{"record":{"id":"a1a683a348394b41","repo":"passbolt/passbolt_api","slug":"the-folder-does-not-exist-foldersupdateservice","errorCode":null,"errorMessage":"The folder does not exist.","messagePattern":"The folder does not exist\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\NotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltCe/Folders/src/Service/Folders/FoldersUpdateService.php","lineNumber":105,"sourceCode":"    }\n\n    /**\n     * Retrieve the folder.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac UserAccessControl updating the resource\n     * @param string $folderId The folder identifier to retrieve.\n     * @return \\Passbolt\\Folders\\Model\\Entity\\Folder\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the folder does not exist.\n     */\n    private function getFolder(UserAccessControl $uac, string $folderId): Folder\n    {\n        /** @var \\App\\Model\\Entity\\Permission|null $permission */\n        $permission = $this->permissionsTable\n            ->findHighestByAcoAndAro(PermissionsTable::FOLDER_ACO, $folderId, $uac->getId())\n            ->first();\n\n        if (empty($permission)) {\n            throw new NotFoundException(__('The folder does not exist.'));\n        } elseif ($permission->type < Permission::UPDATE) {\n            throw new ForbiddenException(__('You are not allowed to update this folder.'));\n        }\n\n        return $this->foldersTable->get($folderId);\n    }\n\n    /**\n     * Update folder meta.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The current user\n     * @param \\Passbolt\\Folders\\Model\\Entity\\Folder $folder The folder to update.\n     * @param \\Passbolt\\Metadata\\Model\\Dto\\MetadataFolderDto $folderDto The folder dto.\n     * @return \\Cake\\Datasource\\EntityInterface|\\Passbolt\\Folders\\Model\\Entity\\Folder\n     */\n    private function updateFolderMeta(\n        UserAccessControl $uac,\n        Folder $folder,","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Folders/src/Service/Folders/FoldersUpdateService.php#L87-L123","documentation":"A NotFoundException from FoldersUpdateService::getFolder, thrown when no permission row can be found linking the given folder id to the acting user. Although the message says 'The folder does not exist.', the actual check is on the user's highest permission for the folder: from the acting user's point of view the folder is invisible/nonexistent. This keeps folder existence hidden from unauthorized users.","triggerScenarios":"PUT /folders/{folderId} (FoldersUpdateService::update) with a folder id the user has no permission row for — folder does not exist, is deleted, or belongs to other users who never shared it with the caller; also invalid/unknown folder UUIDs.","commonSituations":"Typos or stale ids in scripts after a folder was deleted; a user attempts to rename a folder shared only with a teammate; integration tests reusing folder ids from another account's fixture data.","solutions":["Verify the folder id is a valid, existing folder visible to the acting user (GET /folders).","Have an owner share the folder with the user first; then retry the update.","Check you are authenticated as the intended user (UAC) and not a different/admin-less account.","If the folder was deleted, recreate it or use a different target folder."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm the folder is visible to the current user before updating\nconst folders = await api.get('/folders', { params: { 'filter[search]': folderId } });\nif (!folders.some(f => f.id === folderId)) {\n  throw new Error(`Folder ${folderId} not found or not accessible for this user`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await foldersApi.update(folderId, data);\n} catch (e) {\n  if (e.response?.status === 404) {\n    // folder missing or hidden from this user: verify id and sharing\n  }\n  throw e;\n}","preventionTips":["Fetch the folder list for the acting user first and update only ids present there.","Cache folder ids per-user; never reuse ids across accounts or environments.","Treat 404 on this endpoint as 'not visible to you' — it intentionally hides unauthorized folders.","Clean up client caches when folders are deleted."],"tags":["not-found","folders","authorization","rest-api"],"backgroundTag":"resource-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}