{"record":{"id":"9b5170f03ec7ae19","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-9b5170","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/afterVerifyEmail.ts","lineNumber":21,"sourceCode":"\nimport { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';\nimport { runAfterVerifyEmail } from '../../lib/users/runAfterVerifyEmail';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tafterVerifyEmail(): void;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync afterVerifyEmail() {\n\t\tmethodDeprecationLogger.method('afterVerifyEmail', '9.0.0', '/v1/users.verifyEmail');\n\n\t\tconst userId = Meteor.userId();\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'afterVerifyEmail',\n\t\t\t});\n\t\t}\n\n\t\tawait runAfterVerifyEmail(userId);\n\t},\n});\n","sourceCodeStart":3,"sourceCodeEnd":29,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/afterVerifyEmail.ts#L3-L29","documentation":"The deprecated afterVerifyEmail method throws 'error-invalid-user' when the DDP connection has no authenticated user, i.e. Meteor.userId() returns null. It runs post-email-verification side effects for the logged-in user only, so a caller identity is mandatory. Deprecated since 9.0.0 in favor of POST /api/v1/users.verifyEmail.","triggerScenarios":"Calling Meteor.call('afterVerifyEmail') on a logged-out connection, with an expired or invalidated resume token, or from server-to-server code that never performed a login.","commonSituations":"Stale resume token after a server restart/upgrade; token revoked because the same account logged in elsewhere while max parallel logins is 1; scripts or tests invoking the method without a login flow.","solutions":["Log in (or restore a valid resume token) before calling the method","Migrate to POST /api/v1/users.verifyEmail, which takes the verification token explicitly and does not depend on the DDP session","For scripts, authenticate first via POST /api/v1/login or use a personal access token with the REST API"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const userId = Meteor.userId();\nif (!userId) {\n  // re-authenticate or redirect to login before calling\n  throw new Error('Login required for afterVerifyEmail');\n}\nawait Meteor.callAsync('afterVerifyEmail');","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('afterVerifyEmail');\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {\n    // session gone: re-run the login flow, then retry once\n  }\n}","preventionTips":["Check Meteor.userId() before invoking user-bound Meteor methods","Handle session invalidation centrally instead of per call","Prefer the versioned REST endpoint (POST /api/v1/users.verifyEmail) over the deprecated method"],"tags":["authentication","meteor-methods","email-verification","deprecated"],"backgroundTag":"not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}