{"record":{"id":"01b8e86cd0546b01","repo":"passbolt/passbolt_api","slug":"the-user-identifier-should-be-a-uuid","errorCode":null,"errorMessage":"The user identifier should be a UUID.","messagePattern":"The user identifier should be a UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/Metadata/src/Service/UserMetadataKeysDeleteService.php","lineNumber":38,"sourceCode":"use Cake\\Http\\Exception\\InternalErrorException;\nuse Cake\\ORM\\Locator\\LocatorAwareTrait;\nuse Cake\\Utility\\Hash;\nuse Cake\\Validation\\Validation;\n\nclass UserMetadataKeysDeleteService\n{\n    use LocatorAwareTrait;\n\n    /**\n     * Delete user metadata private & session keys.\n     *\n     * @param string $userId User identifier.\n     * @return void\n     */\n    public function delete(string $userId): void\n    {\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user identifier should be a UUID.'));\n        }\n\n        $this->deleteMetadataPrivateKeys($userId);\n        $this->deleteMetadataSessionKeys($userId);\n    }\n\n    /**\n     * @param string $userId User identifier.\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException If data is not deleted.\n     */\n    private function deleteMetadataPrivateKeys(string $userId): void\n    {\n        /** @var \\Passbolt\\Metadata\\Model\\Table\\MetadataPrivateKeysTable $metadataPrivateKeysTable */\n        $metadataPrivateKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataPrivateKeys');\n\n        $metadataPrivateKeys = $metadataPrivateKeysTable\n            ->unhydratedFind()","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/UserMetadataKeysDeleteService.php#L20-L56","documentation":"A BadRequestException thrown by UserMetadataKeysDeleteService::delete when the provided $userId is not a valid UUID. This public service method is the entry point for removing a user's metadata private keys and session keys; it validates the identifier format before touching the database.","triggerScenarios":"Calling the user metadata keys delete service/endpoint with a malformed user identifier — empty string, numeric ID, slug, or truncated UUID instead of a 36-char UUID.","commonSituations":"Client code passing a username or non-UUID identifier; copy-paste errors of user IDs; routing bugs where the wrong URL segment is bound to the userId parameter; scripted cleanups iterating over non-UUID keys.","solutions":["Pass the user's actual UUID (as found in the users table / GET /users.json response)","Validate the identifier client-side with a UUID check (CakePHP Validation::uuid or a regex) before calling delete","Fix the caller/route so the correct path segment is used as the user ID"],"exampleFix":"// before\n$service->delete($user['username']);\n// after\nif (!Validation::uuid($userId)) {\n    throw new BadRequestException(__('The user identifier should be a UUID.'));\n}\n$service->delete($userId);","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!Validation::uuid($userId)) {\n    throw new \\InvalidArgumentException('userId must be a UUID');\n}\n$service->delete($userId);","typeGuard":"function isValidUuid(?string $id): bool {\n    return is_string($id) && (bool) preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i', $id);\n}","tryCatchPattern":"try {\n    $service->delete($userId);\n} catch (BadRequestException $e) {\n    // userId was not a UUID: fix the identifier source\n}","preventionTips":["Always resolve users via the users table/API to obtain their UUID before deleting metadata keys","Validate identifiers with Validation::uuid at the call site","Check route templates bind the correct segment to userId","Avoid passing usernames/emails where UUIDs are expected"],"tags":["cakephp","metadata","validation","uuid"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}