{"record":{"id":"4b7a3fe17a533b9e","repo":"passbolt/passbolt_api","slug":"the-user-does-not-exist-or-is-not-active-or-is-disabled-4b7a3f","errorCode":null,"errorMessage":"The user does not exist or is not active or is disabled.","messagePattern":"The user does not exist or is not active or is disabled\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Users/UserGetService.php","lineNumber":116,"sourceCode":"\n        return $userEntity;\n    }\n\n    /**\n     * Get a user by ID or throw relevant HTTP exceptions\n     *\n     * @param string $userId user id uuid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user could not be found\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the userId is not a valid uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the is not active or deleted or disabled\n     * @return \\App\\Model\\Entity\\User\n     */\n    public function getActiveNotDeletedNotDisabledOrFail(string $userId): User\n    {\n        $userEntity = $this->getActiveNotDeletedOrFail($userId);\n\n        if ($userEntity->isDisabled()) {\n            throw new BadRequestException(__('The user does not exist or is not active or is disabled.'));\n        }\n\n        return $userEntity;\n    }\n\n    /**\n     * Get a user by ID or throw relevant HTTP exceptions\n     *\n     * @param string $userId user id uuid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user could not be found\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the userId is not a valid uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the is not active or deleted\n     * @return \\App\\Model\\Entity\\User\n     */\n    public function getActiveNotDeletedOrFail(string $userId): User\n    {\n        $userEntity = $this->getOrFail($userId);\n        $msg = __('The user does not exist or is not active or is disabled.');","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Users/UserGetService.php#L98-L134","documentation":"Thrown by UserGetService::getActiveNotDeletedNotDisabledOrFail when the user passed the active/not-deleted checks (getActiveNotDeletedOrFail) but its disabled flag is true. This service variant is used by authenticated flows that require a live, enabled account (e.g. settings, MFA setup, account recovery completion).","triggerScenarios":"Any authenticated endpoint that resolves the target user via getActiveNotDeletedNotDisabledOrFail while the user row has disabled = true — e.g. account recovery completion or user detail lookups for a disabled account.","commonSituations":"Disabled user still holds a valid session/token and calls the API; a batch script processes user IDs that include disabled accounts; MFA brute-force protection disabled the account mid-flow.","solutions":["Check the disabled column for the user ID in question.","Have an administrator re-enable the account before retrying.","In scripts, skip or flag disabled users instead of treating them as processable.","If the user believes this is wrong, check audit/roles history to see who disabled the account and why."],"exampleFix":"// before\n$user = $userGetService->getActiveNotDeletedNotDisabledOrFail($id); // 400\n\n// after: pre-check and handle\n$user = $this->Users->get($id);\nif ($user->disabled) {\n    return $this->error('account-disabled');\n}","handlingStrategy":"try-catch","validationCode":"const u = await getUser(userId);\nif (u.disabled || !u.active || u.deleted) {\n  throw new Error(`User ${userId} not eligible: active=${u.active} deleted=${u.deleted} disabled=${u.disabled}`);\n}\n","typeGuard":null,"tryCatchPattern":"try {\n  $user = $userGetService->getActiveNotDeletedNotDisabledOrFail($userId);\n} catch (BadRequestException $e) {\n  $this->handleInactiveOrDisabledUser($userId); // skip, flag, or re-enable\n}","preventionTips":["Pre-check active/deleted/disabled on the user entity before authenticated operations.","Invalidate sessions/tokens of disabled users so they cannot reach these endpoints.","Audit why the account was disabled (MFA failures, admin action) before re-enabling."],"tags":["passbolt","users","bad-request","disabled-user"],"backgroundTag":"invalid-state-transition","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-22T16:17:23.217Z"}