{"record":{"id":"de7f239b96d5ebc7","repo":"passbolt/passbolt_api","slug":"the-metadata-private-key-should-not-be-empty","errorCode":null,"errorMessage":"The metadata private key should not be empty.","messagePattern":"The metadata private key should not be empty\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataKeyShareDefaultService.php","lineNumber":164,"sourceCode":"     * @inheritDoc\n     */\n    public function onFailure(Exception $exception): void\n    {\n        Log::error($exception->getMessage());\n        if (Configure::read('debug')) {\n            Log::error($exception->getTraceAsString());\n        }\n    }\n\n    /**\n     * @param string $clearText private key object in json format\n     * @return void\n     */\n    public function assertPrivateKey(string $clearText): void\n    {\n        if (empty($clearText)) {\n            $msg = __('The metadata private key should not be empty.');\n            throw new InternalErrorException($msg);\n        }\n\n        try {\n            $decoded = json_decode($clearText, true, 2, JSON_THROW_ON_ERROR);\n        } catch (Exception $exception) {\n            if (Configure::read('debug')) {\n                Log::error($clearText);\n            }\n            $msg = __('The metadata private key cleartext data should be in JSON format.');\n            throw new InternalErrorException($msg, 500, $exception);\n        }\n        if (!is_array($decoded) || empty($decoded)) {\n            $msg = __('The metadata private key cleartext data should not be empty.');\n            throw new InternalErrorException($msg);\n        }\n\n        $form = new MetadataCleartextPrivateKeyForm();\n        if (!$form->validate($decoded)) {","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataKeyShareDefaultService.php#L146-L182","documentation":"assertPrivateKey throws InternalErrorException when the decrypted cleartext of the server metadata private key is an empty string. The stored encrypted payload decrypted to nothing, which indicates corrupted or wrongly-stored data rather than a client mistake.","triggerScenarios":"shareMetadataKeyWithUser decrypts serverMetadataPrivateKey->data with the server GPG key and passes the result to assertPrivateKey; if decryption yields '' (empty stored data, wrong key silently producing empty output, or corrupted ciphertext), this error fires.","commonSituations":"Metadata private key row created with empty data (failed earlier import); server OpenPGP key changed/regenerated so decryption behaves unexpectedly; data corrupted by a bad migration or manual DB edit.","solutions":["Inspect the metadata_private_keys row for this key: if data is empty/corrupt, restore from backup or re-import the metadata key","Verify the server OpenPGP key passphrase/key configured matches the one that encrypted the data","Re-run the metadata key share after the data is repaired; assertPrivateKey will pass once cleartext is non-empty"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$row = $metadataPrivateKeysTable->find()->where(['metadata_key_id' => $keyId])->first();\nif ($row === null || trim((string)$row->data) === '') {\n    throw new \\DomainException('Server metadata private key data is empty; re-import the key.');\n}","typeGuard":"if (!is_string($row->data) || $row->data === '') { return; }","tryCatchPattern":"try {\n    $service->shareMetadataKeysWithUser($uac, $userIds, $keyId);\n} catch (MetadataKeyShareException $e) {\n    if (str_contains($e->getMessage(), 'should not be empty')) {\n        // restore or re-import the metadata key before retrying\n    }\n}","preventionTips":["Never edit metadata_private_keys.data manually in the database","Validate encrypted payloads are non-empty before persisting them at import time","Back up metadata keys and server OpenPGP keys before key rotation","Alert on rows with empty data via a periodic integrity check"],"tags":["openpgp","metadata-key","data-integrity","internal-error"],"backgroundTag":"empty-required-field","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}