{"record":{"id":"cc06f6335096b911","repo":"calcom/cal.diy","slug":"parsedquery-error-message","errorCode":null,"errorMessage":"parsedQuery.error.message","messagePattern":"parsedQuery\\.error\\.message","errorType":"validation","errorClass":"HttpError","httpStatus":422,"severity":"warning","filePath":"apps/web/app/api/auth/setup/route.ts","lineNumber":37,"sourceCode":"    .refine((val) => val.trim().length >= 1, { message: \"Please enter at least one character\" }),\n  full_name: z.string().min(3, \"Please enter at least 3 characters\"),\n  email_address: z.string().regex(emailRegex, { message: \"Please enter a valid email\" }),\n  password: z.string().refine((val) => isPasswordValid(val.trim(), false, true), {\n    message:\n      \"The password must be a minimum of 15 characters long containing at least one number and have a mixture of uppercase and lowercase letters\",\n  }),\n});\n\nasync function handler(req: NextRequest) {\n  const userCount = await prisma.user.count();\n  if (userCount !== 0) {\n    throw new HttpError({ statusCode: 400, message: \"No setup needed.\" });\n  }\n  const body = await parseRequestData(req);\n\n  const parsedQuery = querySchema.safeParse(body);\n  if (!parsedQuery.success) {\n    throw new HttpError({ statusCode: 422, message: parsedQuery.error.message });\n  }\n\n  const username = slugify(parsedQuery.data.username.trim());\n  const userEmail = parsedQuery.data.email_address.toLowerCase();\n\n  const hashedPassword = await hashPassword(parsedQuery.data.password);\n\n  await prisma.user.create({\n    data: {\n      username,\n      email: userEmail,\n      password: { create: { hash: hashedPassword } },\n      role: \"ADMIN\",\n      name: parsedQuery.data.full_name,\n      emailVerified: new Date(),\n      locale: \"en\", // TODO: We should revisit this\n      identityProvider: IdentityProvider.CAL,\n      creationSource: CreationSource.WEBAPP,","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/web/app/api/auth/setup/route.ts#L19-L55","documentation":"Thrown by the /api/auth/setup handler (HttpError, HTTP 422) when the zod querySchema fails safeParse on the request body. The message is the raw zod error string, which lists every failed field constraint (username length, full_name min 3, email regex, password policy).","triggerScenarios":"POST /api/auth/setup with username shorter than 1 char, full_name under 3 chars, malformed email, or a password that fails isPasswordValid (must be >=15 chars with upper, lower, and a digit).","commonSituations":"Weak passwords (policy is 15+ chars), whitespace-only username, typo'd email, browser autofill truncating a field.","solutions":["Run the same zod schema (or an equivalent) on the client and show per-field errors before submit.","Ensure password >=15 chars containing uppercase, lowercase, and at least one digit.","Trim username/full_name client-side and reject empty values.","Re-read the exact zod message returned to identify the failing field."],"exampleFix":"// before\nawait fetch('/api/auth/setup', { method:'POST', body: JSON.stringify(form) });\n\n// after\nconst parsed = querySchema.safeParse(form);\nif (!parsed.success) {\n  setFieldErrors(parsed.error.flatten().fieldErrors);\n  return;\n}\nawait fetch('/api/auth/setup', { method:'POST', body: JSON.stringify(parsed.data) });","handlingStrategy":"validation","validationCode":"// Mirror the server schema on the client and validate before submit\nconst result = querySchema.safeParse(form);\nif (!result.success) {\n  setErrors(result.error.flatten().fieldErrors);\n  return;\n}\nawait fetch('/api/auth/setup', { method: 'POST', body: JSON.stringify(result.data) });","typeGuard":"function isPasswordPolicyCompliant(pw: string): boolean {\n  return pw.length >= 15 && /[A-Z]/.test(pw) && /[a-z]/.test(pw) && /[0-9]/.test(pw);\n}","tryCatchPattern":"try {\n  await fetch('/api/auth/setup', { method: 'POST', body });\n} catch (e) {\n  if (e instanceof HttpError && e.statusCode === 422) {\n    showFormErrors(e.message); // zod detail string\n    return;\n  }\n  throw e;\n}","preventionTips":["Run the same zod schema on the client to fail fast with per-field errors.","Show a live password-strength meter reflecting the 15-char + mixed-case + digit rule.","Trim and lower-case email client-side to match server normalization."],"tags":["setup","auth","zod","validation","password-policy"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}