{"record":{"id":"58d678fc701dc51c","repo":"ramsey/uuid","slug":"local-domain-must-be-a-valid-dce-security-domain","errorCode":null,"errorMessage":"Local domain must be a valid DCE Security domain","messagePattern":"Local domain must be a valid DCE Security domain","errorType":"exception","errorClass":"DceSecurityException","httpStatus":null,"severity":"error","filePath":"src/Generator/DceSecurityGenerator.php","lineNumber":69,"sourceCode":"     * Lower bounds for the clock sequence in DCE Security UUIDs.\n     */\n    private const CLOCK_SEQ_LOW = 0;\n\n    public function __construct(\n        private NumberConverterInterface $numberConverter,\n        private TimeGeneratorInterface $timeGenerator,\n        private DceSecurityProviderInterface $dceSecurityProvider,\n    ) {\n    }\n\n    public function generate(\n        int $localDomain,\n        ?IntegerObject $localIdentifier = null,\n        ?Hexadecimal $node = null,\n        ?int $clockSeq = null,\n    ): string {\n        if (!in_array($localDomain, self::DOMAINS)) {\n            throw new DceSecurityException('Local domain must be a valid DCE Security domain');\n        }\n\n        if ($localIdentifier && $localIdentifier->isNegative()) {\n            throw new DceSecurityException(\n                'Local identifier out of bounds; it must be a value between 0 and 4294967295',\n            );\n        }\n\n        if ($clockSeq > self::CLOCK_SEQ_HIGH || $clockSeq < self::CLOCK_SEQ_LOW) {\n            throw new DceSecurityException('Clock sequence out of bounds; it must be a value between 0 and 63');\n        }\n\n        switch ($localDomain) {\n            case Uuid::DCE_DOMAIN_ORG:\n                if ($localIdentifier === null) {\n                    throw new DceSecurityException('A local identifier must be provided for the org domain');\n                }\n","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/ramsey/uuid/blob/da5b521600a707d2dd097598464bd3090de850f5/src/Generator/DceSecurityGenerator.php#L51-L87","documentation":"DceSecurityGenerator::generate() (the engine behind Uuid::uuid2(), version 2 UUIDs) requires the local domain to be one of the three DCE Security domains: Uuid::DCE_DOMAIN_PERSON (0), Uuid::DCE_DOMAIN_GROUP (1), Uuid::DCE_DOMAIN_ORG (2). Anything else throws DceSecurityException.","triggerScenarios":"Uuid::uuid2(3); Uuid::uuid2('person') (string, not the int constant); passing a clock sequence or identifier in the domain position; casting a domain name from config straight to an int.","commonSituations":"Positional-argument mix-ups in uuid2($localDomain, $localIdentifier, $node, $clockSeq); storing domains as strings and letting PHP coerce them; inventing custom domains instead of using the constants.","solutions":["Always pass the constants: Uuid::DCE_DOMAIN_PERSON, Uuid::DCE_DOMAIN_GROUP, or Uuid::DCE_DOMAIN_ORG.","Map domain names to constants before calling: ['person'=>0,'group'=>1,'org'=>2][$name] ?? fail.","Re-check the uuid2() argument order if the value you meant for another slot lands in $localDomain."],"exampleFix":"// before\n$uuid = Uuid::uuid2('org'); // string -> DceSecurityException\n\n// after\n$uuid = Uuid::uuid2(Uuid::DCE_DOMAIN_ORG, new Integer(42));","handlingStrategy":"validation","validationCode":"const DCE_DOMAINS = [\n    Uuid::DCE_DOMAIN_PERSON,\n    Uuid::DCE_DOMAIN_GROUP,\n    Uuid::DCE_DOMAIN_ORG,\n];\n\nif (!in_array($localDomain, DCE_DOMAINS, true)) {\n    throw new InvalidArgumentException('local domain must be person (0), group (1) or org (2)');\n}\n$uuid = Uuid::uuid2($localDomain, $identifier);","typeGuard":"function isDceDomain(int $domain): bool\n{\n    return in_array($domain, [Uuid::DCE_DOMAIN_PERSON, Uuid::DCE_DOMAIN_GROUP, Uuid::DCE_DOMAIN_ORG], true);\n}","tryCatchPattern":"try {\n    $uuid = Uuid::uuid2($domain, $id);\n} catch (\\Ramsey\\Uuid\\Exception\\DceSecurityException $e) {\n    throw new InvalidConfigurationException('bad DCE domain configuration', $e);\n}","preventionTips":["Always use the Uuid::DCE_DOMAIN_* constants, never raw ints from config.","Map domain strings to constants at the config-loading boundary.","Review uuid2()'s positional signature when adding arguments.","Validate the domain in one place (factory wrapper) instead of every call site."],"tags":["php","ramsey-uuid","dce-security","uuid-v2","local-domain"],"backgroundTag":"dce-security-domain-invalid","analyzedSha":"da5b521600a707d2dd097598464bd3090de850f5","analyzedAt":"2026-08-21T01:35:29.252Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}