{"record":{"id":"3906a35640671006","repo":"passbolt/passbolt_api","slug":"the-authentication-token-does-not-exist","errorCode":null,"errorMessage":"The authentication token does not exist.","messagePattern":"The authentication token does not exist\\.","errorType":"exception","errorClass":"RecordNotFoundException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php","lineNumber":83,"sourceCode":"        }\n        if (isset($userId) && !Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id should be a valid UUID.'));\n        }\n\n        try {\n            $where = [\n                'token' => $token,\n                'type' => $type,\n                'active' => true,\n            ];\n            if (isset($userId)) {\n                $where['user_id'] = $userId;\n            }\n\n            /** @var \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken $tokenEntity */\n            $tokenEntity = $this->SsoAuthenticationTokens->find()->where($where)->firstOrFail();\n        } catch (RecordNotFoundException $exception) {\n            throw new RecordNotFoundException(__('The authentication token does not exist.'), 400, $exception);\n        }\n\n        return $tokenEntity;\n    }\n\n    /**\n     * Get active and not expired token or fail\n     *\n     * @param string $token Token value.\n     * @param string $type Type of token.\n     * @return \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If token is not found or inactive\n     * @throws \\App\\Error\\Exception\\CustomValidationException If the token is expired\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If token id is not a valid uuid\n     */\n    public function getActiveNotExpiredOrFail(string $token, string $type): SsoAuthenticationToken\n    {\n        $ssoAuthToken = $this->getOrFail($token, $type);","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php#L65-L101","documentation":"A RecordNotFoundException (with code 400) re-thrown by getOrFail when no active SSO authentication token row matches the given token value, type, and optional user_id. The underlying firstOrFail() raised Cake's RecordNotFoundException, which is wrapped with this domain-specific message.","triggerScenarios":"getOrFail/finds no row in sso_authentication_tokens where token = $token AND type = $type AND active = true (AND user_id = $userId if provided). Happens with a mistyped token, a wrong token type constant, a token already consumed (active = false), a user_id filter that doesn't match, or a token from another environment/database.","commonSituations":"Replaying a token after a previous SSO login already consumed it; browser retry after token deletion by cleanup/cron; staging vs production database mixups; client sending the verify token type when a register/recover type is stored; case or whitespace differences in the token string.","solutions":["Verify the token value and that the correct token TYPE constant is being passed (e.g. SsoAuthenticationToken::TYPE_SSO)","Check the sso_authentication_tokens table directly: SELECT * WHERE token = '...' — confirm the row exists and active = 1","If the token was consumed, restart the SSO flow to generate a fresh token instead of reusing it","Confirm the app points at the expected database/environment where the token was created","If a user_id is passed, confirm it matches the token's user_id or omit it"],"exampleFix":"// before\n$tokenEntity = $service->getOrFail($tokenFromUrl, 'sso.register'); // wrong type\n// after\n$tokenEntity = (new SsoAuthenticationTokenGetService())\n    ->getActiveNotExpiredOrFail($tokenFromUrl, SsoAuthenticationToken::TYPE_SSO);","handlingStrategy":"try-catch","validationCode":"$exists = $this->fetchTable('Passbolt/Sso.SsoAuthenticationTokens')\n    ->exists(['token' => $token, 'type' => $type, 'active' => true]);","typeGuard":null,"tryCatchPattern":"try {\n    $tokenEntity = $service->getOrFail($token, $type, $userId);\n} catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) {\n    // restart SSO flow / issue a new token\n}","preventionTips":["Never reuse tokens across attempts; each SSO flow gets a fresh token","Use the SsoAuthenticationToken type constants instead of string literals","Confirm environment/database when debugging missing tokens"],"tags":["sso","record-not-found","authentication-token"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}