{"record":{"id":"019f71ce255a633e","repo":"passbolt/passbolt_api","slug":"the-metadata-session-key-identifier-should-be-a-uuid","errorCode":null,"errorMessage":"The metadata session key identifier should be a UUID.","messagePattern":"The metadata session key identifier should be a UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyDeleteService.php","lineNumber":41,"sourceCode":"use Cake\\Http\\Exception\\NotFoundException;\nuse Cake\\ORM\\Locator\\LocatorAwareTrait;\nuse Cake\\Validation\\Validation;\n\nclass MetadataSessionKeyDeleteService\n{\n    use LocatorAwareTrait;\n\n    /**\n     * Delete the given metadata session key.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac UAC.\n     * @param string $id The metadata session key identifier.\n     * @return void\n     */\n    public function delete(UserAccessControl $uac, string $id): void\n    {\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The metadata session key identifier should be a UUID.'));\n        }\n\n        /** @var \\Passbolt\\Metadata\\Model\\Table\\MetadataSessionKeysTable $metadataSessionKeysTable */\n        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');\n\n        try {\n            /** @var \\Passbolt\\Metadata\\Model\\Entity\\MetadataSessionKey $metadataSessionKey */\n            $metadataSessionKey = $metadataSessionKeysTable\n                ->find()\n                ->where(['id' => $id, 'user_id' => $uac->getId()])\n                ->firstOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('The metadata session key does not exist or does not belong to this user.')); // phpcs:ignore\n        }\n\n        if ($metadataSessionKeysTable->delete($metadataSessionKey)) {\n            return;\n        }","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyDeleteService.php#L23-L59","documentation":"MetadataSessionKeyDeleteService::delete() validates the session key id with Validation::uuid() before querying. A non-UUID id means a malformed identifier was supplied by the client, so the request is rejected as a 400 Bad Request before any database lookup.","triggerScenarios":"Calling DELETE on the metadata session key endpoint with an id that is not a valid UUID (e.g. truncated id, integer, empty string, or a differently-formatted identifier).","commonSituations":"Client stored an id from a wrong source, manually constructed URLs with non-UUID identifiers, or integration tests passing placeholder strings like 'xxx'.","solutions":["Pass a valid UUID v4 identifier as the session key id","Fetch the id from the metadata session key creation/index endpoint rather than hardcoding","Validate the id with Validation::uuid($id) or a regex on the client before calling"],"exampleFix":"// before\n$service->delete($uac, $idFromUrl);\n// after\nif (!Validation::uuid($idFromUrl)) { throw new InvalidArgumentException('invalid id'); }\n$service->delete($uac, $idFromUrl);","handlingStrategy":"validation","validationCode":"if (!preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id)) { throw new InvalidArgumentException('id must be a UUID'); }","typeGuard":"function isUuid(string $id): bool { return preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id) === 1; }","tryCatchPattern":"try { $service->delete($uac, $id); } catch (BadRequestException $e) { /* non-UUID id */ }","preventionTips":["Always source ids from API responses, never handcraft them","Validate UUID format before any session key call","Add client-side schema validation on URL parameters"],"tags":["uuid","bad-request","input-validation","metadata-session-key"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}