{"record":{"id":"4554baad59a74b8b","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-4554ba","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryPrivateKeyPasswords/AccountRecoveryPrivateKeyPasswordsIndexController.php","lineNumber":60,"sourceCode":"    {\n        parent::initialize();\n        $this->AccountRecoveryPrivateKeyPasswords = $this\n            ->fetchTable('Passbolt/AccountRecovery.AccountRecoveryPrivateKeyPasswords');\n        $this->loadComponent('ApiPagination', [\n            'model' => 'AccountRecoveryPrivateKeyPasswords',\n        ]);\n    }\n\n    /**\n     * List all the account recovery requests\n     *\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the user is not an admin\n     */\n    public function index(): void\n    {\n        if (!$this->User->isAdmin()) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n\n        $passwords = $this->AccountRecoveryPrivateKeyPasswords->find();\n        $this->paginate($passwords);\n\n        $this->success(__('The operation was successful.'), $passwords);\n    }\n}\n","sourceCodeStart":42,"sourceCodeEnd":69,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryPrivateKeyPasswords/AccountRecoveryPrivateKeyPasswordsIndexController.php#L42-L69","documentation":"Role guard in AccountRecoveryPrivateKeyPasswordsIndexController::index(): listing account recovery private key passwords is admin-only because the data is highly sensitive. Fires when a non-admin (or anonymous) user calls the index endpoint, rejecting with HTTP 403 before any query runs; only administrators may enumerate recovery private key password records.","triggerScenarios":"GET /account-recovery/private-key/passwords.json issued by a non-admin user or a guest (unauthenticated) session.","commonSituations":"Regular user probing admin endpoints; missing/lost admin role; in tests, authenticating as a non-admin user; session expired so request treated as guest.","solutions":["Authenticate as an administrator before calling the endpoint","Verify the user's role is admin in the database","In tests, switch the request fixture to an admin user","Ensure authentication cookie/token is valid and not expired"],"exampleFix":"// before\n$this->authenticateAs('betty'); // user role\n$this->get('/account-recovery/private-key/passwords.json'); // 403\n// after\n$this->authenticateAs('admin');\n$this->get('/account-recovery/private-key/passwords.json'); // 200","handlingStrategy":"try-catch","validationCode":"const me = await selfClient.get();\nif (me.role.name !== 'admin') throw new Error('admin role required to list private key passwords');","typeGuard":"function isAdminUser(user: {role: {name: string}}): boolean {\n  return user.role.name === 'admin';\n}","tryCatchPattern":"try {\n  const passwords = await privateKeyPasswordsService.index();\n} catch (ApiError e) {\n  if (e.status === 403) {\n    showForbiddenScreen(); // non-admin access\n  }\n}","preventionTips":["Expose this endpoint only from admin interfaces","Verify the session/token belongs to an admin before calling","Keep authentication tokens fresh to avoid guest fallback","Use admin fixtures in integration tests"],"tags":["php","cakephp","authorization","admin-only"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}