{"record":{"id":"04cc6f659e994b09","repo":"calcom/cal.diy","slug":"teams-are-not-supported","errorCode":null,"errorMessage":"Teams are not supported","messagePattern":"Teams are not supported","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/app-store/_utils/oauth/OAuthManager.ts","lineNumber":613,"sourceCode":"    // Any handlable not ok response should be handled through isTokenObjectUnusable or isAccessTokenUnusable but if still not handled, we should throw an error\n    // So, that the caller can handle it. It could be a network error or some other temporary error from the third party App itself.\n    if (isNotOkay) {\n      return {\n        tokenStatus: TokenStatus.INCONCLUSIVE,\n        invalidReason: response.statusText,\n        json,\n      };\n    }\n\n    return { tokenStatus: TokenStatus.VALID, json, invalidReason: null } as const;\n  }\n}\n\nfunction ensureValidResourceOwner(\n  resourceOwner: { id: number | null; type: \"team\" } | { id: number | null; type: \"user\" }\n) {\n  if (resourceOwner.type === \"team\") {\n    throw new Error(\"Teams are not supported\");\n  } else {\n    if (!resourceOwner.id) {\n      throw new Error(\"resourceOwner should have id set\");\n    }\n  }\n}\n\n/**\n * It converts error into a Response\n */\nfunction handleFetchError(e: unknown) {\n  const myLog = log.getSubLogger({ prefix: [\"handleFetchError\"] });\n  myLog.debug(\"Error\", safeStringify(e));\n  if (e instanceof Error) {\n    return new Response(JSON.stringify({ myFetchError: e.message }), { status: 500 });\n  }\n  return new Response(JSON.stringify({ myFetchError: \"UNKNOWN_ERROR\" }), { status: 500 });\n}","sourceCodeStart":595,"sourceCodeEnd":631,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/_utils/oauth/OAuthManager.ts#L595-L631","documentation":"Thrown by ensureValidResourceOwner inside the OAuthManager constructor when credential sync is enabled (useCredentialSync === true) and the resourceOwner.type is 'team'. Credential syncing is implemented only for user-scoped credentials, so instantiating an OAuthManager for a team credential in sync mode is unsupported by design.","triggerScenarios":"An OAuthManager is constructed for a team-owned credential (resourceOwner.type === 'team') while APP_CREDENTIAL_SHARING_ENABLED, CREDENTIAL_SYNC_ENDPOINT, SECRET_HEADER, and SECRET are all set. The constructor calls ensureValidResourceOwner only in sync mode, which rejects team owners immediately.","commonSituations":"Enabling credential sharing globally without realizing team OAuth credentials are not supported by the sync server; a team install flow (e.g. team Zoom/Google) running under credential-sync env config; misclassifying a user credential as a team credential when building the resourceOwner.","solutions":["Do not enable credential sync for team-scoped OAuth apps; keep team credentials local.","Route team OAuth flows through a non-sync OAuthManager (omit credentialSyncVariables so useCredentialSync is false).","Ensure resourceOwner.type is 'user' with a valid id when sync is on.","If you need team sync, extend the sync server and remove this guard deliberately."],"exampleFix":"// before - sync enabled for a team credential\nnew OAuthManager({\n  resourceOwner: { id: teamId, type: 'team' },\n  credentialSyncVariables: syncVars, // throws 'Teams are not supported'\n});\n// after - only use sync for user owners\nif (resourceOwner.type === 'user') {\n  new OAuthManager({ resourceOwner, credentialSyncVariables: syncVars });\n} else {\n  new OAuthManager({ resourceOwner }); // local token management\n}","handlingStrategy":"validation","validationCode":"if (useCredentialSync && resourceOwner.type === 'team') {\n  throw new Error('Credential sync does not support team-owned credentials; disable sync for this flow.');\n}","typeGuard":"type ResourceOwner = { id: number | null; type: 'team' | 'user' };\nfunction isUserOwner(o: ResourceOwner): o is { id: number; type: 'user' } {\n  return o.type === 'user' && typeof o.id === 'number';\n}","tryCatchPattern":"null","preventionTips":["Do not enable credential sync for team-scoped OAuth apps.","Construct OAuthManager without credentialSyncVariables for team credentials.","Ensure resourceOwner.type is 'user' with a valid id whenever sync is enabled."],"tags":["oauth","credential-sync","team","oauth-manager"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}