{"record":{"id":"fb481863e7de9566","repo":"passbolt/passbolt_api","slug":"the-user-id-is-invalid-accountrecoveryrequestsgetcontroller","errorCode":null,"errorMessage":"The user id is invalid.","messagePattern":"The user id is invalid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsGetController.php","lineNumber":56,"sourceCode":"        $this->Authentication->allowUnauthenticated(['get']);\n\n        parent::beforeFilter($event);\n    }\n\n    /**\n     * Gets an account recovery request\n     * Sends an email to the admins on suspect request\n     *\n     * @param string|null $requestId Request ID\n     * @param string|null $userId User ID\n     * @param string|null $tokenId Token ID\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the data provided is not valid\n     */\n    public function get(?string $requestId, ?string $userId, ?string $tokenId): void\n    {\n        if (!isset($userId) || !Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id is invalid.'));\n        }\n        if (!isset($tokenId) || !Validation::uuid($tokenId)) {\n            throw new BadRequestException(__('The authentication token id is invalid.'));\n        }\n        if (!isset($requestId) || !Validation::uuid($requestId)) {\n            throw new BadRequestException(__('The request id is invalid.'));\n        }\n\n        $ip = $this->getRequest()->clientIp();\n\n        $service = new AccountRecoveryRequestGetService();\n        $requestEntity = $service->getNotCompletedOrFail($requestId, $userId, $tokenId, $ip);\n        $data = $service->decorateResults($requestEntity);\n\n        $this->success(__('The operation was successful.'), $data);\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsGetController.php#L38-L74","documentation":"BadRequestException thrown by AccountRecoveryRequestsGetController::get() when the userId route parameter is missing or not a valid UUID. The controller validates requestId, userId and tokenId formats before fetching the recovery request.","triggerScenarios":"GET /account-recovery/requests/<requestId>/<bad-user-id>/<tokenId>.json with the user id missing, empty, or not a UUID.","commonSituations":"Recovery status-link generated with a placeholder or truncated user id; client passing a username instead of UUID; template variable left unrendered in the email link.","solutions":["Regenerate the link ensuring the full user UUID is in the URL","Validate the user id with Cake\\Validation::uuid() before calling","Check the email template/route builder that composes the URL","Log the request URL to confirm which segment is malformed"],"exampleFix":"// before\n$url = \"/account-recovery/requests/{$requestId}/{$username}/{$tokenId}.json\";\n// after\n$url = \"/account-recovery/requests/{$requestId}/{$user->id}/{$tokenId}.json\";","handlingStrategy":"validation","validationCode":"if (!isValidUuid(userId)) throw new Error('user id must be a UUID');\nif (!isValidUuid(requestId)) throw new Error('request id must be a UUID');\nif (!isValidUuid(tokenId)) throw new Error('token id must be a UUID');","typeGuard":"function isValidUuid(value: unknown): value is string {\n  return typeof value === 'string'\n    && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);\n}","tryCatchPattern":"try {\n  await accountRecoveryRequestService.get(requestId, userId, tokenId);\n} catch (ApiError e) {\n  if (e.message.includes('user id is invalid')) {\n    redirectToRecoveryStart(); // regenerate a valid link\n  }\n}","preventionTips":["Compose status URLs from entity UUID fields only","Validate all three identifiers (requestId, userId, tokenId) before calling","Verify email templates render every URL segment","Log full URLs when debugging malformed recovery links"],"tags":["php","cakephp","validation","uuid"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}