What causes "You are not authorized to access that location." in passbolt/passbolt_api?

Verify the rbacs table has a row for the role and action id, and that it allows the action

passbolt/passbolt_api · error · ForbiddenException

You are not authorized to access that location.

Error message

You are not authorized to access that location.

What it means

RbacsRoleActionAccessControlService::controlUserRoleActionAccess consults the Rbacs table to check whether the given role is allowed to perform the action id, and throws ForbiddenException when no matching allow rule exists. Unlike the admin-only variant, permissions are data-driven from the rbacs table.

Solutions

Verify the rbacs table has a row for the role and action id, and that it allows the action
Run migrations / the UiActions+Rbacs default-seeding commands to populate defaults
Confirm the action id string in the request matches an existing ui_actions record
Re-enable or repair RBAC settings in the admin UI

Example fix

null

Defensive patterns

Strategy: type-guard

Validate before calling

$allowed = TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs')->isActionAllowedForRole($role->id, $actionId);

Type guard

function isActionAllowed(Role $role, string $actionId): bool { return TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs')->isActionAllowedForRole($role->id, $actionId); }

Try / catch

try { $service->controlUserRoleActionAccess($role, $actionId); } catch (ForbiddenException $e) { // surface 403 or fall back to a permitted action }

Prevention

Run RBAC/UiActions seed commands after enabling the plugin so default rules exist
Keep action ids in sync with ui_actions records
Verify rbacs rows allow the role before calling guarded actions

When it happens

Trigger: A user whose role has no rbacs row allowing the requested action id calls an endpoint guarded by this service.

Common situations: RBAC defaults not inserted after enabling the plugin (missing migrations); action id changed/renamed so no rule matches; role's control_function set to a deny value in the database.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/bd96193e601e5132. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/RbacsRoleActionAccessControlService.php:44

 */
class RbacsRoleActionAccessControlService implements RoleActionAccessControlServiceInterface
{
    /**
     * @inheritDoc
     */
    public function controlUserRoleActionAccess(Role $role, string $actionId): void
    {
        if ($role->isAdmin()) {
            return;
        }

        /** @var \Passbolt\Rbacs\Model\Table\RbacsTable $RbacsTable */
        $RbacsTable = TableRegistry::getTableLocator()->get('Passbolt/Rbacs.Rbacs');
        if ($RbacsTable->isActionAllowedForRole($role->id, $actionId)) {
            return;
        }

        throw new ForbiddenException(__('You are not authorized to access that location.'));
    }
}

View on GitHub (pinned to 31c1bbc10f)