{"record":{"id":"96b7f80fd4f7b853","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-account-96b7f8","errorCode":"error-invalid-account","errorMessage":"Invalid WebDAV Account","messagePattern":"Invalid WebDAV Account","errorType":"error_code","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/bridges/webdav/methods/getWebdavFileList.ts","lineNumber":33,"sourceCode":"}\n\nMeteor.methods<ServerMethods>({\n\tasync getWebdavFileList(accountId, path) {\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'getWebdavFileList' });\n\t\t}\n\n\t\tif (!settings.get('Webdav_Integration_Enabled')) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {\n\t\t\t\tmethod: 'getWebdavFileList',\n\t\t\t});\n\t\t}\n\n\t\tconst account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});\n\t\tif (!account) {\n\t\t\tthrow new Meteor.Error('error-invalid-account', 'Invalid WebDAV Account', {\n\t\t\t\tmethod: 'getWebdavFileList',\n\t\t\t});\n\t\t}\n\n\t\ttry {\n\t\t\tconst cred = getWebdavCredentials(account);\n\t\t\tconst client = new WebdavClientAdapter(account.serverURL, cred);\n\t\t\tconst data = (await client.getDirectoryContents(path)) as IWebdavNode[];\n\t\t\treturn { success: true, data };\n\t\t} catch (error) {\n\t\t\tthrow new Meteor.Error('could-not-access-webdav', 'Could not access webdav', {\n\t\t\t\tmethod: 'getWebdavFileList',\n\t\t\t});\n\t\t}\n\t},\n});\n","sourceCodeStart":15,"sourceCodeEnd":50,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/bridges/webdav/methods/getWebdavFileList.ts#L15-L50","documentation":"Thrown by the getWebdavFileList Meteor method when WebdavAccounts.findOneByIdAndUserId(accountId, userId, {}) returns null, meaning no WebDAV account document matches both the passed accountId and the authenticated user's _id. It is an existence-plus-ownership guard that runs after the invalid-user and Webdav_Integration_Enabled checks, so hitting it means the user and the setting are fine but the account reference is stale, deleted, or foreign.","triggerScenarios":"Calling Meteor.call('getWebdavFileList', accountId, path) with an accountId that was deleted, re-created with a new _id after re-authorization, or that belongs to a different user; also passing undefined/null accountId so the lookup matches nothing.","commonSituations":"User changed their Nextcloud password and re-authorized the integration, so the accountId cached in client state no longer exists; the WebDAV account was removed by an admin while the file picker stayed open; bad prop wiring passes another user's account id.","solutions":["Re-authorize the WebDAV/Nextcloud account so a fresh account document is created, then retry with the new accountId","Before the call, fetch the current user's WebDAV accounts and confirm the accountId you hold still exists","Pass the accountId string exactly as stored in the webdav_accounts collection","If the account was intentionally removed, clear the stale accountId from client state instead of retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { WebdavAccounts } from '../../../../../server/models/webdavAccounts';\n\n// server-side: confirm ownership before invoking the method\nconst userId = Meteor.userId();\nif (!userId) throw new Error('login required');\nconst account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});\nif (!account) {\n  // drop cached accountId and prompt re-authorization; do not call the method\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await Meteor.callAsync('getWebdavFileList', accountId, path);\n} catch (e: any) {\n  if (e?.error === 'error-invalid-account') {\n    // invalidate cached accountId, offer 're-authorize WebDAV' action\n  } else {\n    throw e;\n  }\n}","preventionTips":["Always load the user's WebDAV account list fresh when opening the file picker instead of caching accountIds in long-lived state","After any re-authorization flow, replace the stored accountId immediately","Treat error-invalid-account as a signal to re-authenticate, never as a transient retry candidate"],"tags":["webdav","meteor-methods","account-ownership"],"backgroundTag":"resource-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}