{"record":{"id":"23ff37c681d3a5ae","repo":"passbolt/passbolt_api","slug":"account-recovery-is-disabled","errorCode":null,"errorMessage":"Account recovery is disabled.","messagePattern":"Account recovery is disabled\\.","errorType":"http","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryOrganizationPolicies/AccountRecoveryOrganizationPolicyGetService.php","lineNumber":89,"sourceCode":"            $policy = $this->AccountRecoveryOrganizationPolicies->newEntityForDefaultFallback();\n        }\n\n        return $policy;\n    }\n\n    /**\n     * Throw an exception if the organization policy is disabled or\n     * if the public key is empty\n     *\n     * @return \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryOrganizationPolicy\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the feature is not enabled\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the public key is empty\n     */\n    public function getOrFail(): AccountRecoveryOrganizationPolicy\n    {\n        $policy = $this->get();\n        if ($policy->isDisabled()) {\n            throw new BadRequestException(__('Account recovery is disabled.'));\n        } elseif (is_null($policy->account_recovery_organization_public_key)) {\n            throw new BadRequestException(__('The account recovery organization public key is not set.'));\n        }\n\n        return $policy;\n    }\n\n    /**\n     * Join the creator to the query if contained in the request\n     * The Gpgkey of the creator may also be contained.\n     *\n     * @param \\Cake\\ORM\\Query $query Query to decorate\n     * @return void\n     */\n    protected function containCreator(Query $query): void\n    {\n        $contain = $this->request->getQuery('contain');\n        if (is_array($contain) && isset($contain['creator']) && $contain['creator']) {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryOrganizationPolicies/AccountRecoveryOrganizationPolicyGetService.php#L71-L107","documentation":"`getOrFail` enforces that account recovery is enabled before serving the organization policy. When the stored organization policy row says disabled, a `BadRequestException('Account recovery is disabled.')` is raised because the requested operation only makes sense for an enabled setup.","triggerScenarios":"Calling APIs that require an active recovery policy (e.g. user account recovery setup/recovery flows) while the organization policy is 'disabled', or before EE account recovery has ever been enabled.","commonSituations":"CE instance without the EE account recovery plugin configured; admin never enabled recovery in admin settings; policy was disabled after users already attempted setup.","solutions":["Enable account recovery in Admin Workspace > Account Recovery Settings (policy set to opt-in/mandatory) with a valid organization key","Verify via GET /account-recovery/organization-settings.json that the policy is not 'disabled'","If the EE plugin was recently installed/removed, confirm the policy row exists and is enabled"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"const s = await api.get('/account-recovery/organization-settings.json');\nif (s.policy === 'disabled') throw new Error('enable account recovery first');","typeGuard":"function isRecoveryEnabled(settings) { return !!settings && settings.policy !== 'disabled'; }","tryCatchPattern":"try { await recoveryFlow(); } catch (e) { if (e.status === 400 && e.message.includes('disabled')) redirectAdminToEnableRecovery(); else throw e; }","preventionTips":["Check organization settings before starting recovery flows","Enable account recovery in admin settings before onboarding users","Handle EE plugin availability"],"tags":["account-recovery","feature-disabled","ee-plugin","bad-request"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}