{"record":{"id":"56bd4e01ead1258e","repo":"passbolt/passbolt_api","slug":"the-request-data-is-invalid-control-function-missing","errorCode":null,"errorMessage":"The request data is invalid: control_function missing.","messagePattern":"The request data is invalid: control_function missing\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php","lineNumber":133,"sourceCode":"     * Assert a given data entry\n     *\n     * @throw BadRequestException if entry doesn't match the expected format\n     * @param array $entry entry {id:<uuid>, control_function:<string>}\n     * @return void\n     */\n    public function assertEntry(array $entry): void\n    {\n        if (count($entry) > 2) {\n            throw new BadRequestException(__('The request data is invalid: invalid fields.'));\n        }\n        if (!isset($entry['id'])) {\n            throw new BadRequestException(__('The request data is invalid: id missing.'));\n        }\n        if (!is_string($entry['id']) || !Validation::uuid($entry['id'])) {\n            throw new BadRequestException(__('The request data is invalid: id invalid.'));\n        }\n        if (!isset($entry['control_function'])) {\n            throw new BadRequestException(__('The request data is invalid: control_function missing.'));\n        }\n        if (!is_string($entry['control_function']) || !Validation::ascii($entry['control_function'])) {\n            throw new BadRequestException(__('The request data is invalid: control_function invalid.'));\n        }\n    }\n\n    /**\n     * Assert data contains only one occurence of each id\n     *\n     * @throw BadRequestException if multiple entries with same id is sent\n     * @param array $data data [{id:<uuid>, control_function:<string>},...] where id values must be unique\n     * @return void\n     */\n    public function assertUniqueIds(array $data): void\n    {\n        $unique = array_unique(Hash::extract($data, '{n}.id'));\n        if (count($unique) != count($data)) {\n            throw new BadRequestException(__('The request data is invalid: ids must be unique.'));","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php#L115-L151","documentation":"Required-field check in RbacsUpdateDtoCollection::assertEntry(): each RBAC update entry must include a 'control_function' key specifying the permission being set. Fires when an entry supplies an id but omits control_function, leaving nothing to update, so the request is rejected with HTTP 400 and must be resent with both fields per entry.","triggerScenarios":"Sending an entry with only an id, e.g. {\"id\":\"<uuid>\"}, or with the key misspelled (controlFunction, control_function omitted) in the PUT /rbacs/update body.","commonSituations":"Client only sending toggled ids and expecting the server to infer the value, camelCase/snake_case mismatch after client refactor, or building entries from incomplete objects.","solutions":["Include control_function (string, ASCII, e.g. allow/deny) in each entry.","Fix key naming to the exact snake_case control_function.","Add client-side validation for required keys before submitting.","Consult the rbacs update API schema for accepted control_function values."],"exampleFix":"// before\n{\"id\":\"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f\"}\n// after\n{\"id\":\"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f\",\"control_function\":\"allow\"}","handlingStrategy":"validation","validationCode":"foreach ($entries as $e) {\n    if (!isset($e['control_function']) || !is_string($e['control_function'])) {\n        throw new InvalidArgumentException('rbacs update entry missing control_function');\n    }\n}","typeGuard":"function hasControlFunction(mixed $e): bool {\n    return is_array($e) && isset($e['control_function']) && is_string($e['control_function']);\n}","tryCatchPattern":"try {\n    $collection = new RbacsUpdateDtoCollection($data);\n} catch (BadRequestException $e) {\n    // entries must carry control_function\n}","preventionTips":["Use exact snake_case key control_function in payloads.","Always supply an explicit control_function value; never let the server infer it.","Validate required keys and allowed values client-side before sending."],"tags":["php","cakephp","rbacs","bad-request","missing-field"],"backgroundTag":"missing-required-argument","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}