{"record":{"id":"f0d03d41cdd468d7","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-f0d03d","errorCode":"error-invalid-user","errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"exception","errorClass":"MeteorError","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/saveUser/validateUserEditing.ts","lineNumber":41,"sourceCode":"\n\treturn true;\n};\n\n/**\n * Validate permissions to edit user fields\n *\n * @param {string} userId\n * @param {{ _id: string, roles?: string[], username?: string, name?: string, statusText?: string, email?: string, password?: string}} userData\n */\nexport async function validateUserEditing(userId: IUser['_id'], userData: UpdateUserData): Promise<void> {\n\tconst editingMyself = userData._id && userId === userData._id;\n\n\tconst canEditOtherUserInfo = await hasPermissionAsync(userId, 'edit-other-user-info');\n\tconst canEditOtherUserPassword = await hasPermissionAsync(userId, 'edit-other-user-password');\n\tconst user = await Users.findOneById(userData._id);\n\n\tif (!user) {\n\t\tthrow new MeteorError('error-invalid-user', 'Invalid user');\n\t}\n\n\tif (isEditingUserRoles(user.roles, userData.roles) && !(await hasPermissionAsync(userId, 'assign-roles'))) {\n\t\tthrow new MeteorError('error-action-not-allowed', 'Assign roles is not allowed', {\n\t\t\tmethod: 'insertOrUpdateUser',\n\t\t\taction: 'Assign_role',\n\t\t});\n\t}\n\n\tif (!settings.get('Accounts_AllowUserProfileChange') && !canEditOtherUserInfo && !canEditOtherUserPassword) {\n\t\tthrow new MeteorError('error-action-not-allowed', 'Edit user profile is not allowed', {\n\t\t\tmethod: 'insertOrUpdateUser',\n\t\t\taction: 'Update_user',\n\t\t});\n\t}\n\n\tif (\n\t\tisEditingField(user.username, userData.username) &&","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/saveUser/validateUserEditing.ts#L23-L59","documentation":"Thrown by validateUserEditing() when Users.findOneById(userData._id) returns null — the user being updated no longer exists (or never did). It is the first check after validateUserData, so an update that passes permission checks still fails here if the target was deleted. This is a plain Meteor.Error with code error-invalid-user and no extra details object.","triggerScenarios":"users.update for an _id returned by a stale list (user deleted between listing and submitting); a wrong/hand-typed _id; a federated or merged account whose id changed; delete-and-recreate race with another admin.","commonSituations":"Long-lived admin screens or external directory syncs holding cached ids; automation that stores user ids across restarts; ids copied from a different workspace/environment (e.g. staging id used against production).","solutions":["Refresh the id: call GET /api/v1/users.info?userId=... and only update when the user is found.","Re-list the source of truth (users.list) and reconcile before retrying the update.","If the account was deleted intentionally, create it instead of updating, or stop treating it as existing in your sync state."],"exampleFix":"// before\nawait POST '/api/v1/users.update', { userId: staleId, data: { name: 'x' } }); // throws 'Invalid user'\n\n// after\nconst info = await GET `/api/v1/users.info?userId=${staleId}`;\nif (info?.userinfo?._id) {\n  await POST '/api/v1/users.update', { userId: info.userinfo._id, data: { name: 'x' } });\n} else {\n  await POST '/api/v1/users.create', { username: 'recreated', email: 'a@b.c', password: 'pw' });\n}","handlingStrategy":"validation","validationCode":"const { userinfo } = await GET `/api/v1/users.info?userId=${encodeURIComponent(payload._id)}`;\nif (!userinfo?._id) throw new Error('target user no longer exists');","typeGuard":"const isExistingUser = (u: { _id: string } | null | undefined): u is { _id: string } => !!u?._id;","tryCatchPattern":"catch (e) {\n  if (e.error === 'error-invalid-user') {\n    // refresh the user list / reconcile sync state; do NOT retry with the same id\n  }\n}","preventionTips":["Validate ids right before update, not from cached lists.","Refresh sync state after deletes (webhooks or scheduled reconciliation).","Scope stored ids per environment to avoid cross-env mistakes."],"tags":["users","not-found","update","save-user"],"backgroundTag":"user-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}