{"record":{"id":"509dbb3a265d8fe6","repo":"passbolt/passbolt_api","slug":"could-not-validate-password-data","errorCode":null,"errorMessage":"Could not validate password data.","messagePattern":"Could not validate password data\\.","errorType":"validation","errorClass":"CustomValidationException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryPrivateKeyPasswordsTable.php","lineNumber":253,"sourceCode":"        // Otherwise passwords are created with the keys during setup or user settings change\n        if ($validationRules === 'rotateKeys') {\n            $accessibleFields['private_key_id'] = true;\n        }\n\n        $passwordEntities = $this->newEntities($passwords, [\n            'accessibleFields' => $accessibleFields,\n            'validate' => $validationRules,\n        ]);\n\n        $errors = [];\n        foreach ($passwordEntities as $i => $entity) {\n            if ($entity->getErrors()) {\n                $errors[$i] = $entity->getErrors();\n            }\n        }\n\n        if (count($errors)) {\n            throw new CustomValidationException(__('Could not validate password data.'), [\n                'account_recovery_private_key_passwords' => $errors,\n            ]);\n        }\n\n        return $passwordEntities;\n    }\n\n    /**\n     * Delete all records where associated private key are deleted\n     *\n     * @param bool|null $dryRun false\n     * @return int of affected records\n     */\n    public function cleanupHardDeletedAccountRecoveryPrivateKeys(?bool $dryRun = false): int\n    {\n        return $this->cleanupHardDeleted('AccountRecoveryPrivateKeys', $dryRun);\n    }\n","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryPrivateKeyPasswordsTable.php#L235-L271","documentation":"A CustomValidationException thrown when one or more account recovery private key password entities fail validation during buildAndValidateEntities. The exception carries an 'account_recovery_private_key_passwords' map of per-index entity errors so callers can identify which password records failed.","triggerScenarios":"POST /account-recovery/responses (or key rotation flow) where a supplied private key password item misses required fields, has an invalid data/recipient format, or exceeds column lengths.","commonSituations":"Client encrypts the recovery private key password for the wrong recipient key; missing 'data' field for one recipient; schema drift after an upgrade adding new required fields; bulk payloads where only some items are malformed.","solutions":["Read the errors map under account_recovery_private_key_passwords in the response to find failing indexes.","Ensure every password entry has valid recipient fingerprint and encrypted data fields.","Re-encrypt the private key password for the correct current organization key.","Update the client to the schema matching the server version."],"exampleFix":"// before\n{\"account_recovery_private_key_passwords\":[{\"recipient_fingerprint\":\"XYZ\"}]}\n// after\n{\"account_recovery_private_key_passwords\":[{\"recipient_fingerprint\":\"<fingerprint>\",\"data\":\"<encrypted-payload>\"}]}","handlingStrategy":"try-catch","validationCode":"passwords.forEach(p => { if (!p.recipient_fingerprint || !p.data) throw new Error('each password entry needs recipient_fingerprint and data'); });","typeGuard":"function isValidPasswordEntry(p) { return typeof p === 'object' && p !== null && typeof p.recipient_fingerprint === 'string' && typeof p.data === 'string' && p.data.length > 0; }","tryCatchPattern":"try { await api.createAccountRecoveryResponse(payload); } catch (e) { if (e.body?.account_recovery_private_key_passwords) { const failed = e.body.account_recovery_private_key_passwords; /* re-encrypt and retry failed indexes */ } else { throw e; } }","preventionTips":["Encrypt the private key password for every required recipient.","Inspect the per-index error map returned by this exception.","Regenerate encryption after organization key rotation.","Validate payload shape client-side before posting."],"tags":["validation","entity","account-recovery","private-key"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}