{"record":{"id":"b23fd7eba0fc2e85","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-access-this-location","errorCode":null,"errorMessage":"You are not allowed to access this location.","messagePattern":"You are not allowed to access this location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Edition/src/Controller/EditionSubscriptionsDeleteController.php","lineNumber":37,"sourceCode":"use App\\Controller\\AppController;\nuse Cake\\Http\\Exception\\ForbiddenException;\nuse Passbolt\\Edition\\Service\\EditionDowngradeService;\n\n/**\n * HTTP entry point for the in-product downgrade.\n */\nclass EditionSubscriptionsDeleteController extends AppController\n{\n    /**\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException When the caller is not admin.\n     * @throws \\Cake\\Http\\Exception\\ConflictException When the instance is already on CE.\n     */\n    public function delete(): void\n    {\n        $uac = $this->User->getAccessControl();\n        if (!$uac->isAdmin()) {\n            throw new ForbiddenException(__('You are not allowed to access this location.'));\n        }\n\n        // Throws ConflictException(409) if already on CE.\n        (new EditionDowngradeService())->downgrade($uac);\n\n        $this->success(__('The instance was downgraded to CE.'));\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":46,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Edition/src/Controller/EditionSubscriptionsDeleteController.php#L19-L46","documentation":"EditionSubscriptionsDeleteController::delete obtains the caller's UserAccessControl and throws ForbiddenException if the caller is not an administrator. Only admins may downgrade the instance from PRO to CE by deleting the subscription.","triggerScenarios":"Calling DELETE on the edition subscriptions endpoint while authenticated as a non-admin user.","commonSituations":"Operations run with a regular service or user account instead of an admin; revoked admin role; automation using wrong API credentials; logged-in user lacking the admin role after role changes.","solutions":["Authenticate as, or use credentials of, an administrator account","Grant the admin role to the account performing the operation","Update automation/service accounts to use admin credentials for edition management"],"exampleFix":"// before\nawait apiAsUser.delete('/edition/subscriptions'); // 403\n// after\nconst apiAsAdmin = createClient(adminCredentials);\nawait apiAsAdmin.delete('/edition/subscriptions');","handlingStrategy":"type-guard","validationCode":"const uac = getUserAccessControl();\nif (!uac.isAdmin()) { /* abort: operation requires admin */ }","typeGuard":"function isAdminUser(user: {role: {name: string}}): boolean { return user.role?.name === 'admin'; }","tryCatchPattern":"try {\n  await api.delete('/edition/subscriptions');\n} catch (e) {\n  if (e.status === 403) { /* re-authenticate with admin credentials */ }\n}","preventionTips":["Verify the account's role before edition-management operations","Use dedicated admin service accounts for automation","Re-check role assignments after user/role changes"],"tags":["authorization","forbidden","admin"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}