{"record":{"id":"8edf8efdc05c51db","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-update-this-folder","errorCode":null,"errorMessage":"You are not allowed to update this folder.","messagePattern":"You are not allowed to update this folder\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Folders/src/Service/Folders/FoldersUpdateService.php","lineNumber":107,"sourceCode":"    /**\n     * Retrieve the folder.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac UserAccessControl updating the resource\n     * @param string $folderId The folder identifier to retrieve.\n     * @return \\Passbolt\\Folders\\Model\\Entity\\Folder\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the folder does not exist.\n     */\n    private function getFolder(UserAccessControl $uac, string $folderId): Folder\n    {\n        /** @var \\App\\Model\\Entity\\Permission|null $permission */\n        $permission = $this->permissionsTable\n            ->findHighestByAcoAndAro(PermissionsTable::FOLDER_ACO, $folderId, $uac->getId())\n            ->first();\n\n        if (empty($permission)) {\n            throw new NotFoundException(__('The folder does not exist.'));\n        } elseif ($permission->type < Permission::UPDATE) {\n            throw new ForbiddenException(__('You are not allowed to update this folder.'));\n        }\n\n        return $this->foldersTable->get($folderId);\n    }\n\n    /**\n     * Update folder meta.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The current user\n     * @param \\Passbolt\\Folders\\Model\\Entity\\Folder $folder The folder to update.\n     * @param \\Passbolt\\Metadata\\Model\\Dto\\MetadataFolderDto $folderDto The folder dto.\n     * @return \\Cake\\Datasource\\EntityInterface|\\Passbolt\\Folders\\Model\\Entity\\Folder\n     */\n    private function updateFolderMeta(\n        UserAccessControl $uac,\n        Folder $folder,\n        MetadataFolderDto $folderDto\n    ): EntityInterface|Folder {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Folders/src/Service/Folders/FoldersUpdateService.php#L89-L125","documentation":"A ForbiddenException from FoldersUpdateService::getFolder, thrown when the user's highest permission on the folder exists but is below Permission::UPDATE (i.e. READ-only). FoldersUpdateService::update requires at least UPDATE permission to modify folder name or metadata.","triggerScenarios":"PUT /folders/{folderId} by a user whose highest permission on the folder is READ (type < UPDATE); renaming or moving a folder shared as read-only; a formerly-UPDATE user downgraded to READ by the owner.","commonSituations":"Collaborators with viewer rights trying to rename shared folders; scripts using an account that was downgraded; UI state stale after an owner reduced permissions.","solutions":["Ask the folder OWNER to share the folder with the user as UPDATE (type 7) or OWNER (type 15).","Perform the update as a user who already holds UPDATE or OWNER permission.","Refresh the client's permission data to confirm the current effective permission before retrying.","If permission inheritance from a parent folder should apply, verify the folder is in the expected shared hierarchy."],"exampleFix":"// before: READ-only user renames folder -> 403\nPUT /folders/{id} {\"name\":\"new-name\"}\n// after: owner grants UPDATE first\nPOST /folders/{id}/share {\"permissions\":[{\"aro\":{\"id\":\"<userId>\"},\"type\":7}]}","handlingStrategy":"try-catch","validationCode":"const perms = await api.get(`/permissions/folder/${folderId}`);\nconst mine = perms.find(p => p.user.id === currentUserId);\nif (!mine || mine.type < 7) {\n  throw new Error('UPDATE permission required to modify this folder');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await foldersApi.update(folderId, data);\n} catch (e) {\n  if (e.response?.status === 403) {\n    // request UPDATE/OWNER share from the owner before retrying\n  }\n  throw e;\n}","preventionTips":["Verify the user holds at least UPDATE (7) on the folder before update calls.","Refresh permission data after any share change to avoid acting on stale rights.","Disable edit controls in UI for read-only folders.","When downgrading a user's permission, warn them their pending edits will fail."],"tags":["folder-permissions","authorization","forbidden","update"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}