{"record":{"id":"a8b1c4e39c2cef3e","repo":"calcom/cal.diy","slug":"you-must-be-logged-in-to-do-this-a8b1c4","errorCode":null,"errorMessage":"You must be logged in to do this","messagePattern":"You must be logged in to do this","errorType":"http","errorClass":"HttpError","httpStatus":401,"severity":"warning","filePath":"packages/app-store/googlecalendar/api/add.ts","lineNumber":16,"sourceCode":"import { OAuth2Client } from \"googleapis-common\";\nimport type { NextApiRequest, NextApiResponse } from \"next\";\n\nimport { GOOGLE_CALENDAR_SCOPES, SCOPE_USERINFO_PROFILE, WEBAPP_URL_FOR_OAUTH } from \"@calcom/lib/constants\";\nimport { HttpError } from \"@calcom/lib/http-error\";\nimport { defaultHandler } from \"@calcom/lib/server/defaultHandler\";\nimport { defaultResponder } from \"@calcom/lib/server/defaultResponder\";\n\nimport { encodeOAuthState } from \"../../_utils/oauth/encodeOAuthState\";\nimport { getGoogleAppKeys } from \"../lib/getGoogleAppKeys\";\n\nasync function getHandler(req: NextApiRequest, res: NextApiResponse) {\n  const loggedInUser = req.session?.user;\n\n  if (!loggedInUser) {\n    throw new HttpError({ statusCode: 401, message: \"You must be logged in to do this\" });\n  }\n\n  // Ideally this should never happen, as email is there in session user but typings aren't accurate it seems\n  // TODO: So, confirm and later fix the typings\n  if (!loggedInUser.email) {\n    throw new HttpError({ statusCode: 400, message: \"Session user must have an email\" });\n  }\n\n  const { client_id, client_secret } = await getGoogleAppKeys();\n  const redirect_uri = `${WEBAPP_URL_FOR_OAUTH}/api/integrations/googlecalendar/callback`;\n  const oAuth2Client = new OAuth2Client(client_id, client_secret, redirect_uri);\n\n  const authUrl = oAuth2Client.generateAuthUrl({\n    access_type: \"offline\",\n    scope: [SCOPE_USERINFO_PROFILE, ...GOOGLE_CALENDAR_SCOPES],\n    // A refresh token is only returned the first time the user\n    // consents to providing access.  For illustration purposes,\n    // setting the prompt to 'consent' will force this consent","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/googlecalendar/api/add.ts#L1-L34","documentation":"Standard auth guard at the top of the Google Calendar OAuth-start handler. Fires as `HttpError` **401** when `req.session?.user` is absent. `defaultResponder` catches it and returns `{ message, url, method, data }` with status 401. This is expected behavior for unauthenticated requests, not a bug.","triggerScenarios":"A request to `/api/integrations/googlecalendar/add` without a valid session cookie — e.g. direct URL access, an expired session, a curl/automated request with no auth, or a browser that dropped the cookie.","commonSituations":"Session expired between page load and clicking Install Google Calendar; route opened directly in incognito/new tab; cookie stripped by a proxy or blocked by browser privacy settings.","solutions":["Ensure the user is signed in (redirect to login) before navigating to the install endpoint.","On the client, check auth state before issuing the request and redirect to login on a 401.","Confirm the session cookie is actually sent (SameSite/Secure, HTTPS, correct domain)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client-side: only navigate to the Google Calendar install URL when authenticated\nfunction goToGoogleCalendarInstall() {\n  if (!document.cookie.includes(\"next-auth.session-token\") && !document.cookie.includes(\"__Secure-next-auth.session-token\")) {\n    window.location.href = \"/auth/login?callbackUrl=\" + encodeURIComponent(window.location.href);\n    return;\n  }\n  window.location.href = \"/api/integrations/googlecalendar/add\";\n}","typeGuard":null,"tryCatchPattern":"// On the calling client, a 401 from /add should send the user to login\nconst res = await fetch(\"/api/integrations/googlecalendar/add\");\nif (res.status === 401) {\n  window.location.href = `/auth/login?callbackUrl=${encodeURIComponent(\"/apps/installed\")}`;\n  return;\n}","preventionTips":["Require an authenticated session before rendering the Install Google Calendar button.","Handle 401 by redirecting to login with a callbackUrl back to the install flow.","Verify session cookies survive the redirect (see callback 566) before starting OAuth."],"tags":["app-store","googlecalendar","auth","oauth","http-401"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}