{"record":{"id":"2ac58b0bd7a29e9d","repo":"calcom/cal.diy","slug":"you-must-be-logged-in-to-do-this-2ac58b","errorCode":null,"errorMessage":"You must be logged in to do this","messagePattern":"You must be logged in to do this","errorType":"http","errorClass":"HttpError","httpStatus":401,"severity":"error","filePath":"packages/app-store/dub/api/add.ts","lineNumber":14,"sourceCode":"import type { NextApiRequest, NextApiResponse } from \"next\";\n\nimport { HttpError } from \"@calcom/lib/http-error\";\nimport { defaultHandler } from \"@calcom/lib/server/defaultHandler\";\nimport { defaultResponder } from \"@calcom/lib/server/defaultResponder\";\n\nimport getParsedAppKeysFromSlug from \"../../_utils/getParsedAppKeysFromSlug\";\nimport { dubAppKeysSchema, scopeString } from \"../lib/utils\";\n\nasync function handler(req: NextApiRequest, res: NextApiResponse) {\n  const loggedInUser = req.session?.user;\n\n  if (!loggedInUser) {\n    throw new HttpError({ statusCode: 401, message: \"You must be logged in to do this\" });\n  }\n\n  // Ideally this should never happen, as email is there in session user but typings aren't accurate it seems\n  // TODO: So, confirm and later fix the typings\n  if (!loggedInUser.email) {\n    throw new HttpError({ statusCode: 400, message: \"Session user must have an email\" });\n  }\n\n  const { teamId } = req.query;\n  const { client_id, redirect_uris } = await getParsedAppKeysFromSlug(\"dub\", dubAppKeysSchema);\n\n  const url = new URL(\"https://app.dub.co/oauth/authorize\");\n  url.searchParams.append(\"client_id\", client_id);\n  url.searchParams.append(\"redirect_uri\", redirect_uris);\n  url.searchParams.append(\"response_type\", \"code\");\n  url.searchParams.append(\"scope\", scopeString);\n  if (typeof teamId === \"string\" && !Number.isNaN(Number(teamId))) {\n    url.searchParams.append(\"state\", JSON.stringify({ teamId: Number(teamId) }));","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/dub/api/add.ts#L1-L32","documentation":"Thrown as an HttpError (HTTP 401) by the Dub add handler when req.session.user is falsy. The Dub OAuth install flow requires an authenticated Cal.com user to attribute the integration to; an absent session means the user is not logged in (or the session cookie expired).","triggerScenarios":"Hitting POST/GET /api/dub/add without a valid NextAuth session cookie; session expired; route accessed by an unauthenticated browser or curl request.","commonSituations":"Session cookie expired between loading the integrations page and clicking 'Install Dub'; the user opened the install link in an incognito window; NextAuth session cookie blocked by third-party cookie restrictions.","solutions":["Ensure the user is logged into Cal.com before navigating to the Dub install URL.","Verify NEXTAUTH_SECRET and NEXTAUTH_URL are set correctly so sessions persist.","If using a reverse proxy, confirm cookie SameSite/Secure attributes pass through.","Redirect unauthenticated users to the login page with a returnTo to /apps/dub/install instead of throwing."],"exampleFix":"// before\nif (!loggedInUser) {\n  throw new HttpError({ statusCode: 401, message: \"You must be logged in to do this\" });\n}\n\n// after - send to login with callback\nif (!loggedInUser) {\n  res.redirect(`${WEBAPP_URL}/auth/login?callbackUrl=${encodeURIComponent(req.url ?? \"/apps/dub/install\")}`);\n  return;\n}","handlingStrategy":"validation","validationCode":"const session = await getSession({ req });\nif (!session?.user) {\n  res.redirect(`${WEBAPP_URL}/auth/login?callbackUrl=${encodeURIComponent(\"/apps/dub/install\")}`);\n  return;\n}","typeGuard":"const hasSessionUser = (req: NextApiRequest): boolean =>\n  typeof req.session?.user?.id === \"number\";","tryCatchPattern":"try {\n  await handler(req, res);\n} catch (err) {\n  if (err instanceof HttpError && err.statusCode === 401) {\n    res.redirect(`${WEBAPP_URL}/auth/login?callbackUrl=${encodeURIComponent(req.url ?? \"\")}`);\n    return;\n  }\n  throw err;\n}","preventionTips":["Use NextAuth's getSession middleware to enforce auth before the handler runs.","Set NEXTAUTH_SECRET and a stable NEXTAUTH_URL.","Redirect to login instead of throwing for unauthenticated OAuth install attempts."],"tags":["dub","oauth","authentication","session","nextauth"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}