{"record":{"id":"f68277b2a0756be6","repo":"passbolt/passbolt_api","slug":"no-valid-multi-factor-authentication-settings-found","errorCode":null,"errorMessage":"No valid multi-factor authentication settings found.","messagePattern":"No valid multi-factor authentication settings found\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php","lineNumber":100,"sourceCode":"            }\n        }\n    }\n\n    /**\n     * Trigger an error if current MFA settings do not allow verify for the given provider.\n     *\n     * Callers MUST return the response when a non-null value is returned; otherwise the request\n     * will continue to execute past a disabled provider and can mint an MFA cookie.\n     *\n     * @param string $provider name of the provider\n     * @return \\Cake\\Http\\Response|null redirect response for non-JSON requests, null when settings are valid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException on JSON requests with invalid settings\n     */\n    protected function _handleInvalidSettings(string $provider): ?Response\n    {\n        if ($this->mfaSettings->getAccountSettings() === null) {\n            if ($this->getRequest()->is('json')) {\n                throw new BadRequestException(__('No valid multi-factor authentication settings found.'));\n            } else {\n                return $this->redirect('/');\n            }\n        }\n        if (!$this->mfaSettings->isProviderEnabled($provider)) {\n            // for example a user is trying to force a check on a provider that is not set for the org\n            if ($this->getRequest()->is('json')) {\n                throw new BadRequestException(\n                    __('No valid multi-factor authentication settings found for this provider.')\n                );\n            } else {\n                return $this->redirect('/');\n            }\n        }\n\n        return null;\n    }\n","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php#L82-L118","documentation":"Thrown when the user has no MFA account settings at all (getAccountSettings() returns null) but sends a JSON verify request. Since there is nothing configured to verify against, JSON clients get a BadRequestException while browser clients are redirected to '/'.","triggerScenarios":"JSON GET/POST to /mfa/verify/<provider> for a user who never completed MFA setup for any provider.","commonSituations":"User removed/disabled their MFA settings but the client still attempts verification; fresh account where MFA was required by policy but setup never ran; stale frontend state after admin reset.","solutions":["Complete MFA setup for the user (/mfa/setup/<provider>) before verifying","Confirm the user actually has MFA account settings stored in the database","Re-create the account settings if they were lost (org requirement permitting)"],"exampleFix":"// before\nawait http.post('/mfa/verify/totp.json', {totp}); // no settings\n// after: setup first\nawait http.post('/mfa/setup/totp.json', {otpProvisioningUri, totp});","handlingStrategy":"validation","validationCode":"const settings = await getAccountMfaSettings();\nif (settings == null) redirectToSetup();","typeGuard":null,"tryCatchPattern":"try { await mfaVerify(provider); } catch (e) { if (/No valid multi-factor authentication settings/.test(e.message)) redirectToMfaSetup(); else throw e; }","preventionTips":["Complete MFA setup before exposing verify UI","Check GET /mfa/setup/required to know account state","Handle account settings resets after admin changes"],"tags":["mfa","verify","missing-settings","http-400"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}