{"record":{"id":"aa9232e70c6e11f4","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-aa9232","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/messages/getSlashCommandPreviews.ts","lineNumber":44,"sourceCode":"\t\t\tmethod: 'executeSlashCommandPreview',\n\t\t});\n\t}\n\n\tconst theCmd = slashCommands.commands[command.cmd];\n\tif (!theCmd.providesPreview) {\n\t\tthrow new Meteor.Error('error-invalid-command', 'Command Does Not Provide Previews', {\n\t\t\tmethod: 'executeSlashCommandPreview',\n\t\t});\n\t}\n\n\treturn slashCommands.getPreviews(command.cmd, command.params, command.msg, command.userId);\n};\n\nMeteor.methods<ServerMethods>({\n\tasync getSlashCommandPreviews(command) {\n\t\tconst userId = Meteor.userId();\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'getSlashCommandPreview',\n\t\t\t});\n\t\t}\n\n\t\treturn getSlashCommandPreviews({ ...command, userId });\n\t},\n});\n","sourceCodeStart":26,"sourceCodeEnd":52,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/messages/getSlashCommandPreviews.ts#L26-L52","documentation":"Thrown by the getSlashCommandPreviews Meteor method when Meteor.userId() returns null, i.e. the DDP connection has no authenticated user. Slash-command previews execute the command's preview callback in the caller's context, so a valid login is a hard prerequisite; the method rejects the call before touching the command registry.","triggerScenarios":"Meteor.call('getSlashCommandPreviews', ...) from a logged-out tab, after the resume token was invalidated (password change, 'logout other locations', session expiry), or from a raw DDP client (node-ddp-client, python) that connected but never called the login method.","commonSituations":"Long-lived browser tabs whose Meteor session expired; bots and automation scripts that open a DDP connection and call methods without logging in first; races where the preview request fires during logout or before login completes.","solutions":["Ensure Meteor.userId() is truthy before issuing the call","Re-authenticate when the resume token was invalidated, then retry the preview request","For DDP scripts, always complete a login method call before invoking domain methods"],"exampleFix":"// before\nMeteor.call('getSlashCommandPreviews', { cmd, params, msg });\n\n// after\nif (!Meteor.userId()) {\n  // route to login / re-auth flow instead of calling\n} else {\n  Meteor.call('getSlashCommandPreviews', { cmd, params, msg });\n}","handlingStrategy":"validation","validationCode":"const userId = Meteor.userId();\nif (!userId) {\n  // not logged in — trigger the auth flow instead of calling the method\n}","typeGuard":null,"tryCatchPattern":"try {\n  const previews = await Meteor.callAsync('getSlashCommandPreviews', command);\n} catch (error) {\n  if (error instanceof Meteor.Error && error.error === 'error-invalid-user') {\n    // session expired — route to login and re-run after re-auth\n  } else {\n    throw error;\n  }\n}","preventionTips":["Gate preview requests behind a Meteor.userId() check in the composer layer","Handle Meteor session-invalidated events centrally so expired sessions re-authenticate before further calls","In DDP scripts, await the login method result before invoking domain methods"],"tags":["authentication","meteor-method","ddp","session"],"backgroundTag":"not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}