{"record":{"id":"523ec22e6409344b","repo":"passbolt/passbolt_api","slug":"unable-to-authenticate-the-guest-user-with-the-provided","errorCode":null,"errorMessage":"Unable to authenticate the guest user with the provided credentials. No registration authentication token found for the given user.","messagePattern":"Unable to authenticate the guest user with the provided credentials\\. No registration authentication token found for the given user\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":117,"sourceCode":"        }\n\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user ID must be a valid UUID.'));\n        }\n\n        if (!Validation::uuid($authToken)) {\n            throw new BadRequestException(__('The authentication token must be a valid UUID.'));\n        }\n\n        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');\n\n        try {\n            (new AuthenticationTokenGetService())\n                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);\n        } catch (NotFoundException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('No registration authentication token found for the given user.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (CustomValidationException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('The registration authentication token is expired.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (Exception $exception) {\n            throw new ForbiddenException($errorMsg, null, $exception); // phpcs:ignore\n        }\n    }\n}\n","sourceCodeStart":99,"sourceCodeEnd":127,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L99-L127","documentation":"This BadRequestException is thrown while authenticating an anonymous (guest) caller of the user key policies settings endpoint. After validating that user_id and token are UUIDs, the controller looks up a registration-type token via AuthenticationTokenGetService::getActiveNotExpiredOrFail; when no token record matches (NotFoundException), it throws BadRequestException with the appended message 'No registration authentication token found for the given user.'. It prevents guests from reading key policy settings without valid register-flow credentials.","triggerScenarios":"Calling GET /user-key-policies/settings as an unauthenticated guest with user_id=<uuid>&token=<uuid> where no authentication_tokens row exists with that token value, that user_id, and type=register — e.g. token belongs to another user or was deleted.","commonSituations":"Client copied a token from a different user's registration flow; token row cleaned up by expiry/cleanup tasks; stale token cached in browser extension or old setup link; registration already completed so the token was consumed.","solutions":["Verify the token in the database: SELECT * FROM authentication_tokens WHERE id = '<token>' AND user_id = '<user_id>' AND type = 'register';","Re-open the original registration/setup invitation link to get a fresh valid token for the correct user.","Regenerate a registration token for the user via the register flow and retry with that token.","Ensure user_id and token belong to the same user and were not swapped."],"exampleFix":"// before (client)\nGET /user-key-policies/settings?user_id=<uuid-user-a>&token=<token-of-user-b>\n// after\nGET /user-key-policies/settings?user_id=<uuid-user-a>&token=<register-token-issued-to-user-a>","handlingStrategy":"validation","validationCode":"const uuid = (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\nif (!uuid(userId) || !uuid(token)) throw new Error('invalid params');\n// then confirm server-side the token exists:\n// SELECT 1 FROM authentication_tokens WHERE id = ? AND user_id = ? AND type = 'register' AND active = 1","typeGuard":"function isValidRegisterTokenPayload(p) {\n  return typeof p === 'object' && p !== null &&\n    isUuid(p.user_id) && isUuid(p.token);\n}","tryCatchPattern":"try {\n  await get('/user-key-policies/settings', { user_id, token });\n} catch (e) {\n  if (e.status === 400 && /No registration authentication token found/.test(e.message)) {\n    // restart registration flow to obtain a fresh token\n  }\n  throw e;\n}","preventionTips":["Always pair user_id with the token issued to that exact user.","Treat setup-link tokens as single-use and fetch a fresh one after they are consumed.","Query authentication_tokens server-side before calling guest endpoints in scripts.","Never cache registration tokens across registration attempts."],"tags":["authentication","registration-token","guest-access"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}