{"record":{"id":"e35448b843023f70","repo":"bitwarden/server","slug":"invalid-owner","errorCode":null,"errorMessage":"Invalid owner.","messagePattern":"Invalid owner\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs","lineNumber":109,"sourceCode":"        _globalSettings = globalSettings;\n        _dataProtector = dataProtectionProvider.CreateProtector(\"ProviderServiceDataProtector\");\n        _currentContext = currentContext;\n        _stripeAdapter = stripeAdapter;\n        _providerDeleteTokenDataFactory = providerDeleteTokenDataFactory;\n        _organizationAbilityCacheService = organizationAbilityCacheService;\n        _providerAbilityCacheService = providerAbilityCacheService;\n        _providerBillingService = providerBillingService;\n        _pricingClient = pricingClient;\n        _providerClientOrganizationSignUpCommand = providerClientOrganizationSignUpCommand;\n        _policyRequirementQuery = policyRequirementQuery;\n    }\n\n    public async Task<Provider> CompleteSetupAsync(Provider provider, Guid ownerUserId, string token, string key, TokenizedPaymentMethod paymentMethod, BillingAddress billingAddress)\n    {\n        var owner = await _userService.GetUserByIdAsync(ownerUserId);\n        if (owner == null)\n        {\n            throw new BadRequestException(\"Invalid owner.\");\n        }\n\n        if (provider.Status != ProviderStatusType.Pending)\n        {\n            throw new BadRequestException(\"Provider is already setup.\");\n        }\n\n        if (!CoreHelpers.TokenIsValid(\"ProviderSetupInvite\", _dataProtector, token, owner.Email, provider.Id,\n            _globalSettings.OrganizationInviteExpirationHours))\n        {\n            throw new BadRequestException(\"Invalid token.\");\n        }\n\n        var providerUser = await _providerUserRepository.GetByProviderUserAsync(provider.Id, ownerUserId);\n        if (!(providerUser is { Type: ProviderUserType.ProviderAdmin }))\n        {\n            throw new BadRequestException(\"Invalid owner.\");\n        }","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs#L91-L127","documentation":"Thrown inside CompleteSetupAsync when _userService.GetUserByIdAsync(ownerUserId) returns null. The setup flow needs the owner to exist to validate the invite token against their email and to configure their ProviderUser record. BadRequestException (HTTP 400).","triggerScenarios":"CompleteSetupAsync invoked with an ownerUserId that was deleted, never existed, or belongs to a different environment.","commonSituations":"Stale setup link after the owner account was deleted; test fixtures with wrong user IDs; cross-environment ID leakage.","solutions":["Verify the user exists before invoking setup (call IUserService.GetUserByIdAsync).","Re-issue the setup invite for a valid existing user.","Ensure the ownerUserId comes from the authenticated session, not a stale link."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var owner = await _userService.GetUserByIdAsync(ownerUserId);\nif (owner == null)\n    throw new InvalidOperationException($\"Owner user '{ownerUserId}' does not exist.\");","typeGuard":null,"tryCatchPattern":"try { await _providerService.CompleteSetupAsync(provider, ownerUserId, token, key, payment, billing); }\ncatch (BadRequestException ex) when (ex.Message == \"Invalid owner.\")\n{ /* owner user missing — re-issue invite for a valid user */ }","preventionTips":["Derive ownerUserId from the authenticated session, not a stale link.","Re-verify user existence right before setup.","Clean up stale setup links when users are deleted."],"tags":["provider","setup","user-lookup","validation","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}