{"record":{"id":"e7eb112efa93196a","repo":"RocketChat/Rocket.Chat","slug":"invalid-user-e7eb11","errorCode":null,"errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":null,"httpStatus":400,"severity":"error","filePath":"apps/meteor/server/lib/banUserFromRoom.ts","lineNumber":24,"sourceCode":"import { hasRoleAsync } from './authorization/hasRole';\nimport { banUserFromRoom } from './rooms/banUserFromRoom';\nimport { roomCoordinator } from './rooms/roomCoordinator';\nimport { RoomMemberActions } from '../../definition/IRoomTypeConfig';\n\nexport const banUserFromRoomMethod = async (fromId: string, data: { rid: string; username: string }): Promise<boolean> => {\n\tif (!(await hasPermissionAsync(fromId, 'ban-user', data.rid))) {\n\t\tthrow new Error('Not allowed');\n\t}\n\n\tconst room = await Rooms.findOneById(data.rid);\n\n\tif (!room || !(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.BAN, fromId))) {\n\t\tthrow new Error('Not allowed');\n\t}\n\n\tconst fromUser = await Users.findOneById(fromId);\n\tif (!fromUser) {\n\t\tthrow new Error('Invalid user');\n\t}\n\n\tif (!(await canAccessRoomAsync(room, fromUser))) {\n\t\tthrow new Error('The required \"roomId\" or \"roomName\" param provided does not match any group');\n\t}\n\n\tconst bannedUser = await Users.findOneByUsernameIgnoringCase(data.username);\n\tif (!bannedUser) {\n\t\tthrow new Error('User not found');\n\t}\n\n\tconst subscription = await Subscriptions.findOneByRoomIdAndUserId(data.rid, bannedUser._id, {\n\t\tprojection: { _id: 1, status: 1 },\n\t});\n\tif (!subscription) {\n\t\tthrow new Error('User is not in this room');\n\t}\n","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/banUserFromRoom.ts#L6-L42","documentation":"Users.findOneById(fromId) returned null inside banUserFromRoomMethod: the authenticated userId behind the request has no user document. In practice this only happens when the user was deleted while their token/session was still valid, or a forged or mismatched userId reaches the method. It is an integrity signal rather than a normal client error.","triggerScenarios":"User deleted (or merged) after their token was issued; token reuse after account removal; a test harness passing a made-up fromId into the method.","commonSituations":"Offboarding automation deleting users with live sessions; duplicate-account cleanup; interrupted user-migration jobs.","solutions":["Re-authenticate to obtain a session tied to an existing user","Verify the account still exists (users.info) with an admin token","If it persists, purge orphaned tokens/sessions belonging to the deleted user"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const { user } = await GET '/api/v1/users.info' { userId: uid }; // admin token\nif (!user) {\n  // session points at a deleted account - force re-login\n}","typeGuard":null,"tryCatchPattern":"try {\n  await POST '/api/v1/rooms.banUser' { roomId, username };\n} catch (e) {\n  if (String(e.message).includes('Invalid user')) {\n    // caller's account no longer exists - invalidate token and re-authenticate\n  } else {\n    throw e;\n  }\n}","preventionTips":["Invalidate tokens and sessions when deleting or merging user accounts","Treat 'Invalid user' mid-session as a signal to re-authenticate, not to retry","Keep test harness uids backed by real user documents"],"tags":["rocket-chat","users","session","data-integrity"],"backgroundTag":"user-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}