{"record":{"id":"27c6221f9b7c67fd","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-27c622","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/messages/getMessages.ts","lineNumber":22,"sourceCode":"import { check } from 'meteor/check';\nimport { Meteor } from 'meteor/meteor';\n\nimport { canAccessRoomIdAsync } from '../../lib/authorization/canAccessRoom';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tgetMessages(messages: IMessage['_id'][]): Promise<IMessage[]>;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync getMessages(messages) {\n\t\tcheck(messages, [String]);\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'getMessages' });\n\t\t}\n\n\t\tconst msgs = await Messages.findVisibleByIds(messages).toArray();\n\t\tconst rids = await Promise.all([...new Set(msgs.map((m) => m.rid))].map((_id) => canAccessRoomIdAsync(_id, uid)));\n\n\t\tif (!rids.every(Boolean)) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'getSingleMessage' });\n\t\t}\n\n\t\treturn msgs;\n\t},\n});\n","sourceCodeStart":4,"sourceCodeEnd":35,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/messages/getMessages.ts#L4-L35","documentation":"getMessages throws 'error-invalid-user' when the DDP connection has no authenticated user (Meteor.userId() null) before fetching anything. Batch message fetching must run as a user so the per-room access check that follows (canAccessRoomIdAsync for every distinct rid) can be evaluated.","triggerScenarios":"Meteor.call('getMessages', ids) on an unauthenticated or expired connection.","commonSituations":"Quote/preview resolvers running after logout; scripts bulk-resolving message ids over DDP without a login step.","solutions":["Guard on Meteor.userId() and re-login when null","For single-message needs use the REST endpoint /v1/chat.getMessage with an auth token","Prefer authenticated REST endpoints for integration use cases"],"exampleFix":"// before\nMeteor.call('getMessages', ids);\n\n// after\nif (!Meteor.userId()) {\n  throw new Error('Login required');\n}\nMeteor.call('getMessages', ids);","handlingStrategy":"validation","validationCode":"if (!Meteor.userId()) {\n  throw new Error('Login required to fetch messages');\n}\nMeteor.call('getMessages', ids);","typeGuard":null,"tryCatchPattern":"try {\n  const msgs = await Meteor.callAsync('getMessages', ids);\n} catch (e) {\n  if ((e as Meteor.Error).error === 'error-invalid-user') {\n    // re-authenticate, then retry the batch\n  }\n}","preventionTips":["Guard batch resolvers (quote previews, unfurls) on an active session","For single messages prefer REST /v1/chat.getMessage with a token","Key error handling off 'error-invalid-user', not the message text"],"tags":["meteor","ddp","authentication","messages"],"backgroundTag":"user-not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}