{"record":{"id":"2cb16693740fdb52","repo":"passbolt/passbolt_api","slug":"folder-creation-modification-with-encrypted-metadata-not","errorCode":null,"errorMessage":"Folder creation/modification with encrypted metadata not allowed.","messagePattern":"Folder creation/modification with encrypted metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":89,"sourceCode":"\n        if (!$v5Enabled && $isV5) {\n            throw new BadRequestException(__('V5 metadata format is not enabled.'));\n        }\n        if (!$v5Enabled) {\n            // No need to assert if format is v4 and v5 config is disabled\n            return;\n        }\n\n        $settingsDto = MetadataTypesSettingsGetService::getSettings();\n\n        if ($isV5) {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV5ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV5FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV4TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L71-L107","documentation":"Thrown when a client tries to create or modify a folder using v5 encrypted metadata while the metadata types settings forbid v5 folder creation. assertCreationAllowedByMetadataSettings evaluates the ENTITY_FOLDER branch and rejects with BadRequestException. Same policy mechanism as for resources/tags, scoped to folders.","triggerScenarios":"Folder create/update endpoints called with encrypted (v5) metadata payload while MetadataTypesSettingsDto::isV5FolderCreationAllowed() returns false (assertV5FolderCreationEnabled).","commonSituations":"Admin disabled encrypted folders in metadata types settings; client SDK or API scripts hard-coding v5 folder payloads; post-migration environments where folders were intentionally kept on v4 cleartext metadata; automation (e.g. LDAP sync or provisioning scripts) written against v5 API assumptions.","solutions":["Verify the server's metadata settings and whether v5 folder creation is disabled","Use v4 cleartext folder metadata in the request, or ask an admin to enable v5 folder creation in metadata types settings","Update the integration to read the allowed metadata types from the server before creating folders"],"exampleFix":"// before\n$folder = ['folder' => ['metadata' => $encryptedMetadata, 'metadata_key_id' => $kid]];\n// after: send cleartext name when v5 folders are disallowed\n$folder = ['folder' => ['name' => 'My folder']];","handlingStrategy":"try-catch","validationCode":"$settings = MetadataTypesSettingsGetService::getSettings();\nassert($settings->isV5FolderCreationAllowed() || 'use v4 folder payload');","typeGuard":"function v5FolderAllowed($settings): bool { return $settings->isV5FolderCreationAllowed(); }","tryCatchPattern":"try { $folder = $foldersService->create($data, $uac); }\ncatch (\\Cake\\Http\\Exception\\BadRequestException $e) { /* retry with cleartext v4 folder payload if allowed */ }","preventionTips":["Keep folder-creation code paths aligned with the metadata version the server allows","Test folder creation against both v4-only and v5-only settings in CI","Surface the server's allowed metadata types in client UI before form submission"],"tags":["passbolt","metadata","folders","api-policy"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}