{"record":{"id":"2c07b4221a212b9a","repo":"passbolt/passbolt_api","slug":"the-resource-does-not-exist-permissionsviewcontroller","errorCode":null,"errorMessage":"The resource does not exist.","messagePattern":"The resource does not exist\\.","errorType":"exception","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Controller/Permissions/PermissionsViewController.php","lineNumber":79,"sourceCode":"     * @return void\n     */\n    public function viewAcoPermissions(string $acoForeignKey)\n    {\n        $this->assertJson();\n\n        // Check request sanity\n        if (!Validation::uuid($acoForeignKey)) {\n            throw new BadRequestException(__('The identifier should be a valid UUID.'));\n        }\n\n        // Retrieve and sanity the query options.\n        $whitelist = ['contain' => ['group', 'user', 'user.profile']];\n        $options = $this->QueryString->get($whitelist);\n\n        // Check that the user has access to the resource.\n        $resource = $this->Resources->findView($this->User->id(), $acoForeignKey)->first();\n        if (empty($resource)) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n\n        // Retrieve the permissions.\n        $permissions = $this->Permissions->findViewAcoPermissions($acoForeignKey, $options);\n        $this->success(__('The operation was successful.'), $permissions);\n    }\n}\n","sourceCodeStart":61,"sourceCodeEnd":87,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Permissions/PermissionsViewController.php#L61-L87","documentation":"Passbolt throws this 404 when the acoForeignKey is a valid UUID but Resources->findView() returns no row the requesting user can see. The lookup is access-scoped, so the resource may exist yet still be invisible to this user.","triggerScenarios":"GET /permissions/resource/<uuid>.json where the resource was deleted, the UUID belongs to another instance, or the requesting user has no permission entry for that resource (findView filters by access).","commonSituations":"A user probing resource ids hoping to detect existence (correctly gets 404); stale UI after the resource was deleted or the user's permission was revoked; environment mismatch between API client data and server.","solutions":["Confirm the resource exists and is shared with the user via GET /resources.json (list shows only accessible items)","Re-check that the user still has permission on the resource; re-share if it was revoked","Verify the id against the resource index rather than a cached/stale value","Confirm client and server point to the same environment"],"exampleFix":"// before\nconst perms = await fetch(`/permissions/resource/${resourceId}.json`);\n// after\nconst visible = await fetch('/resources.json').then(r => r.json());\nif (!visible.body.some(r => r.id === resourceId)) {\n  throw new Error('resource not accessible to current user');\n}\nconst perms = await fetch(`/permissions/resource/${resourceId}.json`);","handlingStrategy":"try-catch","validationCode":"const visible = (await fetch('/resources.json').then(r=>r.json())).body;\nif (!visible.some(r=>r.id===resourceId)) throw new Error('resource not visible to current user');","typeGuard":"null","tryCatchPattern":"try {\n  return await fetchPermissions(resourceId);\n} catch (e) {\n  if (e.status === 404) return { permissions: [], note: 'resource not found or not shared' };\n  throw e;\n}","preventionTips":["Only query permissions for resources returned by your own /resources.json listing","Remember the lookup is access-scoped: 404 may mean no permission, not non-existence","Re-share or refresh after permission changes"],"tags":["http-404","permissions","resources","rest-api"],"backgroundTag":"entity-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}