{"record":{"id":"a83f2e5271c9382f","repo":"passbolt/passbolt_api","slug":"no-active-refresh-token-matching-the-request-could-be-found","errorCode":null,"errorMessage":"No active refresh token matching the request could be found.","messagePattern":"No active refresh token matching the request could be found\\.","errorType":"http","errorClass":"RefreshTokenNotFoundException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/JwtAuthentication/src/Service/RefreshToken/RefreshTokenAbstractService.php","lineNumber":187,"sourceCode":"            ->where([$this->AuthenticationTokens->aliasField('user_id') => $userId]);\n    }\n\n    /**\n     * @param string $token token to retrieve\n     * @param string $userId user ID\n     * @return \\App\\Model\\Entity\\AuthenticationToken Refresh token\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\RefreshToken\\RefreshTokenNotFoundException if the token is not found\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\RefreshToken\\ConsumedRefreshTokenAccessException if the token was already consumed\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\RefreshToken\\ExpiredRefreshTokenAccessException if the token is expired\n     * @throws \\InvalidArgumentException If the given token or user identifier are not a valid UUIDs\n     */\n    public function getActiveRefreshToken(string $token, string $userId): AuthenticationToken\n    {\n        /** @var \\App\\Model\\Entity\\AuthenticationToken|null $refreshToken */\n        $refreshToken = $this->queryRefreshTokenWithUserId($token, $userId)->contain('Users')->first();\n\n        if ($refreshToken === null) {\n            throw new RefreshTokenNotFoundException();\n        }\n\n        // Check if the user was not deleted or deactivated since the refresh token was issued.\n        $user = $refreshToken->user;\n        if ($user->isDeleted()) {\n            throw new UserDeletedException();\n        } elseif (!$user->isActive()) {\n            throw new UserDeactivatedException();\n        } elseif ($user->isDisabled()) {\n            throw new UserDeactivatedException();\n        }\n\n        $this->throwSecurityExceptionsOnInvalidRefreshToken($refreshToken);\n\n        return $refreshToken;\n    }\n\n    /**","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Service/RefreshToken/RefreshTokenAbstractService.php#L169-L205","documentation":"getActiveRefreshToken throws RefreshTokenNotFoundException ('No active refresh token matching the request could be found') when the (token, userId) pair matches no active AuthenticationToken row, or when the associated user has since been deleted/deactivated. It is a 404-style signal that the presented credentials do not correspond to a live refresh session.","triggerScenarios":"Logging out with a token that was already revoked or rotated; a user id that does not match the token's owner; the user account being deleted or deactivated after the token was issued; querying a database that was migrated/reset and no longer has the token row.","commonSituations":"Stale client credentials after a server database restore; revoked tokens following an admin deactivation; typo'd or swapped token/userId arguments; multi-server setups without shared database state.","solutions":["Re-authenticate to obtain a fresh refresh token; the presented one no longer exists in an active state.","Verify the token and userId belong together and are passed in the correct order.","Check the user account exists and is active (users.deleted=false, not deactivated).","If logout, treat this as 'already logged out' and clear local credentials idempotently."],"exampleFix":"// before\nawait logout(token, userId); // throws if token already revoked\n// after\ntry { await logout(token, userId); } catch (RefreshTokenNotFound) { clearLocalSession(); } // idempotent logout","handlingStrategy":"try-catch","validationCode":"const userActive = !(user.deleted || user.disabled);\nif (!isUuid(token) || !isUuid(userId) || !userActive) skipLogoutCall();","typeGuard":"function isLiveSession(tok: string, uid: string, user: User): boolean {\n  return isUuid(tok) && isUuid(uid) && !user.deleted && !user.disabled;\n}","tryCatchPattern":"try {\n  $service->getActiveRefreshToken($token, $userId);\n} catch (RefreshTokenNotFoundException $e) {\n  // already logged out / token revoked — clear local state, don't surface 500\n  $this->clearLocalSession();\n}","preventionTips":["Treat 'token not found' on logout as an idempotent success","Re-authenticate instead of retrying with the same token after revocation","Verify user accounts are active before resuming refresh flows after admin actions"],"tags":["refresh-token","not-found","jwt","authentication"],"backgroundTag":"resource-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}