{"record":{"id":"02f57d4f1d090bf6","repo":"passbolt/passbolt_api","slug":"it-is-not-possible-to-create-an-authentication-token-for-02f57d","errorCode":null,"errorMessage":"It is not possible to create an authentication token for this user.","messagePattern":"It is not possible to create an authentication token for this user\\.","errorType":"validation","errorClass":"Cake\\Http\\Exception\\ValidationException","httpStatus":400,"severity":"error","filePath":"src/Model/Table/AuthenticationTokensTable.php","lineNumber":232,"sourceCode":"            [\n                'user_id' => $userId,\n                'token' => $token ?? UuidFactory::uuid(),\n                'active' => true,\n                'type' => $type,\n                'data' => empty($data) ? null : json_encode($data),\n            ],\n            ['accessibleFields' => [\n                'user_id' => true,\n                'token' => true,\n                'active' => true,\n                'type' => true,\n                'data' => true,\n            ]]\n        );\n        $errors = $token->getErrors();\n        $msg = __('It is not possible to create an authentication token for this user.');\n        if (!empty($errors)) {\n            throw new ValidationException($msg);\n        }\n        if (!$this->save($token)) {\n            throw new ValidationException($msg);\n        }\n\n        return $token;\n    }\n\n    /**\n     * Check if a token exist and is valid for a given user.\n     *\n     * A valid token :\n     *  - belongs to the given user &&\n     *  - is active &&\n     *  - is not expired ;\n     *\n     * @param string $token uuid of the token to check\n     * @param string $userId uuid of the user","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Model/Table/AuthenticationTokensTable.php#L214-L250","documentation":"AuthenticationTokensTable::generate() builds a new authentication token entity for a user. If entity validation fails (errors present after build), it throws a ValidationException with this generic message instead of exposing field-level errors directly in the message.","triggerScenarios":"Calling AuthenticationTokensTable::generate($userId, $type) where the built token entity fails validation — most commonly the user_id is not a valid UUID or does not exist, or an invalid token type is passed.","commonSituations":"Passing a non-existent or deleted user id, generating a token with an unsupported type constant, or calling generate before the user record is committed.","solutions":["Verify the user id exists and is a valid UUID before calling generate().","Check the token type is one of the supported AuthenticationToken types.","Inspect getErrors() on the token by calling buildEntity/debug to see the actual field errors.","Ensure the user is active/not deleted if your validation rules require it."],"exampleFix":"// before\n$token = $this->AuthenticationTokens->generate('not-a-uuid', AuthenticationToken::TYPE_RECOVER);\n// after\nif (!Validation::uuid($userId)) { throw new BadRequestException('Invalid user id'); }\n$token = $this->AuthenticationTokens->generate($userId, AuthenticationToken::TYPE_RECOVER);","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!Validation::uuid($userId)) { throw new InvalidArgumentException('user id must be a UUID'); }\n$user = $this->Users->find()->where(['id' => $userId])->first();\nif (!$user) { throw new RecordNotFoundException('User not found'); }","typeGuard":"function isValidTokenContext(string $userId, string $type, UsersTable $users): bool {\n  return Validation::uuid($userId)\n    && in_array($type, AuthenticationToken::ALLOWED_TYPES, true)\n    && $users->exists(['id' => $userId]);\n}","tryCatchPattern":"try { $token = $this->AuthenticationTokens->generate($userId, $type); }\ncatch (ValidationException $e) { $this->log('Token generation rejected for user ' . $userId); throw new BadRequestException('Cannot create token for this user.'); }","preventionTips":["Always verify the user exists and is active before generating tokens.","Use the AuthenticationToken type constants instead of raw strings.","Validate UUIDs with Cake's Validation::uuid().","Log token generation failures with user context for diagnosis."],"tags":["validation","authentication-token","cakephp"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}