{"record":{"id":"26e4dc1387309e35","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-room-26e4dc","errorCode":null,"errorMessage":"error-invalid-room","messagePattern":"error-invalid-room","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/authorization/canSendMessage.ts","lineNumber":23,"sourceCode":"import { hasPermissionAsync } from './hasPermission';\nimport { RoomMemberActions } from '../../../definition/IRoomTypeConfig';\nimport { roomCoordinator } from '../rooms/roomCoordinator';\n\nconst subscriptionOptions = {\n\tprojection: {\n\t\tblocked: 1,\n\t\tblocker: 1,\n\t},\n};\n\n// TODO: remove option uid and username and type\nexport async function validateRoomMessagePermissionsAsync(\n\troom: IRoom | null,\n\targs: { uid: IUser['_id']; username: IUser['username']; type: IUser['type'] } | IUser,\n\textraData?: Record<string, any>,\n): Promise<void> {\n\tif (!room) {\n\t\tthrow new Error('error-invalid-room');\n\t}\n\n\tif (room.archived) {\n\t\tthrow new Error('room_is_archived');\n\t}\n\tif (args.type !== 'app' && !(await canAccessRoomAsync(room, 'uid' in args ? { _id: args.uid } : args, extraData))) {\n\t\tthrow new Error('error-not-allowed');\n\t}\n\n\tif (\n\t\tawait roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.BLOCK, 'uid' in args ? args.uid : args._id)\n\t) {\n\t\tconst subscription = await Subscriptions.findOneByRoomIdAndUserId(room._id, 'uid' in args ? args.uid : args._id, subscriptionOptions);\n\t\tif (subscription && (subscription.blocked || subscription.blocker)) {\n\t\t\tthrow new Error('room_is_blocked');\n\t\t}\n\t}\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/authorization/canSendMessage.ts#L5-L41","documentation":"validateRoomMessagePermissionsAsync throws error-invalid-room (plain Error) when the room argument passed in is null. This differs from the lookup variant in canSendMessageAsync: here the caller already resolved the room and passed null, so the failure is an upstream lookup that found nothing.","triggerScenarios":"Calling validateRoomMessagePermissionsAsync(null, user, ...) — code that did Rooms.findOneById(rid) without checking the result, or a hook/webhook passing an absent room object.","commonSituations":"Integrations forwarding to rooms that were deleted; stale or mistyped room ids in configuration; code refactored to call the permissions function before validating its own lookup.","solutions":["Check the room lookup result before calling and fail fast with a clear error if missing","Prefer canSendMessageAsync(rid, user) which performs lookup plus validation in one step","Validate rid existence at the trust boundary (API handler/webhook) before touching authorization"],"exampleFix":"// before\nconst room = await Rooms.findOneById(rid);\nawait validateRoomMessagePermissionsAsync(room, user); // room may be null -> error-invalid-room\n\n// after\nconst room = await Rooms.findOneById(rid);\nif (!room) throw new Meteor.Error('error-invalid-room', `Room ${rid} not found`);\nawait validateRoomMessagePermissionsAsync(room, user);","handlingStrategy":"type-guard","validationCode":"const room = await Rooms.findOneById(rid);\nif (!isExistingRoom(room)) {\n  throw new Meteor.Error('error-invalid-room', `Room not found: ${rid}`);\n}\nawait validateRoomMessagePermissionsAsync(room, user, extraData);","typeGuard":"const isExistingRoom = (room: IRoom | null | undefined): room is IRoom => !!room?._id;","tryCatchPattern":null,"preventionTips":["Never call permission validators with unchecked lookup results","Centralize room resolution in one helper that throws a descriptive error","Validate rid inputs at API/webhook boundaries"],"tags":["authorization","rooms","validation","null-safety"],"backgroundTag":"invalid-room-id","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}