passbolt/passbolt_api · error · StopException

The user with username

Error message

The user with username `%s`does not exist, is not active or is disabled.

What it means

Thrown by GetUserCommandService::getUser() when looking up a CLI-passed username fails to match an existing user that is both active and not disabled. The query chains findByUsername with the 'activeNotDeleted' and 'notDisabled' finders, so any of: missing user, soft-deleted user, inactive (not activated) user, or disabled user results in null and this error. It is a StopException, so it terminates the CLI command.

Solutions

Verify the username with a DB query or `passbolt users list` and correct any typo/case mismatch.
If the user exists but is inactive, complete activation (resend invite or set active via admin) before running the command.
If the user is disabled, re-enable the account (is_disabled=false) or choose another user.
If the user was deleted, pick a different existing active user for the command.

Example fix

// before
bin/cake command --username jdoe@example.com
// after
bin/cake passbolt users list   # confirm exact username of an active, non-disabled user
bin/cake command --username john.doe@example.com

Defensive patterns

Strategy: validation

Validate before calling

if (!filter_var($username, FILTER_VALIDATE_EMAIL)) { throw new InvalidArgumentException('username must be an email'); }
// then confirm the user exists/active: SELECT id FROM users WHERE username = ? AND active = 1 AND deleted = 0 AND disabled = 0

Try / catch

// StopException terminates the command; wrap the whole command run
try {
    $user = $service->getUser($username);
} catch (StopException $e) {
    $this->error($e->getMessage());
    $this->abort(1);
}

Prevention

List users and copy the exact username instead of typing it
Check the user is active and not disabled before running admin commands
Complete account activation workflows before automation targets that user

When it happens

Trigger: Running a passbolt CLI command (e.g. user management/ownership transfer commands) with --username pointing to a username that was never registered, was deleted, was never activated (activation token not completed), or has is_active=false / is_disabled=true.

Common situations: Typo in the username or wrong case; referencing a user deleted via the UI; users imported but whose activation email was never completed; disabled accounts after security incidents; staging databases where the target user does not exist.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/2d0560c4f54cfd68. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Command/GetUserCommandService.php:50

    /**
     * Get user from given username argument option.
     *
     * @throws \Cake\Console\Exception\StopException If user doesn't exist.
     */
    public function getUser(Arguments $args): User
    {
        $username = $args->getOption('username');
        /** @var \App\Model\Table\UsersTable $usersTable */
        $usersTable = $this->fetchTable('Users');

        /** @var \App\Model\Entity\User|null $user */
        $user = $usersTable
            ->findByUsername($username)
            ->find('activeNotDeleted')
            ->find('notDisabled')
            ->first();
        if ($user === null) {
            throw new StopException(
                sprintf('The user with username `%s`does not exist, is not active or is disabled.', $username)
            );
        }

        return $user;
    }
}

View on GitHub (pinned to 31c1bbc10f)