{"record":{"id":"23de5c9c117f4f8d","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-23de5c","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/setEmail.ts","lineNumber":47,"sourceCode":"\t\treturn email;\n\t}\n\n\tif (!(await setEmail(user._id, email))) {\n\t\tthrow new Meteor.Error('error-could-not-change-email', 'Could not change email', {\n\t\t\tmethod: 'setEmail',\n\t\t});\n\t}\n\n\treturn email;\n};\n\nMeteor.methods<ServerMethods>({\n\tasync setEmail(email) {\n\t\tmethodDeprecationLogger.method('setEmail', '9.0.0', '/v1/users.updateOwnBasicInfo');\n\t\tconst user = await Meteor.userAsync();\n\n\t\tif (!user) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setEmail' });\n\t\t}\n\n\t\treturn setEmailFunction(email, user);\n\t},\n});\n\nRateLimiter.limitMethod('setEmail', 1, 1000, {\n\tuserId(/* userId*/) {\n\t\treturn true;\n\t},\n});\n","sourceCodeStart":29,"sourceCodeEnd":59,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/setEmail.ts#L29-L59","documentation":"The setEmail method wrapper requires an authenticated user: it calls Meteor.userAsync() and throws error-invalid-user when the result is null, before delegating to setEmailFunction.","triggerScenarios":"Meteor.call('setEmail', email) executed with no logged-in user - expired login token, post-logout call, or a server-side invocation without user context.","commonSituations":"Session expiring between page load and form submit; custom clients or scripts calling the method cold; test harnesses without a simulated user.","solutions":["Guard the call with Meteor.userId() on the client and re-login when null","For server-side flows use REST /v1/users.updateOwnBasicInfo with an auth token instead of the DDP method","Catch error-invalid-user and route the user back to login"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const user = Meteor.userId();\nif (!user) {\n  throw new Error('Login required before changing email');\n}","typeGuard":null,"tryCatchPattern":"catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {\n    Meteor.logout();\n    redirectToLogin();\n  }\n}","preventionTips":["Guard account-mutation calls with Meteor.userId() at the form-submit handler","For headless flows use REST endpoints with tokens instead of DDP methods","Handle token expiry centrally (e.g. an Accounts.onLogin / 401 interceptor) instead of per-method"],"tags":["meteor","email","authentication","ddp"],"backgroundTag":"authentication-required","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}