{"record":{"id":"ee504fa4d0769a86","repo":"calcom/cal.diy","slug":"bookingpbacguard-bookinguid-is-required","errorCode":null,"errorMessage":"BookingPbacGuard - bookingUid is required","messagePattern":"BookingPbacGuard - bookingUid is required","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-pbac.guard.ts","lineNumber":39,"sourceCode":"      this.prismaReadService.prisma\n    );\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context\n      .switchToHttp()\n      .getRequest<\n        Request & { user?: ApiAuthGuardUser; pbacAuthorizedRequest?: boolean }\n      >();\n    const user = request.user;\n    const bookingUid = request.params.bookingUid;\n\n    if (!user) {\n      throw new UnauthorizedException();\n    }\n\n    if (!bookingUid) {\n      throw new BadRequestException(\n        \"BookingPbacGuard - bookingUid is required\"\n      );\n    }\n\n    const hasAccess =\n      await this.bookingAccessService.doesUserIdHaveAccessToBooking({\n        userId: user.id,\n        bookingUid,\n      });\n\n    if (!hasAccess) {\n      throw new ForbiddenException(\n        `BookingPbacGuard - user with id=${user.id} does not have access to booking with uid=${bookingUid}`\n      );\n    }\n\n    request.pbacAuthorizedRequest = true;\n    return true;","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-pbac.guard.ts#L21-L57","documentation":"A 400 BadRequestException thrown by BookingPbacGuard when request.params.bookingUid is falsy (null, undefined, or empty string). The guard expects the route path to include a :bookingUid parameter segment. If the route is misconfigured or the request URL omits the parameter, this error fires.","triggerScenarios":"A route decorated with BookingPbacGuard where the HTTP request URL doesn't include the bookingUid path segment, or the route path template doesn't have :bookingUid defined. For example, calling PATCH /v2/bookings/ instead of PATCH /v2/bookings/abc-123-def.","commonSituations":"Client constructs the URL incorrectly (trailing slash, missing UID). The route controller path was changed (e.g., from /:bookingUid to /:id) but the guard still reads params.bookingUid. A NestJS routing misconfiguration where the param name doesn't match. The bookingUid was URL-encoded or stripped by a proxy.","solutions":["Ensure the request URL includes the bookingUid path segment: PATCH /v2/bookings/{bookingUid} not PATCH /v2/bookings/.","Verify the controller's route decorator uses @Param('bookingUid') and the path includes :bookingUid.","Check for URL-rewriting middleware or reverse proxy rules that strip path segments.","If the param name differs, update the guard to read the correct param name or rename the route param."],"exampleFix":"// before — client sends request without bookingUid\nPATCH /v2/bookings/\n\n// after — include the booking UID in the path\nPATCH /v2/bookings/abc-123-def-456","handlingStrategy":"validation","validationCode":"// Validate the bookingUid is present before making the API call\nfunction validateBookingUid(bookingUid) {\n  if (!bookingUid || typeof bookingUid !== 'string' || bookingUid.trim() === '') {\n    throw new Error('bookingUid is required and must be a non-empty string');\n  }\n  return bookingUid;\n}\n\nconst uid = validateBookingUid(bookingUid);\nawait api.updateBooking(uid, updates);","typeGuard":null,"tryCatchPattern":"try {\n  await api.updateBooking(bookingUid, updates);\n} catch (err) {\n  if (err.statusCode === 400 && err.message.includes('bookingUid is required')) {\n    throw new Error('Client bug: bookingUid was not included in the URL path');\n  }\n  throw err;\n}","preventionTips":["Always include the bookingUid as a path segment in the URL, not as a query parameter.","Validate the bookingUid is a non-empty string before constructing the request URL.","Use a typed API client that enforces the bookingUid parameter at compile time.","Add URL validation in your HTTP client interceptor."],"tags":["validation","guard","nestjs","pbac","route-param","booking"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}