What causes "Invalid user" in wekan/wekan?

Ensure login before calling: guard on Meteor.userId().

wekan/wekan · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

reloadAccountsLockout in server/methods/lockoutSettings.js throws error-invalid-user when this.userId is falsy — the method was called without an authenticated session. It reloads account-lockout settings and is admin-gated on the very next check, so anonymous invocation is rejected first.

Source

Thrown at server/methods/lockoutSettings.js:28

function reportLockout({ userId, failedAttempts, lockoutSeconds }) {
  try {
    require('/server/lib/securityLog').record({
      key: 'brute.lockout',
      action: 'blocked',
      source: 'DDP login',
      detail: `locked one address out of account ${userId} after ${failedAttempts} `
        + `wrong passwords, for ${lockoutSeconds}s`,
    });
  } catch (e) { /* logging must never break the guard */ }
}


Meteor.methods({
  async reloadAccountsLockout() {
    // Check if user has admin rights
    const userId = this.userId;
    if (!userId) {
      throw new Meteor.Error('error-invalid-user', 'Invalid user');
    }
    const user = await ReactiveCache.getUser(userId);
    if (!user || !user.isAdmin) {
      throw new Meteor.Error('error-not-allowed', 'Not allowed');
    }

    try {
      // Get configurations from database
      const knownUsersConfig = {
        failuresBeforeLockout: (await LockoutSettings.findOneAsync('known-failuresBeforeLockout'))?.value || 3,
        lockoutPeriod: (await LockoutSettings.findOneAsync('known-lockoutPeriod'))?.value || 60,
        failureWindow: (await LockoutSettings.findOneAsync('known-failureWindow'))?.value || 15
      };

      const unknownUsersConfig = {
        failuresBeforeLockout: (await LockoutSettings.findOneAsync('unknown-failuresBeforeLockout'))?.value || 3,
        lockoutPeriod: (await LockoutSettings.findOneAsync('unknown-lockoutPeriod'))?.value || 60,
        failureWindow: (await LockoutSettings.findOneAsync('unknown-failureWindow'))?.value || 15

View on GitHub (pinned to eb1433158b)

Solutions

Ensure login before calling: guard on Meteor.userId().
Re-authenticate after token expiry and retry.
For automation, use an admin REST endpoint with a token instead of raw DDP.
Only invoke the method from the admin settings UI path.

Example fix

// before
Meteor.call('reloadAccountsLockout', cb); // anonymous
// after
if (Meteor.userId()) Meteor.call('reloadAccountsLockout', cb);
else loginRedirect();

Defensive patterns

Strategy: try-catch

Validate before calling

if (!Meteor.userId()) { redirectToLogin(); } else { Meteor.call('reloadAccountsLockout', ...); }

Type guard

function isLoggedIn() { return typeof Meteor !== 'undefined' && Boolean(Meteor.userId()); }

Try / catch

Meteor.call('reloadAccountsLockout', (err) => {
  if (err && err.error === 'error-invalid-user') { redirectToLogin(); return; }
  if (err) throw err;
  notify('Lockout settings reloaded');
});

Prevention

Fire settings reloads only after login completes (post-auth lifecycle hooks).
Use an admin REST token for automated settings changes.
Re-authenticate after session expiry instead of retrying.
Keep the call inside the admin settings UI path.

When it happens

Trigger: Meteor.call('reloadAccountsLockout') from a logged-out client, anonymous DDP connection, or after session expiry; server-internal call where this.userId is undefined.

Common situations: Settings page fires before auth completes; test harness invoking the method without a logged-in user; proxy stripping auth cookies.

Understand the failure class

Background: error-invalid-user: "Invalid user" errors in Rocket.Chat — what they mean and how to fix them — this error's family across 2 libraries.

Related errors

AI-assisted analysis of wekan/wekan@eb1433158b (2026-09-01). Data as JSON: /api/errors/1bee6eacbfd0797d. Report an issue: GitHub.