account login lifetime settings too short; multiple logins invalidating the session.","solutions":["Log back into Rocket.Chat and restart the cloud registration flow from the beginning.","Complete the cloud consent step promptly after the redirect to avoid session expiry.","Review Accounts session lifetime settings if this recurs for many users."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before finishing the OAuth leg, make sure the session is still alive\nif (!Meteor.userId()) {\n  throw new Error('session expired during cloud OAuth — log in again and restart the flow');\n}\nawait Meteor.callAsync('cloud:finishOAuthAuthorization', code, state);","typeGuard":"const isSessionAlive = (): boolean => Meteor.userId() != null;","tryCatchPattern":"try {\n  await Meteor.callAsync('cloud:finishOAuthAuthorization', code, state);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-invalid-user' && e.details?.method === 'cloud:finishOAuthAuthorization') {\n    // session dropped mid-flow: re-login and restart the cloud registration\n  }\n  throw e;\n}","preventionTips":["Complete the cloud consent step promptly after the redirect instead of leaving the tab open.","Re-check Meteor.userId() on the callback page before invoking the finishing method.","Keep Accounts login lifetime sane for admin flows that involve external redirects."],"tags":["oauth","session-expired","cloud","rocket-chat"],"backgroundTag":"session-expired-during-oauth","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}