{"record":{"id":"ad31d461e7c064d1","repo":"calcom/cal.diy","slug":"user-is-not-authorized-to-update-this-booking-loca","errorCode":null,"errorMessage":"User is not authorized to update this booking location. User must be the event type owner, host, team admin or owner, or org admin or owner.","messagePattern":"User is not authorized to update this booking location\\. User must be the event type owner, host, team admin or owner, or org admin or owner\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-08-13/services/booking-location.service.ts","lineNumber":61,"sourceCode":"\n  async updateBookingLocation(\n    bookingUid: string,\n    input: UpdateBookingLocationInput_2024_08_13,\n    user: ApiAuthGuardUser\n  ): Promise<BookingLocationResponse> {\n    const existingBooking = await this.bookingsRepository.getBookingByUidWithUserAndEventDetails(bookingUid);\n    if (!existingBooking) {\n      throw new NotFoundException(`Booking with uid=${bookingUid} not found`);\n    }\n\n    if (existingBooking.eventTypeId && existingBooking.eventType) {\n      const eventType = await this.eventTypesRepository.getEventTypeByIdWithOwnerAndTeam(\n        existingBooking.eventTypeId\n      );\n      if (eventType) {\n        const isAllowed = await this.eventTypeAccessService.userIsEventTypeAdminOrOwner(user, eventType);\n        if (!isAllowed) {\n          throw new ForbiddenException(\n            \"User is not authorized to update this booking location. User must be the event type owner, host, team admin or owner, or org admin or owner.\"\n          );\n        }\n      }\n    }\n\n    const { location } = input;\n\n    if (location) {\n      if (location.type !== \"integration\") {\n        const locationValue = this.getNonIntegrationLocationValue(location);\n        if (locationValue) {\n          await this.calendarSyncService.syncCalendarEvent(existingBooking.id, locationValue);\n        }\n      }\n      return await this.updateLocation(existingBooking, location, user);\n    }\n","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-08-13/services/booking-location.service.ts#L43-L79","documentation":"Authorization guard in updateBookingLocation. When the booking has an eventTypeId and eventType, the service loads the full event type with owner/team and runs eventTypeAccessService.userIsEventTypeAdminOrOwner. If the authenticated API user is not the event type owner, a host, a team admin/owner, or an org admin/owner, the location update is refused with HTTP 403.","triggerScenarios":"PATCH booking location where the booking belongs to an event type, using an API key/access token whose user lacks admin/owner rights over that event type or its team/org.","commonSituations":"Using an API key issued for a different user than the event type owner; an org member (not admin) trying to edit a team event type's booking; booking belongs to a team the authenticated user isn't an admin of.","solutions":["Use an API key / access token belonging to the event type owner, a host, or a team/org admin.","Grant the authenticated user the appropriate team (admin) or organization (admin/owner) role.","If the booking has no event type, this check is skipped — confirm whether the booking should have one."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm the caller is authorized over the event type before PATCHing location.\n// Use an API key whose user is the event type owner / team or org admin.\nconst me = await api.get('/v2/me');\nconst eventType = await api.get(`/v2/event-types/${booking.eventTypeId}`);\n// verify ownership locally or rely on a dedicated permission check before calling PATCH","typeGuard":null,"tryCatchPattern":"try {\n  await api.patch(`/v2/bookings/${uid}/location`, payload);\n} catch (err) {\n  if (err.status === 403) {\n    // switch to an owner/admin API key or request elevated role\n  }\n  throw err;\n}","preventionTips":["Use an API key belonging to the event type owner or a team/org admin for location edits.","Confirm the authenticated user's role over the event type's team/org before calling.","Centralize authorization checks in a shared client wrapper."],"tags":["authorization","forbidden","event-type","location"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}