{"record":{"id":"6f5536d9a4278f33","repo":"passbolt/passbolt_api","slug":"the-user-does-not-exist-is-already-active-or-has-been","errorCode":null,"errorMessage":"The user does not exist, is already active or has been deleted.","messagePattern":"The user does not exist, is already active or has been deleted\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Setup/SetupCompleteService.php","lineNumber":147,"sourceCode":"\n        return $user;\n    }\n\n    /**\n     * Return the user for matching the requesting id\n     *\n     * @param string $userId the user uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user id is not a valid uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user was deleted, is already active or does not exist\n     * @return \\App\\Model\\Entity\\User user entity\n     */\n    protected function getAndAssertUser(string $userId): User\n    {\n        try {\n            return (new UserGetService())->getNotActiveNotDeletedNotDisabledOrFail($userId);\n        } catch (NotFoundException $exception) {\n            $msg = __('The user does not exist, is already active or has been deleted.');\n            throw new BadRequestException($msg);\n        }\n    }\n}\n","sourceCodeStart":129,"sourceCodeEnd":151,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Setup/SetupCompleteService.php#L129-L151","documentation":"Setup completion requires the target user to exist and be inactive, not deleted, and not disabled. UserGetService's getNotActiveNotDeletedNotDisabledOrFail threw NotFoundException, which is converted here to a BadRequestException with this message. The vague wording deliberately does not reveal which of the three conditions failed.","triggerScenarios":"POST /setup/complete with a userId that: was already completed (active), was deleted, is disabled, or never existed.","commonSituations":"Re-running setup after it already succeeded; replaying an old setup link; admin deleted the user between invite and completion; wrong user id copied from the email token URL.","solutions":["Check whether the user is already active in the database / admin UI; if so, log in instead of completing setup","Re-issue the registration token via the admin (resend invite) if the user was deleted or disabled","Verify the userId in the setup URL is the correct, full UUID","Confirm the user's deleted flag is false before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// check user state before attempting setup completion\n$user = $this->Users->find()->where(['id' => $userId])->first();\n$eligible = $user && !$user->active && !$user->deleted && !$user->disabled;","typeGuard":null,"tryCatchPattern":"try {\n    $user = $setupCompleteService->complete($userId);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    if ($e->getMessage() === 'The user does not exist, is already active or has been deleted.') {\n        // redirect to login or re-invite flow\n    }\n}","preventionTips":["Check the user's active/deleted/disabled flags before sending setup links","Re-issue invitations for deleted or disabled users","Never reuse old setup URLs after successful completion","Validate the userId UUID format client-side"],"tags":["setup","user-state","http-400"],"backgroundTag":"user-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}