{"record":{"id":"9290a526eb9df99e","repo":"passbolt/passbolt_api","slug":"the-resource-identifier-should-be-a-valid-uuid-9290a5","errorCode":null,"errorMessage":"The resource identifier should be a valid UUID.","messagePattern":"The resource identifier should be a valid UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Comments/CommentsAddService.php","lineNumber":64,"sourceCode":"     */\n    public function __construct()\n    {\n        $this->Comments = TableRegistry::getTableLocator()->get('Comments');\n    }\n\n    /**\n     * Create a new comment for a resource.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The user access control\n     * @param string $foreignKey The identifier of the resource to add a comment to\n     * @param array $data The comment data\n     * @return \\App\\Model\\Entity\\Comment $comment comment entity\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the comment couldn't be saved\n     */\n    public function add(UserAccessControl $uac, string $foreignKey, array $data): Comment\n    {\n        if (!Validation::uuid($foreignKey)) {\n            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));\n        }\n\n        $comment = $this->_buildAndValidateCommentEntity($uac, $foreignKey, $data);\n        $this->_handleValidationErrors($comment);\n\n        if (!$this->Comments->save($comment)) {\n            $this->_handleValidationErrors($comment);\n            $oops = __('Could not save the comment, please try again later.');\n            throw new InternalErrorException($oops);\n        }\n        $this->_notifyUsers($comment);\n\n        return $comment;\n    }\n\n    /**\n     * Manage validation errors.\n     *","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Comments/CommentsAddService.php#L46-L82","documentation":"CommentsAddService::add() validates that the resource identifier (foreignKey, i.e. the resource the comment is attached to) is a well-formed UUID using Cake's Validation::uuid() before doing anything else. A malformed id is rejected early with a 400 to avoid pointless DB work. It says nothing about whether the resource actually exists — that is checked later.","triggerScenarios":"POST /comments/{resourceId}/comments (or POST /comments with resourceId in payload) where resourceId is not a 36-char UUID — e.g. a slug, an integer id, an empty string, or a truncated id.","commonSituations":"Client-side code concatenating route fragments incorrectly; using a legacy numeric id from an old database; copy-paste dropping characters; sending 'me' or other placeholder tokens as the resource id.","solutions":["Inspect the request URL/payload and replace the identifier with the resource's actual UUID.","Check the client is reading the id from the correct response field (e.g. resource.id, not resource.slug).","Validate ids client-side with a UUID regex before sending."],"exampleFix":"// before\nawait fetch(`/comments/${resource.slug}/comments`, {method: 'POST'})\n// after\nif (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(resource.id)) throw new Error('invalid resource id');\nawait fetch(`/comments/${resource.id}/comments`, {method: 'POST'})","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(resourceId)) throw new Error(`resourceId is not a UUID: ${resourceId}`);","typeGuard":"function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }","tryCatchPattern":"try { await addComment(resourceId, data); }\ncatch (e) { if (e.response?.status === 400) console.error('Bad resource id:', resourceId); else throw e; }","preventionTips":["Always take ids from API response fields like data.id","Validate UUID format client-side before any API call","Never interpolate undefined/slug values into id path segments"],"tags":["validation","uuid","http-400"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}