{"record":{"id":"db0d218ca79bdee4","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-db0d21","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/settings/sendSMTPTestEmail.ts","lineNumber":21,"sourceCode":"import { Meteor } from 'meteor/meteor';\n\nimport * as Mailer from '../../lib/notifications/email/api';\nimport { settings } from '../../settings';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tsendSMTPTestEmail(): {\n\t\t\tmessage: string;\n\t\t\tparams: string[];\n\t\t};\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync sendSMTPTestEmail() {\n\t\tif (!Meteor.userId()) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\t\tmethod: 'sendSMTPTestEmail',\n\t\t\t});\n\t\t}\n\t\tconst user = await Meteor.userAsync();\n\t\tif (!user?.emails?.[0]?.address) {\n\t\t\tthrow new Meteor.Error('error-invalid-email', 'Invalid email', {\n\t\t\t\tmethod: 'sendSMTPTestEmail',\n\t\t\t});\n\t\t}\n\t\ttry {\n\t\t\tawait Mailer.send({\n\t\t\t\tto: user.emails[0].address,\n\t\t\t\tfrom: settings.get('From_Email'),\n\t\t\t\tsubject: 'SMTP Test Email',\n\t\t\t\thtml: '<p>You have successfully sent an email</p>',\n\t\t\t});\n\t\t} catch ({ message }: any) {\n\t\t\tthrow new Meteor.Error('error-email-send-failed', `Error trying to send email: ${message}`, {","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/settings/sendSMTPTestEmail.ts#L3-L39","documentation":"`sendSMTPTestEmail` starts with `if (!Meteor.userId())` and throws `error-invalid-user` when there is no authenticated DDP session. The method is intentionally available to any logged-in user (no permission check) because it only sends a test mail to the caller's own address — hence the login requirement is the sole gate.","triggerScenarios":"Calling `Meteor.call('sendSMTPTestEmail')` while unauthenticated: before login completes, after logout, with an expired resume token, or from server-side code without a user context.","commonSituations":"SMTP test button clicked from a stale logged-out tab; startup sequences that probe SMTP before authentication finishes; monitoring scripts invoking the DDP method without a session instead of using an authenticated REST call.","solutions":["Log in first and only call the method once `Meteor.userId()` is set.","For automated SMTP health checks, authenticate programmatically (token login) or run the check through an admin REST session.","Handle the error as a signal to re-authenticate, then retry the send."],"exampleFix":"// before\nMeteor.call('sendSMTPTestEmail');\n\n// after\nif (!Meteor.userId()) {\n  // require login before testing SMTP delivery\n  return;\n}\nMeteor.call('sendSMTPTestEmail');","handlingStrategy":"validation","validationCode":"if (!Meteor.userId()) {\n  return;\n}\nawait Meteor.callAsync('sendSMTPTestEmail');","typeGuard":"const isAuthenticated = (): boolean => typeof Meteor.userId() === 'string';","tryCatchPattern":"try {\n  await Meteor.callAsync('sendSMTPTestEmail');\n} catch (e: any) {\n  if (e?.error === 'error-invalid-user') {\n    // not logged in: authenticate, then retry the SMTP test\n  }\n}","preventionTips":["Only render the 'send test email' control for logged-in sessions.","For monitoring, use an authenticated REST session rather than an anonymous DDP call."],"tags":["meteor","smtp","email","authentication"],"backgroundTag":"authentication-required","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}