phacility/phabricator · error · PhabricatorApplicationTransactionValidationException

This comment was signed with MFA, so edits to it must also b

Error message

This comment was signed with MFA, so edits to it must also be signed with MFA. You do not have any MFA factors attached to your account, so you can not sign this edit. Add MFA to your account in Settings.

What it means

When a comment was originally published with an MFA signature, Phabricator requires every later edit of that comment to be signed with MFA as well. Before applying the edit, PhabricatorApplicationTransactionCommentEditor loads the acting user's auth factors; if the query returns none, this PhabricatorApplicationTransactionValidationException is raised with a 'No MFA' field error.

Source

Thrown at src/applications/transactions/editor/PhabricatorApplicationTransactionCommentEditor.php:254

        ->withUserPHIDs(array($this->getActingAsPHID()))
        ->withFactorProviderStatuses(
          array(
            PhabricatorAuthFactorProviderStatus::STATUS_ACTIVE,
            PhabricatorAuthFactorProviderStatus::STATUS_DEPRECATED,
          ))
        ->execute();
      if (!$factors) {
        $error = new PhabricatorApplicationTransactionValidationError(
          $xaction->getTransactionType(),
          pht('No MFA'),
          pht(
            'This comment was signed with MFA, so edits to it must also be '.
            'signed with MFA. You do not have any MFA factors attached to '.
            'your account, so you can not sign this edit. Add MFA to your '.
            'account in Settings.'),
          $xaction);

        throw new PhabricatorApplicationTransactionValidationException(
          array(
            $error,
          ));
      }
    }

    $workflow_key = sprintf(
      'comment.edit(%s, %d)',
      $xaction->getPHID(),
      $xaction->getComment()->getID());

    $hisec_token = id(new PhabricatorAuthSessionEngine())
      ->setWorkflowKey($workflow_key)
      ->requireHighSecurityToken($actor, $request, $cancel_uri);
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Add an MFA factor to the editing account: Settings -> Multi-Factor Authentication -> Add Authentication Factor, then retry the edit.
2. Have a user who does have MFA factors perform the edit.
3. If the factors were removed by accident, re-enroll the same factor type before editing.
4. As a last resort, delete the comment and post a new one (requires appropriate privileges).

// Block the edit UI early when the viewer cannot sign
$factors = id(new PhabricatorAuthFactorConfigQuery())
  ->setViewer($viewer)
  ->withUserPHIDs(array($viewer->getPHID()))
  ->execute();
if (!$factors && $comment_requires_mfa) {
  // Show guidance instead of submitting the edit
  return $this->newDialog()
    ->setTitle(pht('MFA Required'))
    ->appendChild(pht('Add an MFA factor in Settings to edit this comment.'));
}

try {
  id(new PhabricatorApplicationTransactionCommentEditor())
    ->setActor($viewer)
    ->setContentSource($source)
    ->applyEdits($comment, $xactions);
} catch (PhabricatorApplicationTransactionValidationException $ex) {
  foreach ($ex->getErrors() as $error) {
    if ($error->getType() === pht('No MFA')) {
      // Direct the user to Settings -> Multi-Factor Authentication
    }
  }
}

When it happens

Trigger: Calling PhabricatorApplicationTransactionCommentEditor->applyEdits() (the comment-edit workflow) on a comment whose original transaction has a multi-factor signature requirement, while the acting user has zero rows in their PhabricatorAuthFactorConfig (no TOTP, passphrase, or other factor enrolled).

Common situations: A user who signed comments with MFA removed all their factors and then tries to edit an old signed comment; an administrator without MFA tries to edit another user's signed comment; edits attempted by automation accounts that never enrolled factors.

Related errors

• This transaction group requires MFA to apply, but you can no
• Invalid response token for this challenge: token digest does
• The "Has MFA" query constraint may only be used by administr
• Your account has too many outstanding, incomplete MFA synchr
• This Duo enrollment attempt is invalid or has expired ("%s")

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/416fdf86c52573cb. Report an issue: GitHub.