{"record":{"id":"3562d6640860cd35","repo":"passbolt/passbolt_api","slug":"tag-creation-with-cleartext-metadata-not-allowed","errorCode":null,"errorMessage":"Tag creation with cleartext metadata not allowed.","messagePattern":"Tag creation with cleartext metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":107,"sourceCode":"                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV4TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":89,"sourceCodeEnd":113,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L89-L113","documentation":"Thrown when a tag is created with v4 cleartext metadata while the metadata types settings disallow v4 tag creation, i.e. only encrypted (v5) tags may be created. Raised by the ENTITY_TAG branch in the else ($isV5 === false) path of assertCreationAllowedByMetadataSettings.","triggerScenarios":"Tag creation endpoints (POST /tags, tags on resource create) with plain slug payload while isV4TagCreationAllowed() returns false.","commonSituations":"Post-migration environments enforcing encrypted tags; scripts tagging resources with simple slug arrays; test fixtures/build data using v4 tag format.","solutions":["Create the tag using v5 encrypted metadata payload","Admin-side: enable v4 tag creation in metadata types settings if cleartext tags are still acceptable","Update tagging scripts/fixtures to the v5 format"],"exampleFix":"// before\n$tag = ['slug' => 'prod'];\n// after\n$tag = ['slug' => $encryptedSlug, 'is_shared' => $encryptedBool]; // v5","handlingStrategy":"validation","validationCode":"$isPlainSlug = isset($tag['slug']) && !isset($tag['metadata_key_id']) && !isset($tag['is_shared']);\nif ($isPlainSlug && !$settings->isV4TagCreationAllowed()) { /* convert to encrypted v5 tag */ }","typeGuard":"function isV5TagPayload(array $t): bool { return isset($t['is_shared']) || isset($t['metadata_key_id']); }","tryCatchPattern":"try { $tag = $tagsService->create($data, $uac); }\ncatch (\\Cake\\Http\\Exception\\BadRequestException $e) { /* upgrade payload to v5 and retry */ }","preventionTips":["Read the allowed metadata types from the server before tagging operations","Update CI fixtures to the metadata version enforced by target environments","Prefer v5 tag payloads in new code unless v4 creation is explicitly enabled"],"tags":["passbolt","metadata","tags","migration"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}