{"record":{"id":"512b7cb9f5a4e258","repo":"passbolt/passbolt_api","slug":"the-resource-identifier-should-be-a-valid-uuid-512b7c","errorCode":null,"errorMessage":"The resource identifier should be a valid UUID.","messagePattern":"The resource identifier should be a valid UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Tags/src/Controller/Tags/ResourcesTagsAddController.php","lineNumber":64,"sourceCode":"    {\n        parent::initialize();\n        $this->Resources = $this->fetchTable('Resources');\n        $this->Tags = $this->fetchTable('Passbolt/Tags.Tags');\n    }\n\n    /**\n     * Add tags for a given resource.\n     * Providing an empty list of tags delete all the personal tags\n     *\n     * @param string $resourceId The identifier of the resource to add a comment to\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @throws \\Cake\\Http\\Exception\\NotFoundException\n     * @return void\n     */\n    public function addPost(string $resourceId)\n    {\n        if (!Validation::uuid($resourceId)) {\n            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));\n        }\n\n        $uac = $this->User->getAccessControl();\n        $data = $this->formatRequestData();\n        $data = $this->validateRequestData($data, $uac);\n\n        $options = ['contain' => ['all_tags' => 1, 'permission' => 1]];\n        /** @var \\App\\Model\\Entity\\Resource|null $resource */\n        $resource = $this->Resources->findView($uac->getId(), $resourceId, $options)->first();\n        if (is_null($resource)) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n\n        $tags = (new ResourcesTagsAddService())->add($uac, $resource, $data);\n        $tags = (new MetadataTagsRenderService())->renderTags($tags);\n        $this->success(__('The operation was successful.'), $tags);\n    }\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Tags/src/Controller/Tags/ResourcesTagsAddController.php#L46-L82","documentation":"ResourcesTagsAddController::addPost() validates the resourceId route parameter with CakePHP Validation::uuid() before doing any work; a malformed id raises BadRequestException. This is a first-line input-format check on the URL.","triggerScenarios":"PUT/POST to /resources-tags/<resourceId> (or the tags-add route) where resourceId is not a UUID: numeric ids, slugs, empty strings, or truncated identifiers.","commonSituations":"Client code passing a database auto-increment id or a name instead of the passbolt resource UUID; URL templating bug that leaves a placeholder in the path; hand-crafted curl tests.","solutions":["Pass the passbolt resource UUID (36-char, e.g. from GET /resources.json)","Fix client URL construction so the id placeholder is actually substituted","Validate the id client-side with a UUID regex/validator before calling the endpoint"],"exampleFix":"// before\nawait api.put(`/resources-tags/${resource.id}`);\n// after\nif (!/^[0-9a-f-]{36}$/i.test(resource.id)) throw new Error('Invalid resource UUID');\nawait api.put(`/resources-tags/${resource.id}`);","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(resourceId)) throw new Error('resourceId must be a UUID');","typeGuard":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"try { await addResourceTags(id, tags); } catch (e) { if (e.status === 400 && /UUID/.test(e.message)) { /* fix client id source */ } else throw e; }","preventionTips":["Always source ids from passbolt API responses, never local numeric ids","Validate UUID format client-side before requests","Check URL templates for unsubstituted placeholders"],"tags":["passbolt","validation","uuid"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}