passbolt/passbolt_api · error · InternalErrorException

The metadata private key should not be empty.

Error message

The metadata private key should not be empty.

What it means

assertPrivateKey throws InternalErrorException when the decrypted cleartext of the server metadata private key is an empty string. The stored encrypted payload decrypted to nothing, which indicates corrupted or wrongly-stored data rather than a client mistake.

Solutions

1. Inspect the metadata_private_keys row for this key: if data is empty/corrupt, restore from backup or re-import the metadata key
2. Verify the server OpenPGP key passphrase/key configured matches the one that encrypted the data
3. Re-run the metadata key share after the data is repaired; assertPrivateKey will pass once cleartext is non-empty

$row = $metadataPrivateKeysTable->find()->where(['metadata_key_id' => $keyId])->first();
if ($row === null || trim((string)$row->data) === '') {
    throw new \DomainException('Server metadata private key data is empty; re-import the key.');
}

if (!is_string($row->data) || $row->data === '') { return; }

try {
    $service->shareMetadataKeysWithUser($uac, $userIds, $keyId);
} catch (MetadataKeyShareException $e) {
    if (str_contains($e->getMessage(), 'should not be empty')) {
        // restore or re-import the metadata key before retrying
    }
}

When it happens

Trigger: shareMetadataKeyWithUser decrypts serverMetadataPrivateKey->data with the server GPG key and passes the result to assertPrivateKey; if decryption yields '' (empty stored data, wrong key silently producing empty output, or corrupted ciphertext), this error fires.

Common situations: Metadata private key row created with empty data (failed earlier import); server OpenPGP key changed/regenerated so decryption behaves unexpectedly; data corrupted by a bad migration or manual DB edit.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• The metadata private key cleartext data should be in JSON…
• Could not validate metadata key data.
• The metadata could not be encrypted with the metadata key…
• Invalid public key validation rules are missing.
• Invalid record set. Responses should be set for approved…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/de7f239b96d5ebc7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataKeyShareDefaultService.php:164

     * @inheritDoc
     */
    public function onFailure(Exception $exception): void
    {
        Log::error($exception->getMessage());
        if (Configure::read('debug')) {
            Log::error($exception->getTraceAsString());
        }
    }

    /**
     * @param string $clearText private key object in json format
     * @return void
     */
    public function assertPrivateKey(string $clearText): void
    {
        if (empty($clearText)) {
            $msg = __('The metadata private key should not be empty.');
            throw new InternalErrorException($msg);
        }

        try {
            $decoded = json_decode($clearText, true, 2, JSON_THROW_ON_ERROR);
        } catch (Exception $exception) {
            if (Configure::read('debug')) {
                Log::error($clearText);
            }
            $msg = __('The metadata private key cleartext data should be in JSON format.');
            throw new InternalErrorException($msg, 500, $exception);
        }
        if (!is_array($decoded) || empty($decoded)) {
            $msg = __('The metadata private key cleartext data should not be empty.');
            throw new InternalErrorException($msg);
        }

        $form = new MetadataCleartextPrivateKeyForm();
        if (!$form->validate($decoded)) {

View on GitHub (pinned to 31c1bbc10f)