passbolt/passbolt_api · warning · StopException

Password expiry email notifications are disabled.

Error message

Password expiry email notifications are disabled.

What it means

Passbolt's PasswordExpiryPolicies plugin throws this StopException from findResourcesExpiringTodayOrInNDays when the notification conditions are contradictory: no 'expires in N days' window was requested and 'notify if expires today' is disabled, so there is no valid condition to query expiring resources with. It signals that expiry email notifications are effectively turned off in the settings, making the lookup impossible.

Solutions

1. Enable the password expiry notification settings (set notifyIfExpiresToday true or configure an expiresInDays interval) via passbolt settings or the PasswordExpiryPolicies settings API
2. Skip running the expiry notification lookup when notifications are disabled — check the settings before calling getUsersToNotify
3. Verify the organization-settings entity for PasswordExpiryPolicies is populated (passbolt org settings table) and re-save the policy form

Example fix

// before
$service->findResourcesExpiringTodayOrInNDays($uac, [], false); // throws

// after
$settings = $this->getSettings();
if ($settings->isNotificationEnabled()) {
    $service->findResourcesExpiringTodayOrInNDays($uac, [], true);
}

$settings = $this->getPasswordExpirySettings();
if (!$settings['notifyIfExpiresToday'] && empty($settings['expiresInDays'])) {
    return; // skip lookup: notifications disabled
}

When it happens

Trigger: Calling getUsersToNotify when the password expiry settings have no expiresInDays interval and notifyIfExpiresToday is false (e.g. empty/0 $expiresInDays with $notifyIfExpiresToday falsy), typically via the expiry report email command.

Common situations: Organizational settings where the 'notify about passwords expiring today' option is disabled while a scheduled cron job still runs the expiry notification lookup; a settings migration that wiped the expiry policy configuration leaving both flags off.

Related errors

• Password expiry is not activated.
• 400
• Account recovery case must be a string.
• Account recovery reason not supported.
• An array of arrays is expected.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/57271c2e85469759. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/PasswordExpiryPolicies/src/Service/Resources/PasswordExpiryPoliciesGetOwnersOfResourcesAboutToExpireService.php:148

        $tomorrow = DateTime::tomorrow();
        $aboutToExpireCondition = [
            'expired >=' => $today->addDays($expiresInDays ?? 0),
            'expired <' => $tomorrow->addDays($expiresInDays ?? 0),
        ];
        $expiredCondition = [
            'expired >=' => $today,
            'expired <' => $tomorrow,
        ];
        if ($expiresInDays && $notifyIfExpiresToday) {
            $condition = [
                'OR' => [$aboutToExpireCondition, $expiredCondition],
            ];
        } elseif ($expiresInDays) {
            $condition = $aboutToExpireCondition;
        } elseif ($notifyIfExpiresToday) {
            $condition = $expiredCondition;
        } else {
            throw new StopException(__('Password expiry email notifications are disabled.'));
        }

        return $expiredResources->where($condition);
    }
}

View on GitHub (pinned to 31c1bbc10f)