{"record":{"id":"bd96193e601e5132","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-bd9619","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/RbacsRoleActionAccessControlService.php","lineNumber":44,"sourceCode":" */\nclass RbacsRoleActionAccessControlService implements RoleActionAccessControlServiceInterface\n{\n    /**\n     * @inheritDoc\n     */\n    public function controlUserRoleActionAccess(Role $role, string $actionId): void\n    {\n        if ($role->isAdmin()) {\n            return;\n        }\n\n        /** @var \\Passbolt\\Rbacs\\Model\\Table\\RbacsTable $RbacsTable */\n        $RbacsTable = TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs');\n        if ($RbacsTable->isActionAllowedForRole($role->id, $actionId)) {\n            return;\n        }\n\n        throw new ForbiddenException(__('You are not authorized to access that location.'));\n    }\n}\n","sourceCodeStart":26,"sourceCodeEnd":47,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/RbacsRoleActionAccessControlService.php#L26-L47","documentation":"RbacsRoleActionAccessControlService::controlUserRoleActionAccess consults the Rbacs table to check whether the given role is allowed to perform the action id, and throws ForbiddenException when no matching allow rule exists. Unlike the admin-only variant, permissions are data-driven from the rbacs table.","triggerScenarios":"A user whose role has no rbacs row allowing the requested action id calls an endpoint guarded by this service.","commonSituations":"RBAC defaults not inserted after enabling the plugin (missing migrations); action id changed/renamed so no rule matches; role's control_function set to a deny value in the database.","solutions":["Verify the rbacs table has a row for the role and action id, and that it allows the action","Run migrations / the UiActions+Rbacs default-seeding commands to populate defaults","Confirm the action id string in the request matches an existing ui_actions record","Re-enable or repair RBAC settings in the admin UI"],"exampleFix":"null","handlingStrategy":"type-guard","validationCode":"$allowed = TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs')->isActionAllowedForRole($role->id, $actionId);","typeGuard":"function isActionAllowed(Role $role, string $actionId): bool { return TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs')->isActionAllowedForRole($role->id, $actionId); }","tryCatchPattern":"try { $service->controlUserRoleActionAccess($role, $actionId); } catch (ForbiddenException $e) { // surface 403 or fall back to a permitted action }","preventionTips":["Run RBAC/UiActions seed commands after enabling the plugin so default rules exist","Keep action ids in sync with ui_actions records","Verify rbacs rows allow the role before calling guarded actions"],"tags":["authorization","forbidden","rbacs","roles","database"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}