{"record":{"id":"a6a8b1dfcc49559e","repo":"passbolt/passbolt_api","slug":"the-group-id-is-not-valid-groupsviewcontroller","errorCode":null,"errorMessage":"The group id is not valid.","messagePattern":"The group id is not valid\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Controller/Groups/GroupsViewController.php","lineNumber":44,"sourceCode":" * @property \\App\\Model\\Table\\GroupsTable $Groups\n */\nclass GroupsViewController extends AppController\n{\n    /**\n     * Group View action\n     *\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the group id is not a uuid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the group does not exist\n     * @param string $id uuid Identifier of the group\n     * @return void\n     */\n    public function view(string $id)\n    {\n        $this->assertJson();\n\n        // Check request sanity\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The group id is not valid.'));\n        }\n        /** @var \\App\\Model\\Table\\GroupsTable $groupsTable */\n        $groupsTable = $this->fetchTable('Groups');\n\n        // Retrieve and sanity the query options.\n        $whitelist = [\n            'contain' => [\n                'modifier', 'modifier.profile', 'my_group_user',\n                'users', 'groups_users', 'groups_users.user',\n                'groups_users.user.profile', 'groups_users.user.gpgkey',\n                // Deprecated contains, use plural form instead\n                // @deprecated remove when v2 support is dropped\n                'user', 'group_user', 'group_user.user', 'group_user.user.profile',\n                'group_user.user.gpgkey',\n            ],\n        ];\n        $options = $this->QueryString->get($whitelist);\n        if (isset($options['contain']['my_group_user'])) {","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Groups/GroupsViewController.php#L26-L62","documentation":"UUID guard in GroupsViewController::view(): the {id} path parameter must be a valid UUID of a group. Fires when the client requests a group with a malformed identifier, rejecting with HTTP 400 before any database lookup; a valid id for a missing group yields NotFoundException ('The group does not exist.').","triggerScenarios":"GET /groups/<id>.json with a non-UUID id: numeric legacy id, truncated string, URL-encoded garbage, or an empty segment resulting in a route mismatch/malformed call.","commonSituations":"Old integrations built before passbolt used UUIDs; string concatenation bugs building the URL; reading the wrong column (e.g. user id instead of group id) from another API response; trimming/truncation by a proxy or client.","solutions":["Inspect the URL actually requested and confirm the id segment is a 36-char UUID (8-4-4-4-12 hex)","Fix the client code to pass the group's UUID from GET /groups.json","If you only have a name, resolve it to a UUID first via the groups index endpoint","Validate the id client-side with a UUID regex before calling"],"exampleFix":"// before\nconst url = `/groups/${group.id}.json`; // group.id was a numeric legacy id\n// after\nif (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(groupId)) {\n  throw new Error('group id must be a UUID');\n}\nconst url = `/groups/${groupId}.json`;","handlingStrategy":"validation","validationCode":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\nif (!isUuid(groupId)) throw new Error('group id must be a UUID, got: ' + groupId);","typeGuard":"const asGroupUuid = (v) => isUuid(v) ? v : null;","tryCatchPattern":"if (!isUuid(id)) { id = await resolveGroupIdByName(name); }","preventionTips":["Always source ids from API responses, never construct them","Validate UUID format client-side before any passbolt call","Beware legacy numeric ids from pre-UUID integrations"],"tags":["http-400","uuid","validation","rest-api"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}