{"record":{"id":"36ed50e12baa67a1","repo":"RocketChat/Rocket.Chat","slug":"invalid-user-36ed50","errorCode":null,"errorMessage":"invalid user","messagePattern":"invalid user","errorType":"exception","errorClass":"Error","httpStatus":500,"severity":"error","filePath":"apps/meteor/server/modules/core-apps/nps.module.ts","lineNumber":65,"sourceCode":"\n\t\tconst [npsId] = Object.keys(state);\n\n\t\tconst bannerId = viewId.replace(`${npsId}-`, '');\n\n\t\tconst {\n\t\t\t[npsId]: { 'nps-score': score, comment },\n\t\t} = state;\n\n\t\tawait NPS.vote({\n\t\t\tnpsId,\n\t\t\tuserId,\n\t\t\tcomment: String(comment),\n\t\t\troles,\n\t\t\tscore: Number(score),\n\t\t});\n\n\t\tif (!userId) {\n\t\t\tthrow new Error('invalid user');\n\t\t}\n\n\t\tawait Banner.dismiss(userId, bannerId);\n\t}\n}\n","sourceCodeStart":47,"sourceCodeEnd":71,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/modules/core-apps/nps.module.ts#L47-L71","documentation":"Final guard in NpsModule.viewSubmit: the user is destructured with a default of {} (user: { _id: userId, roles } = {}), the vote is recorded via NPS.vote, and only afterwards does the check run — so a payload without user._id throws 'invalid user'. Note the ordering: NPS.vote is attempted before the guard fires.","triggerScenarios":"A viewSubmit payload whose user is undefined or lacks _id, e.g. submissions from custom clients that omit identity, or middleware stripping the user field.","commonSituations":"Bots or scripts submitting NPS modals without an acting user; refactors of the payload envelope; testing payloads built by hand.","solutions":["Always include the acting user (with _id) on viewSubmit payloads","Validate payload.user before dispatch","If you already hit this, audit NPS vote records — the vote call runs before the guard and may have recorded data without a user","Fix client identity propagation so the interaction carries Meteor.userId()"],"exampleFix":"// before\nawait nps.viewSubmit({ payload: { view: { state, id: viewId } } }); // user missing -> 'invalid user'\n\n// after\nawait nps.viewSubmit({\n  user: { _id: Meteor.userId()!, roles: Meteor.user()?.roles },\n  payload: { view: { state, id: viewId } },\n});","handlingStrategy":"validation","validationCode":"const hasActingUser = (p: any): boolean => Boolean(p?.user?._id);","typeGuard":"const hasUserId = (p: unknown): p is { user: { _id: string } } =>\n  typeof p === 'object' && p !== null && typeof (p as any).user?._id === 'string';","tryCatchPattern":null,"preventionTips":["Always attach the acting user before dispatching any viewSubmit","Audit NPS vote records if this fires — the vote call runs before the guard","Propagate Meteor.userId() into every interaction payload in custom clients"],"tags":["uikit","nps","user-context","payload-validation"],"backgroundTag":"missing-user-id","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}