{"record":{"id":"e04fa879ffed0bb7","repo":"passbolt/passbolt_api","slug":"only-administrators-are-allowed-to-create-update-user","errorCode":null,"errorMessage":"Only administrators are allowed to create/update user passphrase policies settings.","messagePattern":"Only administrators are allowed to create/update user passphrase policies settings\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/UserPassphrasePolicies/src/Service/UserPassphrasePoliciesSetSettingsService.php","lineNumber":51,"sourceCode":"    /**\n     * Event name. Fired after user passphrase policies settings has been saved.\n     *\n     * @var string\n     */\n    public const EVENT_SETTINGS_UPDATED = 'Service.UserPassphrasePoliciesSetSettings.updated';\n\n    /**\n     * Create user passphrase policy settings if not already present in DB or update the settings value if already exists.\n     *\n     * @param \\App\\Utility\\ExtendedUserAccessControl $uac Extended user access control.\n     * @param array $requestData Request data.\n     * @return \\Passbolt\\UserPassphrasePolicies\\Model\\Dto\\UserPassphrasePoliciesSettingsDto\n     * @throws \\Exception\n     */\n    public function createOrUpdate(ExtendedUserAccessControl $uac, array $requestData): UserPassphrasePoliciesSettingsDto // phpcs:ignore\n    {\n        if (!$uac->isAdmin()) {\n            throw new ForbiddenException(\n                __('Only administrators are allowed to create/update user passphrase policies settings.')\n            );\n        }\n\n        $form = new UserPassphrasePoliciesSettingsForm();\n        if (!$form->execute($requestData)) {\n            throw new FormValidationException(\n                __('Could not validate the user passphrase policies settings.'),\n                $form\n            );\n        }\n\n        /** @var \\Passbolt\\UserPassphrasePolicies\\Model\\Dto\\UserPassphrasePoliciesSettingsDto $settingsDto */\n        $settingsDto = UserPassphrasePoliciesSettingsDto::createFromArray($form->getData());\n\n        /** @var \\Passbolt\\UserPassphrasePolicies\\Model\\Table\\UserPassphrasePoliciesSettingsTable $userPassphrasePoliciesSettingsTable */\n        $userPassphrasePoliciesSettingsTable = $this->fetchTable('Passbolt/UserPassphrasePolicies.UserPassphrasePoliciesSettings'); // phpcs:ignore\n","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/UserPassphrasePolicies/src/Service/UserPassphrasePoliciesSetSettingsService.php#L33-L69","documentation":"UserPassphrasePoliciesSetSettingsService::createOrUpdate requires the acting user to be an administrator via ExtendedUserAccessControl::isAdmin(). Any non-admin calling the set settings endpoint is rejected with this ForbiddenException before any validation or persistence occurs.","triggerScenarios":"POST to the user passphrase policies settings endpoint authenticated as a non-admin user (or with a UAC lacking the admin role).","commonSituations":"A logged-in standard user or an API integration using a non-admin key tries to change the policy; an admin's role was revoked between login and the request; misconfigured automation credentials.","solutions":["Authenticate as a user with the administrator role before calling the endpoint.","Check the UAC/role assignment of the account being used and re-grant admin if legitimately required.","Use the server-side CLI (passbolt commands) for policy changes if API admin access is not available."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (currentUser?.role?.name !== 'admin') throw new Error('Admin role required to set passphrase policies');","typeGuard":"const isAdminUser = (u): u is AdminUser => u?.role?.name === 'admin';","tryCatchPattern":"catch (e) { if (e.status === 403) { notifyAdminRoleRequired(); } }","preventionTips":["Check the logged-in user's role before exposing admin settings UI.","Use dedicated admin service accounts for automation.","Handle 403 by surfacing a permissions message, not retrying."],"tags":["user-passphrase-policies","forbidden","permissions","admin"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}