fix: guard against null return from find() in PATCH path of updateFromArray

[bbrands02]

Summary

objectService->find() returns ?ObjectEntity (nullable). In updateFromArray(), when $patch === true, the result was dereferenced unconditionally via $existing->getObject(). If the target object does not exist — unknown ID, wrong register/schema scope, or RBAC denial — find() returns null and the call produces a fatal TypeError, surfacing as an unhandled 500.

The fix adds an explicit null check immediately after find() and throws ValidationException with a clear message. Using a uniform message for both "not found" and "not accessible" also prevents ID enumeration through differing error signatures.

Reported in code review by @WilcoLouwerse.

Test plan

• PATCH an object with a valid ID in the correct register/schema scope — verify normal update behaviour is unchanged
• PATCH an object with an ID that does not exist — verify a ValidationException is thrown (no unhandled 500)
• PATCH an object with an ID that exists but in a different register/schema scope — verify a ValidationException is thrown rather than a fatal TypeError
• Run existing unit and integration tests for ObjectServiceMapperAdapter and confirm no regressions

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ f1ddfaa

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 147/147
npm			✅	✅ 599/599
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-24 11:52 UTC

Download the full PDF report from the workflow artifacts.