{"record":{"id":"3158dcc7bd7406ed","repo":"passbolt/passbolt_api","slug":"unable-to-authenticate-the-guest-user-with-the-provided-3158dc","errorCode":null,"errorMessage":"Unable to authenticate the guest user with the provided credentials.","messagePattern":"Unable to authenticate the guest user with the provided credentials\\.","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":123,"sourceCode":"        if (!Validation::uuid($authToken)) {\n            throw new BadRequestException(__('The authentication token must be a valid UUID.'));\n        }\n\n        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');\n\n        try {\n            (new AuthenticationTokenGetService())\n                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);\n        } catch (NotFoundException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('No registration authentication token found for the given user.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (CustomValidationException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('The registration authentication token is expired.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (Exception $exception) {\n            throw new ForbiddenException($errorMsg, null, $exception); // phpcs:ignore\n        }\n    }\n}\n","sourceCodeStart":105,"sourceCodeEnd":127,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L105-L127","documentation":"This ForbiddenException is the catch-all branch of the guest authentication check in UserKeyPoliciesGetSettingsController::assertQueryParameters. When the token lookup throws any exception other than NotFoundException or CustomValidationException, the controller rejects the guest with 'Unable to authenticate the guest user with the provided credentials.' It signals token validation failed in an unexpected way (e.g. a database error), so the caller is denied without leaking details.","triggerScenarios":"GET /user-key-policies/settings as guest with valid-format user_id and token UUIDs, but the lookup throws an unexpected Exception — typically a database connection/query failure reading authentication_tokens, or an exception from the service/listeners.","commonSituations":"Database down or misconfigured during setup; authentication_tokens table missing (migrations not run); plugin/event listener on token lookup throwing; transient DB lock or timeout.","solutions":["Check the server error log — the underlying exception is chained and logged — and fix the root cause (usually DB connectivity or missing migrations).","Run database migrations (ddev refresh or cake migrations migrate) to ensure authentication_tokens exists.","Verify database credentials and connectivity in config/app.php.","Retry once the infrastructure issue is resolved; this branch is rarely caused by the client payload."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await get('/user-key-policies/settings', { user_id, token });\n} catch (e) {\n  if (e.status === 403) {\n    // unexpected token-validation failure: check server logs / DB health, retry after infra recovery\n  }\n  throw e;\n}","preventionTips":["Ensure the database is reachable and migrations have run before invoking installer-related endpoints.","Monitor server error logs; the real cause is the chained exception, not the client payload.","Retry only after fixing the underlying infrastructure issue, not in a tight loop."],"tags":["authentication","forbidden","database"],"backgroundTag":"authentication-required","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}