{"record":{"id":"f2b519f54d962958","repo":"passbolt/passbolt_api","slug":"the-metadata-session-key-does-not-exist-or-does-not-belong","errorCode":null,"errorMessage":"The metadata session key does not exist or does not belong to this user.","messagePattern":"The metadata session key does not exist or does not belong to this user\\.","errorType":"exception","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyDeleteService.php","lineNumber":54,"sourceCode":"     * @return void\n     */\n    public function delete(UserAccessControl $uac, string $id): void\n    {\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The metadata session key identifier should be a UUID.'));\n        }\n\n        /** @var \\Passbolt\\Metadata\\Model\\Table\\MetadataSessionKeysTable $metadataSessionKeysTable */\n        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');\n\n        try {\n            /** @var \\Passbolt\\Metadata\\Model\\Entity\\MetadataSessionKey $metadataSessionKey */\n            $metadataSessionKey = $metadataSessionKeysTable\n                ->find()\n                ->where(['id' => $id, 'user_id' => $uac->getId()])\n                ->firstOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('The metadata session key does not exist or does not belong to this user.')); // phpcs:ignore\n        }\n\n        if ($metadataSessionKeysTable->delete($metadataSessionKey)) {\n            return;\n        }\n\n        // In scenarios where requests are sent twice delete can fail.\n        // Check for the record again and if it doesn't exist then throw 404. If present and delete fail then throw a 500.\n        $exists = $metadataSessionKeysTable\n            ->find()\n            ->select(['id'])\n            ->where(['id' => $id, 'user_id' => $uac->getId()])\n            ->first();\n\n        $exists\n            ? throw new InternalErrorException(__('The metadata session key could not be deleted.'))\n            : throw new NotFoundException(__('The metadata session key does not exist or does not belong to this user.')); // phpcs:ignore\n    }","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyDeleteService.php#L36-L72","documentation":"After UUID validation, delete() looks up the session key filtered by both id and user_id (ownership check). If no row matches, firstOrFail throws RecordNotFoundException which is converted to a 404 NotFoundException. The key either does not exist or belongs to another user.","triggerScenarios":"DELETE call with a valid UUID id that (a) was never created, (b) was already deleted, or (c) belongs to a different user than the one in the UserAccessControl.","commonSituations":"Re-running cleanup scripts that delete twice, using an admin account to delete another user's session key (not allowed by design), stale client cache referencing an expired key.","solutions":["Verify the id exists via the metadata session key index endpoint for the current user","Check you are authenticated as the user who created the session key","Handle the 404 gracefully and treat it as already-deleted in idempotent workflows"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"$key = $table->find()->where(['id' => $id, 'user_id' => $uac->getId()])->first(); if (!$key) { return; } // pre-check before delete","typeGuard":"if ($key === null) { throw new NotFoundException(); }","tryCatchPattern":"try { $service->delete($uac, $id); } catch (NotFoundException $e) { /* treat as already deleted */ }","preventionTips":["List owned session keys first and delete only known ids","Make delete flows idempotent (404 = success)","Never assume an id from another user's session applies to yours"],"tags":["not-found","ownership","metadata-session-key","delete"],"backgroundTag":"resource-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}