{"record":{"id":"f30a69a7ee6f5907","repo":"passbolt/passbolt_api","slug":"the-comment-id-is-not-valid-commentsdeleteservice","errorCode":null,"errorMessage":"The comment id is not valid.","messagePattern":"The comment id is not valid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Comments/CommentsDeleteService.php","lineNumber":56,"sourceCode":"    public function __construct()\n    {\n        $this->Comments = TableRegistry::getTableLocator()->get('Comments');\n    }\n\n    /**\n     * Delete a comment.\n     *\n     * @param string $id The identifier of comment to delete.\n     * @param string|null $userId The user identifier who comments\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @throws \\Cake\\Http\\Exception\\NotFoundException\n     * @return void\n     */\n    public function delete(string $id, ?string $userId = null): void\n    {\n        // Check request sanity\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The comment id is not valid.'));\n        }\n        if (is_null($userId) || empty($userId)) {\n            throw new BadRequestException(__('The comment userId is not valid.'));\n        }\n\n        // Retrieve the comment.\n        try {\n            /**\n             * @var \\App\\Model\\Entity\\Comment $comment\n             */\n            $comment = $this->Comments->get($id);\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('The comment does not exist.'));\n        }\n\n        // Delete the comment.\n        $this->Comments->delete($comment, ['Comments.user_id' => $userId]);\n        $this->_handleDeleteErrors($comment);","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Comments/CommentsDeleteService.php#L38-L74","documentation":"CommentsDeleteService::delete() sanity-checks that the comment id is a valid UUID before attempting retrieval. A non-UUID id cannot exist in the comments table, so the request is rejected immediately with 400 before any DB access.","triggerScenarios":"DELETE /comments/{id} where id is not a 36-char UUID — e.g. an empty path segment, a slug, a truncated copy-paste, or passing the userId in place of the comment id.","commonSituations":"Client building the DELETE URL with the wrong variable (swapping comment id and user id); empty id from an unset variable in JS (undefined interpolated into the URL); integer ids from legacy data.","solutions":["Log/inspect the id actually sent in the DELETE request and replace it with the comment's UUID.","Fix the client code that selects which variable is used for the id path segment.","Validate the id with a UUID regex before issuing DELETE."],"exampleFix":"// before\ndeleteComment(currentUser.id)\n// after\ndeleteComment(comment.id) // must be the comment's UUID, not the user's","handlingStrategy":"validation","validationCode":"if (!isUuid(commentId)) throw new Error(`comment id must be a UUID, got: ${commentId}`);","typeGuard":"function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }","tryCatchPattern":"try { await deleteComment(commentId); }\ncatch (e) { if (e.response?.status === 400 && /comment id/.test(e.response?.data?.message ?? '')) console.error('malformed id:', commentId); else throw e; }","preventionTips":["Pass comment.id, not user.id, into DELETE endpoints","Guard against undefined ids before building URLs","Validate ids with a UUID regex in the API client layer"],"tags":["validation","uuid","http-400"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}