{"record":{"id":"4bdd6cbff719b802","repo":"passbolt/passbolt_api","slug":"the-comment-id-is-not-valid","errorCode":null,"errorMessage":"The comment id is not valid.","messagePattern":"The comment id is not valid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Controller/Comments/CommentsUpdateController.php","lineNumber":45,"sourceCode":" * @property \\App\\Model\\Table\\CommentsTable $Comments\n */\nclass CommentsUpdateController extends AppController\n{\n    /**\n     * Update a comment.\n     *\n     * @param string $commentId The identifier of the comment to update\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @throws \\App\\Error\\Exception\\ValidationException\n     * @return void\n     */\n    public function update(string $commentId)\n    {\n        $this->assertJson();\n\n        if (!Validation::uuid($commentId)) {\n            throw new BadRequestException(__('The comment id is not valid.'));\n        }\n\n        $comment = (new CommentsUpdateService())->update(\n            $this->User->id(),\n            $commentId,\n            Hash::get($this->request->getData(), 'content')\n        );\n\n        $this->success(__('The comment was successfully updated.'), $comment);\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":57,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Comments/CommentsUpdateController.php#L27-L57","documentation":"CommentsUpdateController::update() validates the commentId route parameter as a UUID before doing anything else. If the id in the URL is not a valid UUID string it throws BadRequestException('The comment id is not valid.') producing a 400 response. This guards the service layer from receiving malformed identifiers.","triggerScenarios":"PUT /comments/<commentId> where commentId is not a UUID v4 — e.g. a numeric database id, a slug, an empty string, a truncated or typosquatted UUID, or URL-encoded junk in the path segment.","commonSituations":"Client code building URLs from the wrong id field (resource id instead of comment id); older API integrations using integer ids from a pre-UUID schema; copied URL with missing or clipped id; manual curl testing with a made-up id.","solutions":["Send a valid UUID comment id in the URL, obtained from the comment resource's own `id` field (e.g. from GET /comments/<resourceId>.json).","Fix client code that interpolates the wrong id (parent resource id or numeric legacy id) into the comments endpoint.","If migrating from a legacy integer-id integration, remap old ids to UUIDs before calling update."],"exampleFix":"// before — wrong id used (parent resource id)\nawait api.put(`/comments/${resourceId}`, { content });\n// after — use the comment's own UUID\nconst comment = comments.find(c => c.id === commentId);\nif (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(comment.id)) throw new Error('bad comment id');\nawait api.put(`/comments/${comment.id}`, { content });","handlingStrategy":"validation","validationCode":"// run before calling PUT /comments/<id>\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(commentId)) throw new TypeError(`comment id must be a UUID, got: ${commentId}`);","typeGuard":"const isCommentId = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"try {\n  await api.put(`/comments/${commentId}`, { content });\n} catch (e) {\n  if (e.response?.status === 400 && e.response?.data?.message === 'The comment id is not valid.') {\n    throw new Error('Check you are passing the comment UUID, not the parent resource id');\n  }\n  throw e;\n}","preventionTips":["Take comment ids only from the comment resource's `id` field, never from parent resource responses.","Add a UUID-format assertion at the API client boundary for all id path parameters.","Use a typed id wrapper (CommentId) in client code to prevent mixing resource ids and comment ids.","When porting from legacy integer-id integrations, remap ids before issuing updates."],"tags":["comments","uuid-validation","http-400","bad-request"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}