{"record":{"id":"3cef0a229690c8cd","repo":"passbolt/passbolt_api","slug":"the-user-does-not-exist-or-is-already-active-or-is-disabled","errorCode":null,"errorMessage":"The user does not exist or is already active or is disabled.","messagePattern":"The user does not exist or is already active or is disabled\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Setup/SetupStartUserInfoService.php","lineNumber":37,"sourceCode":"\nuse App\\Model\\Entity\\AuthenticationToken;\nuse App\\Model\\Entity\\User;\nuse App\\Service\\AuthenticationTokens\\AuthenticationTokenGetService;\nuse App\\Service\\Users\\UserGetService;\nuse Cake\\Http\\Exception\\BadRequestException;\nuse Cake\\Http\\Exception\\NotFoundException;\n\nclass SetupStartUserInfoService implements SetupStartInfoServiceInterface\n{\n    /**\n     * @inheritDoc\n     */\n    public function getInfo(string $userId, string $token, ?array $data): array\n    {\n        try {\n            $user = (new UserGetService())->getNotActiveNotDeletedNotDisabledOrFail($userId);\n        } catch (NotFoundException $exception) {\n            throw new BadRequestException(__('The user does not exist or is already active or is disabled.'));\n        }\n\n        $this->assertAuthToken($user, $token);\n\n        $data['user'] = $user;\n\n        return $data;\n    }\n\n    /**\n     * Check the setup token\n     *\n     * @param \\App\\Model\\Entity\\User $user user attempting to recover\n     * @param string $token uuid of the token\n     * @throw BadRequestException if the token is not valid\n     * @return void\n     */\n    private function assertAuthToken(User $user, string $token): void","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Setup/SetupStartUserInfoService.php#L19-L55","documentation":"The setup-start info endpoint requires a user who exists and is inactive, not deleted and not disabled. getNotActiveNotDeletedNotDisabledOrFail threw BadRequestException with this combined message (deliberately indistinguishable between the conditions to avoid user enumeration).","triggerScenarios":"GET /setup/start/:userId/:token where the user id is unknown, the account is already active, was deleted, or is disabled.","commonSituations":"Opening an invite link after setup already finished; account disabled by admin before the user started; wrong/typoed UUID from the email link.","solutions":["If setup was already completed, use the login page instead","Have an admin verify the user's status and resend the invite if it was deleted/disabled","Double-check the userId UUID in the setup URL against the invitation email","Re-register/re-invite the user to generate a fresh token if the account state is unrecoverable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$user = $this->Users->find()->where(['id' => $userId])->first();\nif (!$user || $user->active || $user->deleted || $user->disabled) {\n    // do not attempt setup-start; redirect to login or re-invite\n}","typeGuard":null,"tryCatchPattern":"try {\n    $info = $setupStartUserInfoService->getInfo($userId, $token, $data);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    // user unknown/active/deleted/disabled: show generic guidance\n}","preventionTips":["Verify account state before sending the setup link","Have admins resend invites rather than reusing stale links","Confirm the UUID in the link matches the invited user","Guide already-active users to the login page"],"tags":["setup","user-state","http-400"],"backgroundTag":"user-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-22T11:17:16.035Z"}