What causes "You are not authorized to access that location." in passbolt/passbolt_api?

Authenticate as an administrator before calling the endpoint

passbolt/passbolt_api · error · ForbiddenException

You are not authorized to access that location.

Error message

You are not authorized to access that location.

What it means

Role guard in AccountRecoveryPrivateKeyPasswordsIndexController::index(): listing account recovery private key passwords is admin-only because the data is highly sensitive. Fires when a non-admin (or anonymous) user calls the index endpoint, rejecting with HTTP 403 before any query runs; only administrators may enumerate recovery private key password records.

Solutions

Authenticate as an administrator before calling the endpoint
Verify the user's role is admin in the database
In tests, switch the request fixture to an admin user
Ensure authentication cookie/token is valid and not expired

Example fix

// before
$this->authenticateAs('betty'); // user role
$this->get('/account-recovery/private-key/passwords.json'); // 403
// after
$this->authenticateAs('admin');
$this->get('/account-recovery/private-key/passwords.json'); // 200

Defensive patterns

Strategy: try-catch

Validate before calling

const me = await selfClient.get();
if (me.role.name !== 'admin') throw new Error('admin role required to list private key passwords');

Type guard

function isAdminUser(user: {role: {name: string}}): boolean {
  return user.role.name === 'admin';
}

Try / catch

try {
  const passwords = await privateKeyPasswordsService.index();
} catch (ApiError e) {
  if (e.status === 403) {
    showForbiddenScreen(); // non-admin access
  }
}

Prevention

Expose this endpoint only from admin interfaces
Verify the session/token belongs to an admin before calling
Keep authentication tokens fresh to avoid guest fallback
Use admin fixtures in integration tests

When it happens

Trigger: GET /account-recovery/private-key/passwords.json issued by a non-admin user or a guest (unauthenticated) session.

Common situations: Regular user probing admin endpoints; missing/lost admin role; in tests, authenticating as a non-admin user; session expired so request treated as guest.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4554baad59a74b8b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryPrivateKeyPasswords/AccountRecoveryPrivateKeyPasswordsIndexController.php:60

    {
        parent::initialize();
        $this->AccountRecoveryPrivateKeyPasswords = $this
            ->fetchTable('Passbolt/AccountRecovery.AccountRecoveryPrivateKeyPasswords');
        $this->loadComponent('ApiPagination', [
            'model' => 'AccountRecoveryPrivateKeyPasswords',
        ]);
    }

    /**
     * List all the account recovery requests
     *
     * @return void
     * @throws \Cake\Http\Exception\ForbiddenException if the user is not an admin
     */
    public function index(): void
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(__('You are not authorized to access that location.'));
        }

        $passwords = $this->AccountRecoveryPrivateKeyPasswords->find();
        $this->paginate($passwords);

        $this->success(__('The operation was successful.'), $passwords);
    }
}

View on GitHub (pinned to 31c1bbc10f)