{"record":{"id":"f58268f546098235","repo":"RocketChat/Rocket.Chat","slug":"error-user-has-no-roles","errorCode":"error-user-has-no-roles","errorMessage":"User has no roles","messagePattern":"User has no roles","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":445,"sourceCode":"\n\tif (login.user.type === 'visitor') {\n\t\treturn true;\n\t}\n\n\tif (login.user.type === 'app') {\n\t\tthrow new Meteor.Error('error-app-user-is-not-allowed-to-login', 'App user is not allowed to login', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!!login.user.active !== true) {\n\t\tthrow new Meteor.Error('error-user-is-not-activated', 'User is not activated', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!login.user.roles || !Array.isArray(login.user.roles)) {\n\t\tthrow new Meteor.Error('error-user-has-no-roles', 'User has no roles', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.user.roles.includes('admin') === false && login.type === 'password' && settings.get('Accounts_EmailVerification') === true) {\n\t\tconst validEmail = login.user.emails.filter((email) => email.verified === true);\n\t\tif (validEmail.length === 0) {\n\t\t\tthrow new Meteor.Error('error-invalid-email', 'Invalid email __email__');\n\t\t}\n\t}\n\n\tlogin = await callbacks.run('onValidateLogin', login);\n\n\tawait Users.updateLastLoginById(login.user._id);\n\tsetImmediate(() => {\n\t\treturn callbacks.run('afterValidateLogin', login);\n\t});\n","sourceCodeStart":427,"sourceCodeEnd":463,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L427-L463","documentation":"validateLoginAttempt throws error-user-has-no-roles when login.user.roles is missing or not an array. Rocket.Chat assumes every human user carries a roles array (at minimum 'user'); a document without it is treated as corrupt because all later authorization (hasPermission) would behave unpredictably.","triggerScenarios":"Login as a user whose Mongo document lacks roles or stores it as a non-array (null, string, object) — after manual database surgery, a partial restore, a skipped migration, or custom code inserting users directly into the Users collection.","commonSituations":"Users inserted via mongoimport or scripts bypassing Accounts.createUser; database restored from a much older version without running migrations; a manual cleanup deleted the roles field instead of emptying it.","solutions":["Re-assign roles in Administration -> Users -> edit the user -> Roles (typically add 'user')","Repair the document directly: db.users.updateOne({ _id: '<uid>' }, { $set: { roles: ['user'] } })","Ensure migrations ran after upgrades (check the migrations collection and server startup logs)","Always create users through Accounts.createUser or the admin APIs so defaults are applied"],"exampleFix":"// before (broken doc)\n// db.users.findOne(uid) -> { _id: uid, username: 'bob', roles: null }\n\n// after\n// mongo shell:\ndb.users.updateOne({ _id: uid }, { $set: { roles: ['user'] } });","handlingStrategy":"type-guard","validationCode":"const user = await Users.findOneById(uid);\nif (!hasValidRoles(user)) {\n  await Users.updateOne({ _id: uid }, { $set: { roles: ['user'] } }); // repair before login is attempted\n}","typeGuard":"const hasValidRoles = (u: unknown): u is { roles: string[] } =>\n  typeof u === 'object' && u !== null && Array.isArray((u as { roles?: unknown }).roles);","tryCatchPattern":"try {\n  await loginWithPassword(user, password);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-user-has-no-roles') {\n    // data corruption: repair roles via admin/db, then retry once\n  }\n  throw e;\n}","preventionTips":["Create users only via Accounts.createUser / admin APIs so roles defaults are applied","Run and verify migrations after restores and upgrades","Add a data-audit step after bulk imports checking that every user has a non-empty roles array"],"tags":["authentication","login","data-integrity","user-management","database"],"backgroundTag":"missing-user-role","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}