{"record":{"id":"36ac761b0fb0966b","repo":"calcom/cal.diy","slug":"nextauthstrategy-email-not-found-in-the-authenti","errorCode":null,"errorMessage":"NextAuthStrategy - Email not found in the authentication token.","messagePattern":"NextAuthStrategy - Email not found in the authentication token\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/next-auth/next-auth.strategy.ts","lineNumber":25,"sourceCode":"import { getToken } from \"next-auth/jwt\";\n\n@Injectable()\nexport class NextAuthStrategy extends PassportStrategy(NextAuthPassportStrategy, \"next-auth\") {\n  constructor(private readonly userRepository: UsersRepository, private readonly config: ConfigService) {\n    super();\n  }\n\n  async authenticate(req: Request) {\n    try {\n      const nextAuthSecret = this.config.get(\"next.authSecret\", { infer: true });\n      const payload = await getToken({ req, secret: nextAuthSecret });\n\n      if (!payload) {\n        throw new UnauthorizedException(\"NextAuthStrategy - Authentication token is missing or invalid.\");\n      }\n\n      if (!payload.email) {\n        throw new UnauthorizedException(\"NextAuthStrategy - Email not found in the authentication token.\");\n      }\n\n      const user = await this.userRepository.findByEmailWithProfile(payload.email);\n      if (!user) {\n        throw new UnauthorizedException(\n          \"NextAuthStrategy - User associated with the authentication token email not found.\"\n        );\n      }\n\n      return this.success(user);\n    } catch (error) {\n      if (error instanceof Error) return this.error(error);\n      return this.error(\n        new InternalServerErrorException(\n          \"NextAuthStrategy - An error occurred while authenticating the request\"\n        )\n      );\n    }","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/next-auth/next-auth.strategy.ts#L7-L43","documentation":"Thrown by NextAuthStrategy.authenticate when the decoded NextAuth session payload has no `email` claim. The token decoded (so the signature/secret is correct), but the session does not carry an email — Cal.com resolves users by email and cannot proceed without it.","triggerScenarios":"A logged-in session that was created without persisting the user's email into the JWT (custom NextAuth callbacks that drop the email), or a token minted with a different claims shape.","commonSituations":"Custom NextAuth `jwt`/`session` callbacks that forget to propagate `email`; anonymous/magic-link sessions that haven't completed email verification; switching identity providers mid-session.","solutions":["Review the NextAuth callbacks (jwt/session) to ensure `token.email` is set from `profile.email`.","Force the user to re-authenticate so a complete session JWT is minted.","If email is genuinely optional in your setup, authenticate by userId/sub instead."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"const payload = await getToken({ req, secret });\nif (!payload?.email) throw new Error('Session JWT missing email; fix NextAuth callbacks or re-authenticate');","typeGuard":"function hasEmailClaim(p: unknown): p is { email: string } {\n  return typeof p === 'object' && p !== null && typeof (p as any).email === 'string' && (p as any).email.length > 0;\n}","tryCatchPattern":null,"preventionTips":["In NextAuth jwt/session callbacks, always propagate token.email from profile.email.","Reject sessions that lack an email claim before issuing protected-route access.","Re-authenticate users whose session predates a callback change."],"tags":["auth","next-auth","jwt","platform"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}