{"record":{"id":"ee08240162058c76","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-share-this-resource","errorCode":null,"errorMessage":"You are not authorized to share this resource.","messagePattern":"You are not authorized to share this resource\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"src/Controller/Share/ShareController.php","lineNumber":145,"sourceCode":"    {\n        if (!Validation::uuid($resourceId)) {\n            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));\n        }\n        // Retrieve the resource to simulate the share with.\n        try {\n            $resource = $this->Resources->get($resourceId);\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n        // The resource is not soft deleted.\n        if ($resource->deleted) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n        // The user can access the resource.\n        $acoType = PermissionsTable::RESOURCE_ACO;\n        $userId = $this->User->id();\n        if (!$this->Resources->Permissions->hasAccess($acoType, $resourceId, $userId, Permission::OWNER)) {\n            throw new ForbiddenException(__('You are not authorized to share this resource.'));\n        }\n        // V5 validations\n        $resourceDto = MetadataResourceDto::fromArray($resource->toArray());\n        if ($resourceDto->isV5() && $resource->get('metadata_key_type') === 'user_key') {\n            throw new BadRequestException(__('Resource metadata key type is invalid.'));\n        }\n    }\n\n    /**\n     * Format the result.\n     *\n     * This entry point is used by the plugin app, and due to the V1 legacy the output body must be\n     * formatted as following:\n     *\n     * [\n     *   'changes' => [\n     *     'added' => [\n     *       ['User' => ['id' => uuid]],","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Share/ShareController.php#L127-L163","documentation":"Thrown by ShareController::_assertRequestParameters when the authenticated user lacks OWNER permission on the target resource. Only resource owners may share it (or simulate sharing it); other permission levels (edit/read) get 403.","triggerScenarios":"PUT /share/resource/<uuid> or /share/simulate/<uuid> executed by a user whose highest permission on the resource is not OWNER — e.g. an editor attempting to add recipients.","commonSituations":"Automations running with a service account that only has edit rights; a user who was demoted from owner to editor trying to reshare; team workflows where ownership was transferred elsewhere.","solutions":["Ask an existing owner of the resource to perform the share, or to grant your user OWNER permission.","Verify the permission level with GET /permissions/resource/<id>.json.","Log in as an administrator only if policy allows elevating ownership."],"exampleFix":"// before\nawait api.put(`/share/resource/${id}`, changes); // user is EDITOR\n// after\nconst perms = await api.get(`/permissions/resource/${id}.json`);\nif (perms.find(p => p.user.id === me.id)?.type === 1 /* OWNER */) await api.put(`/share/resource/${id}`, changes);","handlingStrategy":"validation","validationCode":"const perms = (await api.get(`/permissions/resource/${resourceId}.json`)).body;\nconst mine = perms.find(p => p.user?.id === me.id);\nif (!mine || mine.type !== 1 /* OWNER */) throw new Error('only owners can share this resource');","typeGuard":"function isOwner(permission) { return permission?.type === 1; }","tryCatchPattern":"try { await share(id, perms); } catch (e) { if (e.status === 403 && /not authorized to share/.test(e.message)) { requestOwnerAction(id); } else throw e; }","preventionTips":["Check your permission type on a resource before share operations","Run automations with an account that owns the target resources","Surface ownership in UIs so editors do not attempt to reshare"],"tags":["authorization","permissions","share","forbidden"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}