{"record":{"id":"7456166bf451ae02","repo":"passbolt/passbolt_api","slug":"an-authentication-token-should-be-provided-745616","errorCode":null,"errorMessage":"An authentication token should be provided.","messagePattern":"An authentication token should be provided\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Setup/AbstractCompleteService.php","lineNumber":95,"sourceCode":"     * Return the authentication from data if any\n     *\n     * @param string $userId the user uuid the token belongs to\n     * @param string $tokenType AuthenticationToken::TYPE_*\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if no authentication token was provided\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the authentication token is not a uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the authentication token is expired or invalid\n     * @return \\App\\Model\\Entity\\AuthenticationToken\n     */\n    protected function getAndAssertToken(string $userId, string $tokenType): AuthenticationToken\n    {\n        $data = $this->request->getData();\n\n        // @deprecated since v3.6\n        if (isset($data['authenticationtoken'])) {\n            $data['authentication_token'] = $data['authenticationtoken'];\n        }\n        if (!isset($data['authentication_token']) || !isset($data['authentication_token']['token'])) {\n            throw new BadRequestException(__('An authentication token should be provided.'));\n        }\n        $token = $data['authentication_token']['token'];\n        if (!Validation::uuid($token)) {\n            throw new BadRequestException(__('The authentication token should be a valid UUID.'));\n        }\n        try {\n            return (new AuthenticationTokenGetService())->getActiveNotExpiredOrFail($token, $userId, $tokenType);\n        } catch (NotFoundException $exception) {\n            throw new BadRequestException(__('The authentication token is not valid.'));\n        }\n    }\n\n    /**\n     * Atomically consume a Setup/Recover token; loser of a concurrent race\n     * throws the same `CustomValidationException` shape as `getActiveOrFail`.\n     *\n     * @param \\App\\Model\\Entity\\AuthenticationToken $token token entity previously fetched via `getAndAssertToken`\n     * @return void","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Setup/AbstractCompleteService.php#L77-L113","documentation":"Payload guard in AbstractCompleteService::getAndAssertToken: the request data contains no authentication_token.token entry (legacy authenticationtoken spelling also handled), so setup/recovery completion cannot proceed and a 400 is raised.","triggerScenarios":"Thrown at src/Service/Setup/AbstractCompleteService.php:95 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Include authentication_token.token in the request body","Use the browser extension flow which sends the token"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}