bug fix: change user.id to user.userId