{"record":{"id":"109c5e8c6f9a41d5","repo":"calcom/cal.diy","slug":"err-message-109c5e","errorCode":null,"errorMessage":"${err.message}","messagePattern":"\\$\\{err\\.message\\}","errorType":"http","errorClass":"HttpException","httpStatus":null,"severity":"error","filePath":"apps/api/v2/src/modules/auth/oauth2/services/oauth2-error.service.ts","lineNumber":68,"sourceCode":"      );\n    }\n    this.logger.error(err);\n    throw new OAuth2HttpException(\n      {\n        error: \"server_error\",\n        error_description: \"An unexpected error occurred\",\n      },\n      500\n    );\n  }\n\n  handleClientError(err: unknown, fallbackMessage: string): never {\n    if (err instanceof ErrorWithCode) {\n      const statusCode = getHttpStatusCode(err);\n      if (statusCode >= 500) {\n        this.logger.error(err);\n      }\n      throw new HttpException(err.message, statusCode);\n    }\n    this.logger.error(err);\n    throw new InternalServerErrorException(fallbackMessage);\n  }\n}\n","sourceCodeStart":50,"sourceCodeEnd":74,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/oauth2/services/oauth2-error.service.ts#L50-L74","documentation":"Thrown by handleClientError when the error is an ErrorWithCode. Unlike the OAuth2-specific handlers, this produces a Nest HttpException whose body is the raw err.message string (not an OAuth2-shaped object) and whose status is getHttpStatusCode(err). It is used by the OAuth client management endpoints (CRUD on OAuth clients) rather than the protocol endpoints.","triggerScenarios":"Calling a client-management route (e.g., create/update/delete OAuth client) with input that fails validation or authorization in a way that raises an ErrorWithCode — for example attempting to delete a client you do not own, or supplying a redirect_uri that fails server-side validation.","commonSituations":"Operating on an OAuth client id belonging to a different organization; submitting malformed metadata fields; the platform-constants error codes map to 400/403/404 and the developer sees the raw message.","solutions":["Treat the HTTP status code as authoritative (400 bad request, 403 forbidden, 404 not found) and read err.message for the specific reason.","For 403, confirm the authenticated user/org owns the OAuth client id in the request.","For 400, validate the request body against the OpenAPI schema for the endpoint before retrying.","If statusCode >= 500, the error was also logged — check server logs as it indicates a server-side fault."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate ownership and body shape before calling client-management endpoints\nconst OWNED_CLIENT_IDS = new Set((await getMyOAuthClients()).map(c => c.id));\nif (!OWNED_CLIENT_IDS.has(targetClientId)) throw new Error('not owned — will 403/404');","typeGuard":"function isHttpExceptionWithStatus(err: unknown, status: number): boolean {\n  return err instanceof Error && (err as any).status === status;\n}","tryCatchPattern":"try {\n  await updateOAuthClient(clientId, patch);\n} catch (err) {\n  if (isHttpExceptionWithStatus(err, 403)) { showPermissionError(); return; }\n  if (isHttpExceptionWithStatus(err, 400)) { showValidationErrors(err.response?.message); return; }\n  throw err;\n}","preventionTips":["Fetch the list of owned clients first and restrict the UI to those ids.","Validate request bodies client-side against the OpenAPI schema before sending.","Treat 403 as a hard stop — do not retry ownership-gated operations."],"tags":["oauth2","client-management","http-exception","errorwithcode"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}