{"record":{"id":"6302e08f63614682","repo":"passbolt/passbolt_api","slug":"the-user-does-not-exist-or-has-been-deleted","errorCode":null,"errorMessage":"The user does not exist or has been deleted.","messagePattern":"The user does not exist or has been deleted\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\NotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltCe/JwtAuthentication/src/Authenticator/GpgJwtAuthenticator.php","lineNumber":284,"sourceCode":"\n    /**\n     * @param string $userId uuid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user cannot be found, is deleted, is not active\n     * @return \\App\\Model\\Entity\\User\n     */\n    private function findUser(string $userId): User\n    {\n        try {\n            /** @var \\App\\Model\\Table\\UsersTable $Users */\n            $Users = TableRegistry::getTableLocator()->get('Users');\n\n            /** @var \\App\\Model\\Entity\\User|null $userData */\n            $userData = $Users->findView($userId, Role::GUEST)\n                ->contain('Gpgkeys')\n                ->first();\n        } catch (Exception $exception) {\n            Log::error($exception->getMessage());\n            throw new NotFoundException(__('The user does not exist or has been deleted.'));\n        }\n\n        if (!isset($userData)) {\n            throw new NotFoundException(__('The user does not exist or has been deleted.'));\n        }\n\n        if ($userData->isDisabled()) {\n            throw new NotFoundException(__('The user does not exist or has been deleted.'));\n        }\n\n        return $userData;\n    }\n\n    /**\n     * @throws \\InvalidArgumentException if the challenge is missing\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the challenge is invalid\n     * @return string\n     */","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Authenticator/GpgJwtAuthenticator.php#L266-L302","documentation":"findUser loads the user via Users->findView($userId, Role::GUEST) with its Gpgkey, logging any query exception and converting it to NotFoundException 'The user does not exist or has been deleted.' This first raise covers the case where the query itself throws (invalid UUID, DB error) or is otherwise exceptional. It guards the JWT flow against tokens referencing missing users.","triggerScenarios":"Presenting a JWT whose 'sub' claim contains a user id that is malformed (not a UUID), fails the view query, or triggers a DB exception during lookup during GPG-JWT authentication.","commonSituations":"Stale tokens surviving a user hard-delete; corrupted or hand-crafted JWT payloads; database connectivity errors during authentication; tokens issued before a server migration changed user data.","solutions":["Re-authenticate to obtain a fresh token: the token's user id is invalid, so it cannot be reused.","Verify the user actually exists and is not deleted (users back-end listing / database).","Check logs for the logged exception message to distinguish malformed id vs DB failure.","Purge invalid refresh tokens for deleted users so clients fall back to full login.","If DB errors recur, check database health and migration status."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const isUuid = (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\nif (!isUuid(subClaim)) forceFullLogin();","typeGuard":null,"tryCatchPattern":"try { await authenticatedCall(); } catch (e) { if (e.message.includes('does not exist or has been deleted')) { clearTokens(); redirectToLogin(); } else throw e; }","preventionTips":["Clear stored tokens when a user is deleted from the instance.","On this 404, always fall back to a fresh login rather than retrying the token.","Validate the token 'sub' is a UUID before sending requests.","Keep environments' databases and issued tokens consistent."],"tags":["jwt","authentication","user-not-found","not-found"],"backgroundTag":"user-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}