{"record":{"id":"9b2cbe9fe565714d","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-9b2cbe","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/publications/room/index.ts","lineNumber":66,"sourceCode":"Meteor.methods<ServerMethods>({\n\tasync 'rooms/get'(updatedAt) {\n\t\treturn roomsGetMethod(Meteor.userId(), updatedAt);\n\t},\n\n\tasync 'getRoomByTypeAndName'(type, name) {\n\t\tif (!type || !name) {\n\t\t\tthrow new Meteor.Error('error-invalid-room', 'Invalid room', {\n\t\t\t\tmethod: 'getRoomByTypeAndName',\n\t\t\t});\n\t\t}\n\n\t\tconst user = await Meteor.userAsync();\n\t\tconst isAnonymous = !user?._id;\n\n\t\tif (isAnonymous) {\n\t\t\tconst allowAnon = settings.get('Accounts_AllowAnonymousRead');\n\t\t\tif (!allowAnon || type !== 'c') {\n\t\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\t\tmethod: 'getRoomByTypeAndName',\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tconst roomFind = roomCoordinator.getRoomFind(type);\n\n\t\tconst room = roomFind ? await roomFind.call(this, name) : await Rooms.findByTypeAndNameOrId(type, name);\n\n\t\tif (!room) {\n\t\t\tthrow new Meteor.Error('error-invalid-room', 'Invalid room', {\n\t\t\t\tmethod: 'getRoomByTypeAndName',\n\t\t\t});\n\t\t}\n\n\t\tif (\n\t\t\tuser &&\n\t\t\t!(await canAccessRoomAsync(room, user, {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/publications/room/index.ts#L48-L84","documentation":"Thrown by 'getRoomByTypeAndName' when the caller is anonymous (Meteor.userAsync() yields no user _id) and anonymous read is not allowed: either the Accounts_AllowAnonymousRead setting is off, or the requested room type is not 'c' (public channel). Anonymous visitors may only read public channels, and only when the setting enables it.","triggerScenarios":"Unauthenticated DDP call to getRoomByTypeAndName('p', 'secret') (private room); any anonymous call while Accounts_AllowAnonymousRead is false.","commonSituations":"Embedding a public channel in a public site without enabling anonymous read; logged-out preview pages hitting private/direct rooms; sessions dropped by cookie policy so 'logged in' users appear anonymous.","solutions":["Enable Administration > General > Accounts_AllowAnonymousRead for public channel reads","Restrict anonymous lookups to type 'c'","Require login for private rooms and direct messages"],"exampleFix":"// before (anonymous, private room)\nMeteor.call('getRoomByTypeAndName', 'p', 'secret');\n\n// after: login first, or only fetch public channels when anonymous\nif (!Meteor.userId()) {\n  Meteor.call('getRoomByTypeAndName', 'c', 'general');\n}","handlingStrategy":"validation","validationCode":"const anonOk = Settings.isTrue('Accounts_AllowAnonymousRead');\nif (!Meteor.userId() && (!anonOk || roomType !== 'c')) {\n  throw new Error('anonymous access requires Accounts_AllowAnonymousRead and a public channel');\n}\nMeteor.call('getRoomByTypeAndName', roomType, name);","typeGuard":"function canAnonymousFetch(type: string, allowAnonRead: boolean): boolean {\n  return allowAnonRead && type === 'c';\n}","tryCatchPattern":"try { await Meteor.callAsync('getRoomByTypeAndName', type, name); } catch (e) { if (e.error === 'error-invalid-user') { /* prompt login or fall back to public channel */ } }","preventionTips":["Check the anonymous-read setting before showing logged-out room previews","Restrict anonymous room links to public channels"],"tags":["meteor","rooms","anonymous-access","settings","rocket-chat"],"backgroundTag":"anonymous-access-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}