{"record":{"id":"8e51d84c00ba27ed","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-8e51d8","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/setUserAvatar.ts","lineNumber":32,"sourceCode":"import { SystemLogger } from '../logger/system';\nimport { RocketChatFile } from '../media/file';\nimport { FileUpload } from '../media/file-upload';\n\nexport const setAvatarFromServiceWithValidation = async (\n\tuserId: string,\n\tdataURI: string,\n\tcontentType?: string,\n\tservice?: string,\n\ttargetUserId?: string,\n): Promise<void> => {\n\tif (!dataURI) {\n\t\tthrow new Meteor.Error('error-invalid-data', 'Invalid dataURI', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tif (!userId) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tif (!settings.get('Accounts_AllowUserAvatarChange')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tlet user: IUser | null;\n\n\tif (targetUserId && targetUserId !== userId) {\n\t\tif (!(await hasPermissionAsync(userId, 'edit-other-user-avatar'))) {\n\t\t\tthrow new Meteor.Error('error-unauthorized', 'Unauthorized', {\n\t\t\t\tmethod: 'setAvatarFromService',\n\t\t\t});\n\t\t}","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/setUserAvatar.ts#L14-L50","documentation":"Second guard in setAvatarFromServiceWithValidation: throws error-invalid-user when the acting userId argument is falsy. Like all empty-id guards, it indicates a caller bug — the avatar operation was started without a user context. Distinct from error-invalid-desired-user, which is the later failure to find the target user document.","triggerScenarios":"Calling the avatar setter from an unauthenticated context (this.userId undefined in a Meteor method), passing the wrong variable, or invoking server code outside a user session.","commonSituations":"Server-side integration script forgetting to pass the acting user id; method called from a logged-out session; automated clients without a login token.","solutions":["Pass the authenticated user's id (this.userId in methods, uid from the REST layer).","Add a falsy guard in the caller and reject the operation early.","Ensure the calling context is actually authenticated before initiating avatar upload."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const actingUserId = this.userId;\nif (!actingUserId) {\n  throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'caller' });\n}\nawait setAvatarFromServiceWithValidation(actingUserId, dataURI, contentType, service, targetUserId);","typeGuard":"const hasUserId = (id: unknown): id is string => typeof id === 'string' && id.trim().length > 0;","tryCatchPattern":null,"preventionTips":["Take the acting user id from the authenticated context, never from client-supplied parameters.","Reject avatar operations early when there is no session."],"tags":["validation","user-management","avatar"],"backgroundTag":"missing-required-parameter","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}