{"record":{"id":"3673b9010e6900b8","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-3673b9","errorCode":"error-invalid-user","errorMessage":"Invalid User","messagePattern":"Invalid User","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/bridges/webdav/methods/addWebdavAccount.ts","lineNumber":21,"sourceCode":"import type { ServerMethods } from '@rocket.chat/ddp-client';\nimport { WebdavAccounts } from '@rocket.chat/models';\nimport { Match, check } from 'meteor/check';\nimport { Meteor } from 'meteor/meteor';\n\nimport { settings } from '../../../settings';\nimport { WebdavClientAdapter } from '../lib/webdavClientAdapter';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\taddWebdavAccount(formData: IWebdavAccountPayload): boolean;\n\t\taddWebdavAccountByToken(data: IWebdavAccountPayload): boolean;\n\t}\n}\n\nexport const addWebdavAccountByToken = async (userId: string, data: IWebdavAccountPayload): Promise<boolean> => {\n\tif (!userId) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'addWebdavAccount' });\n\t}\n\n\tif (!settings.get('Webdav_Integration_Enabled')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {\n\t\t\tmethod: 'addWebdavAccount',\n\t\t});\n\t}\n\n\tcheck(\n\t\tdata,\n\t\tMatch.ObjectIncluding({\n\t\t\tserverURL: String,\n\t\t\ttoken: Match.ObjectIncluding({\n\t\t\t\taccess_token: String,\n\t\t\t\ttoken_type: String,\n\t\t\t\trefresh_token: Match.Optional(String),\n\t\t\t}),\n\t\t\tname: Match.Maybe(String),","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/bridges/webdav/methods/addWebdavAccount.ts#L3-L39","documentation":"Thrown by the addWebdavAccountByToken helper (used by the addWebdavAccount Meteor methods) when the supplied userId is falsy. The helper is the shared implementation behind both the form-based and token-based WebDAV account flows; it requires a resolved user id before it checks the Webdav_Integration_Enabled setting or validates the payload.","triggerScenarios":"The method is invoked without a bound user id - e.g. from server code that did not pass a userId, or from a client flow where the login was not established before the call. addWebdavAccountByToken is also exported and may be called directly with an empty string.","commonSituations":"Custom server code calls addWebdavAccountByToken('') or omits the id. A client method wrapper passes the wrong variable. OAuth token flow fails to resolve the user before invoking the helper.","solutions":["Ensure a valid userId is passed: in Meteor methods derive it from Meteor.userId() inside the method body and pass it explicitly to the helper.","Guard the call site: if (!userId) return error before invoking addWebdavAccountByToken.","For the token flow, resolve the user from the OAuth token first and only then call the helper with the resolved id."],"exampleFix":"// before\nawait addWebdavAccountByToken('', data) // empty userId\n\n// after\nconst userId = Meteor.userId()\nif (!userId) throw new Meteor.Error('error-invalid-user', 'login required')\nawait addWebdavAccountByToken(userId, data)","handlingStrategy":"validation","validationCode":"if (!userId || typeof userId !== 'string') {\n  throw new Meteor.Error('error-invalid-user','login required');\n}\nawait addWebdavAccountByToken(userId, data);","typeGuard":"function isNonEmptyUserId(id) { return typeof id === 'string' && id.trim().length > 0; }","tryCatchPattern":"try { await addWebdavAccountByToken(userId, data); }\ncatch (e) {\n  if (e?.error === 'error-invalid-user') { userId = Meteor.userId(); await addWebdavAccountByToken(userId, data); return; }\n  throw e;\n}","preventionTips":["Derive userId from Meteor.userId() inside method bodies and pass it explicitly.","Resolve the user from the OAuth token before calling the token-based helper.","Guard exported helpers with an id check at the call site."],"tags":["meteor","methods","webdav","bridge","authentication","users"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}