{"record":{"id":"12d704f34d981e74","repo":"passbolt/passbolt_api","slug":"the-identifier-should-be-a-valid-uuid-12d704","errorCode":null,"errorMessage":"The identifier should be a valid UUID.","messagePattern":"The identifier should be a valid UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Model/Traits/Permissions/PermissionsFindersTrait.php","lineNumber":106,"sourceCode":"\n    /**\n     * Returns a query retrieving the permissions an aro have.\n     *\n     * The $checkGroupsUsers will also return the permissions inherited from the groups the aro is member of.\n     *\n     * @param string $acoType The aco type. By instance Resource or Folder.\n     * @param string $aroForeignKey The target aro id. By instance a user or a group id.\n     * @param array|null $options options\n     * [\n     *   bool $checkGroupsUsers Check also for the groups the aro is member of\n     * ]\n     * @return \\Cake\\ORM\\Query\\SelectQuery\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the aro foreign key is not a valid UUID\n     */\n    public function findAllByAro(string $acoType, string $aroForeignKey, ?array $options = []): SelectQuery\n    {\n        if (!Validation::uuid($aroForeignKey)) {\n            throw new BadRequestException(__('The identifier should be a valid UUID.'));\n        }\n        $checkGroupsUsers = Hash::get($options, 'checkGroupsUsers', false);\n\n        // Retrieve also the permissions for the groups a user is member of.\n        if ($checkGroupsUsers) {\n            $aroForeignKeys = $this->Groups->GroupsUsers->find()\n                ->select('group_id')\n                ->where(['user_id' => $aroForeignKey])\n                ->epilog('UNION SELECT :aroForeignKey')\n                ->bind(':aroForeignKey', $aroForeignKey);\n        } else {\n            $aroForeignKeys = [$aroForeignKey];\n        }\n\n        return $this->find()\n            ->where([\n                'Permissions.aco' => $acoType,\n                'Permissions.aro_foreign_key IN' => $aroForeignKeys,","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Model/Traits/Permissions/PermissionsFindersTrait.php#L88-L124","documentation":"findAllByAro() in PermissionsFindersTrait validates that the $aroForeignKey argument is a valid UUID and throws BadRequestException otherwise. All permission-finder methods built on it (findHighestByAcoAndAro, findAcosAccessesDiffBetweenGroupAndUser, findAcosByAroIsOwner) inherit this check, since a non-UUID ARO id would produce a broken or dangerous SQL comparison.","triggerScenarios":"Calling any of the permission finders (or the controller endpoints that use them, e.g. permission lookups for a resource) with a user/group id that is null-coerced to '', a slug, an integer id, or otherwise malformed instead of a 36-char UUID.","commonSituations":"Route parameters picked up from a mistyped URL (e.g. /permissions/user/not-a-uuid); legacy integrations sending integer ids; unvalidated user input passed straight into the query; tests using placeholder ids like '1' or 'abc'.","solutions":["Ensure the aro id passed in is a valid UUID as stored in users.id/groups.id.","Validate route/query parameters with Cake\\Validation::uuid() in the controller before calling the finder.","Fix upstream callers that build the id from untrusted input (add parameter validation).","If ids come from an external system, map legacy integer ids to passbolt UUIDs first."],"exampleFix":"// before\n$perms = $this->Permissions->findHighestByAcoAndAro($aco, $userIdFromRequest);\n// after\nuse Cake\\Validation\\Validation;\nif (!Validation::uuid($userIdFromRequest)) {\n    throw new BadRequestException('The identifier should be a valid UUID.');\n}\n$perms = $this->Permissions->findHighestByAcoAndAro($aco, $userIdFromRequest);","handlingStrategy":"type-guard","validationCode":"use Cake\\Validation\\Validation; if (!Validation::uuid($aroForeignKey)) { throw new Cake\\Http\\Exception\\BadRequestException('aroForeignKey must be a UUID'); }","typeGuard":"function isUuidString(mixed $v): bool { return is_string($v) && Cake\\Validation\\Validation::uuid($v); }","tryCatchPattern":"try { $perms = $this->Permissions->findHighestByAcoAndAro($aco, $aroId); } catch (\\Cake\\Http\\Exception\\BadRequestException $e) { // return 400: invalid identifier }","preventionTips":["Validate route parameters with Validation::uuid() before querying.","Never pass slugs or integer ids where UUIDs are expected.","Type-hint parameters as string and reject empty values early.","Map legacy/external ids to passbolt UUIDs at integration boundaries."],"tags":["uuid","bad-request","permissions","input-validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}