{"record":{"id":"3d6698855c6479b1","repo":"passbolt/passbolt_api","slug":"the-user-id-should-be-a-valid-uuid-3d6698","errorCode":null,"errorMessage":"The user id should be a valid UUID.","messagePattern":"The user id should be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php","lineNumber":67,"sourceCode":"    {\n        $this->SsoAuthenticationTokens = $this->fetchTable('Passbolt/Sso.SsoAuthenticationTokens');\n    }\n\n    /**\n     * @param string $token token\n     * @param string $type type\n     * @param string|null $userId uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the authentication token is invalid\n     * @throws \\Cake\\Datasource\\Exception\\RecordNotFoundException if the authentication token cannot be found\n     * @return \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken\n     */\n    public function getOrFail(string $token, string $type, ?string $userId = null): SsoAuthenticationToken\n    {\n        if (!Validation::uuid($token)) {\n            throw new BadRequestException(__('The authentication token should be a valid UUID.'));\n        }\n        if (isset($userId) && !Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id should be a valid UUID.'));\n        }\n\n        try {\n            $where = [\n                'token' => $token,\n                'type' => $type,\n                'active' => true,\n            ];\n            if (isset($userId)) {\n                $where['user_id'] = $userId;\n            }\n\n            /** @var \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken $tokenEntity */\n            $tokenEntity = $this->SsoAuthenticationTokens->find()->where($where)->firstOrFail();\n        } catch (RecordNotFoundException $exception) {\n            throw new RecordNotFoundException(__('The authentication token does not exist.'), 400, $exception);\n        }\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php#L49-L85","documentation":"This BadRequestException is thrown by SsoAuthenticationTokenGetService::getOrFail when an optional $userId argument is passed but is not a valid UUID. getOrFail looks up SSO authentication tokens by token, type and optionally user_id, so a malformed user id would produce an invalid query and is rejected up front by CakePHP's Validation::uuid().","triggerScenarios":"Calling getOrFail($token, $type, $userId) (directly or via getActiveNotExpiredOrFail, get, or activate) with a $userId that is null-safe set but not a UUID — e.g. an empty string '', an integer cast to string, a truncated ID, or raw user input passed through without validation.","commonSituations":"Controller layers forwarding unvalidated route/query parameters; passing a username or email instead of the users.id UUID; passing an empty string instead of null for 'no user'; copying IDs from logs with surrounding whitespace.","solutions":["Validate the user id with \\Cake\\Validation\\Validation::uuid($userId) before calling getOrFail, or pass null instead of an empty/malformed value","Fetch the user from the users table first and pass the resulting entity's id UUID","Trim/sanitize the incoming identifier; confirm it is the 36-char UUID from the users table, not a username or external SSO identifier","In tests, ensure fixtures use real UUIDs rather than short placeholder strings"],"exampleFix":"// before\n$service->getOrFail($token, SsoAuthenticationToken::TYPE_SSO, $this->request->getQuery('user_id'));\n// after\n$userId = $this->request->getQuery('user_id');\nif (!\\Cake\\Validation\\Validation::uuid($userId)) {\n    throw new BadRequestException(__('The user id should be a valid UUID.'));\n}\n$service->getOrFail($token, SsoAuthenticationToken::TYPE_SSO, $userId);","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif ($userId !== null && !Validation::uuid($userId)) {\n    throw new \\Cake\\Http\\Exception\\BadRequestException('Invalid user id');\n}","typeGuard":"function isValidUuid(?string $id): bool {\n    return $id === null || \\Cake\\Validation\\Validation::uuid($id);\n}","tryCatchPattern":"try {\n    $token = $service->getOrFail($token, $type, $userId);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    // handle invalid token/user id input\n}","preventionTips":["Always run Validation::uuid() on user-supplied ids before service calls","Pass null (not '' or 0) when no user filter is intended","Use the users table to resolve identifiers to canonical UUIDs"],"tags":["validation","uuid","sso","bad-request"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}