{"record":{"id":"9e761c9e4f4f1934","repo":"passbolt/passbolt_api","slug":"only-admin-can-create-or-update-subscription-information","errorCode":null,"errorMessage":"Only admin can create or update subscription information.","messagePattern":"Only admin can create or update subscription information\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"plugins/PassboltEe/Subscription/src/Model/Table/SubscriptionsTable.php","lineNumber":104,"sourceCode":"        $query->where([\n            $this->aliasField('property_id') => $this->getPropertyId(),\n        ]);\n    }\n\n    /**\n     * Ensure that an administration is provided in options before saving.\n     *\n     * @param \\Cake\\Event\\Event $event the event\n     * @param \\Passbolt\\Subscription\\Model\\Entity\\Subscription $entity entity\n     * @param \\ArrayObject $options options\n     * @return void\n     */\n    public function beforeSave(Event $event, EntityInterface $entity, ArrayObject $options): void\n    {\n        /** @var \\App\\Utility\\UserAccessControl $uac */\n        $uac = $options['uac'] ?? null;\n        if (empty($uac) || !$uac->isAdmin()) {\n            throw new UnauthorizedException(__('Only admin can create or update subscription information.'));\n        }\n        if ($entity->isNew()) {\n            $entity->set('created_by', $uac->getId());\n        }\n        $entity->set('modified_by', $uac->getId());\n    }\n\n    /**\n     * Fields property and property_id are fixed.\n     *\n     * @param \\Cake\\Event\\Event $event the event\n     * @param \\ArrayObject $data data\n     * @param \\ArrayObject $options options\n     * @return void\n     */\n    public function beforeMarshal(Event $event, ArrayObject $data, ArrayObject $options): void\n    {\n        $data['property'] = $this->getProperty();","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Subscription/src/Model/Table/SubscriptionsTable.php#L86-L122","documentation":"SubscriptionsTable::beforeSave() enforces that only an admin UserAccessControl can create or update a subscription record; it throws UnauthorizedException when the 'uac' save option is missing, empty, or not an admin. This guards the subscription table from non-privileged writes.","triggerScenarios":"Calling SubscriptionsTable::save()/createOrUpdate()/update() without passing 'uac' in the save options, or with a UAC belonging to a non-admin (e.g. a user role) — $options['uac'] is null or !isAdmin().","commonSituations":"Custom scripts or plugins saving to Subscriptions directly and forgetting the uac option; running subscription updates with a logged-in non-admin session; CLI tasks that build a UAC with the wrong role; calling save() on the entity from another plugin without compact('uac').","solutions":["Always pass a UAC in save options: `$table->save($entity, ['uac' => $uac])` or use SubscriptionsTable::createOrUpdate($uac, $key).","Ensure the UAC is built for an admin user (role id of 'admin') — e.g. via UserAccessControl for an administrator identity.","In CLI/root contexts, construct a UAC from an admin user record instead of skipping it."],"exampleFix":"// before\n$this->Subscriptions->save($subscriptionEntity);\n// after\n$this->Subscriptions->save($subscriptionEntity, ['uac' => $uac]); // $uac->isAdmin() === true","handlingStrategy":"validation","validationCode":"if (!$uac->isAdmin()) {\n    throw new \\Cake\\Http\\Exception\\ForbiddenException('Admin required to save subscription');\n}\n$table->save($entity, ['uac' => $uac]);","typeGuard":null,"tryCatchPattern":"try {\n    $this->Subscriptions->createOrUpdate($uac, $key);\n} catch (\\Cake\\Http\\Exception\\UnauthorizedException $e) {\n    // caller lacks admin UAC or uac option missing\n}","preventionTips":["Always pass 'uac' in save options for SubscriptionsTable","Never bypass SubscriptionsTable by writing entities directly without a UAC","Ensure CLI/automation jobs construct an admin-role UserAccessControl"],"tags":["authorization","permissions","cakephp","php"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}