{"record":{"id":"d564f8fe66c2a5b7","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-email","errorCode":"error-invalid-email","errorMessage":"Invalid email __email__","messagePattern":"Invalid email __email__","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":453,"sourceCode":"\t\t});\n\t}\n\n\tif (!!login.user.active !== true) {\n\t\tthrow new Meteor.Error('error-user-is-not-activated', 'User is not activated', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!login.user.roles || !Array.isArray(login.user.roles)) {\n\t\tthrow new Meteor.Error('error-user-has-no-roles', 'User has no roles', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.user.roles.includes('admin') === false && login.type === 'password' && settings.get('Accounts_EmailVerification') === true) {\n\t\tconst validEmail = login.user.emails.filter((email) => email.verified === true);\n\t\tif (validEmail.length === 0) {\n\t\t\tthrow new Meteor.Error('error-invalid-email', 'Invalid email __email__');\n\t\t}\n\t}\n\n\tlogin = await callbacks.run('onValidateLogin', login);\n\n\tawait Users.updateLastLoginById(login.user._id);\n\tsetImmediate(() => {\n\t\treturn callbacks.run('afterValidateLogin', login);\n\t});\n\n\t/**\n\t * Trigger the event only when the\n\t * user does login in Rocket.chat\n\t */\n\tif (login.type !== 'resume') {\n\t\t// App IPostUserLoggedIn event hook\n\t\tawait Apps.self?.triggerEvent(AppEvents.IPostUserLoggedIn, login.user);\n\t}","sourceCodeStart":435,"sourceCodeEnd":471,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L435-L471","documentation":"During password login, if the user is not admin, Accounts_EmailVerification is true, and none of login.user.emails has verified === true, validateLoginAttempt throws error-invalid-email. The __email__ placeholder in the message is never interpolated; the actionable meaning is simply that the account has no verified email address.","triggerScenarios":"Meteor.loginWithPassword for a non-admin user with zero verified emails while Accounts_EmailVerification is enabled — the verification link was never clicked, never delivered (broken SMTP), or the setting was enabled after the user already existed.","commonSituations":"Workspace enables email verification retroactively and locks out existing users; SMTP misconfigured so verification mails never arrive; users registered with typos in their email addresses.","solutions":["Resend the verification email from the user profile after confirming SMTP works (Administration -> Email)","As admin, mark the user's email as verified (Administration -> Users -> edit the email -> verified)","Give the user the 'admin' role if appropriate (admins bypass the check)","Disable Accounts_EmailVerification if verified email is not actually required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const hasVerifiedEmail = (emails: Array<{ verified?: boolean }> | undefined): boolean =>\n  Array.isArray(emails) && emails.some((e) => e?.verified === true);\n\nif (settings.get('Accounts_EmailVerification') === true && !hasVerifiedEmail(user.emails)) {\n  // resend verification email or have an admin verify before attempting password login\n}","typeGuard":"const hasVerifiedEmail = (emails: unknown): emails is Array<{ verified: true }> =>\n  Array.isArray(emails) && emails.some((e) => (e as { verified?: boolean })?.verified === true);","tryCatchPattern":"try {\n  await loginWithPassword(user, password);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-invalid-email') {\n    // prompt the user to verify their email / resend the verification mail\n  }\n  throw e;\n}","preventionTips":["Test SMTP delivery before enabling Accounts_EmailVerification","When enabling verification on an existing workspace, verify existing emails in bulk first","Expose 'resend verification email' in the client so users can self-recover"],"tags":["authentication","login","email-verification","smtp"],"backgroundTag":"email-verification-required","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}