{"record":{"id":"2acec9be5ce2f644","repo":"passbolt/passbolt_api","slug":"the-commented-object-type-does-not-exist","errorCode":null,"errorMessage":"The commented object type does not exist.","messagePattern":"The commented object type does not exist\\.","errorType":"exception","errorClass":"Cake\\Datasource\\Exception\\RecordNotFoundException","httpStatus":404,"severity":"error","filePath":"src/Model/Table/CommentsTable.php","lineNumber":274,"sourceCode":"        ?array $options = []\n    ): SelectQuery {\n        // Check model sanity.\n        if (!in_array($foreignModelName, self::ALLOWED_FOREIGN_MODELS)) {\n            throw new InvalidArgumentException('The parameter foreignModel provided is not supported');\n        }\n\n        // Check uuid format.\n        if (!Validation::uuid($foreignKey)) {\n            throw new InvalidArgumentException('The parameter groupId should be a valid UUID.');\n        }\n\n        // Retrieve the resource.\n        // This will break if the resource doesn't exist, if it is soft deleted, or if the user is not allowed to access it.\n        /** @var \\App\\Model\\Table\\ResourcesTable $ResourcesTable */\n        $ResourcesTable = TableRegistry::getTableLocator()->get('Resources');\n        $foreignModelLookup = $ResourcesTable->findView($userId, $foreignKey)->first();\n        if (empty($foreignModelLookup)) {\n            throw new RecordNotFoundException(__('The commented object type does not exist.'));\n        }\n\n        $query = $this->find('threaded');\n        $query->where([\n            'Comments.foreign_model' => $foreignModelName,\n            'Comments.foreign_key' => $foreignKey,\n        ]);\n        $query->orderBy([\n            'Comments.modified' => 'DESC',\n        ]);\n\n        // If contains creator.\n        if (isset($options['contain']['creator'])) {\n            $query->contain([\n                'Creator' => ['Profiles' => AvatarsTable::addContainAvatar()],\n            ]);\n        }\n","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Model/Table/CommentsTable.php#L256-L292","documentation":"CommentsTable::findViewForeignComments() retrieves the commented foreign object (e.g. a resource) first. If no record is found for the given user and foreign key, it throws RecordNotFoundException with this message.","triggerScenarios":"Requesting comments for a foreignModel/foreignKey combination where the underlying resource does not exist, is soft-deleted, or the user lacks permission so findView() returns no row.","commonSituations":"Commenting endpoints called with a stale or deleted resource id, sharing permissions revoked so the user can no longer see the resource, or a wrong foreign key passed by a client.","solutions":["Verify the resource id (foreignKey) exists and is not deleted before fetching comments.","Check the user has access permission to the resource.","Catch RecordNotFoundException and return 404 to the client.","If ids are provided by clients, validate them against the resource table first."],"exampleFix":"// before\n$comments = $this->Comments->findViewForeignComments($userId, 'Resource', $resourceId);\n// after\ntry { $comments = $this->Comments->findViewForeignComments($userId, 'Resource', $resourceId); }\ncatch (RecordNotFoundException $e) { throw new NotFoundException(__('The resource does not exist.')); }","handlingStrategy":"try-catch","validationCode":"$resourcesTable = TableRegistry::getTableLocator()->get('Resources');\nif (!$resourcesTable->findView($userId, $foreignKey)->first()) {\n  throw new NotFoundException('Resource not found or not accessible.');\n}","typeGuard":null,"tryCatchPattern":"try { $comments = $commentsTable->findViewForeignComments($userId, 'Resource', $resourceId); }\ncatch (RecordNotFoundException $e) {\n  throw new NotFoundException(__('The commented resource does not exist.'));\n}","preventionTips":["Check resource existence and user permission before requesting its comments.","Catch RecordNotFoundException at the controller boundary and map to 404.","Purge comments when their parent resource is hard-deleted.","Never trust client-supplied foreign keys without an access check."],"tags":["record-not-found","comments","permissions"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}