{"record":{"id":"6b6a0402f2236e92","repo":"passbolt/passbolt_api","slug":"only-administrators-are-allowed-to-create-update-password","errorCode":null,"errorMessage":"Only administrators are allowed to create/update password policies settings.","messagePattern":"Only administrators are allowed to create/update password policies settings\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/PasswordPoliciesUpdate/src/Service/PasswordPoliciesUpdateSetSettingsService.php","lineNumber":50,"sourceCode":"\n    /**\n     * Event name. Fired after passwords policies settings has been saved.\n     *\n     * @var string\n     */\n    public const EVENT_SETTINGS_UPDATED = 'Service.PasswordPoliciesSetSettings.updated';\n\n    /**\n     * Create passwords policies settings if not present already in DB or updates the settings value if already exists.\n     *\n     * @param \\App\\Utility\\ExtendedUserAccessControl $uac Extended user access control.\n     * @param array $requestData Request data.\n     * @return \\Passbolt\\PasswordPoliciesUpdate\\Model\\Dto\\PasswordPoliciesUpdateSettingsDto\n     */\n    public function createOrUpdate(ExtendedUserAccessControl $uac, array $requestData): PasswordPoliciesUpdateSettingsDto // phpcs:ignore\n    {\n        if (!$uac->isAdmin()) {\n            throw new ForbiddenException(\n                __('Only administrators are allowed to create/update password policies settings.')\n            );\n        }\n\n        $form = new PasswordPoliciesSettingsForm();\n        if (!$form->execute($requestData)) {\n            throw new FormValidationException(__('Could not validate the password policies settings.'), $form);\n        }\n\n        /** @var \\Passbolt\\PasswordPoliciesUpdate\\Model\\Dto\\PasswordPoliciesUpdateSettingsDto $settingsDto */\n        $settingsDto = PasswordPoliciesUpdateSettingsDto::createFromArray($form->getData());\n\n        /** @var \\Passbolt\\PasswordPoliciesUpdate\\Model\\Table\\PasswordPoliciesSettingsTable $passwordPoliciesSettingsTable */\n        $passwordPoliciesSettingsTable = $this->fetchTable('Passbolt/PasswordPoliciesUpdate.PasswordPoliciesSettings'); // phpcs:ignore\n\n        /** @var \\Passbolt\\PasswordPoliciesUpdate\\Model\\Entity\\PasswordPoliciesSetting $passwordPoliciesSetting */\n        $passwordPoliciesSetting = $passwordPoliciesSettingsTable->createOrUpdateSetting(\n            $passwordPoliciesSettingsTable->getProperty(),","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/PasswordPoliciesUpdate/src/Service/PasswordPoliciesUpdateSetSettingsService.php#L32-L68","documentation":"This ForbiddenException is thrown by PasswordPoliciesUpdateSetSettingsService::createOrUpdate when the ExtendedUserAccessControl object indicates the acting user is not an administrator. Password policy settings are EE-level configuration that only admins may create or update, so the service enforces role-based access before processing the payload.","triggerScenarios":"POST to the password policies settings endpoint by a logged-in user whose UAC role is not admin (e.g. a user or admin-less role), or calling createOrUpdate directly in code/tests with a UAC built for a non-admin user.","commonSituations":"A non-admin user (or automation using a non-admin API key/user) attempts to change password policies; integration tests reuse a non-admin UAC fixture; role assignment changes stripped admin from the account.","solutions":["Log in / authenticate as a user with the admin role before calling the endpoint","Verify the UAC passed to createOrUpdate is built from an admin user's access control","Check the user's role in the database (roles table) and promote them to admin if appropriate","Ensure the route's authentication middleware correctly identifies the user so isAdmin() evaluates the right identity"],"exampleFix":"// before\n$this->post('/password-policies.json', $payload); // as non-admin user\n// after\n$this->authenticateAs('admin');\n$this->post('/password-policies.json', $payload);","handlingStrategy":"validation","validationCode":"if (!uac.isAdmin()) { throw new Error('Password policies settings can only be modified by administrators'); }","typeGuard":"const isAdminUser = (uac: { isAdmin(): boolean }): boolean => uac.isAdmin();","tryCatchPattern":null,"preventionTips":["Always authenticate with an admin account for settings-mutation endpoints","In tests, use an admin UAC fixture for admin-only services","Assert role before issuing privileged API calls in scripts/automation"],"tags":["permissions","authorization","password-policies"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}