{"record":{"id":"97d3dca55f2de1a7","repo":"calcom/cal.diy","slug":"bookinguidguard-booking-uid-missing-in-the-reque","errorCode":null,"errorMessage":"BookingUidGuard - Booking UID missing in the request path","messagePattern":"BookingUidGuard - Booking UID missing in the request path","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-uid.guard.ts","lineNumber":11,"sourceCode":"import { Injectable, CanActivate, ExecutionContext, BadRequestException } from \"@nestjs/common\";\n\n@Injectable()\nexport class BookingUidGuard implements CanActivate {\n  canActivate(context: ExecutionContext): boolean {\n    const request = context.switchToHttp().getRequest();\n\n    const bookingUid = request.params.bookingUid;\n\n    if (!bookingUid) {\n      throw new BadRequestException(\"BookingUidGuard - Booking UID missing in the request path\");\n    }\n\n    return true;\n  }\n}\n","sourceCodeStart":1,"sourceCodeEnd":17,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-uid.guard.ts#L1-L17","documentation":"A 400 BadRequestException thrown by BookingUidGuard (a lightweight sync guard) when request.params.bookingUid is falsy. Unlike BookingPbacGuard, this guard only checks param presence — no user or access checks. It's used on routes that need the UID present but delegate authorization elsewhere.","triggerScenarios":"Any route decorated with BookingUidGuard where the HTTP request URL omits the :bookingUid path segment. This guard runs synchronously (canActivate returns boolean, not Promise) and fails fast before the controller method executes.","commonSituations":"Client sends a request to a URL pattern that doesn't include the booking UID. Route path template was changed without updating the guard's param read. The bookingUid param name in the route doesn't match 'bookingUid'. A misconfigured API gateway strips path segments.","solutions":["Include the bookingUid in the request URL path, e.g., GET /v2/bookings/{bookingUid}/attendees instead of GET /v2/bookings/attendees.","Verify the route's @Controller or @Get/@Patch/@Delete decorator path includes :bookingUid.","Ensure the @Param decorator reads 'bookingUid' — a mismatch like @Param('id') would leave params.bookingUid undefined.","Check client-side URL construction for off-by-one or missing segment bugs."],"exampleFix":"// before — client omits bookingUid from path\nGET /v2/bookings//attendees\n\n// after — include bookingUid\nGET /v2/bookings/abc-123-def/attendees","handlingStrategy":"validation","validationCode":"// Ensure bookingUid is present in the path\nfunction buildBookingUrl(basePath, bookingUid, suffix) {\n  if (!bookingUid) throw new Error('bookingUid is required');\n  return `${basePath}/${bookingUid}${suffix || ''}`;\n}\n\nconst url = buildBookingUrl('/v2/bookings', bookingUid, '/attendees');","typeGuard":null,"tryCatchPattern":"try {\n  await api.getBookingAttendees(bookingUid);\n} catch (err) {\n  if (err.statusCode === 400 && err.message.includes('Booking UID missing')) {\n    throw new Error('Client error: bookingUid was not provided in the URL');\n  }\n  throw err;\n}","preventionTips":["Always include the bookingUid as a URL path segment.","Use a typed API client that requires the bookingUid parameter.","Validate the bookingUid before constructing the URL.","Add integration tests that verify URL construction includes all required path segments."],"tags":["validation","guard","nestjs","route-param","booking"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}