{"record":{"id":"e511b6518234197f","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-access-this-location-e511b6","errorCode":null,"errorMessage":"You are not allowed to access this location.","messagePattern":"You are not allowed to access this location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryOrganizationPolicies/AccountRecoveryOrganizationPoliciesSetController.php","lineNumber":72,"sourceCode":"     * @throw BadRequestException if no data are provided\n     * @return void\n     */\n    protected function assertRequestData(): void\n    {\n        $data = $this->request->getData();\n        if (!isset($data) || !is_array($data) || !count($data)) {\n            throw new BadRequestException(__('The request data should not be empty.'));\n        }\n    }\n\n    /**\n     * @throw ForbiddenException if the user is not an administrator\n     * @return void\n     */\n    protected function assertIsAdmin(): void\n    {\n        if (!$this->User->isAdmin()) {\n            throw new ForbiddenException(__('You are not allowed to access this location.'));\n        }\n    }\n}\n","sourceCodeStart":54,"sourceCodeEnd":76,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryOrganizationPolicies/AccountRecoveryOrganizationPoliciesSetController.php#L54-L76","documentation":"ForbiddenException thrown by AccountRecoveryOrganizationPoliciesSetController::assertIsAdmin() when the authenticated user is not an administrator. Only admins may change account recovery organization policies.","triggerScenarios":"PUT /account-recovery/organization-policies.json performed by a logged-in non-admin user or an anonymous request that passes authentication middleware as guest.","commonSituations":"Non-admin account attempting policy changes via API directly; missing admin role assignment in the test fixture; token/role misconfiguration making the user appear non-admin.","solutions":["Log in as a user with the admin role before calling the endpoint","Grant the admin role to the intended user (users table role_id)","In tests, use an admin-authenticated request fixture","Confirm authorization middleware is loading the correct user role"],"exampleFix":"// before\n$this->authenticateAs('ada'); // regular user role\n$this->put('/account-recovery/organization-policies.json', $data); // 403\n// after\n$this->authenticateAs('admin');\n$this->put('/account-recovery/organization-policies.json', $data); // 200","handlingStrategy":"try-catch","validationCode":"const me = await selfClient.get();\nif (me.role.name !== 'admin') throw new Error('admin role required to set organization policies');","typeGuard":"function isAdminUser(user: {role: {name: string}}): boolean {\n  return user.role.name === 'admin';\n}","tryCatchPattern":"try {\n  await organizationPoliciesService.set(policy);\n} catch (ApiError e) {\n  if (e.status === 403 && e.message.includes('not allowed to access this location')) {\n    hidePolicySettingsUi(); // user lacks admin rights\n  }\n}","preventionTips":["Gate admin-only UI behind a role check so non-admins never call the endpoint","Confirm the operating user actually has the admin role","In tests, use admin-authenticated fixtures for admin endpoints","Handle 403 gracefully instead of retrying"],"tags":["php","cakephp","authorization","admin-only"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}