{"record":{"id":"5b4e2a98e678e275","repo":"calcom/cal.diy","slug":"unauthorized-5b4e2a","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"HttpError","httpStatus":401,"severity":"warning","filePath":"packages/app-store/basecamp3/api/projectMutation.ts","lineNumber":23,"sourceCode":"import { refreshAccessToken } from \"@calcom/app-store/basecamp3/lib/helpers\";\nimport type { BasecampToken } from \"@calcom/app-store/basecamp3/lib/types\";\nimport { HttpError } from \"@calcom/lib/http-error\";\nimport { defaultHandler } from \"@calcom/lib/server/defaultHandler\";\nimport { defaultResponder } from \"@calcom/lib/server/defaultResponder\";\nimport prisma from \"@calcom/prisma\";\nimport { credentialForCalendarServiceSelect } from \"@calcom/prisma/selects/credential\";\n\ninterface IDock {\n  id: number;\n  name: string;\n}\n\nconst ZProjectMutationInputSchema = z.object({ projectId: z.string() });\n\nasync function handler(req: NextApiRequest) {\n  const userId = req.session?.user?.id;\n  if (!userId) {\n    throw new HttpError({ statusCode: 401, message: \"Unauthorized\" });\n  }\n\n  const parsed = ZProjectMutationInputSchema.safeParse(req.body ?? {});\n  if (!parsed.success) {\n    throw new HttpError({\n      statusCode: 400,\n      message: \"Invalid request body\",\n    });\n  }\n  const { projectId } = parsed.data;\n\n  const { user_agent } = await getAppKeysFromSlug(\"basecamp3\");\n\n  const credential = await prisma.credential.findFirst({\n    where: { userId },\n    select: credentialForCalendarServiceSelect,\n  });\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/basecamp3/api/projectMutation.ts#L5-L41","documentation":"Thrown by the Basecamp 3 project mutation handler when req.session.user.id is missing - the request has no authenticated Cal.com session. Surfaced as HTTP 401 via HttpError.","triggerScenarios":"Calling POST /api/basecamp3/project without a session cookie; an expired session; the route hit by an unauthenticated script or curl.","commonSituations":"Session cookie expired; calling the API from outside the authenticated browser context; middleware/auth misroute stripping the session.","solutions":["Ensure the request includes a valid Cal.com session cookie.","Re-authenticate the user before retrying.","Use the in-app UI (which carries the session) rather than direct unauthenticated API calls."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!req.session?.user?.id) {\n  // redirect to login or return 401 before reaching the handler logic\n}","typeGuard":"const isAuthenticated = (req: NextApiRequest): req is NextApiRequest & { session: { user: { id: number } } } =>\n  typeof req.session?.user?.id === 'number';","tryCatchPattern":null,"preventionTips":["Call these endpoints only from the authenticated in-app browser context.","Handle 401 in the client by redirecting to login.","Do not expose the route to unauthenticated scripts."],"tags":["basecamp3","auth","session","unauthorized"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}