{"record":{"id":"accc2c1dcd3d9fc1","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-accc2c","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/DirectorySync/src/Controller/DirectoryIgnoreController.php","lineNumber":63,"sourceCode":"\n        $this->directoryOrgSettings = DirectoryOrgSettings::get();\n\n        $this->DirectoryIgnore = $this->fetchTable('Passbolt/DirectorySync.DirectoryIgnore');\n    }\n\n    /**\n     * Check if a record is ignored\n     *\n     * @param string $foreignModel foreign model\n     * @param string $foreignKey foreign key\n     * @throws \\App\\Error\\Exception\\ValidationException If the model name or id is not valid\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the current user is not an admin\n     * @return void\n     */\n    public function toggle(string $foreignModel, string $foreignKey): void\n    {\n        if ($this->User->role() !== Role::ADMIN) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n        $this->assertDirectoryEnabled();\n        $foreignModel = $this->normalizeForeignModel($foreignModel);\n        if (!Validation::inList($foreignModel, ['Groups', 'Users', 'DirectoryEntries'])) {\n            throw new BadRequestException(__('The record model is not valid.'));\n        }\n\n        $ignored = null;\n        try {\n            $ignored = $this->DirectoryIgnore->get($foreignKey);\n            $this->DirectoryIgnore->delete($ignored);\n        } catch (RecordNotFoundException $exception) {\n        }\n        $this->success(__('The record is currently ignored as part of directory synchronization.'), $ignored);\n    }\n\n    /**\n     * Check if a record is ignored","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Controller/DirectoryIgnoreController.php#L45-L81","documentation":"ForbiddenException thrown by DirectoryIgnoreController::toggle when the authenticated user's role is not Role::ADMIN. The ignore/un-ignore endpoint that controls which directory records are skipped during sync is admin-only; any non-admin (or unauthenticated) request is rejected with the standard CakePHP 'not authorized' message before the foreign model is even validated.","triggerScenarios":"Calling PUT/POST to the directory ignore toggle route (e.g. /directoryignore/<model>/<id>.json) while logged in as a non-admin user, or with missing/invalid authentication (User->role() not resolving to admin), or with a CSRF/auth token mismatch causing the identity to fall back to a lower role.","commonSituations":"UI automation or scripts run under a regular user account; stale session after the admin role was revoked; API token registered to a non-admin user; testing the endpoint unauthenticated.","solutions":["Authenticate as a user with the admin role, or grant the admin role to the account performing the operation.","Check the auth token/cookie used by the client corresponds to the intended admin (inspect User->role() via /me.json).","If this must be automated, run the equivalent server-side command (e.g. `passbolt directory_sync ignore-delete`) as a root/admin server operator instead of the HTTP endpoint.","Ensure the session didn't expire and the role lookup isn't failing silently (re-login to refresh the identity)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$me = $apiClient->get('/me.json');\nif (($me['role']['name'] ?? null) !== 'admin') {\n    throw new RuntimeException('Directory ignore toggle requires an admin account');\n}","typeGuard":"function isAdmin(array $me): bool { return ($me['role']['name'] ?? '') === 'admin'; }","tryCatchPattern":"try {\n    $apiClient->put('/directoryignore/' . $model . '/' . $id . '.json');\n} catch (HttpException $e) {\n    if ($e->getCode() === 403) {\n        // switch to an admin-authenticated client or run server-side command\n    }\n}","preventionTips":["Verify the authenticated user's role is admin before calling admin-only endpoints.","Refresh sessions/tokens after role changes.","For automation, prefer server-side cake commands over HTTP admin endpoints.","Centralize auth-client construction so non-admin tokens aren't reused for admin calls."],"tags":["authorization","rbac","directory-sync","forbidden"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}