{"record":{"id":"ab7cce9e3dd825d5","repo":"passbolt/passbolt_api","slug":"please-provide-a-valid-request-id","errorCode":null,"errorMessage":"Please provide a valid request id.","messagePattern":"Please provide a valid request id\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsViewController.php","lineNumber":45,"sourceCode":"{\n    /**\n     * List the details of one account recovery request\n     *\n     * @param string $id uuid of the request\n     * @param \\Passbolt\\Rbacs\\Service\\ActionAccessControl\\RoleActionAccessControlServiceInterface $accessControlService service assessing if the user's role has access to this action\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the user is not an admin\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if request id could not be found\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the id is not a uuid\n     * @return void\n     */\n    public function view(string $id, RoleActionAccessControlServiceInterface $accessControlService): void\n    {\n        $accessControlService->controlUserRoleActionAccess(\n            $this->User->getRoleEntity(),\n            UserAction::getInstance()->getActionId()\n        );\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('Please provide a valid request id.'));\n        }\n\n        // Whitelisted filters and contain parameters\n        $options = $this->QueryString->get([\n            'contain' => [\n                'armored_key', 'account_recovery_private_key_passwords',\n                'account_recovery_request_responses',\n                'creator',\n            ],\n        ]);\n\n        $options['id'] = $id;\n\n        /** @var \\Passbolt\\AccountRecovery\\Model\\Table\\AccountRecoveryRequestsTable $accountRecoveryRequestsTable */\n        $accountRecoveryRequestsTable = $this->fetchTable('Passbolt/AccountRecovery.AccountRecoveryRequests');\n        $request = $accountRecoveryRequestsTable->findView($options)->firstOrFail();\n\n        $this->success(__('The operation was successful.'), $request);","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsViewController.php#L27-L63","documentation":"Thrown by the account recovery request view endpoint when the `id` route parameter is not a valid UUID. The access-control check succeeds but the controller rejects the identifier before building the query, so this is purely an input-format error.","triggerScenarios":"GET /account-recovery/requests/<id> with a non-UUID id (empty string, numeric id, slug, or truncated UUID).","commonSituations":"Admin tools listing recovery requests with a wrong column; passing an internal integer id from a legacy system; URL templates losing the id segment.","solutions":["Ensure the id comes from the recovery requests index response (UUID format).","Add a client-side UUID check before calling the endpoint.","Check for string interpolation bugs producing empty ids.","Verify you are not passing a response-id or user-id instead of the request id."],"exampleFix":"// before\nget(`/account-recovery/requests/${row.number}`);\n// after\nget(`/account-recovery/requests/${row.id}`); // row.id is a UUID","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!id || !UUID_RE.test(id)) throw new Error('request id must be a UUID');","typeGuard":"function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }","tryCatchPattern":"try { await api.viewAccountRecoveryRequest(id, {contain:['creator']}); } catch (e) { if (e.code === 400 && /valid request id/.test(e.message)) { /* fix id source */ } else { throw e; } }","preventionTips":["Always take the id from the API's index/list responses.","Never substitute numeric internal ids.","Guard against empty template interpolations.","Type ids as UUID strings in client models."],"tags":["validation","uuid","bad-request","account-recovery"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}