{"record":{"id":"80ab0ae6fda8c0d4","repo":"passbolt/passbolt_api","slug":"invalid-id","errorCode":null,"errorMessage":"Invalid id","messagePattern":"Invalid id","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Comments/CommentsViewService.php","lineNumber":69,"sourceCode":"     * @throws \\Cake\\Http\\Exception\\BadRequestException if the sanity checks failed\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the foreignKey can't be found\n     * @param string $userId The currently logged in user's ID\n     * @param string $foreignModelName name of the foreign model used for the comment\n     * @param string $foreignKey uuid Identifier of the model\n     * @param array $options Query options\n     * @return \\Cake\\ORM\\Query\\SelectQuery\n     */\n    public function view(string $userId, string $foreignModelName, string $foreignKey, array $options = []): SelectQuery\n    {\n        $foreignModelName = ucfirst($foreignModelName);\n        // Check model sanity.\n        if (!in_array($foreignModelName, CommentsTable::ALLOWED_FOREIGN_MODELS)) {\n            throw new BadRequestException('Invalid model name');\n        }\n\n        // Check uuid sanity.\n        if (!Validation::uuid($foreignKey)) {\n            throw new BadRequestException('Invalid id');\n        }\n\n        try {\n            $comments = $this->Comments->findViewForeignComments(\n                $userId,\n                $foreignModelName,\n                $foreignKey,\n                $options\n            );\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('Could not find comments for the requested model.'));\n        }\n\n        return $comments;\n    }\n}\n","sourceCodeStart":51,"sourceCodeEnd":86,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Comments/CommentsViewService.php#L51-L86","documentation":"Generic sanity guard in CommentsViewService::view: the provided identifier (comment or foreign key context) failed the uuid/format sanity check, and the generic 'Invalid id' message is surfaced as a 400.","triggerScenarios":"GET /comments/<model>/<foreignKey> where foreignKey is missing, numeric, or otherwise fails Validation::uuid().","commonSituations":"URL construction bugs omitting the id; passing a slug or external id instead of the passbolt UUID; copy-paste truncation of ids.","solutions":["Ensure the foreign key is the full UUID of the resource the comments belong to","Fix the client URL builder to interpolate the correct id variable","Validate ids client-side before issuing the request"],"exampleFix":"// before\nGET /comments/resources/123\n// after\nGET /comments/resources/9d3f1c0a-8f2e-4b1a-9c3d-2e5f6a7b8c9d","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!Validation::uuid($foreignKey)) { /* abort request */ }","typeGuard":"function isValidUuid(string $id): bool { return preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id) === 1; }","tryCatchPattern":"try { $service->view($userId, $model, $foreignKey); } catch (BadRequestException $e) { /* invalid id: fix URL builder */ }","preventionTips":["Interpolate full UUIDs into URLs, never slugs or integers","Validate URL segments before sending","Guard against truncated ids from copy-paste"],"tags":["validation","uuid","comments","bad-request"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}