passbolt/passbolt_api · error · InternalErrorException

Invalid validation ruleset.

Error message

Invalid validation ruleset.

What it means

An InternalErrorException thrown when buildAndValidateEntities receives a $validationRules argument other than 'default' or 'rotateKeys'. This indicates a programming error in server code calling the table with an unsupported ruleset name, not user input.

Solutions

1. Fix the caller to pass 'default' or 'rotateKeys'.
2. Search the codebase for buildAndValidateEntities call sites using other strings.
3. If a new ruleset is genuinely needed, add it to the whitelist in the table method.
4. Ensure plugin versions are consistent with the core after an upgrade.

Example fix

// before
$table->buildAndValidateEntities($uac, $passwords, 'rotation');
// after
$table->buildAndValidateEntities($uac, $passwords, 'rotateKeys');

const RULESETS = ['default','rotateKeys'];
if (!RULESETS.includes(validationRules)) throw new Error(`ruleset must be one of ${RULESETS.join(', ')}`);

function isValidationRuleset(v) { return v === 'default' || v === 'rotateKeys'; }

try { $entities = $table->buildAndValidateEntities($uac, $passwords, $rules); } catch (InternalErrorException $e) { if ($e->getMessage() === 'Invalid validation ruleset.') { $rules = 'default'; $entities = $table->buildAndValidateEntities($uac, $passwords, $rules); } else { throw $e; } }

When it happens

Trigger: Internal service code passes a wrong ruleset string (typo, renamed option after refactor, or a version-mismatched plugin calling an older/newer signature).

Common situations: Custom plugins or forks calling the table method directly; code merged across EE versions where the 'rotateKeys' option was added or renamed; copy-pasted call sites using stale string constants.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid public key validation rules are missing.
• Invalid record set. Responses should be set for approved…
• Unknown key validation rule
• 500
• AccessToken should be an instance of BaseIdToken class.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/37279662115a6ae7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryPrivateKeyPasswordsTable.php:218

            $f = strtoupper(str_replace(' ', '', $data['recipient_fingerprint']));
            $data['recipient_fingerprint'] = $f;
        }
    }

    /**
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param array $passwords user provided data
     * @param string $validationRules ruleset
     * @throws \App\Error\Exception\CustomValidationException if data doesn't validate
     * @return array<\Passbolt\AccountRecovery\Model\Entity\AccountRecoveryPrivateKeyPassword> array of entities
     */
    public function buildAndValidateEntities(
        UserAccessControl $uac,
        array $passwords,
        string $validationRules = 'default'
    ): array {
        if (!in_array($validationRules, ['default', 'rotateKeys'])) {
            throw new InternalErrorException('Invalid validation ruleset.');
        }

        foreach ($passwords as $i => $entity) {
            $passwords[$i]['created_by'] = $uac->getId();
            $passwords[$i]['modified_by'] = $uac->getId();
        }

        $accessibleFields = [
            'recipient_fingerprint' => true,
            'recipient_foreign_model' => true,
            'data' => true,
            'created_by' => true,
            'modified_by' => true,
        ];

        // Private key id should only be set when rotating keys
        // Otherwise passwords are created with the keys during setup or user settings change
        if ($validationRules === 'rotateKeys') {

View on GitHub (pinned to 31c1bbc10f)