passbolt/passbolt_api · error · InternalErrorException

Invalid public key validation rules are missing.

Error message

Invalid public key validation rules are missing.

What it means

InternalErrorException thrown by PublicKeyValidationService::parseAndValidatePublicKey when the effective rules array is empty. Rules drive the validation pipeline; an empty set is treated as a programming/configuration error rather than a user-input problem.

Solutions

1. Pass a non-empty rules array, or omit the $rules parameter to use getDefaultRules().
2. Check the configuration feeding custom rules (e.g. security.gpg key validation settings) is populated.
3. Validate the rules array with count($rules) > 0 before calling.
4. Catch InternalErrorException to convert it into a clearer configuration error.

Example fix

// before
$rules = $this->getConfiguredRules(); // may be empty
PublicKeyValidationService::parseAndValidatePublicKey($armoredKey, $rules);

// after
$rules = $this->getConfiguredRules();
if (!count($rules)) {
    $rules = PublicKeyValidationService::getDefaultRules();
}
PublicKeyValidationService::parseAndValidatePublicKey($armoredKey, $rules);

// PHP
$rules = $rules ?? PublicKeyValidationService::getDefaultRules();
if (!count($rules)) {
    throw new BadConfigurationException('Key validation rules cannot be empty.');
}

function hasRules(?array $rules): bool {
    return is_array($rules) && count($rules) > 0;
}

try {
    PublicKeyValidationService::parseAndValidatePublicKey($armoredKey, $rules);
} catch (\Cake\Http\Exception\InternalErrorException $e) {
    throw new BadConfigurationException('Check key validation rules configuration.');
}

When it happens

Trigger: Calling parseAndValidatePublicKey($armoredKey, []) with an explicitly empty rules array, or getDefaultRules() returning an empty array because of misconfiguration.

Common situations: Passing a custom $rules array built dynamically that ends up empty; config changes removing all key validation rules; refactoring that passes null-coalesced empty arrays.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• Unknown key validation rule
• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.
• Could not login using Duo MFA provider.
• Invalid validation ruleset.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0bbcd8245bcde413. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/OpenPGP/PublicKeyValidationService.php:148

            self::HAS_NO_EXTRA_BREAK_LINE_RULE,
            self::IS_REVOKED_RULE,
        ]);
    }

    /**
     * @param string $armoredKey user provided data
     * @param array|null $rules to override default rules
     * @throws \App\Error\Exception\CustomValidationException If parsing public key fails
     * @throws \App\Error\Exception\CustomValidationException Validation rules fails
     * @throws \Cake\Http\Exception\InternalErrorException No public key validation rules
     * @throws \Cake\Http\Exception\InternalErrorException Unknown key validation rule
     * @return array key information (see OpenPGPBackendInterface::getKeyInfo)
     */
    public static function parseAndValidatePublicKey(string $armoredKey, ?array $rules = null): array
    {
        $rules = $rules ?? self::getDefaultRules();
        if (!count($rules)) {
            throw new InternalErrorException('Invalid public key validation rules are missing.');
        }

        // Parsing check is mandatory and always done first
        // We don't even try the other rules if this one fails
        if (!self::isParsableArmoredPublicKey($armoredKey)) {
            throw new CustomValidationException(__('A valid OpenPGP key must be provided.'), [
                'armored_key' => [
                    self::IS_PARSABLE_ARMORED_KEY_RULE => __('The public key could not be parsed.'),
                ],
            ]);
        }

        // Other rules are recommended but not mandatory
        // As one may want to see what's inside the key info for debugging purpose
        $keyInfo = self::getPublicKeyInfo($armoredKey);
        $validationErrors = [];
        foreach ($rules as $ruleName) {
            switch ($ruleName) {

View on GitHub (pinned to 31c1bbc10f)