passbolt/passbolt_api · error · BadRequestException

Invalid model name

Error message

Invalid model name

What it means

Passbolt throws this BadRequestException when the foreign model name given to CommentsViewService::view() is not one of CommentsTable::ALLOWED_FOREIGN_MODELS. The whitelist prevents arbitrary table lookups through the comments endpoint.

Solutions

1. Use only allowed foreign models (e.g. 'Resource') in the URL or call
2. Fix case/typos in the model path segment
3. Consult CommentsTable::ALLOWED_FOREIGN_MODELS for the supported list

Example fix

// before
GET /comments/users/<uuid>
// after
GET /comments/resources/<uuid>

use App\Model\Table\CommentsTable;
if (!in_array(ucfirst($model), CommentsTable::ALLOWED_FOREIGN_MODELS, true)) { /* reject before call */ }

function isAllowedForeignModel(string $model): bool { return in_array(ucfirst($model), CommentsTable::ALLOWED_FOREIGN_MODELS, true); }

try { $service->view($userId, $model, $foreignKey); } catch (BadRequestException $e) { /* unsupported model: correct URL */ }

When it happens

Trigger: Calling view() with a model name (after ucfirst) not in the allowed list, e.g. 'users', 'anything', or lowercase variants of unsupported models; API clients guessing model names in /comments/<model>/<id> URLs.

Common situations: Typo in the model segment of the URL; API version changes that narrowed the allowed models; clients assuming other resource types support comments.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid id
• The comment id is not valid.
• Could not save the SSO state, invalid nonce.
• Could not validate comment data.
• Could not validate comment data.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8cba354cca145081. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Comments/CommentsViewService.php:64

    }

    /**
     * Comments View action
     *
     * @throws \Cake\Http\Exception\BadRequestException if the sanity checks failed
     * @throws \Cake\Http\Exception\NotFoundException if the foreignKey can't be found
     * @param string $userId The currently logged in user's ID
     * @param string $foreignModelName name of the foreign model used for the comment
     * @param string $foreignKey uuid Identifier of the model
     * @param array $options Query options
     * @return \Cake\ORM\Query\SelectQuery
     */
    public function view(string $userId, string $foreignModelName, string $foreignKey, array $options = []): SelectQuery
    {
        $foreignModelName = ucfirst($foreignModelName);
        // Check model sanity.
        if (!in_array($foreignModelName, CommentsTable::ALLOWED_FOREIGN_MODELS)) {
            throw new BadRequestException('Invalid model name');
        }

        // Check uuid sanity.
        if (!Validation::uuid($foreignKey)) {
            throw new BadRequestException('Invalid id');
        }

        try {
            $comments = $this->Comments->findViewForeignComments(
                $userId,
                $foreignModelName,
                $foreignKey,
                $options
            );
        } catch (RecordNotFoundException $e) {
            throw new NotFoundException(__('Could not find comments for the requested model.'));
        }

View on GitHub (pinned to 31c1bbc10f)