{"record":{"id":"5e3c7680ded5959b","repo":"passbolt/passbolt_api","slug":"the-user-id-must-be-a-valid-uuid","errorCode":null,"errorMessage":"The user ID must be a valid UUID.","messagePattern":"The user ID must be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":102,"sourceCode":"                // session confusion: If user is logged in but still authentication token is provided we consider it bad request.\n                throw new BadRequestException(__('Conflicting authentication parameters, provide user_id/token only when the user is not already signed in.')); // phpcs:ignore\n            }\n\n            return;\n        }\n\n        $userId = $this->getRequest()->getQuery('user_id');\n        $authToken = $this->getRequest()->getQuery('token');\n\n        if (is_null($userId) || is_null($authToken)) {\n            throw new UnauthorizedException(\n                __('You are not authorized to access this location.') . ' ' .\n                __('Sign-in to passbolt, or provide a valid user ID and authentication token.')\n            );\n        }\n\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user ID must be a valid UUID.'));\n        }\n\n        if (!Validation::uuid($authToken)) {\n            throw new BadRequestException(__('The authentication token must be a valid UUID.'));\n        }\n\n        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');\n\n        try {\n            (new AuthenticationTokenGetService())\n                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);\n        } catch (NotFoundException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('No registration authentication token found for the given user.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (CustomValidationException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('The registration authentication token is expired.');","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L84-L120","documentation":"A BadRequestException thrown when the provided user_id query parameter fails UUID validation before guest authentication is attempted. The controller validates both identifiers' format up front to avoid pointless token lookups.","triggerScenarios":"Unauthenticated GET /user-key-policies/settings?user_id=<not-a-uuid>&token=<uuid>, e.g. user_id passed as an email address, username, integer ID, empty string, or truncated value.","commonSituations":"Passing a username or email instead of the user's UUID; copy-paste truncation of the UUID; client code using a legacy non-UUID identifier; URL encoding issues corrupting the parameter.","solutions":["Supply the user's UUID (36-char, e.g. 0d2f5eaa-...), obtainable from the users API or admin console.","Fix client code that passes email/username instead of the user ID; resolve it to a UUID first.","Verify the value survives URL encoding (no stripped hyphens or truncation)."],"exampleFix":"// before\n?user_id=admin@passbolt.test&token=9a1b...\n// after\n?user_id=0d2f5eaa-6c3a-4c1f-9f2e-1b7d8a9c0d1e&token=9a1b...","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(params.user_id)) throw new Error('user_id must be a valid UUID');","typeGuard":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"catch (e) {\n  if (e.response?.status === 400 && /valid UUID/.test(e.response.data?.message)) {\n    // fix the offending identifier before retrying; do not retry as-is\n  }\n}","preventionTips":["Validate all identifiers against a UUID regex before sending.","Resolve emails/usernames to UUIDs via the users API first.","Beware copy-paste truncation and URL-encoding of hyphens."],"tags":["bad-request","validation","uuid","query-parameters"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}