{"record":{"id":"1943b8b326bf9bcd","repo":"passbolt/passbolt_api","slug":"this-operation-is-not-allowed-for-this-user","errorCode":null,"errorMessage":"This operation is not allowed for this user.","messagePattern":"This operation is not allowed for this user\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Mobile/src/Service/Transfers/TransfersUpdateService.php","lineNumber":161,"sourceCode":"            $msg .= __('The current page does not match the total number of pages.');\n            throw new ForbiddenException($msg);\n        }\n    }\n\n    /**\n     * Check if operation is allowed\n     *\n     * @param \\Passbolt\\Mobile\\Model\\Entity\\Transfer $transfer entity\n     * @param \\App\\Utility\\UserAccessControl $uac user access control object\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if operation is not allowed for example:\n     * - Transfer or AuthToken is for another user\n     * - Authentication token is expired\n     * @return void\n     */\n    private function assertOperationIsAllowed(Transfer $transfer, UserAccessControl $uac): void\n    {\n        if ($transfer->user_id !== $uac->getId()) {\n            throw new ForbiddenException(__('This operation is not allowed for this user.'));\n        }\n        if (!isset($transfer->authentication_token)) {\n            throw new ForbiddenException(__('The authentication token is missing.'));\n        }\n        if ($transfer->authentication_token->user_id !== $uac->getId()) {\n            throw new ForbiddenException(__('The authentication token is not valid for this user.'));\n        }\n        if ($transfer->authentication_token->type !== AuthenticationToken::TYPE_MOBILE_TRANSFER) {\n            throw new ForbiddenException(__('The authentication token type is invalid.'));\n        }\n        if ($transfer->authentication_token->active !== true) {\n            throw new ForbiddenException(__('The authentication token is not active.'));\n        }\n        if ($transfer->authentication_token->isExpired()) {\n            throw new ForbiddenException(__('The authentication token is expired.'));\n        }\n    }\n","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Mobile/src/Service/Transfers/TransfersUpdateService.php#L143-L179","documentation":"Thrown by TransfersUpdateService::assertOperationIsAllowed when the authenticated user (UserAccessControl) is not the owner of the transfer being updated (transfer.user_id !== uac.getId()). Only the user who initiated a mobile transfer may update it.","triggerScenarios":"PUT/PATCH to /transfers/{id}.json while logged in as a user different from the transfer's creator — e.g. reusing a transfer id from another account, or a token/account switch on the mobile device mid-transfer.","commonSituations":"Switching passbolt accounts on a mobile device without restarting the transfer flow; copy-pasting a transfer UUID from another user's logs; server-side admin testing with a different session than the one that created the transfer.","solutions":["Log in as the user who created the transfer before updating it","Abort and create a fresh transfer for the current user","Verify the transfer id belongs to the authenticated account"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const me = await api.getLoggedInUser();\nif (transfer.userId !== me.id) {\n  throw new Error('Transfer belongs to another user; create a new transfer');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.updateTransfer(transferId, payload);\n} catch (e) {\n  if (e.code === 403 && e.message.includes('not allowed for this user')) {\n    // re-authenticate as transfer owner or recreate the transfer\n  }\n}","preventionTips":["Store the transfer id together with the creating account and recheck on account switch","Create a fresh transfer per logged-in user","Never reuse transfer ids copied from other sessions"],"tags":["mobile","transfer","forbidden","ownership"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}