{"record":{"id":"9c67538c00553cca","repo":"passbolt/passbolt_api","slug":"the-metadata-session-key-identifier-should-be-a-uuid-9c6753","errorCode":null,"errorMessage":"The metadata session key identifier should be a UUID.","messagePattern":"The metadata session key identifier should be a UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php","lineNumber":54,"sourceCode":"{\n    use LocatorAwareTrait;\n\n    /**\n     * Delete the given metadata session key.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac UAC.\n     * @param string $id The metadata session key identifier.\n     * @param array $data non-empty array of user provided data\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @throws \\Cake\\Http\\Exception\\NotFoundException\n     * @throws \\Cake\\Http\\Exception\\ConflictException\n     * @throws \\App\\Error\\Exception\\CustomValidationException\n     * @return \\Passbolt\\Metadata\\Model\\Entity\\MetadataSessionKey\n     */\n    public function update(UserAccessControl $uac, string $id, array $data): MetadataSessionKey\n    {\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The metadata session key identifier should be a UUID.'));\n        }\n\n        // 400 invalid user provided data, we expect [modified:<datetime>, data:<string>]\n        $form = new MetadataSessionKeyUpdateForm();\n        if (!$form->execute($data)) {\n            throw new FormValidationException(__('Could not validate the data.'), $form);\n        }\n        $data = $form->getData();\n\n        /** @var \\Passbolt\\Metadata\\Model\\Table\\MetadataSessionKeysTable $metadataSessionKeysTable */\n        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');\n\n        try {\n            /** @var \\Passbolt\\Metadata\\Model\\Entity\\MetadataSessionKey $metadataSessionKey */\n            $metadataSessionKey = $metadataSessionKeysTable\n                ->find()\n                ->where(['id' => $id, 'user_id' => $uac->getId()])\n                ->firstOrFail();","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php#L36-L72","documentation":"Format guard in MetadataSessionKeyUpdateService::update(): the id argument does not pass Validation::uuid(), so the metadata session key identifier is malformed and the update is rejected with 400 before any form validation or lookup.","triggerScenarios":"PUT/PATCH-style update call with an id that is not a valid UUID (empty string, numeric id, malformed identifier).","commonSituations":"Bad URL construction in clients, string concatenation losing part of the id, tests using dummy ids.","solutions":["Send a valid UUID v4 as the session key identifier","Obtain the id from the session key index/creation endpoint","Validate the id client-side before issuing the update request"],"exampleFix":"// before\n$service->update($uac, $requestId, $data);\n// after\nif (!Validation::uuid($requestId)) { return 400; }\n$service->update($uac, $requestId, $data);","handlingStrategy":"validation","validationCode":"if (!Validation::uuid($id)) { throw new InvalidArgumentException('id must be a UUID'); }","typeGuard":"function isValidSessionKeyId(string $id): bool { return Validation::uuid($id); }","tryCatchPattern":"try { $service->update($uac, $id, $data); } catch (BadRequestException $e) { /* invalid id */ }","preventionTips":["Validate UUID format before update calls","Generate ids only from server responses","Add contract tests for endpoint URL params"],"tags":["uuid","bad-request","input-validation","metadata-session-key"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}