{"record":{"id":"d74d5aa09106677a","repo":"passbolt/passbolt_api","slug":"resource-creation-with-cleartext-metadata-not-allowed","errorCode":null,"errorMessage":"Resource creation with cleartext metadata not allowed.","messagePattern":"Resource creation with cleartext metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":99,"sourceCode":"\n        if ($isV5) {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV5ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV5FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV4TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":81,"sourceCodeEnd":113,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L81-L113","documentation":"The mirror case of error 260: thrown when a resource is created with v4 cleartext metadata while the metadata types settings require/allow only v5 (encrypted) metadata for new resources. This enforces migration toward encrypted metadata in environments where v4 creation has been disabled.","triggerScenarios":"POST/PUT resource endpoints with plain-text metadata (name, username, description in clear) while isV4ResourceCreationAllowed() returns false (the $isV5 === false branch of assertCreationAllowedByMetadataSettings).","commonSituations":"Environments that completed the v5 migration and disabled v4 creation; legacy scripts or old clients still sending cleartext metadata; migrations/imports (e.g. KeePass/LastPass importers) that produce v4 resources; test suites using old fixtures.","solutions":["Encrypt the resource metadata client-side and send v5 payload (metadata, metadata_key_id, signed metadata_key) instead of cleartext fields","If cleartext must be kept temporarily, have an admin re-enable v4 resource creation in metadata types settings","Update legacy importers/scripts to use the v5 metadata format and a user private key for encryption"],"exampleFix":"// before: v4 cleartext\n$resource = ['name' => 'Secret login', 'username' => 'bob', 'uri' => 'https://x'];\n// after: v5 encrypted metadata\n$resource = ['resource_type_id' => $v5TypeId, 'metadata_key_id' => $keyId, 'metadata' => $openpgpEncryptedJson];","handlingStrategy":"try-catch","validationCode":"$isCleartext = empty($data['metadata']) && isset($data['name']);\nif ($isCleartext && !$settings->isV4ResourceCreationAllowed()) { /* encrypt to v5 before sending */ }","typeGuard":"function isV5ResourcePayload(array $d): bool { return isset($d['metadata'], $d['metadata_key_id']); }","tryCatchPattern":"try { $r = $service->create($data, $uac); }\ncatch (\\Cake\\Http\\Exception\\BadRequestException $e) { if (str_contains($e->getMessage(), 'cleartext metadata')) { /* encrypt metadata and retry as v5 */ } }","preventionTips":["After a v4->v5 migration, update all legacy importers and scripts to produce v5 payloads","Gate cleartext creation behind the isV4ResourceCreationAllowed flag","Keep the user private key available to clients so metadata encryption can run"],"tags":["passbolt","metadata","migration","v5"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}