{"record":{"id":"d12ffa4cea8d5fda","repo":"passbolt/passbolt_api","slug":"the-authentication-token-is-not-valid-for-this-user","errorCode":null,"errorMessage":"The authentication token is not valid for this user.","messagePattern":"The authentication token is not valid for this user\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Mobile/src/Service/Transfers/TransfersUpdateService.php","lineNumber":167,"sourceCode":"     * Check if operation is allowed\n     *\n     * @param \\Passbolt\\Mobile\\Model\\Entity\\Transfer $transfer entity\n     * @param \\App\\Utility\\UserAccessControl $uac user access control object\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if operation is not allowed for example:\n     * - Transfer or AuthToken is for another user\n     * - Authentication token is expired\n     * @return void\n     */\n    private function assertOperationIsAllowed(Transfer $transfer, UserAccessControl $uac): void\n    {\n        if ($transfer->user_id !== $uac->getId()) {\n            throw new ForbiddenException(__('This operation is not allowed for this user.'));\n        }\n        if (!isset($transfer->authentication_token)) {\n            throw new ForbiddenException(__('The authentication token is missing.'));\n        }\n        if ($transfer->authentication_token->user_id !== $uac->getId()) {\n            throw new ForbiddenException(__('The authentication token is not valid for this user.'));\n        }\n        if ($transfer->authentication_token->type !== AuthenticationToken::TYPE_MOBILE_TRANSFER) {\n            throw new ForbiddenException(__('The authentication token type is invalid.'));\n        }\n        if ($transfer->authentication_token->active !== true) {\n            throw new ForbiddenException(__('The authentication token is not active.'));\n        }\n        if ($transfer->authentication_token->isExpired()) {\n            throw new ForbiddenException(__('The authentication token is expired.'));\n        }\n    }\n\n    /**\n     * Return an updated transfer entity.\n     *\n     * @param \\Passbolt\\Mobile\\Model\\Entity\\Transfer $transfer entity\n     * @param array $data data\n     * @return \\Passbolt\\Mobile\\Model\\Entity\\Transfer","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Mobile/src/Service/Transfers/TransfersUpdateService.php#L149-L185","documentation":"Ownership guard for mobile transfers: the authentication token attached to the transfer belongs to a different user than the one performing the operation, so the token is not valid for this user and the transfer update is denied with 403.","triggerScenarios":"Updating a transfer with a valid mobile-transfer token that was issued to another user — e.g. after switching accounts on the device while keeping the old transfer id/token, or sharing transfer credentials between accounts.","commonSituations":"Account switch on a mobile device mid-setup; restoring a backup onto a device logged in as a different user; mismatched token transfer between test fixtures.","solutions":["Re-run the mobile transfer setup as the currently logged-in user to get a matching token","Ensure the token used is the one returned for this user's transfer-create call","Delete stale tokens for the old account and start a new transfer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const me = await api.getLoggedInUser();\nif (transfer.authenticationToken && transfer.authenticationToken.userId !== me.id) {\n  throw new Error('Token/user mismatch: restart transfer as current user');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.updateTransfer(transferId, payload);\n} catch (e) {\n  if (e.code === 403 && e.message.includes('not valid for this user')) {\n    // token belongs to another user; recreate transfer + token for this user\n  }\n}","preventionTips":["Bind transfer + token + account together in client state","On account switch, discard old transfer ids and tokens","Never share tokens between accounts or devices"],"tags":["mobile","transfer","authentication-token","user-mismatch"],"backgroundTag":"invalid-identifier","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}