{"record":{"id":"2adf18134267e158","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/AdminOnlyRoleActionAccessControlService.php","lineNumber":33,"sourceCode":" * @since         5.8.0\n */\n\nnamespace Passbolt\\Rbacs\\Service\\ActionAccessControl;\n\nuse App\\Model\\Entity\\Role;\nuse Cake\\Http\\Exception\\ForbiddenException;\n\nclass AdminOnlyRoleActionAccessControlService implements RoleActionAccessControlServiceInterface\n{\n    /**\n     * @inheritDoc\n     */\n    public function controlUserRoleActionAccess(Role $role, string $actionId): void\n    {\n        if ($role->isAdmin()) {\n            return;\n        }\n        throw new ForbiddenException(__('You are not authorized to access that location.'));\n    }\n}\n","sourceCodeStart":15,"sourceCodeEnd":36,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/AdminOnlyRoleActionAccessControlService.php#L15-L36","documentation":"AdminOnlyRoleActionAccessControlService::controlUserRoleActionAccess throws ForbiddenException for any role that is not admin. This service is used for RBAC management actions that only administrators may perform, so a 403 is returned for non-admin callers.","triggerScenarios":"A logged-in user with a non-admin role (user, etc.) attempts to update role/action RBAC settings via the RBACS update endpoint.","commonSituations":"Regular users trying to change their own permissions; API tokens belonging to non-admin accounts; tests or scripts hitting the endpoint with the wrong account.","solutions":["Log in as / use an administrator account","Grant the admin role to the user who needs to manage RBACs","Check that the correct authenticated session/token is being used (not a lesser-privileged one)","Do not call this endpoint from non-admin clients; use documented user-facing APIs instead"],"exampleFix":"null","handlingStrategy":"type-guard","validationCode":"$isAdmin = $user->role->isAdmin(); if (!$isAdmin) { // skip or hide the RBAC admin UI }","typeGuard":"function isAdminRole(Role $role): bool { return $role->isAdmin(); }","tryCatchPattern":"try { $service->controlUserRoleActionAccess($role, $actionId); } catch (ForbiddenException $e) { // show 403 / redirect non-admins }","preventionTips":["Only expose RBAC admin endpoints to admin accounts in the client","Check the current user's role before rendering admin controls","Ensure test fixtures use an admin UAC when exercising this endpoint"],"tags":["authorization","forbidden","rbacs","roles"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}