{"record":{"id":"353fe5101a4235f3","repo":"flarum/framework","slug":"invalid-erasure-mode-mode","errorCode":null,"errorMessage":"Invalid erasure mode: $mode","messagePattern":"Invalid erasure mode: \\$mode","errorType":"validation","errorClass":"ValidationException","httpStatus":422,"severity":"error","filePath":"extensions/gdpr/src/Api/UserResourceDeleteEndpoint.php","lineNumber":61,"sourceCode":"\n            $this->deleteAction($model, $context);\n\n            $endpoint->callAfterHook($context, $model);\n\n            return null;\n        });\n    }\n\n    /**\n     * @throws ValidationException\n     */\n    protected function deleteAction(User $user, Context $context): void\n    {\n        $actor = $context->getActor();\n        $mode = Arr::get($context->body(), 'gdprMode', $this->settings->get('flarum-gdpr.default-erasure'));\n\n        if (! in_array($mode, [ErasureRequest::MODE_ANONYMIZATION, ErasureRequest::MODE_DELETION])) {\n            throw new ValidationException(['mode' => \"Invalid erasure mode: $mode\"]);\n        }\n\n        ErasureRequest::unguard();\n\n        $erasureRequest = ErasureRequest::firstOrNew([\n            'user_id' => $user->id,\n        ]);\n\n        $erasureRequest->user_id = $user->id;\n        $erasureRequest->status = ErasureRequest::STATUS_MANUAL;\n        $erasureRequest->created_at = Carbon::now();\n        $erasureRequest->processed_mode = $mode;\n        $erasureRequest->processed_at = Carbon::now();\n        $erasureRequest->processed_by = $actor->id;\n\n        $erasureRequest->save();\n\n        ErasureRequest::reguard();","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/extensions/gdpr/src/Api/UserResourceDeleteEndpoint.php#L43-L79","documentation":"UserResourceDeleteEndpoint::deleteAction reads the erasure mode from gdprMode in the request body (falling back to the flarum-gdpr.default-erasure setting) and throws a ValidationException if it is not one of the allowed modes (anonymization or deletion).","triggerScenarios":"Deleting a user via the GDPR delete endpoint with body gdprMode set to anything other than 'anonymization'/'deletion', or with an invalid stored value in the flarum-gdpr.default-erasure setting and no gdprMode supplied.","commonSituations":"Client sending gdprMode: 'delete' or 'erase' instead of the exact mode strings; admin misconfiguring default-erasure in settings; casing/typos in the mode value.","solutions":["Send gdprMode exactly as 'anonymization' or 'deletion' (use ErasureRequest::MODE_* constants).","Fix the flarum-gdpr.default-erasure setting in the admin panel/database if the fallback is invalid.","Check for case-sensitivity and trailing whitespace in the submitted mode value."],"exampleFix":"// before\n{ \"gdprMode\": \"delete\" }\n// after\n{ \"gdprMode\": \"deletion\" }","handlingStrategy":"validation","validationCode":"$mode = $body['gdprMode'] ?? $settings->get('flarum-gdpr.default-erasure'); if (! in_array($mode, [ErasureRequest::MODE_ANONYMIZATION, ErasureRequest::MODE_DELETION], true)) { /* reject before sending */ }","typeGuard":null,"tryCatchPattern":"try { $api->deleteUser($id, ['gdprMode' => $mode]); } catch (ValidationException $e) { // inspect $e->getErrors()['mode'] }","preventionTips":["Use ErasureRequest::MODE_* constants, never string literals","Audit the flarum-gdpr.default-erasure setting value","Validate mode server-side in your own form handling"],"tags":["validation","enum","gdpr"],"backgroundTag":"invalid-enum-value","analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}