{"record":{"id":"502c45ce5c06e804","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-502c45","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/resetAvatar.ts","lineNumber":56,"sourceCode":"\t} else {\n\t\tuser = await Users.findOneById(fromUserId, { projection: { _id: 1, username: 1 } });\n\t}\n\n\tif (!user?.username) {\n\t\tthrow new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', {\n\t\t\tmethod: 'resetAvatar',\n\t\t});\n\t}\n\n\tawait Upload.resetUserAvatar(user);\n};\n\nMeteor.methods<ServerMethods>({\n\tasync resetAvatar(userId) {\n\t\tmethodDeprecationLogger.method('resetAvatar', '9.0.0', '/v1/users.resetAvatar');\n\t\tconst uid = Meteor.userId();\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'resetAvatar',\n\t\t\t});\n\t\t}\n\n\t\treturn resetAvatar(uid, userId);\n\t},\n});\n\nDDPRateLimiter.addRule(\n\t{\n\t\ttype: 'method',\n\t\tname: 'resetAvatar',\n\t\tuserId() {\n\t\t\treturn true;\n\t\t},\n\t},\n\t1,\n\t60000,","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/resetAvatar.ts#L38-L74","documentation":"Thrown by the 'resetAvatar' Meteor method wrapper when Meteor.userId() is null, i.e. the DDP call arrived without a valid login token. It is the standard 'you must be logged in' guard, fired before any permission or settings logic. Note the method itself is deprecated since 9.0.0 in favor of POST /v1/users.resetAvatar.","triggerScenarios":"Calling Meteor.call('resetAvatar', ...) after the login token expired or the user logged out; fire-and-forget calls from a component that outlived the session; scripts that connect DDP without authenticating first.","commonSituations":"Long-lived admin tabs whose token expired; logout triggered while a dialog action was still open; automated clients forgetting Meteor.loginWithPassword before invoking methods.","solutions":["Ensure the user is authenticated before invoking: guard with Meteor.userId() and re-login if null.","Handle 401-style method errors globally by redirecting to /login.","Prefer the non-deprecated REST endpoint POST /v1/users.resetAvatar with X-Auth-Token/X-User-Id headers."],"exampleFix":"// before\nonClick={() => Meteor.callAsync('resetAvatar', uid)} // fails after token expiry\n\n// after\nonClick={async () => {\n  if (!Meteor.userId()) return FlowRouter.go('/login');\n  await Meteor.callAsync('resetAvatar', uid);\n}}","handlingStrategy":"validation","validationCode":"const uid = Meteor.userId();\nif (!uid) {\n  FlowRouter.go('/login');\n} else {\n  await Meteor.callAsync('resetAvatar', uid);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('resetAvatar', uid);\n} catch (e) {\n  if ((e as Meteor.Error).error === 'error-invalid-user') {\n    handleSessionExpired(); // redirect to login and re-authenticate\n  }\n}","preventionTips":["Check Meteor.userId() before every authenticated method call","Handle 'error-invalid-user' globally as a session-expiry signal","Prefer the non-deprecated REST /v1/users.resetAvatar with token refresh"],"tags":["authentication","session-expired","meteor-method","avatar"],"backgroundTag":"user-not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}