{"record":{"id":"b5729968037d48cd","repo":"passbolt/passbolt_api","slug":"folder-creation-with-cleartext-metadata-not-allowed","errorCode":null,"errorMessage":"Folder creation with cleartext metadata not allowed.","messagePattern":"Folder creation with cleartext metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":103,"sourceCode":"                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV5FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV4TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":85,"sourceCodeEnd":113,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L85-L113","documentation":"Thrown when a folder is created with v4 cleartext metadata while metadata settings disallow v4 folder creation. The ENTITY_FOLDER branch of the $isV5 === false path rejects the request with BadRequestException, pushing clients toward encrypted folder metadata.","triggerScenarios":"Folder create/update endpoints receiving a plain 'name' (cleartext) payload while isV4FolderCreationAllowed() returns false (assertV5FolderCreationEnabled context).","commonSituations":"Orgs enforcing v5-only metadata after migration; folder-creation scripts (provisioning, LDAP sync) still sending clear names; clients that haven't implemented folder metadata encryption yet.","solutions":["Send the folder with encrypted v5 metadata (metadata + metadata_key_id) instead of cleartext name","Admin-side: re-enable v4 folder creation in metadata types settings if the environment still needs cleartext folders","Upgrade the integrating client to support v5 folder metadata encryption"],"exampleFix":"// before\n$folder = ['folder' => ['name' => 'HR']];\n// after: v5 encrypted folder\n$folder = ['folder' => ['metadata' => $encryptedJson, 'metadata_key_id' => $keyId]];","handlingStrategy":"try-catch","validationCode":"if (isset($folder['name']) && empty($folder['metadata']) && !$settings->isV4FolderCreationAllowed()) { /* build v5 encrypted folder payload */ }","typeGuard":"function isV5FolderPayload(array $f): bool { return isset($f['metadata'], $f['metadata_key_id']); }","tryCatchPattern":"try { $folder = $foldersService->create($data, $uac); }\ncatch (\\Cake\\Http\\Exception\\BadRequestException $e) { /* switch payload to v5 or inform admin to relax settings */ }","preventionTips":["Sync folder tooling (provisioning, LDAP) with the org's metadata policy","Test folder creation under v5-only settings before deploying migrations","Cache metadata settings with a short TTL to detect admin changes"],"tags":["passbolt","metadata","folders","migration"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}