{"record":{"id":"78ddf6105c4534d2","repo":"passbolt/passbolt_api","slug":"the-user-identifier-should-be-a-valid-uuid-78ddf6","errorCode":null,"errorMessage":"The user identifier should be a valid UUID.","messagePattern":"The user identifier should be a valid UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AuditLog/src/Controller/UserLogsController.php","lineNumber":51,"sourceCode":"        return 'Users';\n    }\n\n    /**\n     * View action logs for a given user.\n     *\n     * @param string|null $userId user id\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user id has the wrong format\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the UAC is not admin\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user does not exist\n     */\n    public function view(?string $userId = null)\n    {\n        $this->User->assertIsAdmin(__('Only administrators can view user logs.'));\n\n        // Check request sanity\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user identifier should be a valid UUID.'));\n        }\n        if (!TableRegistry::getTableLocator()->get('Users')->exists(['id' => $userId])) {\n            throw new NotFoundException(__('The user does not exist.'));\n        }\n\n        $this->viewByEntity(new UserActionLogsFinder(), $userId);\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":60,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AuditLog/src/Controller/UserLogsController.php#L33-L60","documentation":"Thrown by the AuditLog EE plugin's UserLogsController after the admin check passes, when the userId path parameter is not a valid UUID. Only administrators can view user logs, and the controller validates identifier format before checking user existence.","triggerScenarios":"GET /users/<userId>/logs.json called by a non-UUID identifier (empty, numeric, slug), even when the caller is an authenticated admin.","commonSituations":"Admin tooling or scripts iterating with wrong identifiers; UI bug passing undefined into the URL; tests using placeholder ids; users without admin rights hitting this after the earlier admin assertion differently — but the specific 400 here is purely format-related.","solutions":["Use the target user's passbolt UUID in the URL path","Resolve the id via GET /users.json (admin endpoint) and use its id field","Validate the id format client-side before calling the endpoint","Ensure the caller is authenticated as an administrator so the request passes the preceding admin assertion"],"exampleFix":"// before\nget(`/users/${user.profile.username}/logs.json`);\n// after\nget(`/users/${user.id}/logs.json`); // UUID","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!isAdmin()) throw new Error('Admin role required');\nif (!UUID_RE.test(userId)) throw new Error('userId must be a UUID');","typeGuard":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"try {\n  const logs = await getUserLogs(userId);\n} catch (e) {\n  if (e.code === 400 && /valid UUID/.test(e.message)) {\n    console.error('Invalid user id format:', userId);\n  } else if (e.code === 403) {\n    console.error('Admin role required');\n  } else { throw e; }\n}","preventionTips":["Remember the endpoint is admin-only — check role before calling","Resolve user ids from GET /users.json rather than usernames","Validate UUID format before the request","Avoid undefined interpolations in URL templates"],"tags":["audit-log","uuid","http-400","admin"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}