{"record":{"id":"3ea910ee590f8ce8","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-3ea910","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"http","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts","lineNumber":12,"sourceCode":"import type { IOAuthApps, IUser } from '@rocket.chat/core-typings';\nimport { OAuthApps, Users } from '@rocket.chat/models';\nimport { Random } from '@rocket.chat/random';\nimport { Meteor } from 'meteor/meteor';\n\nimport { parseUriList } from './parseUriList';\nimport type { OauthAppsAddParams } from '../../../api/v1/oauthapps';\nimport { hasPermissionAsync } from '../../authorization/hasPermission';\n\nexport async function addOAuthApp(applicationParams: OauthAppsAddParams, uid: IUser['_id'] | undefined): Promise<IOAuthApps> {\n\tif (!uid) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'addOAuthApp' });\n\t}\n\n\tconst user = await Users.findOneById(uid, { projection: { username: 1 } });\n\n\tif (!user?.username) {\n\t\t// TODO: username is required, but not always present\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'addOAuthApp' });\n\t}\n\n\tif (!(await hasPermissionAsync(uid, 'manage-oauth-apps'))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'addOAuthApp' });\n\t}\n\n\tif (!applicationParams.name || typeof applicationParams.name.valueOf() !== 'string' || applicationParams.name.trim() === '') {\n\t\tthrow new Meteor.Error('error-invalid-name', 'Invalid name', { method: 'addOAuthApp' });\n\t}\n\n\tif (","sourceCodeStart":1,"sourceCodeEnd":30,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts#L1-L30","documentation":"addOAuthApp() backs POST /api/v1/oauth-apps.create (and the equivalent method). It refuses to operate when uid is falsy: no user context means no audit trail or permission anchor for the new OAuth app. The REST route is authRequired and permissionsRequired, so this specific throw is reachable mainly from direct/internal calls (server code, apps, tests) that pass an undefined user id.","triggerScenarios":"Calling addOAuthApp(params, undefined) from server code; a method wrapper that forwards this.userId of an unauthenticated context; tests invoking the function without a user id.","commonSituations":"Custom integrations or Apps calling the library function directly instead of the REST endpoint; refactors that drop the uid argument; unit tests missing a user fixture.","solutions":["Pass the authenticated user's _id as uid, e.g. addOAuthApp(params, Meteor.userId()) or this.userId in a method","Prefer the REST endpoint POST /api/v1/oauth-apps.create with an auth token - it guarantees a uid and permission check","Guard the call site: return early with a proper authentication error when uid is undefined"],"exampleFix":"// before\nawait addOAuthApp(params, undefined);\n\n// after\nconst uid = Meteor.userId();\nif (!uid) throw new Meteor.Error('error-not-logged-in', 'Must be logged in');\nawait addOAuthApp(params, uid);","handlingStrategy":"validation","validationCode":"// guard the call site before invoking\nconst uid = Meteor.userId();\nif (!uid) {\n  throw new Meteor.Error('error-not-logged-in', 'Must be logged in to create OAuth apps');\n}\nconst app = await addOAuthApp(params, uid);","typeGuard":"const hasAuthenticatedUid = (uid: string | undefined): uid is string => typeof uid === 'string' && uid.length > 0;","tryCatchPattern":"try {\n  await addOAuthApp(params, uid);\n} catch (error) {\n  if (error instanceof Meteor.Error && error.error === 'error-invalid-user') {\n    throw new Meteor.Error('error-not-logged-in', 'Authentication required');\n  }\n  throw error;\n}","preventionTips":["Always derive uid from the authenticated context (this.userId / Meteor.userId()), never from request bodies","Prefer the REST endpoint, which enforces authentication for you","In tests, seed a user fixture and pass its _id"],"tags":["oauth-apps","rest-api","authentication","meteor-methods"],"backgroundTag":"invalid-user-id","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}