{"record":{"id":"6289a792384d472f","repo":"passbolt/passbolt_api","slug":"no-default-expiry-or-expiry-for-token-type","errorCode":null,"errorMessage":"No default expiry or expiry for token type ","messagePattern":"No default expiry or expiry for token type ","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/AuthToken/SsoAuthTokenExpiry.php","lineNumber":51,"sourceCode":"        if (!in_array($tokenType, SsoAuthenticationTokensTable::SSO_ALLOWED_TYPES)) {\n            throw new InvalidArgumentException(\n                sprintf(\n                    'Invalid $tokenType `%s`. Must be one of `%s`.',\n                    $tokenType,\n                    implode(',', SsoAuthenticationTokensTable::SSO_ALLOWED_TYPES)\n                )\n            );\n        }\n\n        $tokenTypeExpiry = Configure::read(sprintf('passbolt.auth.token.%s.expiry', $tokenType));\n\n        if (!is_string($tokenTypeExpiry)) {\n            $tokenTypeExpiry = Configure::read('passbolt.auth.tokenExpiry');\n        }\n\n        if (!is_string($tokenTypeExpiry)) {\n            $msg = 'No default expiry or expiry for token type ' . $tokenTypeExpiry;\n            throw new InternalErrorException($msg);\n        }\n\n        return $tokenTypeExpiry;\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":57,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/AuthToken/SsoAuthTokenExpiry.php#L33-L57","documentation":"SsoAuthTokenExpiry::getExpiryForTokenType() resolves the expiry duration for an SSO auth token type: first from a per-type config, then falling back to passbolt.auth.tokenExpiry. If neither yields a string, an InternalErrorException is thrown. (Note the message itself concatenates null, hence the trailing space.)","triggerScenarios":"getExpiryForTokenType() called with a token type that has no Configure entry under passbolt.security.authToken.expiry (or equivalent) AND the global passbolt.auth.tokenExpiry config is not set (null/non-string).","commonSituations":"Running the SSO plugin without loading its default config (config/bootstrap not loaded after manual install); a typo'd token type string; config file overridden in production losing the default; PHP config cache stale.","solutions":["Ensure passbolt.php / app.default.php defines passbolt.auth.tokenExpiry (e.g. '3 days')","Reload plugin config: clear cache (`bin/cake cache clear_all`) and re-deploy config files","Check the token type passed in matches one configured in SsoAuthTokenExpiry","Verify the Sso plugin's config/bootstrap.php is loaded in the application bootstrap"],"exampleFix":"// before: passbolt.php missing key\n// after\nConfigure::write('passbolt.auth.tokenExpiry', '3 days');","handlingStrategy":"type-guard","validationCode":"if (!is_string(Configure::read('passbolt.auth.tokenExpiry'))) { throw new \\RuntimeException('passbolt.auth.tokenExpiry missing in config'); }","typeGuard":"function tokenExpiryConfigured(): bool { $v = Configure::read('passbolt.auth.tokenExpiry'); return is_string($v) && strtotime($v) !== false; }","tryCatchPattern":"try { $expiry = SsoAuthTokenExpiry::getExpiryForTokenType($type); } catch (InternalErrorException $e) { Log::critical('SSO tokenExpiry config missing'); throw $e; }","preventionTips":["Always ship passbolt.auth.tokenExpiry in production config","Clear config cache after deploying config changes","Validate expiry strings parse as time expressions"],"tags":["sso","auth-token","config","expiry"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}