{"record":{"id":"fe17eef7ca18aee1","repo":"passbolt/passbolt_api","slug":"the-resource-does-not-exist-commentsaddservice","errorCode":null,"errorMessage":"The resource does not exist.","messagePattern":"The resource does not exist\\.","errorType":"http","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Service/Comments/CommentsAddService.php","lineNumber":100,"sourceCode":"     *\n     * @param \\App\\Model\\Entity\\Comment $comment comment\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @throws \\Cake\\Http\\Exception\\NotFoundException\n     * @return void\n     */\n    protected function _handleValidationErrors(Comment $comment): void\n    {\n        $errors = $comment->getErrors();\n        if (!empty($errors)) {\n            if (\n                !empty($errors['foreign_key']) &&\n                (\n                    !empty($errors['foreign_key']['resource_exists']) ||\n                 !empty($errors['foreign_key']['resource_is_soft_deleted']) ||\n                 !empty($errors['foreign_key']['has_resource_access'])\n                )\n            ) {\n                throw new NotFoundException(__('The resource does not exist.'));\n            }\n            throw new BadRequestException(__('Could not validate comment data.'));\n        }\n    }\n\n    /**\n     * Build and validate comment entity from user input.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The user access control\n     * @param string $foreignKey The identifier of the instance the comment belongs to.\n     * @param array $data The comment data\n     * @return \\App\\Model\\Entity\\Comment $comment comment entity\n     */\n    protected function _buildAndValidateCommentEntity(UserAccessControl $uac, string $foreignKey, array $data): Comment\n    {\n        // Build entity and perform basic check.\n        /**\n         * @var \\App\\Model\\Entity\\Comment $comment","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Comments/CommentsAddService.php#L82-L118","documentation":"Raised inside CommentsAddService::_handleValidationErrors() when the comment entity failed validation specifically because the referenced resource fails the foreign_key rules: the resource does not exist, is soft-deleted, or the user has no access to it. It is mapped to 404 rather than 400 so it doesn't leak whether the resource exists.","triggerScenarios":"POSTing a comment to a resource UUID that: was deleted (soft delete), was never created, belongs to a deleted/shared folder the user cannot access, or is in a resource the calling user lacks permission on.","commonSituations":"Client caching a resource id that was deleted by another user; comments on resources shared via a folder that lost share permissions; using an id from a different passbolt instance/environment (staging vs prod).","solutions":["Refresh the resource list and confirm the resource id still exists and is visible to the current user.","Re-share the resource/folder with the user if access was revoked.","Check you are calling the correct passbolt instance (environment mismatch produces 404s for valid-looking ids)."],"exampleFix":"// before\naddComment(deletedResourceId, 'text')\n// after\nconst resource = await getResource(id); // 404 surfaces here, before commenting\nif (!resource) return;\nawait addComment(resource.id, 'text');","handlingStrategy":"try-catch","validationCode":"// Verify the resource is reachable before commenting:\nconst resource = await fetch(`${baseUrl}/resources/${resourceId}`).then(r => { if (!r.ok) throw new Error('resource inaccessible'); return r.json(); });","typeGuard":null,"tryCatchPattern":"try { await addComment(resourceId, data); }\ncatch (e) { if (e.response?.status === 404) { await refreshResourceList(); notifyUser('Resource no longer available'); } else throw e; }","preventionTips":["Refresh resource lists before operations on cached ids","Re-check folder/resource share permissions after permission changes","Ensure clients point at the intended environment"],"tags":["http-404","permissions","comments"],"backgroundTag":"entity-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}