{"record":{"id":"70a20b4f868b1248","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-70a20b","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/deleteUserOwnAccount.ts","lineNumber":29,"sourceCode":"import { deleteUser } from '../../lib/users/deleteUser';\nimport { settings } from '../../settings';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tdeleteUserOwnAccount(password: string, confirmRelinquish?: boolean): Promise<boolean>;\n\t}\n}\n\nexport const deleteUserOwnAccount = async (fromUserId: string, password: string, confirmRelinquish = false): Promise<boolean> => {\n\tif (!settings.get('Accounts_AllowDeleteOwnAccount')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tif (!fromUserId) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tconst user = await Users.findOneById(fromUserId);\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tif (user.services?.password && trim(user.services.password.bcrypt)) {\n\t\tconst result = await Accounts._checkPasswordAsync(user as Meteor.User, {\n\t\t\tdigest: password.toLowerCase(),\n\t\t\talgorithm: 'sha-256',\n\t\t});\n\t\tif (result.error) {\n\t\t\tthrow new Meteor.Error('error-invalid-password', 'Invalid password', {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/deleteUserOwnAccount.ts#L11-L47","documentation":"Thrown by the exported deleteUserOwnAccount server helper when its first argument fromUserId is falsy (empty string, null, undefined). The helper refuses to run without a concrete user id because user lookup, credential verification, and deletion all key off it. The DDP method wrapper checks Meteor.userId() before calling, so this specific line is only reachable by direct callers of the helper (custom server code, REST bridges, tests).","triggerScenarios":"Calling deleteUserOwnAccount(fromUserId, password, confirmRelinquish) server-side with fromUserId empty/undefined — e.g. an integration that resolves the caller id from a request context and forwards it without checking it resolved.","commonSituations":"Custom server modules importing the helper and passing an unresolved auth context; refactors that changed the first parameter; unit tests with fixtures missing the id.","solutions":["Fail fast in your wrapper: verify fromUserId is a non-empty string before invoking the helper","If invoking over DDP, call Meteor.callAsync('deleteUserOwnAccount', ...) while logged in so the wrapper supplies a valid uid","Map this throw to a 401-style response in your caller instead of letting error-invalid-user leak"],"exampleFix":"// before\nawait deleteUserOwnAccount(uidFromContext, password);\n\n// after\nif (!uidFromContext) {\n\tthrow new Meteor.Error('error-invalid-user', 'Invalid user');\n}\nawait deleteUserOwnAccount(uidFromContext, password);","handlingStrategy":"validation","validationCode":"if (typeof fromUserId !== 'string' || fromUserId.trim().length === 0) {\n\tthrow new Error('deleteUserOwnAccount: fromUserId is required');\n}\nawait deleteUserOwnAccount(fromUserId, password, confirmRelinquish);","typeGuard":"const isUserId = (v: unknown): v is string => typeof v === 'string' && v.trim().length > 0;","tryCatchPattern":"try {\n\tawait deleteUserOwnAccount(uid, password);\n} catch (err) {\n\tif (err instanceof Meteor.Error && err.error === 'error-invalid-user') {\n\t\t// caller context had no user id — treat as unauthorized\n\t}\n\tthrow err;\n}","preventionTips":["Never forward an unresolved auth context into the helper — resolve and check the user id at your boundary","Type call sites so an undefined id fails at compile time (no optional passthrough)","Log the resolved caller id before invoking deletion flows"],"tags":["meteor","users","account-deletion","validation","server"],"backgroundTag":"invalid-user-id","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}