{"record":{"id":"ed761dc6d8c053a2","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-ed761d","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/addPermissionToRole.ts","lineNumber":19,"sourceCode":"import type { ServerMethods } from '@rocket.chat/ddp-client';\nimport { Meteor } from 'meteor/meteor';\n\nimport { addPermissionToRoleMethod } from '../../lib/authorization/permissionRole';\nimport { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\t'authorization:addPermissionToRole'(permissionId: string, role: string): void;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync 'authorization:addPermissionToRole'(permissionId, role) {\n\t\tmethodDeprecationLogger.method('authorization:addPermissionToRole', '9.0.0', '/v1/permissions.addRole');\n\t\tconst uid = Meteor.userId();\n\t\tif (!uid) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'authorization:addPermissionToRole' });\n\t\t}\n\t\tawait addPermissionToRoleMethod(uid, permissionId, role);\n\t},\n});\n","sourceCodeStart":1,"sourceCodeEnd":24,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/addPermissionToRole.ts#L1-L24","documentation":"The 'authorization:addPermissionToRole' DDP method (deprecated in favor of POST /api/v1/permissions.addRole) requires a logged-in user; Meteor.userId() returning null throws error-invalid-user before delegating to the permission-checked core logic. It protects role-permission edits from anonymous connections.","triggerScenarios":"Meteor.call('authorization:addPermissionToRole', permissionId, role) on a connection without a valid login session — expired token, never-logged-in bot connection, or logged-out admin tab.","commonSituations":"Permission-management UI driven by a stale session; scripts calling DDP methods directly without login; token expiry in the middle of an admin session.","solutions":["Re-authenticate the DDP connection (login or loginWithToken) and retry.","Use the REST equivalent POST /api/v1/permissions.addRole with an admin token.","Redirect the user to login when the session is no longer valid."],"exampleFix":"// before: session expired, Meteor.userId() is null\nMeteor.call('authorization:addPermissionToRole', permissionId, role);\n\n// after: ensure a live session before acting\nconst uid = Meteor.userId();\nif (!uid) { await reauthenticate(); }\nMeteor.call('authorization:addPermissionToRole', permissionId, role);","handlingStrategy":"validation","validationCode":"const uid = Meteor.userId();\nif (!uid) {\n  await reauthenticate();\n}\nMeteor.call('authorization:addPermissionToRole', permissionId, role);","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('authorization:addPermissionToRole', permissionId, role);\n} catch (err: any) {\n  if (err?.error === 'error-invalid-user' && err?.details?.method === 'authorization:addPermissionToRole') {\n    return redirectToLogin(); // session expired mid-admin\n  }\n  throw err;\n}","preventionTips":["Guard admin UI actions on a live session check.","Prefer POST /api/v1/permissions.addRole with an admin token for automation.","Handle expired resume tokens by re-authenticating, not by silent retries."],"tags":["authentication","meteor-methods","permissions","ddp"],"backgroundTag":"not-authenticated","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}