{"record":{"id":"d089ddc065c5a136","repo":"passbolt/passbolt_api","slug":"could-not-validate-public-key-data-d089dd","errorCode":null,"errorMessage":"Could not validate public key data.","messagePattern":"Could not validate public key data\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":422,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryOrganizationPolicies/AbstractAccountRecoveryOrganizationPolicySetService.php","lineNumber":354,"sourceCode":"                'account_recovery_organization_revoked_key' => $patchedEntity->getErrors(),\n            ]);\n        }\n\n        return $patchedEntity;\n    }\n\n    /**\n     * Run public key model rules and throw an exception in case of errors\n     *\n     * @param \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryOrganizationPublicKey $publicKey entity\n     * @throws \\App\\Error\\Exception\\ValidationException if model rules fail\n     * @return void\n     */\n    private function assertPublicKeyModelRules(AccountRecoveryOrganizationPublicKey $publicKey): void\n    {\n        $table = $this->AccountRecoveryOrganizationPublicKeys;\n        if (!$table->checkRules($publicKey) && $publicKey->getErrors()) {\n            throw new ValidationException(__('Could not validate public key data.'), $publicKey, $table);\n        }\n    }\n\n    /**\n     * Assert an organization recovery public key exists and is not deleted for given fingerprint\n     *\n     * @param string $fingerprint user provided data\n     * @throws \\App\\Error\\Exception\\CustomValidationException if the provided fingerprint does not match the one\n     * from the currently active key\n     * @return \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryOrganizationPublicKey existing key\n     */\n    private function findActiveKeyByFingerprintOrFail(string $fingerprint): AccountRecoveryOrganizationPublicKey\n    {\n        try {\n            /** @var \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryOrganizationPublicKey $key */\n            $key = $this->AccountRecoveryOrganizationPublicKeys->find()->where([\n                'fingerprint' => $fingerprint,\n                'deleted IS' => null,","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryOrganizationPolicies/AbstractAccountRecoveryOrganizationPolicySetService.php#L336-L372","documentation":"Thrown by `assertPublicKeyModelRules` when application-level model rules (`checkRules`) on an `AccountRecoveryOrganizationPublicKey` entity fail, i.e. the public key entity built from the request does not satisfy domain invariants. It wraps the table's validation errors in a `ValidationException`.","triggerScenarios":"Posting a new organization recovery public key that fails model rules such as valid armored-key format, unique fingerprint, or key type checks during `buildPublicKeyEntityFromDataOrFail`.","commonSituations":"Client sends a private key instead of a public key; key generated with algorithms the server rejects; duplicate fingerprint already registered; API version mismatch sending extra/missing fields.","solutions":["Read the validation errors attached to the ValidationException response body","Verify the submitted `armored_key` is a valid armored OpenPGP public key (not private)","Ensure the key's fingerprint is not already registered in account_recovery_organization_public_keys","Regenerate the key with supported OpenPGP settings and retry"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const armored = armor.isArmored(pubkey) && /BEGIN PGP PUBLIC KEY/.test(pubkey);\nif (!armored) throw new Error('must be an armored public key');","typeGuard":"function isArmoredPublicKey(s) { return typeof s === 'string' && s.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----'); }","tryCatchPattern":"try { await submitKey(key); } catch (e) { if (e.status === 400 && e.body?.errors) showValidationErrors(e.body.errors); else throw e; }","preventionTips":["Verify the key is a PUBLIC key, not private","Check for duplicate fingerprints before submission","Use supported OpenPGP algorithms when generating keys"],"tags":["account-recovery","validation","public-key","openpgp"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}