{"record":{"id":"677671b7f507f47a","repo":"passbolt/passbolt_api","slug":"the-property-0-is-visible-by-administrators-only","errorCode":null,"errorMessage":"The property {0} is visible by administrators only.","messagePattern":"The property (.+?) is visible by administrators only\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Service/Query/IsMfaEnabledQueryService.php","lineNumber":47,"sourceCode":"{\n    public const IS_MFA_ENABLED_FILTER_NAME = 'is-mfa-enabled';\n    public const IS_MFA_ENABLED_PROPERTY = 'is_mfa_enabled';\n    public const MFA_SETTINGS_PROPERTY = 'mfa_settings';\n\n    /**\n     * @param \\Cake\\ORM\\Query\\SelectQuery $query Query\n     * @param \\App\\Utility\\UserAccessControl $uac User Access Control\n     * @param array $options Query Options\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if a non-admin requests the is_mfa_enabled contain\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the filter is applied and is_mfa_enabled not contained\n     */\n    public function decorateAndFilterForIndex(SelectQuery $query, UserAccessControl $uac, array $options): void\n    {\n        $queryContainsIsMfaEnabled = $this->queryContainsIsMfaEnabled($options);\n\n        if ($queryContainsIsMfaEnabled && !$uac->isAdmin()) {\n            throw new BadRequestException(\n                __('The property {0} is visible by administrators only.', self::IS_MFA_ENABLED_PROPERTY)\n            );\n        }\n\n        $isMfaEnabledFilter = $options['filter'][self::IS_MFA_ENABLED_FILTER_NAME] ?? null;\n        if (!is_null($isMfaEnabledFilter)) {\n            $this->filterByMfaEnabled($query, $isMfaEnabledFilter, $queryContainsIsMfaEnabled);\n        } elseif ($queryContainsIsMfaEnabled) {\n            $this->addIsMfaEnabledPropertyToQuery($query);\n        }\n    }\n\n    /**\n     * Contain the \"is_mfa_enabled\" property if the request is made\n     *  - by an admin\n     *  - or the user being viewed\n     *\n     * @param \\Cake\\ORM\\Query\\SelectQuery $query Query","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Service/Query/IsMfaEnabledQueryService.php#L29-L65","documentation":"IsMfaEnabledQueryService::decorateAndFilterForIndex() throws BadRequestException when a users-index query requests the is_mfa_enabled property or filter but the caller is not an administrator. The MFA status of other users is admin-only data.","triggerScenarios":"GET /users.json?contain[is_mfa_enabled]=1 or ?filter[has-mfa]=... performed by a non-admin (role user/group admin) UAC.","commonSituations":"Scripts or UIs built against admin sessions reused with regular user credentials; API consumers adding the contain unconditionally for all users.","solutions":["Perform the query with administrator credentials.","Remove the is_mfa_enabled contain/filter for non-admin callers.","Gate the client-side feature requesting this property behind role === admin.","If needed for self, use account settings endpoints instead of the users index."],"exampleFix":"// before: unconditionally add contain\n$query = $usersTable->find()->contain('IsMfaEnabled');\n// after: only for admins\nif ($uac->isAdmin()) {\n    $query = $usersTable->find()->contain('IsMfaEnabled');\n} else {\n    $query = $usersTable->find();\n}","handlingStrategy":"validation","validationCode":"if (!$uac->isAdmin() && (isset($options['contain']['is_mfa_enabled']) || isset($options['filter']['has-mfa']))) {\n    // drop the property/filter before the query or reject in the UI\n    unset($options['contain']['is_mfa_enabled'], $options['filter']['has-mfa']);\n}","typeGuard":null,"tryCatchPattern":"try {\n    $users = $this->UsersIndex->find($uac, $options);\n} catch (BadRequestException $e) {\n    return $this->forbidden('is_mfa_enabled is admin-only');\n}","preventionTips":["Only request is_mfa_enabled in admin-only UI views.","Gate client code on the authenticated user's role.","Document the contain/filter as admin-only in API docs."],"tags":["mfa","authorization","query-parameter","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}