{"record":{"id":"f060b811532ad0ce","repo":"RocketChat/Rocket.Chat","slug":"invalid-user-f060b8","errorCode":"invalid-user","errorMessage":"Invalid User","messagePattern":"Invalid User","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts","lineNumber":190,"sourceCode":"\tconst { insertedId } = await Integrations.insertOne(strippedIntegrationData);\n\n\tconst integrationStored = await Integrations.findOne({ _id: insertedId });\n\n\tif (!integrationStored) {\n\t\tthrow new Error('Error inserting integration');\n\t}\n\tvoid notifyOnIntegrationChanged({ ...integrationStored, _id: insertedId }, 'inserted');\n\n\treturn integrationStored as IIncomingIntegration;\n};\n\nMeteor.methods<ServerMethods>({\n\tasync addIncomingIntegration(integration: INewIncomingIntegration): Promise<IIncomingIntegration> {\n\t\tmethodDeprecationLogger.method('addIncomingIntegration', '9.0.0', '/v1/integrations.create');\n\t\tconst { userId } = this;\n\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('invalid-user', 'Invalid User', {\n\t\t\t\tmethod: 'addIncomingIntegration',\n\t\t\t});\n\t\t}\n\n\t\treturn addIncomingIntegration(userId, integration);\n\t},\n});\n","sourceCodeStart":172,"sourceCodeEnd":198,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts#L172-L198","documentation":"Thrown by the Meteor.methods wrapper of addIncomingIntegration when this.userId is falsy: the DDP method was invoked without an authenticated user. This checks the CALLER's session, unrelated to integration.username. Typical causes are expired/invalid login tokens, calling before login finished, or server-side Meteor.call which carries no user context.","triggerScenarios":"Client invokes the method after the token expired or the user logged out; a call raced ahead of Meteor.loginWithPassword completing; server code running Meteor.call('addIncomingIntegration', ...) directly (no bound user).","commonSituations":"Long-lived dashboards whose session expired overnight; hot-reload losing the accounts state in development; importers/migration scripts using DDP instead of the REST API.","solutions":["Ensure the user is logged in before the call: await the login promise and check Meteor.userId()","For server-to-server or scripted usage, switch to the REST API POST /api/v1/integrations.create with X-Auth-Token/X-User-Id headers","If the token expired, re-authenticate (logout/login or token refresh) and retry"],"exampleFix":"// before: server-side or pre-login call\nMeteor.call('addIncomingIntegration', integration); // this.userId is undefined -> 'invalid-user'\n// after: authenticated REST call\nawait fetch(`${root}/api/v1/integrations.create`, { method: 'POST', headers: { 'X-Auth-Token': token, 'X-User-Id': userId, 'Content-Type': 'application/json' }, body: JSON.stringify(integration) });","handlingStrategy":"validation","validationCode":"if (!Meteor.userId()) throw new Error('login required before creating integrations');\nawait Meteor.callAsync('addIncomingIntegration', integration);","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('addIncomingIntegration', integration);\n} catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'invalid-user') { /* redirect to login, preserve form state */ }\n}","preventionTips":["Gate admin screens on Meteor.userId() presence","Await login promises before first method call after refresh","Use REST with token headers for server-to-server integration management"],"tags":["rocket-chat","incoming-integration","authentication","meteor-method"],"backgroundTag":"unauthenticated-request","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}