{"record":{"id":"13cbe8500d605015","repo":"passbolt/passbolt_api","slug":"the-user-identifier-should-be-a-valid-uuid-or-me","errorCode":null,"errorMessage":"The user identifier should be a valid UUID or \"me\".","messagePattern":"The user identifier should be a valid UUID or \"me\"\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Controller/Users/UsersViewController.php","lineNumber":53,"sourceCode":"\n    /**\n     * User View action\n     *\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user id is not a uuid or 'me'\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user does not exist\n     * @param string $id uuid|me\n     * @return void\n     */\n    public function view(string $id)\n    {\n        $this->assertJson();\n\n        // Check request sanity\n        if (!Validation::uuid($id)) {\n            if ($id === 'me') {\n                $id = $this->User->id(); // me returns the currently logged-in user\n            } else {\n                throw new BadRequestException(__('The user identifier should be a valid UUID or \"me\".'));\n            }\n        }\n\n        // Retrieve the user\n        /** @var \\App\\Model\\Table\\UsersTable $usersTable */\n        $usersTable = $this->fetchTable('Users');\n        $query = $usersTable->findView($id, $this->User->role());\n\n        // Trigger an event to filter data, decorate results, add contain, etc.\n        $event = TableFindIndexBefore::create(\n            $query,\n            FindIndexOptions::createFromArray(['query' => $query]),\n            $usersTable\n        );\n        /** @var \\App\\Model\\Event\\TableFindIndexBefore $event */\n        $this->getEventManager()->dispatch($event);\n        $query = $event->getQuery();\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Users/UsersViewController.php#L35-L71","documentation":"GET /users/<id>.json validates that the user identifier in the URL is either a valid UUID or the literal string \"me\". Any other token (username, e-mail address, numeric id) fails Validation::uuid() and is rejected with a 400 BadRequestException before the database is queried.","triggerScenarios":"GET /users/{id}.json where {id} is not a UUID and not \"me\" — e.g. passing a username, email address, auto-increment id, or an empty/truncated string as the identifier.","commonSituations":"Clients storing/displaying user emails instead of UUIDs in URLs; older API v1 style numeric ids; URL-encoding mistakes that corrupt the UUID; frontend bugs where an undefined variable interpolates as a non-UUID string.","solutions":["Send the user's UUID (the `id` field returned by /users.json) in the URL.","Use GET /users/me.json when the target is the currently authenticated user.","Fix the client to resolve emails/usernames to UUIDs via the user index endpoint first.","Ensure the id is not URL-mangled (no spaces, full 36-char UUID)."],"exampleFix":"// before\nfetch('/users/alice@example.com.json')\n// after\nfetch('/users/782609da-397c-4a52-9f4c-8a0f3d5f2a01.json')\n// or\nfetch('/users/me.json')","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nfunction canCallUserView(id) { return id === 'me' || UUID_RE.test(id); }\nif (!canCallUserView(id)) throw new TypeError(`Expected UUID or 'me', got: ${id}`);","typeGuard":"function isUserIdentifier(v) {\n  const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n  return typeof v === 'string' && (v === 'me' || UUID_RE.test(v));\n}","tryCatchPattern":"try {\n  const res = await api.get(`/users/${id}.json`);\n} catch (e) {\n  if (e.response?.status === 400) {\n    throw new Error(`'${id}' is not a valid user identifier: use a UUID or 'me'.`);\n  }\n  throw e;\n}","preventionTips":["Always source ids from the API response `id` field, never from usernames/emails.","Prefer /users/me.json for the logged-in user instead of tracking your own UUID.","Validate UUIDs client-side with a regex before building URLs.","Beware variable interpolation bugs producing 'undefined' or empty ids."],"tags":["passbolt","cakephp","validation","uuid","http-400"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}