passbolt/passbolt_api · error · BadRequestException

The comment id is not valid.

Error message

The comment id is not valid.

What it means

Passbolt throws this BadRequestException when the comment id supplied to CommentsUpdateService::update() is not a valid UUID. The library validates the identifier format before any database lookup to avoid useless queries and malformed SQL input. It is a client-side input error, not a server fault.

Solutions

1. Ensure the comment id passed to update() is a valid UUID string (e.g. '9d3f1c0a-...')
2. Fix the client-side variable mixup so the comment id, not the resource/user id, is passed
3. Log the incoming id and inspect the request route parameters for mis-mapped placeholders
4. Add a format check in the calling code before invoking the service

Example fix

// before
$service->update($userId, $resourceId, $data);
// after
if (!Validation::uuid($commentId)) { throw new BadRequestException(__('The comment id is not valid.')); }
$service->update($userId, $commentId, $data);

use Cake\Validation\Validation;
if (!Validation::uuid($commentId)) { throw new \InvalidArgumentException('commentId must be a UUID'); }

function isValidUuid(string $id): bool { return preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id) === 1; }

try { $service->update($userId, $commentId, $data); } catch (BadRequestException $e) { /* invalid id format: fix input */ }

When it happens

Trigger: Calling the comment update API (PATCH/PUT on a comment) with a comment id that is empty, an integer, a short token, or any string failing Validation::uuid().

Common situations: Client code passing a resource id instead of a comment id; truncated ids from URL parsing; test fixtures using fake non-UUID ids; switching database drivers where ids were serialized differently.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• Invalid id
• Invalid model name
• Please provide a valid request id.
• The authentication token id is invalid.
• The authentication token must be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/6777f8fcd577b607. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Comments/CommentsUpdateService.php:63

     */
    public function __construct()
    {
        $this->Comments = TableRegistry::getTableLocator()->get('Comments');
    }

    /**
     * Create a new comment for a resource.
     *
     * @param string $userId The currently logged in user ID
     * @param string $commentId The comment ID
     * @param string $requestDataContent The comment 'content' data
     * @return \App\Model\Entity\Comment $comment comment entity
     * @throws \Cake\Http\Exception\BadRequestException if the validation failed
     */
    public function update(string $userId, string $commentId, string $requestDataContent): Comment
    {
        if (!Validation::uuid($commentId)) {
            throw new BadRequestException(__('The comment id is not valid.'));
        }

        $comment = $this->_patchAndValidateCommentEntity($userId, $commentId, $requestDataContent);
        $this->_handleValidationErrors($comment);

        $this->Comments->save($comment, ['Comments.user_id' => $userId]);
        $this->_handleValidationErrors($comment);

        return $comment;
    }

    /**
     * Manage validation errors.
     *
     * @param \App\Model\Entity\Comment $comment comment
     * @throws \Cake\Http\Exception\ForbiddenException
     * @throws \App\Error\Exception\ValidationException
     * @return void

View on GitHub (pinned to 31c1bbc10f)