{"record":{"id":"c9922bda410ab20e","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-c9922b","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts","lineNumber":64,"sourceCode":"\t\tif (!(await hasPermissionAsync(user, 'create-team-group', team.roomId))) {\n\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });\n\t\t}\n\t} else if (!(await hasPermissionAsync(user, 'create-p'))) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });\n\t}\n\n\treturn createRoom('p', name, user, members, excludeSelf, readOnly, {\n\t\t...(customFields && Object.keys(customFields).length && { customFields }),\n\t\t...extraData,\n\t});\n};\n\nMeteor.methods<ServerMethods>({\n\tasync createPrivateGroup(name, members, readOnly = false, customFields = {}, extraData = {}) {\n\t\tconst uid = Meteor.userId();\n\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'createPrivateGroup',\n\t\t\t});\n\t\t}\n\n\t\tconst user = await Users.findOneById(uid, { projection: { services: 0 } });\n\t\tif (!user) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'createPrivateGroup',\n\t\t\t});\n\t\t}\n\n\t\treturn createPrivateGroupMethod(user, name, members, readOnly, customFields, extraData);\n\t},\n});\n","sourceCodeStart":46,"sourceCodeEnd":79,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts#L46-L79","documentation":"Authentication gate of the createPrivateGroup Meteor method wrapper: Meteor.userId() returned null, so the DDP connection had no logged-in user. A sibling guard in the same wrapper throws the same code when Users.findOneById cannot load the account afterwards, but line 64 is specifically the missing-login case.","triggerScenarios":"Calling Meteor.call('createPrivateGroup', ...) before the client login completes; after token invalidation (password change, server restart); from a DDP connection that never logged in.","commonSituations":"Group-creation UI racing the login flow; stale sessions; scripts that connect but skip login.","solutions":["Check Meteor.userId() first and await login on the client.","Re-authenticate on session expiry and retry.","Use POST /api/v1/groups.create with token auth for integrations."],"exampleFix":"// before\nMeteor.call('createPrivateGroup', name, members);\n\n// after\nif (!Meteor.userId()) {\n  await relogin();\n}\nMeteor.call('createPrivateGroup', name, members);","handlingStrategy":"validation","validationCode":"if (!Meteor.userId()) {\n  // log in before creating private groups\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('createPrivateGroup', name, members);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-invalid-user') {\n    await Meteor.logout();\n    goToLogin();\n    return;\n  }\n  throw e;\n}","preventionTips":["Fire createPrivateGroup only after Accounts login resolves.","Re-authenticate instead of retrying on error-invalid-user.","Prefer POST /api/v1/groups.create for non-interactive integrations."],"tags":["rocket-chat","meteor","create-private-group","authentication"],"backgroundTag":"meteor-invalid-user","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}