{"record":{"id":"c945574ab8ca0c7c","repo":"passbolt/passbolt_api","slug":"could-not-validate-password-data-c94557","errorCode":null,"errorMessage":"Could not validate password data.","messagePattern":"Could not validate password data\\.","errorType":"validation","errorClass":"App\\Error\\Exception\\CustomValidationException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryPrivateKeyPasswords/AccountRecoveryPrivateKeyPasswordsValidationService.php","lineNumber":102,"sourceCode":"                $errors[$i]['recipient_fingerprint']['wrongRecipient'] = $msg;\n                continue;\n            }\n\n            // Check subkey id in message packet\n            if (!MessageRecipientValidationService::isMessageForRecipient($msgInfo, $keyInfo)) {\n                $errors[$i]['data']['wrongRecipient'] = $msg;\n                continue;\n            }\n\n            // Check business rules\n            if (!$this->AccountRecoveryPrivateKeyPasswords->checkRules($entity)) {\n                $errors[$i] = $entity->getErrors();\n            }\n        }\n\n        // Throw an error on business rules or message composition\n        if (count($errors)) {\n            throw new CustomValidationException(__('Could not validate password data.'), [\n                'account_recovery_private_key_passwords' => $errors,\n            ]);\n        }\n\n        return $passwordEntities;\n    }\n}\n","sourceCodeStart":84,"sourceCodeEnd":110,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryPrivateKeyPasswords/AccountRecoveryPrivateKeyPasswordsValidationService.php#L84-L110","documentation":"Thrown by AccountRecoveryPrivateKeyPasswordsValidationService::buildPasswordEntitiesFromDataOrFail after it builds password entities and rule-checks them: any entity whose errors() are non-empty (business rules or message composition failures) is collected, and if any errors exist a CustomValidationException is raised with the per-index entity errors under 'account_recovery_private_key_passwords'.","triggerScenarios":"Creating/updating account recovery private key passwords where an entry fails entity-level rules — invalid user_id (recipient not found/not active), missing or malformed encrypted 'data', invalid private_key_id, or failed message composition (e.g. recipient has no configured account-recovery key).","commonSituations":"Passing plaintext instead of the expected encrypted message format; referencing a user who never completed account-recovery setup so their key/stamp is missing; schema/rounding issues in the base64 OpenPGP message payload; bulk payload where one bad row aborts the whole batch.","solutions":["Inspect the per-index errors returned in the exception details under account_recovery_private_key_passwords and fix the flagged field(s)","Verify each 'data' value is a valid OpenPGP message encrypted for the recipient user's account-recovery key","Confirm every recipient user_id exists, is active, and has completed account-recovery setup (has a private key to receive the share)","Retry entries one at a time to isolate the failing row before fixing the batch"],"exampleFix":"// before\n{\"user_id\": \"unknown-uuid\", \"data\": \"plaintext-secret\"}\n// after\n{\"user_id\": \"<existing-active-user-uuid>\", \"data\": \"<openpgp-message-encrypted-for-user-recovery-key>\"}","handlingStrategy":"validation","validationCode":"// Validate each entry before building entities:\nforeach ($passwordsData as $i => $entry) {\n    if (empty($entry['user_id']) || !Uuid::isValid($entry['user_id'])) {\n        throw new \\InvalidArgumentException(\"Entry {$i}: invalid user_id\");\n    }\n    if (empty($entry['data']) || !str_starts_with($entry['data'], '-----BEGIN PGP MESSAGE-----')) {\n        throw new \\InvalidArgumentException(\"Entry {$i}: data must be an armored OpenPGP message\");\n    }\n}","typeGuard":"$isValidEntry = fn(array $e): bool =>\n    isset($e['user_id'], $e['data'], $e['private_key_id'])\n    && Uuid::isValid($e['user_id']) && Uuid::isValid($e['private_key_id'])\n    && is_string($e['data']) && $e['data'] !== '';","tryCatchPattern":"try {\n    $entities = $validationService->buildPasswordEntitiesFromDataOrFail($uac, $data);\n} catch (\\App\\Error\\Exception\\CustomValidationException $e) {\n    $perIndexErrors = $e->getErrors()['account_recovery_private_key_passwords'];\n    foreach ($perIndexErrors as $i => $errs) {\n        // log/fix the specific fields failing on row $i\n    }\n}","preventionTips":["Encrypt each password share with the recipient user's account-recovery public key, never plaintext","Confirm recipients completed account-recovery setup before including them in the payload","Fix one row at a time; the exception reports errors per index, so isolate the bad entry","Keep the OpenPGP library and key formats up to date to avoid message-composition rule failures"],"tags":["validation","openpgp","entity-validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}