{"record":{"id":"57f327ecf0dbc683","repo":"calcom/cal.diy","slug":"email-and-code-are-required","errorCode":null,"errorMessage":"Email and code are required","messagePattern":"Email and code are required","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/modules/atoms/services/verification-atom.service.ts","lineNumber":37,"sourceCode":"  constructor(\n    private readonly atomsSecondaryEmailsRepository: AtomsSecondaryEmailsRepository,\n    private readonly usersRepository: UsersRepository\n  ) {}\n\n  async checkEmailVerificationRequired(input: CheckEmailVerificationRequiredParams) {\n    return await checkEmailVerificationRequired(input);\n  }\n\n  async verifyEmailCodeUnAuthenticated(input: VerifyEmailCodeInput) {\n    try {\n      return await verifyCodeUnAuthenticated(input.email, input.code);\n    } catch (error) {\n      if (error instanceof Error) {\n        if (error.message === \"invalid_code\") {\n          throw new BadRequestException(\"Invalid verification code\");\n        }\n        if (error.message === \"BAD_REQUEST\") {\n          throw new BadRequestException(\"Email and code are required\");\n        }\n      }\n      throw new BadRequestException(\"Verification failed\");\n    }\n  }\n\n  async verifyEmailCodeAuthenticated(user: UserWithProfile, input: VerifyEmailCodeInput) {\n    try {\n      return await verifyCodeAuthenticated({\n        user,\n        email: input.email,\n        code: input.code,\n      });\n    } catch (error) {\n      if (error instanceof Error) {\n        if (error.message === \"invalid_code\") {\n          throw new BadRequestException(\"Invalid verification code\");\n        }","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/atoms/services/verification-atom.service.ts#L19-L55","documentation":"Thrown by VerificationAtomService.verifyEmailCodeUnAuthenticated when the upstream rejects with an Error whose message equals 'BAD_REQUEST', surfaced as a 400 'Email and code are required'. The intent is to flag a missing-email-or-code call. IMPORTANT: this branch is DEAD under current source — verifyCodeUnAuthenticated throws new Error('Email and code are required') (not 'BAD_REQUEST'), so the equality check never matches and execution falls through to the generic 'Verification failed' (error 22). Callers therefore never see this specific message today.","triggerScenarios":"POST to the unauthenticated verify endpoint with email or code omitted/empty, AND the upstream library throwing an Error whose message is literally 'BAD_REQUEST'. The real upstream message is 'Email and code are required', so the predicate misses.","commonSituations":"Client omits the code field; client sends an empty string; client sends null; contract drift after upgrading @calcom/features/auth where the thrown message string changed.","solutions":["As platform maintainer: fix the predicate to match the actual upstream message 'Email and code are required', or better, validate input shape (class-validator DTO) before calling the upstream so missing fields never reach the try/catch.","As API caller: ensure the request body includes both non-empty email and code fields before sending.","Add a DTO-level @IsNotEmpty()/@IsString() guard on VerifyEmailCodeInput so this is a 422 before the service layer."],"exampleFix":"// before\nif (error.message === \"BAD_REQUEST\") {\n  throw new BadRequestException(\"Email and code are required\");\n}\n\n// after\nif (error.message === \"Email and code are required\" || error.message === \"BAD_REQUEST\") {\n  throw new BadRequestException(\"Email and code are required\");\n}","handlingStrategy":"validation","validationCode":"if (!input?.email || !input?.code) {\n  throw new BadRequestException('Email and code are required');\n}","typeGuard":"function hasEmailAndCode(v: unknown): v is { email: string; code: string } {\n  return typeof v === 'object' && v !== null &&\n    typeof (v as any).email === 'string' && (v as any).email.length > 0 &&\n    typeof (v as any).code === 'string' && (v as any).code.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Add class-validator @IsNotEmpty() @IsString() on VerifyEmailCodeInput fields so missing input returns 422 before the service.","Note this branch is currently dead — the real upstream message is 'Email and code are required', not 'BAD_REQUEST'."],"tags":["verification","input-validation","dead-branch","error-message-mismatch","atoms-api"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}